lexbor: Merge upstream WHATWG URL and IDNA fixes

Author: alexandre-daubois

NEWS

@@ -24,6 +24,12 @@ PHP                                                                        NEWS
   . Merge patches 8a14bc0 and f67ce4b, fixing a heap buffer overflow in
     :lexbor-contains() parsing and buffer overflows in malformed decode
     replay. (alexandre-daubois)
+  . Merge patches lexbor/lexbor@859f100, lexbor/lexbor@a36e09a,
+    lexbor/lexbor@b0f7412, lexbor/lexbor@1b215a8 and lexbor/lexbor@385afff,
+    fixing dropped usernames containing an at sign, uninitialized memory in
+    IDNA buffer growth, the encoding of a space before a query or fragment in
+    an opaque path, the URLSearchParams tail pointer and fragment
+    serialization without a query. (alexandre-daubois)
 
 - MBString:
   . Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in

ext/lexbor/lexbor/unicode/idna.c

@@ -117,12 +117,14 @@ lxb_unicode_idna_realloc(lxb_codepoint_t *buf, const lxb_codepoint_t *buffer,
     lxb_codepoint_t *tmp;
 
     nlen = ((*buf_end - buf) * 4) + len;
- 
+
     if (buf == buffer) {
         tmp = lexbor_malloc(nlen * sizeof(lxb_codepoint_t));
         if (tmp == NULL) {
             return NULL;
         }
+
+        memcpy(tmp, buf, (*buf_p - buf) * sizeof(lxb_codepoint_t));
     }
     else {
         tmp = lexbor_realloc(buf, nlen * sizeof(lxb_codepoint_t));
@@ -458,13 +460,17 @@ lxb_unicode_idna_ascii_puny_cb(const lxb_char_t *data, size_t length, void *ctx,
 
         if (asc->buf == asc->buffer) {
             tmp = lexbor_malloc(nlen);
+            if (tmp == NULL) {
+                return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
+            }
+
+            memcpy(tmp, asc->buf, asc->p - asc->buf);
         }
         else {
             tmp = lexbor_realloc(asc->buf, nlen);
-        }
-
-        if (tmp == NULL) {
-            return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
+            if (tmp == NULL) {
+                return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
+            }
         }
 
         asc->p = tmp + (asc->p - asc->buf);
@@ -711,13 +717,17 @@ lxb_unicode_idna_to_unicode_cb(const lxb_codepoint_t *part, size_t len,
 
         if (asc->buf == asc->buffer) {
             tmp = lexbor_malloc(nlen);
+            if (tmp == NULL) {
+                return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
+            }
+
+            memcpy(tmp, asc->buf, asc->p - asc->buf);
         }
         else {
             tmp = lexbor_realloc(asc->buf, nlen);
-        }
-
-        if (tmp == NULL) {
-            return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
+            if (tmp == NULL) {
+                return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
+            }
         }
 
         asc->p = tmp + (asc->p - asc->buf);

ext/lexbor/lexbor/url/url.c

@@ -1753,16 +1753,13 @@ lxb_url_parse_basic_h(lxb_url_parser_t *parser, lxb_url_t *url,
                         break;
                     }
 
-                    if (pswd == NULL || !at_sign) {
-                        tmp = (pswd != NULL) ? pswd - 1 : p;
-
-                        if (tmp > begin) {
-                            status = lxb_url_percent_encode_after_utf_8(begin, tmp,
-                                                        &url->username, url->mraw,
-                                                        LXB_URL_MAP_USERINFO, false);
-                            if (status != LXB_STATUS_OK) {
-                                lxb_url_parse_return(orig_data, buf, status);
-                            }
+                    tmp = (pswd != NULL) ? pswd - 1 : p;
+                    if (tmp > begin) {
+                        status = lxb_url_percent_encode_after_utf_8(begin, tmp,
+                                                    &url->username, url->mraw,
+                                                    LXB_URL_MAP_USERINFO, false);
+                        if (status != LXB_STATUS_OK) {
+                            lxb_url_parse_return(orig_data, buf, status);
                         }
                     }
 
@@ -2343,6 +2340,17 @@ lxb_url_parse_basic_h(lxb_url_parser_t *parser, lxb_url_t *url,
                     lxb_url_parse_return(orig_data, buf, status);
                 }
 
+                /* Encode only the space immediately before a query or fragment. */
+                if (p > begin && p[-1] == ' ') {
+                    tmp_str.length--;
+                    if (lexbor_str_append(&tmp_str, url->mraw,
+                                          (const lxb_char_t *) "%20", 3) == NULL)
+                    {
+                        lxb_url_parse_return(orig_data, buf,
+                                             LXB_STATUS_ERROR_MEMORY_ALLOCATION);
+                    }
+                }
+
                 status = lxb_url_path_list_push(url, &tmp_str);
                 if (status != LXB_STATUS_OK) {
                     lxb_url_parse_return(orig_data, buf, status);
@@ -4907,7 +4915,7 @@ lxb_status_t
 lxb_url_serialize_fragment(const lxb_url_t *url,
                            lexbor_serialize_cb_f cb, void *ctx)
 {
-    if (url->query.data != NULL) {
+    if (url->fragment.data != NULL) {
         return cb(url->fragment.data, url->fragment.length, ctx);
     }
 
@@ -5106,6 +5114,8 @@ lxb_url_search_params_parse(lxb_url_search_params_t *search_params,
             return status;
         }
 
+        last = entry;
+
         lexbor_str_init(&entry->value, mraw, 0);
         if (entry->value.data == NULL) {
             return LXB_STATUS_ERROR_MEMORY_ALLOCATION;

ext/lexbor/patches/0001-Expose-line-and-column-information-for-use-in-PHP.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
 Date: Sat, 26 Aug 2023 15:08:59 +0200
-Subject: [PATCH 01/12] Expose line and column information for use in PHP
+Subject: [PATCH 01/17] Expose line and column information for use in PHP
 
 ---
  source/lexbor/dom/interfaces/node.h  |  2 ++

ext/lexbor/patches/0002-Track-implied-added-nodes-for-options-use-in-PHP.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
 Date: Mon, 14 Aug 2023 20:18:51 +0200
-Subject: [PATCH 02/12] Track implied added nodes for options use in PHP
+Subject: [PATCH 02/17] Track implied added nodes for options use in PHP
 
 ---
  source/lexbor/html/tree.h                            | 3 +++

ext/lexbor/patches/0003-Patch-utilities-and-data-structure-to-be-able-to-gen.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
 Date: Thu, 24 Aug 2023 22:57:48 +0200
-Subject: [PATCH 03/12] Patch utilities and data structure to be able to
+Subject: [PATCH 03/17] Patch utilities and data structure to be able to
  generate smaller lookup tables
 
 Changed the generation script to check if everything fits in 32-bits.

ext/lexbor/patches/0004-Remove-unused-upper-case-tag-static-data.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
 Date: Wed, 29 Nov 2023 21:26:47 +0100
-Subject: [PATCH 04/12] Remove unused upper case tag static data
+Subject: [PATCH 04/17] Remove unused upper case tag static data
 
 ---
  source/lexbor/tag/res.h | 2 ++

ext/lexbor/patches/0005-Shrink-size-of-static-binary-search-tree.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
 Date: Wed, 29 Nov 2023 21:29:31 +0100
-Subject: [PATCH 05/12] Shrink size of static binary search tree
+Subject: [PATCH 05/17] Shrink size of static binary search tree
 
 This also makes it more efficient on the data cache.
 ---

ext/lexbor/patches/0006-Patch-out-unused-CSS-style-code.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
 Date: Sun, 7 Jan 2024 21:59:28 +0100
-Subject: [PATCH 06/12] Patch out unused CSS style code
+Subject: [PATCH 06/17] Patch out unused CSS style code
 
 ---
  source/lexbor/css/rule.h | 2 ++

ext/lexbor/patches/0007-URL-fixed-setters-for-empty-hosts.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Borisov <lex.borisov@gmail.com>
 Date: Fri, 26 Jun 2026 18:55:56 +0300
-Subject: [PATCH 07/12] URL: fixed setters for empty hosts.
+Subject: [PATCH 07/17] URL: fixed setters for empty hosts.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit