From f9ce5e79daf72f1d172f6d198a67bcda23e092fa Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Mon, 21 Oct 2024 20:12:56 +0200
Subject: [PATCH] Fix GH-16523: FILTER_FLAG_HOSTNAME accepts ending hyphen

Domain name labels must not end with a hyphen, and that is also true
for the last label.  Apparently, this has been overlooked so far.

Closes GH-16540.
---
 NEWS                          |  3 +++
 ext/filter/logical_filters.c  |  2 +-
 ext/filter/tests/gh16523.phpt | 20 ++++++++++++++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 ext/filter/tests/gh16523.phpt

diff --git a/NEWS b/NEWS
index eb434beaf23..b437f80d6f4 100644
--- a/NEWS
+++ b/NEWS
@@ -42,6 +42,9 @@ PHP                                                                        NEWS
   . Fixed bug GH-16397 (Segmentation fault when comparing FFI object).
     (nielsdos)
 
+- Filter:
+  . Fixed bug GH-16523 (FILTER_FLAG_HOSTNAME accepts ending hyphen). (cmb)
+
 - GD:
   . Fixed bug GH-16334 (imageaffine overflow on matrix elements).
     (David Carlier)
diff --git a/ext/filter/logical_filters.c b/ext/filter/logical_filters.c
index ca8e65c1f75..7ac64444fa7 100644
--- a/ext/filter/logical_filters.c
+++ b/ext/filter/logical_filters.c
@@ -542,7 +542,7 @@ static int _php_filter_validate_domain(char * domain, size_t len, zend_long flag
 			/* Reset label length counter */
 			i = 1;
 		} else {
-			if (i > 63 || (hostname && *s != '-' && !isalnum((int)*(unsigned char *)s))) {
+			if (i > 63 || (hostname && (*s != '-' || *(s + 1) == '\0') && !isalnum((int)*(unsigned char *)s))) {
 				return 0;
 			}
 
diff --git a/ext/filter/tests/gh16523.phpt b/ext/filter/tests/gh16523.phpt
new file mode 100644
index 00000000000..b2985c12a78
--- /dev/null
+++ b/ext/filter/tests/gh16523.phpt
@@ -0,0 +1,20 @@
+--TEST--
+GH-16523 (FILTER_FLAG_HOSTNAME accepts ending hyphen)
+--EXTENSIONS--
+filter
+--FILE--
+<?php
+$domains = [
+    'a-.bc.com',
+    'a.bc-.com',
+    'a.bc.com-',
+];
+
+foreach ($domains as $domain) {
+    var_dump(filter_var($domain, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME));
+}
+?>
+--EXPECT--
+bool(false)
+bool(false)
+bool(false)