ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED

php_filter_encode_url() initialized its 256-byte "must encode" table with
memset(tmp, 1, sizeof(tmp) - 1), leaving tmp[255] uninitialized. Whether
0xFF got percent-encoded then depended on stack garbage; valgrind reports
the read as a conditional jump on an uninitialised value. Initialize the
whole table.

Author: iliaal

ext/filter/sanitizing_filters.c

@@ -68,7 +68,7 @@ static void php_filter_encode_url(zval *value, const unsigned char* chars, const
 	unsigned char *e = s + char_len;
 	zend_string *str;
 
-	memset(tmp, 1, sizeof(tmp)-1);
+	memset(tmp, 1, sizeof(tmp));
 
 	while (s < e) {
 		tmp[*s++] = '\0';

ext/filter/tests/filter_sanitize_encoded_0xff.phpt

@@ -0,0 +1,12 @@
+--TEST--
+FILTER_SANITIZE_ENCODED percent-encodes 0xFF
+--EXTENSIONS--
+filter
+--FILE--
+<?php
+var_dump(filter_var("\xFF", FILTER_SANITIZE_ENCODED));
+var_dump(filter_var("\xFE\xFF\x00A", FILTER_SANITIZE_ENCODED));
+?>
+--EXPECT--
+string(3) "%FF"
+string(10) "%FE%FF%00A"