- Bug report #1973352 (http://curl.haxx.se/bug/view.cgi?id=1973352) identified

  how the HTTP redirect following code didn't properly follow to a new URL if
  the new url was but a query string such as "Location: ?moo=foo". Test case
  1031 was added to verify this fix.

1 files changed, 12 insertions, 8 deletions

diff --git a/lib/transfer.c b/lib/transfer.c
index 9cae70346..aafec6d4e 100644
--- a/lib/transfer.c
+++ b/lib/transfer.c
@@ -2044,14 +2044,18 @@ CURLcode Curl_follow(struct SessionHandle *data,
       if(pathsep)
         *pathsep=0;
 
-      /* we have a relative path to append to the last slash if
-         there's one available */
-      pathsep = strrchr(protsep, '/');
-      if(pathsep)
-        *pathsep=0;
+      /* we have a relative path to append to the last slash if there's one
+         available, or if the new URL is just a query string (starts with a
+         '?')  we append the new one at the end of the entire currently worked
+         out URL */
+      if(useurl[0] != '?') {
+        pathsep = strrchr(protsep, '/');
+        if(pathsep)
+          *pathsep=0;
+      }
 
-      /* Check if there's any slash after the host name, and if so,
-         remember that position instead */
+      /* Check if there's any slash after the host name, and if so, remember
+         that position instead */
       pathsep = strchr(protsep, '/');
       if(pathsep)
         protsep = pathsep+1;
@@ -2129,7 +2133,7 @@ CURLcode Curl_follow(struct SessionHandle *data,
     memcpy(newest, url_clone, urllen);
 
     /* check if we need to append a slash */
-    if(('/' == useurl[0]) || (protsep && !*protsep))
+    if(('/' == useurl[0]) || (protsep && !*protsep) || ('?' == useurl[0]))
       ;
     else
       newest[urllen++]='/';