urlapi: question mark within fragment is still fragment

The parser would check for a query part before fragment, which caused it
to do wrong when the fragment contains a question mark.

Extended test 1560 to verify.

Reported-by: Alex Konev
Fixes #4412
Closes #4413

1 files changed, 4 insertions, 4 deletions

diff --git a/lib/urlapi.c b/lib/urlapi.c
index 1334236b2..a51428404 100644
--- a/lib/urlapi.c
+++ b/lib/urlapi.c
@@ -849,14 +849,14 @@ static CURLUcode seturl(const char *url, CURLU *u, unsigned int flags)
   if(junkscan(path))
     return CURLUE_MALFORMED_INPUT;
 
+  fragment = strchr(path, '#');
+  if(fragment)
+    *fragment++ = 0;
+
   query = strchr(path, '?');
   if(query)
     *query++ = 0;
 
-  fragment = strchr(query?query:path, '#');
-  if(fragment)
-    *fragment++ = 0;
-
   if(!path[0])
     /* if there's no path set, unset */
     path = NULL;