The urlencode function is not binary safe. It retrieves the length of the string to encode as a parameter,
then uses strlen to allocate the new buffer. Strlen returns wrong length for the bin-string.
After that, the len-parameter is used to fill the buffer => a buffer-overwrite occurs.

php 4 beta 4 pl1:

change line 241 from 
      str = (unsigned char *) emalloc(3 * strlen(s) + 1);
to 
      str = (unsigned char *) emalloc(3 * len + 1);

php 3.15

change line 242 from
  str = (unsigned char *) emalloc(3 * strlen(s) + 1);
to
  str = (unsigned char *) emalloc(3 * len + 1);