@- Fixed a bug with /e modifier in preg_replace(), that would not correctly

@  replace two-digit references if single digit references were present
@  before them. This fixed bug #10218. (Andrei)

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index 4a0afe1f890e02f5f9dd0f873deb41c69e115f3c..8c7bf18b558e9436b9465b8e6eb5db698e81dc0f 100644 (file)
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -22,6 +22,7 @@
 #include "php_globals.h"
 #include "php_pcre.h"
 #include "ext/standard/info.h"
+#include "ext/standard/php_smart_str.h"
 
 #if HAVE_PCRE || HAVE_BUNDLED_PCRE
 
@@ -584,37 +585,36 @@ static int preg_do_eval(char *eval_str, int eval_str_len, char *subject,
                                                int *offsets, int count, char **result)
 {
        zval             retval;                        /* Return value from evaluation */
-       char             backref_buf[4],        /* Buffer for string version of backref */
-                               *code,                          /* PHP code string */
-                               *new_code,                      /* Code as result of substitution */
+       char            *eval_str_end,          /* End of eval string */
                                *match,                         /* Current match for a backref */
                                *esc_match,                     /* Quote-escaped match */
                                *walk,                          /* Used to walk the code string */
+                               *segment,                       /* Start of segment to append while walking */
                                 walk_last;                     /* Last walked character */
-       int                      code_len;                      /* Length of the code string */
-       int                      new_code_len;          /* Length of the substituted code string */
        int                      match_len;                     /* Length of the match */
        int                      esc_match_len;         /* Length of the quote-escaped match */
        int                      result_len;            /* Length of the result of the evaluation */
        int                      backref;                       /* Current backref */
        char        *compiled_string_description;
+       smart_str    code = {0};
        CLS_FETCH();
        ELS_FETCH();
        
-       /* Save string to be evaluated, since we will be modifying it */
-       code = estrndup(eval_str, eval_str_len);
-       walk = code;
-       new_code_len = code_len = eval_str_len;
+       eval_str_end = eval_str + eval_str_len;
+       walk = segment = eval_str;
        walk_last = 0;
        
-       while (*walk) {
+       while (walk < eval_str_end) {
                /* If found a backreference.. */
                if ('\\' == *walk || '$' == *walk) {
+                       smart_str_appendl(&code, segment, walk - segment);
                        if (walk_last == '\\') {
-                               memmove(walk-1, walk, code_len - (walk - code) + 1);
+                               code.c[code.len-1] = *walk++;
+                               segment = walk;
                                walk_last = 0;
                                continue;
                        }
+                       segment = walk;
                        if (preg_get_backref(walk+1, &backref)) {
                                if (backref < count) {
                                        /* Find the corresponding string match and substitute it
@@ -632,30 +632,27 @@ static int preg_do_eval(char *eval_str, int eval_str_len, char *subject,
                                        esc_match_len = 0;
                                        match_len = 0;
                                }
-                               sprintf(backref_buf, "%c%d", *walk, backref);
-                               new_code = php_str_to_str(code, code_len,
-                                                                                 backref_buf, (backref > 9) ? 3 : 2,
-                                                                                 esc_match, esc_match_len, &new_code_len);
+                               smart_str_appendl(&code, esc_match, esc_match_len);
 
                                /* Adjust the walk pointer */
-                               walk = new_code + (walk - code) + match_len;
+                               walk += (backref > 9 ? 3 : 2);
+                               segment = walk;
 
                                /* Clean up and reassign */
                                if (esc_match_len)
                                        efree(esc_match);
-                               efree(code);
-                               code = new_code;
-                               code_len = new_code_len;
                                continue;
                        }
                }
                walk++;
                walk_last = walk[-1];
        }
+       smart_str_appendl(&code, segment, walk - segment);
+       smart_str_0(&code);
 
        compiled_string_description = zend_make_compiled_string_description("regexp code");
        /* Run the code */
-       if (zend_eval_string(code, &retval, compiled_string_description CLS_CC ELS_CC) == FAILURE) {
+       if (zend_eval_string(code.c, &retval, compiled_string_description CLS_CC ELS_CC) == FAILURE) {
                efree(compiled_string_description);
                zend_error(E_ERROR, "Failed evaluating code:\n%s\n", code);
                /* zend_error() does not return in this case */
@@ -669,7 +666,7 @@ static int preg_do_eval(char *eval_str, int eval_str_len, char *subject,
        
        /* Clean up */
        zval_dtor(&retval);
-       efree(code);
+       smart_str_free(&code);
        
        return result_len;
 }