MFH

diff --git a/ext/ereg/ereg.c b/ext/ereg/ereg.c
index ef29cae84d3261ff2dd549be4ae71b30a7d63814..56026f59262bdfc097bb8ab6869c079df310cf8f 100644 (file)
--- a/ext/ereg/ereg.c
+++ b/ext/ereg/ereg.c
@@ -341,6 +341,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
                        while (*walk)
                                if ('\\' == *walk
                                        && '0' <= walk[1] && '9' >= walk[1]
+                                       && walk[1] - '0' <= re.re_nsub
                                        && subs[walk[1] - '0'].rm_so > -1
                                        && subs[walk[1] - '0'].rm_eo > -1) {
                                        new_l += subs[walk[1] - '0'].rm_eo
@@ -368,6 +369,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
                        while (*walk)
                                if ('\\' == *walk
                                        && '0' <= walk[1] && '9' >= walk[1]
+                                       && walk[1] - '0' <= re.re_nsub
                                        && subs[walk[1] - '0'].rm_so > -1
                                        && subs[walk[1] - '0'].rm_eo > -1
                                        /* this next case shouldn't happen. it does. */

diff --git a/ext/standard/reg.c b/ext/standard/reg.c
index ef29cae84d3261ff2dd549be4ae71b30a7d63814..56026f59262bdfc097bb8ab6869c079df310cf8f 100644 (file)
--- a/ext/standard/reg.c
+++ b/ext/standard/reg.c
@@ -341,6 +341,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
                        while (*walk)
                                if ('\\' == *walk
                                        && '0' <= walk[1] && '9' >= walk[1]
+                                       && walk[1] - '0' <= re.re_nsub
                                        && subs[walk[1] - '0'].rm_so > -1
                                        && subs[walk[1] - '0'].rm_eo > -1) {
                                        new_l += subs[walk[1] - '0'].rm_eo
@@ -368,6 +369,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
                        while (*walk)
                                if ('\\' == *walk
                                        && '0' <= walk[1] && '9' >= walk[1]
+                                       && walk[1] - '0' <= re.re_nsub
                                        && subs[walk[1] - '0'].rm_so > -1
                                        && subs[walk[1] - '0'].rm_eo > -1
                                        /* this next case shouldn't happen. it does. */