Be more aggressive in making sure that substring matches are valid in

ereg_replace before trying to use them.
# i could have sworn i fixed this in php3. ereg() has similar logic, i
# guess i just missed ereg_replace. fixing this lets
# ext/standard/tests/reg/012.phpt pass on my debian/unstable box

diff --git a/ext/ereg/ereg.c b/ext/ereg/ereg.c
index 98b09345e2e72d7789a6230612fd6cc605260bbc..82a12a1d8385010a49d38591d5461d6bd289c67b 100644 (file)
--- a/ext/ereg/ereg.c
+++ b/ext/ereg/ereg.c
@@ -369,7 +369,9 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
                                if ('\\' == *walk
                                        && '0' <= walk[1] && '9' >= walk[1]
                                        && subs[walk[1] - '0'].rm_so > -1
-                                       && subs[walk[1] - '0'].rm_eo > -1) {
+                                       && subs[walk[1] - '0'].rm_eo > -1
+                                       /* this next case shouldn't happen. it does. */
+                                       && subs[walk[1] - '0'].rm_so < subs[walk[1] - '0'].rm_eo) {
                                        tmp = subs[walk[1] - '0'].rm_eo
                                                - subs[walk[1] - '0'].rm_so;
                                        memcpy (walkbuf,

diff --git a/ext/standard/reg.c b/ext/standard/reg.c
index 98b09345e2e72d7789a6230612fd6cc605260bbc..82a12a1d8385010a49d38591d5461d6bd289c67b 100644 (file)
--- a/ext/standard/reg.c
+++ b/ext/standard/reg.c
@@ -369,7 +369,9 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
                                if ('\\' == *walk
                                        && '0' <= walk[1] && '9' >= walk[1]
                                        && subs[walk[1] - '0'].rm_so > -1
-                                       && subs[walk[1] - '0'].rm_eo > -1) {
+                                       && subs[walk[1] - '0'].rm_eo > -1
+                                       /* this next case shouldn't happen. it does. */
+                                       && subs[walk[1] - '0'].rm_so < subs[walk[1] - '0'].rm_eo) {
                                        tmp = subs[walk[1] - '0'].rm_eo
                                                - subs[walk[1] - '0'].rm_so;
                                        memcpy (walkbuf,