Fixed bug #68740 (NULL Pointer Dereference)

(cherry picked from commit 124fb22a13fafa3648e4e15b4f207c7096d8155e)

diff --git a/NEWS b/NEWS
index f8f046c056d08551ca70d650c25708ecbd055046..0a83818e2e2d3cbe9214951648ef645423ca85a0 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2015 PHP 5.4.40
 
+- Ereg:
+  . Fixed bug #68740 (NULL Pointer Dereference). (Laruence)
+
 - GD:
   . Fixed bug #68601 (buffer read overflow in gd_gif_in.c). (Remi)
 

diff --git a/ext/ereg/regex/regcomp.c b/ext/ereg/regex/regcomp.c
index f4bfc1c1679ffedfff020a7c1c73811075cb7710..c2223d7dbe05e48cd281179b45e97cf297dcba41 100644 (file)
--- a/ext/ereg/regex/regcomp.c
+++ b/ext/ereg/regex/regcomp.c
@@ -1284,6 +1284,10 @@ int c;
        register int ncols = (g->ncsets+(CHAR_BIT-1)) / CHAR_BIT;
        register unsigned uc = (unsigned char)c;
 
+       if (!g->setbits) {
+               return(0);
+       }
+
        for (i = 0, col = g->setbits; i < ncols; i++, col += g->csetsize)
                if (col[uc] != 0)
                        return(1);