From: Andrei Zmievski <andrei@php.net>
Date: Mon, 17 Jun 2002 15:11:39 +0000 (+0000)
Subject: MFH
X-Git-Tag: php-4.2.3RC1~112
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=252d12ce1cacf14845cbb8f5c2e4653695083f08;p=php

MFH
---

diff --git a/ext/ereg/ereg.c b/ext/ereg/ereg.c
index ef29cae84d..56026f5926 100644
--- a/ext/ereg/ereg.c
+++ b/ext/ereg/ereg.c
@@ -341,6 +341,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
 			while (*walk)
 				if ('\\' == *walk
 					&& '0' <= walk[1] && '9' >= walk[1]
+					&& walk[1] - '0' <= re.re_nsub
 					&& subs[walk[1] - '0'].rm_so > -1
 					&& subs[walk[1] - '0'].rm_eo > -1) {
 					new_l += subs[walk[1] - '0'].rm_eo
@@ -368,6 +369,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
 			while (*walk)
 				if ('\\' == *walk
 					&& '0' <= walk[1] && '9' >= walk[1]
+					&& walk[1] - '0' <= re.re_nsub
 					&& subs[walk[1] - '0'].rm_so > -1
 					&& subs[walk[1] - '0'].rm_eo > -1
 					/* this next case shouldn't happen. it does. */
diff --git a/ext/standard/reg.c b/ext/standard/reg.c
index ef29cae84d..56026f5926 100644
--- a/ext/standard/reg.c
+++ b/ext/standard/reg.c
@@ -341,6 +341,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
 			while (*walk)
 				if ('\\' == *walk
 					&& '0' <= walk[1] && '9' >= walk[1]
+					&& walk[1] - '0' <= re.re_nsub
 					&& subs[walk[1] - '0'].rm_so > -1
 					&& subs[walk[1] - '0'].rm_eo > -1) {
 					new_l += subs[walk[1] - '0'].rm_eo
@@ -368,6 +369,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
 			while (*walk)
 				if ('\\' == *walk
 					&& '0' <= walk[1] && '9' >= walk[1]
+					&& walk[1] - '0' <= re.re_nsub
 					&& subs[walk[1] - '0'].rm_so > -1
 					&& subs[walk[1] - '0'].rm_eo > -1
 					/* this next case shouldn't happen. it does. */