From: Andrei Zmievski <andrei@php.net>
Date: Tue, 11 Apr 2006 21:33:46 +0000 (+0000)
Subject: MFH
X-Git-Tag: php-5.1.3RC3~45
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6a4faee367b446166420473235e7521496048493;p=php

MFH
---

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index 6cd6d27a29..9998be2cee 100644
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -453,7 +453,7 @@ static void php_pcre_match(INTERNAL_FUNCTION_PARAMETERS, int global)
 
 	/*
 	 * Build a mapping from subpattern numbers to their names. We will always
-	 * allocate the table, even though they may be no named subpatterns. This
+	 * allocate the table, even though there may be no named subpatterns. This
 	 * avoids somewhat more complicated logic in the inner loops.
 	 */
 	subpat_names = (char **)safe_emalloc(num_subpats, sizeof(char *), 0);
@@ -467,22 +467,34 @@ static void php_pcre_match(INTERNAL_FUNCTION_PARAMETERS, int global)
 		if (rc < 0) {
 			php_error(E_WARNING, "%s: internal pcre_fullinfo() error %d",
 					  get_active_function_name(TSRMLS_C), rc);
+			efree(offsets);
+			efree(subpat_names);
 			RETURN_FALSE;
 		}
 		if (name_cnt > 0) {
 			int rc1, rc2;
+			long dummy_l;
+			double dummy_d;
 			rc1 = pcre_fullinfo(re, extra, PCRE_INFO_NAMETABLE, &name_table);
 			rc2 = pcre_fullinfo(re, extra, PCRE_INFO_NAMEENTRYSIZE, &name_size);
 			rc = rc2 ? rc2 : rc1;
 			if (rc < 0) {
 				php_error(E_WARNING, "%s: internal pcre_fullinfo() error %d",
 						  get_active_function_name(TSRMLS_C), rc);
+				efree(offsets);
+				efree(subpat_names);
 				RETURN_FALSE;
 			}
 
 			while (ni++ < name_cnt) {
 				name_idx = 0xff * name_table[0] + name_table[1];
 				subpat_names[name_idx] = name_table + 2;
+				if (is_numeric_string(subpat_names[name_idx], strlen(subpat_names[name_idx]), &dummy_l, &dummy_d, 0) > 0) {
+					php_error(E_WARNING, "%s: numeric named subpatterns are not allowed", get_active_function_name(TSRMLS_C));
+					efree(offsets);
+					efree(subpat_names);
+					RETURN_FALSE;
+				}
 				name_table += name_size;
 			}
 		}