From: jim winstead <jimw@php.net>
Date: Sat, 5 Jan 2002 01:59:11 +0000 (+0000)
Subject: Be more aggressive in making sure that substring matches are valid in
X-Git-Tag: PRE_ISSET_PATCH~289
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=9a171d03e84af05f135a2e2afe8a9008bc79e3a1;p=php

Be more aggressive in making sure that substring matches are valid in
ereg_replace before trying to use them.
# i could have sworn i fixed this in php3. ereg() has similar logic, i
# guess i just missed ereg_replace. fixing this lets
# ext/standard/tests/reg/012.phpt pass on my debian/unstable box
---

diff --git a/ext/ereg/ereg.c b/ext/ereg/ereg.c
index 98b09345e2..82a12a1d83 100644
--- a/ext/ereg/ereg.c
+++ b/ext/ereg/ereg.c
@@ -369,7 +369,9 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
 				if ('\\' == *walk
 					&& '0' <= walk[1] && '9' >= walk[1]
 					&& subs[walk[1] - '0'].rm_so > -1
-					&& subs[walk[1] - '0'].rm_eo > -1) {
+					&& subs[walk[1] - '0'].rm_eo > -1
+					/* this next case shouldn't happen. it does. */
+					&& subs[walk[1] - '0'].rm_so < subs[walk[1] - '0'].rm_eo) {
 					tmp = subs[walk[1] - '0'].rm_eo
 						- subs[walk[1] - '0'].rm_so;
 					memcpy (walkbuf,
diff --git a/ext/standard/reg.c b/ext/standard/reg.c
index 98b09345e2..82a12a1d83 100644
--- a/ext/standard/reg.c
+++ b/ext/standard/reg.c
@@ -369,7 +369,9 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
 				if ('\\' == *walk
 					&& '0' <= walk[1] && '9' >= walk[1]
 					&& subs[walk[1] - '0'].rm_so > -1
-					&& subs[walk[1] - '0'].rm_eo > -1) {
+					&& subs[walk[1] - '0'].rm_eo > -1
+					/* this next case shouldn't happen. it does. */
+					&& subs[walk[1] - '0'].rm_so < subs[walk[1] - '0'].rm_eo) {
 					tmp = subs[walk[1] - '0'].rm_eo
 						- subs[walk[1] - '0'].rm_so;
 					memcpy (walkbuf,