From 2632a9785640d1166b3304b93d8cb316fb99b6da Mon Sep 17 00:00:00 2001
From: Jim Jagielski <jim@apache.org>
Date: Thu, 13 Oct 2011 14:49:39 +0000
Subject: [PATCH] Force the honoring of AP_MAX_REG_MATCH

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1182887 13f79535-47bb-0310-9956-ffa450edef68
---
 server/util.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/server/util.c b/server/util.c
index 2444a0d667..64d1bebc55 100644
--- a/server/util.c
+++ b/server/util.c
@@ -357,11 +357,13 @@ AP_DECLARE(const char *) ap_stripprefix(const char *bigstring,
  * submatches. Pass it the same nmatch and pmatch arguments that you
  * passed ap_regexec(). pmatch should not be greater than the maximum number
  * of subexpressions - i.e. one more than the re_nsub member of ap_regex_t.
+ * nmatch must be >=AP_MAX_REG_MATCH (10).
  *
  * input should be the string with the $-expressions, source should be the
  * string that was matched against.
  *
  * It returns the substituted string, or NULL if a vbuf is used.
+ * On errors, returns the orig string.
  *
  * Parts of this code are based on Henry Spencer's regsub(), from his
  * AT&T V8 regexp package.
@@ -379,7 +381,7 @@ static char *regsub_core(apr_pool_t *p, struct ap_varbuf *vb,
 
     if (!source)
         return NULL;
-    if (!nmatch) {
+    if (!nmatch || nmatch>AP_MAX_REG_MATCH) {
         if (!vb) {
             return apr_pstrdup(p, src);
         }
@@ -397,7 +399,7 @@ static char *regsub_core(apr_pool_t *p, struct ap_varbuf *vb,
         if (c == '$' && apr_isdigit(*src))
             no = *src++ - '0';
         else
-            no = 10;
+            no = AP_MAX_REG_MATCH;
 
         if (no > 9) {                /* Ordinary character. */
             if (c == '\\' && *src)
-- 
2.40.0