From a347ed559bde49393106ea3181ed59513a034b61 Mon Sep 17 00:00:00 2001 From: Andrei Zmievski Date: Mon, 17 Jun 2002 15:10:22 +0000 Subject: [PATCH] Applied fix for #17764. @- Fixed a crash in ereg_replace() when backreference number was greater @ than the number of subpatterns. (oliver@billix.franken.de) --- ext/ereg/ereg.c | 2 ++ ext/standard/reg.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/ext/ereg/ereg.c b/ext/ereg/ereg.c index 0335347b39..13e06ba3cc 100644 --- a/ext/ereg/ereg.c +++ b/ext/ereg/ereg.c @@ -342,6 +342,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha while (*walk) if ('\\' == *walk && '0' <= walk[1] && '9' >= walk[1] + && walk[1] - '0' <= re.re_nsub && subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1) { new_l += subs[walk[1] - '0'].rm_eo @@ -369,6 +370,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha while (*walk) if ('\\' == *walk && '0' <= walk[1] && '9' >= walk[1] + && walk[1] - '0' <= re.re_nsub && subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1 /* this next case shouldn't happen. it does. */ diff --git a/ext/standard/reg.c b/ext/standard/reg.c index 0335347b39..13e06ba3cc 100644 --- a/ext/standard/reg.c +++ b/ext/standard/reg.c @@ -342,6 +342,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha while (*walk) if ('\\' == *walk && '0' <= walk[1] && '9' >= walk[1] + && walk[1] - '0' <= re.re_nsub && subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1) { new_l += subs[walk[1] - '0'].rm_eo @@ -369,6 +370,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha while (*walk) if ('\\' == *walk && '0' <= walk[1] && '9' >= walk[1] + && walk[1] - '0' <= re.re_nsub && subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1 /* this next case shouldn't happen. it does. */ -- 2.40.0