diff options
| author | Andrei Zmievski <andrei@php.net> | 2002-06-17 15:10:22 +0000 |
|---|---|---|
| committer | Andrei Zmievski <andrei@php.net> | 2002-06-17 15:10:22 +0000 |
| commit | a347ed559bde49393106ea3181ed59513a034b61 (patch) | |
| tree | 87f8c647f5b87c16f81102ae3057f9e2ad6d33fa /ext/ereg/ereg.c | |
| parent | d2b435eb08eb936da16226a4d2586bf4c9f685ac (diff) | |
| download | php-git-a347ed559bde49393106ea3181ed59513a034b61.tar.gz | |
Applied fix for #17764.
@- Fixed a crash in ereg_replace() when backreference number was greater
@ than the number of subpatterns. (oliver@billix.franken.de)
Diffstat (limited to 'ext/ereg/ereg.c')
| -rw-r--r-- | ext/ereg/ereg.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/ext/ereg/ereg.c b/ext/ereg/ereg.c index 0335347b39..13e06ba3cc 100644 --- a/ext/ereg/ereg.c +++ b/ext/ereg/ereg.c @@ -342,6 +342,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha while (*walk) if ('\\' == *walk && '0' <= walk[1] && '9' >= walk[1] + && walk[1] - '0' <= re.re_nsub && subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1) { new_l += subs[walk[1] - '0'].rm_eo @@ -369,6 +370,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha while (*walk) if ('\\' == *walk && '0' <= walk[1] && '9' >= walk[1] + && walk[1] - '0' <= re.re_nsub && subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1 /* this next case shouldn't happen. it does. */ |