diff options
| author | Rui Hirokawa <hirokawa@php.net> | 2011-09-25 08:33:43 +0000 |
|---|---|---|
| committer | Rui Hirokawa <hirokawa@php.net> | 2011-09-25 08:33:43 +0000 |
| commit | 9b1c6035d283513415cf16c15aed5013ea8d78a8 (patch) | |
| tree | 9141d43367b885cac663023bec694040ab577495 /ext/mbstring/php_mbregex.c | |
| parent | 1297c0508a1dc88310e0f0c8297de3de732a7f67 (diff) | |
| download | php-git-9b1c6035d283513415cf16c15aed5013ea8d78a8.tar.gz | |
fixed seg faults for mb_ereg_replace_callback.
Diffstat (limited to 'ext/mbstring/php_mbregex.c')
| -rw-r--r-- | ext/mbstring/php_mbregex.c | 42 |
1 files changed, 22 insertions, 20 deletions
diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c index dcd739937a..64db8396e8 100644 --- a/ext/mbstring/php_mbregex.c +++ b/ext/mbstring/php_mbregex.c @@ -913,30 +913,32 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp #endif /* copy the part of the string before the match */ smart_str_appendl(&out_buf, pos, (size_t)((OnigUChar *)(string + regs->beg[0]) - pos)); - /* copy replacement and backrefs */ - i = 0; - p = replace; - while (i < replace_len) { - int fwd = (int) php_mb_mbchar_bytes_ex(p, enc); - n = -1; - if ((replace_len - i) >= 2 && fwd == 1 && + + if (!is_callable) { + /* copy replacement and backrefs */ + i = 0; + p = replace; + while (i < replace_len) { + int fwd = (int) php_mb_mbchar_bytes_ex(p, enc); + n = -1; + if ((replace_len - i) >= 2 && fwd == 1 && p[0] == '\\' && p[1] >= '0' && p[1] <= '9') { - n = p[1] - '0'; - } - if (n >= 0 && n < regs->num_regs) { - if (regs->beg[n] >= 0 && regs->beg[n] < regs->end[n] && regs->end[n] <= string_len) { - smart_str_appendl(pbuf, string + regs->beg[n], regs->end[n] - regs->beg[n]); + n = p[1] - '0'; + } + if (n >= 0 && n < regs->num_regs) { + if (regs->beg[n] >= 0 && regs->beg[n] < regs->end[n] && regs->end[n] <= string_len) { + smart_str_appendl(pbuf, string + regs->beg[n], regs->end[n] - regs->beg[n]); + } + p += 2; + i += 2; + } else { + smart_str_appendl(pbuf, p, fwd); + p += fwd; + i += fwd; } - p += 2; - i += 2; - } else { - smart_str_appendl(pbuf, p, fwd); - p += fwd; - i += fwd; } } - - + if (eval) { zval v; /* null terminate buffer */ |