From 3e0680f2ee00de7a4992e1d21607226984f1b36b Mon Sep 17 00:00:00 2001 From: Jani Taskinen Date: Fri, 16 Nov 2007 12:26:34 +0000 Subject: MFH:- Fixed bug #31911 (mb_ereg*_replace() crashes when replacement string is invalid PHP expression and 'e' option is used) --- ext/mbstring/php_mbregex.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'ext/mbstring/php_mbregex.c') diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c index 79ff22a503..3f8bca9d47 100644 --- a/ext/mbstring/php_mbregex.c +++ b/ext/mbstring/php_mbregex.c @@ -737,7 +737,12 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp /* null terminate buffer */ smart_str_appendc(&eval_buf, '\0'); /* do eval */ - zend_eval_string(eval_buf.c, &v, description TSRMLS_CC); + if (zend_eval_string(eval_buf.c, &v, description TSRMLS_CC) == FAILURE) { + efree(description); + php_error_docref(NULL TSRMLS_CC,E_ERROR, "Failed evaluating code: %s%s", PHP_EOL, eval_buf.c); + /* zend_error() does not return in this case */ + } + /* result of eval */ convert_to_string(&v); smart_str_appendl(&out_buf, Z_STRVAL(v), Z_STRLEN(v)); -- cgit v1.2.1