archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixed bug #72164 (Null Pointer Dereference - mb_ereg_replace)

Browse source
This commit is contained in:
Xinchen Hui 2016-05-05 17:27:34 +08:00
parent c15b6134f6
commit 395863b1d1
3 changed files with 29 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

18
ext/mbstring/php_mbregex.c
View file

@ -935,12 +935,20 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp
if (eval) {
zval v;
zend_string *eval_str;
/* null terminate buffer */
smart_str_0(&eval_buf);
if (eval_buf.s) {
eval_str = eval_buf.s;
} else {
eval_str = ZSTR_EMPTY_ALLOC();
}
/* do eval */
if (zend_eval_stringl(ZSTR_VAL(eval_buf.s), ZSTR_LEN(eval_buf.s), &v, description) == FAILURE) {
if (zend_eval_stringl(ZSTR_VAL(eval_str), ZSTR_LEN(eval_str), &v, description) == FAILURE) {
efree(description);
php_error_docref(NULL,E_ERROR, "Failed evaluating code: %s%s", PHP_EOL, ZSTR_VAL(eval_buf.s));
php_error_docref(NULL,E_ERROR, "Failed evaluating code: %s%s", PHP_EOL, ZSTR_VAL(eval_str));
/* zend_error() does not return in this case */
}
@ -948,7 +956,7 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp
convert_to_string(&v);
smart_str_appendl(&out_buf, Z_STRVAL(v), Z_STRLEN(v));
/* Clean up */
ZSTR_LEN(eval_buf.s) = 0;
smart_str_free(&eval_buf);
zval_dtor(&v);
} else if (is_callable) {
zval args[1];
@ -971,9 +979,7 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp
!Z_ISUNDEF(retval)) {
convert_to_string_ex(&retval);
smart_str_appendl(&out_buf, Z_STRVAL(retval), Z_STRLEN(retval));
if (eval_buf.s) {
ZSTR_LEN(eval_buf.s) = 0;
}
smart_str_free(&eval_buf);
zval_ptr_dtor(&retval);
} else {
efree(description);