archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Applied fix for #17764.

Browse source 
@- Fixed a crash in ereg_replace() when backreference number was greater
@  than the number of subpatterns. (oliver@billix.franken.de)
This commit is contained in:
Andrei Zmievski 2002-06-17 15:10:22 +00:00
parent d2b435eb08
commit a347ed559b
2 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
ext/ereg/ereg.c
View file

@ -342,6 +342,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
while (*walk)
if ('\\' == *walk
&& '0' <= walk[1] && '9' >= walk[1]
&& walk[1] - '0' <= re.re_nsub
&& subs[walk[1] - '0'].rm_so > -1
&& subs[walk[1] - '0'].rm_eo > -1) {
new_l += subs[walk[1] - '0'].rm_eo
@ -369,6 +370,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
while (*walk)
if ('\\' == *walk
&& '0' <= walk[1] && '9' >= walk[1]
&& walk[1] - '0' <= re.re_nsub
&& subs[walk[1] - '0'].rm_so > -1
&& subs[walk[1] - '0'].rm_eo > -1
/* this next case shouldn't happen. it does. */

2
ext/standard/reg.c
View file

@ -342,6 +342,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
while (*walk)
if ('\\' == *walk
&& '0' <= walk[1] && '9' >= walk[1]
&& walk[1] - '0' <= re.re_nsub
&& subs[walk[1] - '0'].rm_so > -1
&& subs[walk[1] - '0'].rm_eo > -1) {
new_l += subs[walk[1] - '0'].rm_eo
@ -369,6 +370,7 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
while (*walk)
if ('\\' == *walk
&& '0' <= walk[1] && '9' >= walk[1]
&& walk[1] - '0' <= re.re_nsub
&& subs[walk[1] - '0'].rm_so > -1
&& subs[walk[1] - '0'].rm_eo > -1
/* this next case shouldn't happen. it does. */