Be more aggressive in making sure that substring matches are valid in

ereg_replace before trying to use them. # i could have sworn i fixed this in php3. ereg() has similar logic, i # guess i just missed ereg_replace. fixing this lets # ext/standard/tests/reg/012.phpt pass on my debian/unstable box
strk · Jan 5, 2002 · 9a171d0 · 9a171d0
1 parent 6823fb1
commit 9a171d0
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/ext/ereg/ereg.c b/ext/ereg/ereg.c
@@ -369,7 +369,9 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
 				if ('\\' == *walk
 					&& '0' <= walk[1] && '9' >= walk[1]
 					&& subs[walk[1] - '0'].rm_so > -1
-					&& subs[walk[1] - '0'].rm_eo > -1) {
+					&& subs[walk[1] - '0'].rm_eo > -1
+					/* this next case shouldn't happen. it does. */
+					&& subs[walk[1] - '0'].rm_so < subs[walk[1] - '0'].rm_eo) {
 					tmp = subs[walk[1] - '0'].rm_eo
 						- subs[walk[1] - '0'].rm_so;
 					memcpy (walkbuf,

diff --git a/ext/standard/reg.c b/ext/standard/reg.c
@@ -369,7 +369,9 @@ PHPAPI char *php_reg_replace(const char *pattern, const char *replace, const cha
 				if ('\\' == *walk
 					&& '0' <= walk[1] && '9' >= walk[1]
 					&& subs[walk[1] - '0'].rm_so > -1
-					&& subs[walk[1] - '0'].rm_eo > -1) {
+					&& subs[walk[1] - '0'].rm_eo > -1
+					/* this next case shouldn't happen. it does. */
+					&& subs[walk[1] - '0'].rm_so < subs[walk[1] - '0'].rm_eo) {
 					tmp = subs[walk[1] - '0'].rm_eo
 						- subs[walk[1] - '0'].rm_so;
 					memcpy (walkbuf,