hirokawa Sun, 25 Sep 2011 08:33:43 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=317265
Log: fixed seg faults for mb_ereg_replace_callback. Changed paths: U php/php-src/trunk/ext/mbstring/php_mbregex.c Modified: php/php-src/trunk/ext/mbstring/php_mbregex.c =================================================================== --- php/php-src/trunk/ext/mbstring/php_mbregex.c 2011-09-25 08:22:58 UTC (rev 317264) +++ php/php-src/trunk/ext/mbstring/php_mbregex.c 2011-09-25 08:33:43 UTC (rev 317265) @@ -913,30 +913,32 @@ #endif /* copy the part of the string before the match */ smart_str_appendl(&out_buf, pos, (size_t)((OnigUChar *)(string + regs->beg[0]) - pos)); - /* copy replacement and backrefs */ - i = 0; - p = replace; - while (i < replace_len) { - int fwd = (int) php_mb_mbchar_bytes_ex(p, enc); - n = -1; - if ((replace_len - i) >= 2 && fwd == 1 && + + if (!is_callable) { + /* copy replacement and backrefs */ + i = 0; + p = replace; + while (i < replace_len) { + int fwd = (int) php_mb_mbchar_bytes_ex(p, enc); + n = -1; + if ((replace_len - i) >= 2 && fwd == 1 && p[0] == '\\' && p[1] >= '0' && p[1] <= '9') { - n = p[1] - '0'; - } - if (n >= 0 && n < regs->num_regs) { - if (regs->beg[n] >= 0 && regs->beg[n] < regs->end[n] && regs->end[n] <= string_len) { - smart_str_appendl(pbuf, string + regs->beg[n], regs->end[n] - regs->beg[n]); + n = p[1] - '0'; } - p += 2; - i += 2; - } else { - smart_str_appendl(pbuf, p, fwd); - p += fwd; - i += fwd; + if (n >= 0 && n < regs->num_regs) { + if (regs->beg[n] >= 0 && regs->beg[n] < regs->end[n] && regs->end[n] <= string_len) { + smart_str_appendl(pbuf, string + regs->beg[n], regs->end[n] - regs->beg[n]); + } + p += 2; + i += 2; + } else { + smart_str_appendl(pbuf, p, fwd); + p += fwd; + i += fwd; + } } } - - + if (eval) { zval v; /* null terminate buffer */
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php