Bug #17764: crash in ereg_replace (with patch to fix it ;-)

From: oliver@billix.franken.de Operating system: Linux 2.2.19 PHP version: 4.2.1 PHP Bug Type: Reproducible crash Bug description: crash in ereg_replace (with patch to fix it ;-) I wanted to replace any umlauts with strings (not chars in octal...) like "\200". I used ereg_replace for this and it worked until PHP 4.2.0 was released. Than php just crashed. I now know there are better solutions to accomplish this, e.g. str_replace... But on the other hand, php shouldn't crash on user input... Here is the code: <?php $x = "aäböc"; $x = ereg_replace ( "ä" , "\\200" , $x ); print "$x\n"; $x = ereg_replace ( "ö" , "\\234" , $x ); print "$x\n"; ?> The problem is, \\2 is taken as an index into an array, which has only one element. The fix is easy, just check the digit if it is a valid index: --- reg.c Sun May 5 10:39:57 2002 +++ reg.c.new Fri Jun 14 16:13:38 2002 @@ -341,6 +341,7 @@ while (*walk) if ('\\' == *walk && '0' <= walk[1] && '9' >= walk[1] + && walk[1] - '0' <= re.re_nsub && subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1) { new_l += subs[walk[1] - '0'].rm_eo @@ -368,6 +369,7 @@ while (*walk) if ('\\' == *walk && '0' <= walk[1] && '9' >= walk[1] + && walk[1] - '0' <= re.re_nsub && subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1 /* this next case shouldn't happen. it does. */ -- Edit bug report at http://bugs.php.net/?id=17764&edit=1 -- Fixed in CVS: http://bugs.php.net/fix.php?id=17764&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=17764&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=17764&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=17764&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=17764&r=support Expected behavior: http://bugs.php.net/fix.php?id=17764&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=17764&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=17764&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=17764&r=globals