Bug #17764 Updated: crash in ereg_replace (with patch to fix it ;-)

ID: 17764 Updated by: andrei@php.net Reported By: oliver@billix.franken.de -Status: Open +Status: Closed Bug Type: Reproducible crash Operating System: Linux 2.2.19 PHP Version: 4.2.1 New Comment: This bug has been fixed in CVS. You can grab a snapshot of the CVS version at http://snaps.php.net/. In case this was a documentation problem, the fix will show up soon at http://www.php.net/manual/. In case this was a PHP.net website problem, the change will show up on the PHP.net site and on the mirror sites. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2002-06-14 10:39:41] oliver@billix.franken.de I wanted to replace any umlauts with strings (not chars in octal...) like "\200". I used ereg_replace for this and it worked until PHP 4.2.0 was released. Than php just crashed. I now know there are better solutions to accomplish this, e.g. str_replace... But on the other hand, php shouldn't crash on user input... Here is the code: <?php $x = "aäböc"; $x = ereg_replace ( "ä" , "\\200" , $x ); print "$x\n"; $x = ereg_replace ( "ö" , "\\234" , $x ); print "$x\n"; ?> The problem is, \\2 is taken as an index into an array, which has only one element. The fix is easy, just check the digit if it is a valid index: --- reg.c Sun May 5 10:39:57 2002 +++ reg.c.new Fri Jun 14 16:13:38 2002 @@ -341,6 +341,7 @@ while (*walk) if ('\\' == *walk && '0' <= walk[1] && '9' >= walk[1] + && walk[1] - '0' <= re.re_nsub && subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1) { new_l += subs[walk[1] - '0'].rm_eo @@ -368,6 +369,7 @@ while (*walk) if ('\\' == *walk && '0' <= walk[1] && '9' >= walk[1] + && walk[1] - '0' <= re.re_nsub && subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1 /* this next case shouldn't happen. it does. */ ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=17764&edit=1