MFH: - Fixed bug #33200 (preg_replace(): magic_quotes_sybase=On makes 'e' modifier misbehave)

5 files changed, 29 insertions, 6 deletions

diff --git a/NEWS b/NEWS
index 16b0ae4f0c..9122b8307a 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,8 @@ PHP 4                                                                      NEWS
   them sort based on the current locale. (Derick)
 - Changed sha1_file() and md5_file() functions to use streams instead of 
   low level IO. (Uwe)
+- Fixed bug #33200 (preg_replace(): magic_quotes_sybase=On makes 'e' modifier
+  misbehave). (Jani)
 - Fixed bug #33072 (Add a safemode/open_basedir check for runtime save_path 
   change) (Rasmus)
 - Fixed bug #33057 (Don't send extraneous entity-headers on a 304 as per
diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index e25be3a320..f0d105921d 100644
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -750,9 +750,9 @@ static int preg_do_eval(char *eval_str, int eval_str_len, char *subject,
 					   in instead of the backref */
 					match = subject + offsets[backref<<1];
 					match_len = offsets[(backref<<1)+1] - offsets[backref<<1];
-					if (match_len)
-						esc_match = php_addslashes(match, match_len, &esc_match_len, 0 TSRMLS_CC);
-					else {
+					if (match_len) {
+						esc_match = php_addslashes_ex(match, match_len, &esc_match_len, 0, 1 TSRMLS_CC);
+					} else {
 						esc_match = match;
 						esc_match_len = 0;
 					}
diff --git a/ext/pcre/tests/bug33200.phpt b/ext/pcre/tests/bug33200.phpt
new file mode 100644
index 0000000000..b00b72ac28
--- /dev/null
+++ b/ext/pcre/tests/bug33200.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #33200 (magic_quotes_sybase = On makes 'e' modifier misbehave)
+--INI--
+magic_quotes_sybase=1
+--FILE--
+<?php
+$str = 'some \'$sample\' text';
+$str = preg_replace("/(some.*text)/e", "strtoupper('\\1')", $str);
+echo $str;
+?>
+--EXPECT--
+SOME '$SAMPLE' TEXT
diff --git a/ext/standard/php_string.h b/ext/standard/php_string.h
index 7300b0ed33..b70df0a45a 100644
--- a/ext/standard/php_string.h
+++ b/ext/standard/php_string.h
@@ -116,6 +116,7 @@ PHPAPI char *php_strtoupper(char *s, size_t len);
 PHPAPI char *php_strtolower(char *s, size_t len);
 PHPAPI char *php_strtr(char *str, int len, char *str_from, char *str_to, int trlen);
 PHPAPI char *php_addslashes(char *str, int length, int *new_length, int freeit TSRMLS_DC);
+PHPAPI char *php_addslashes_ex(char *str, int length, int *new_length, int freeit, int ignore_sybase TSRMLS_DC);
 PHPAPI char *php_addcslashes(char *str, int length, int *new_length, int freeit, char *what, int wlength TSRMLS_DC);
 PHPAPI void php_stripslashes(char *str, int *len TSRMLS_DC);
 PHPAPI void php_stripcslashes(char *str, int *len);
diff --git a/ext/standard/string.c b/ext/standard/string.c
index 51aaff8e0a..94e1d371cc 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2413,18 +2413,26 @@ PHPAPI char *php_addcslashes(char *str, int length, int *new_length, int should_
 }
 /* }}} */
 
+/* {{{ php_addslashes
+ */
+PHPAPI char *php_addslashes(char *str, int length, int *new_length, int should_free TSRMLS_DC)
+{
+	return php_addslashes_ex(str, length, new_length, should_free, 0 TSRMLS_CC);
+}
+/* }}} */
+
 /* true static */
 const unsigned char php_esc_list[256] = {2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
 
-/* {{{ php_addslashes
+/* {{{ php_addslashes_ex
  */
-PHPAPI char *php_addslashes(char *str, int length, int *new_length, int should_free TSRMLS_DC)
+PHPAPI char *php_addslashes_ex(char *str, int length, int *new_length, int should_free, int ignore_sybase TSRMLS_DC)
 {
 	char *e = str + (length ? length : (length = strlen(str)));
 	char *p = str;
 	char *new_str, *ps;
 	int local_new_length = length;
-	int type = PG(magic_quotes_sybase) ? 1 : 0;
+	int type = (!ignore_sybase && PG(magic_quotes_sybase)) ? 1 : 0;
 
 	if (!new_length) {
 		new_length = &local_new_length;