From aaa295fa3517f452c074c3ed718262cda68c19bb Mon Sep 17 00:00:00 2001 From: Jani Taskinen Date: Fri, 16 Nov 2007 12:28:34 +0000 Subject: MFH:- Fixed bug #43301 (mb_ereg*_replace() crashes when replacement string is invalid PHP expression and 'e' option is used) --- ext/mbstring/php_mbregex.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'ext/mbstring/php_mbregex.c') diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c index 81b39b1bd8..99e1a5fde7 100644 --- a/ext/mbstring/php_mbregex.c +++ b/ext/mbstring/php_mbregex.c @@ -737,7 +737,12 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp /* null terminate buffer */ smart_str_appendc(&eval_buf, '\0'); /* do eval */ - zend_eval_string(eval_buf.c, &v, description TSRMLS_CC); + if (zend_eval_string(eval_buf.c, &v, description TSRMLS_CC) == FAILURE) { + efree(description); + php_error_docref(NULL TSRMLS_CC,E_ERROR, "Failed evaluating code: %s%s", PHP_EOL, eval_buf.c); + /* zend_error() does not return in this case */ + } + /* result of eval */ convert_to_string(&v); smart_str_appendl(&out_buf, Z_STRVAL(v), Z_STRLEN(v)); -- cgit v1.2.1