@@ -2184,11 +2184,10 @@ static zend_string *php_replace_in_subject_func(zend_string *regex_str, const Ha
21842184 }
21852185}
21862186
2187- /* {{{ preg_replace_func_impl */
2188- static size_t preg_replace_func_impl (zval * return_value ,
2189- zend_string * regex_str , HashTable * regex_ht ,
2190- zend_fcall_info * fci , zend_fcall_info_cache * fcc ,
2191- zend_string * subject_str , HashTable * subject_ht , zend_long limit_val , zend_long flags )
2187+ static size_t php_preg_replace_func_impl (zval * return_value ,
2188+ zend_string * regex_str , const HashTable * regex_ht ,
2189+ zend_fcall_info_cache * fcc ,
2190+ zend_string * subject_str , const HashTable * subject_ht , zend_long limit_val , zend_long flags )
21922191{
21932192 zend_string * result ;
21942193 size_t replace_count = 0 ;
@@ -2216,7 +2215,10 @@ static size_t preg_replace_func_impl(zval *return_value,
22162215 and add the result to the return_value array. */
22172216 ZEND_HASH_FOREACH_KEY_VAL (subject_ht , num_key , string_key , subject_entry ) {
22182217 zend_string * tmp_subject_entry_str ;
2219- zend_string * subject_entry_str = zval_get_tmp_string (subject_entry , & tmp_subject_entry_str );
2218+ zend_string * subject_entry_str = zval_try_get_tmp_string (subject_entry , & tmp_subject_entry_str );
2219+ if (UNEXPECTED (subject_entry_str == NULL )) {
2220+ break ;
2221+ }
22202222
22212223 result = php_replace_in_subject_func (
22222224 regex_str , regex_ht , fcc , subject_entry_str , limit_val , & replace_count , flags );
@@ -2235,7 +2237,6 @@ static size_t preg_replace_func_impl(zval *return_value,
22352237
22362238 return replace_count ;
22372239}
2238- /* }}} */
22392240
22402241static void _preg_replace_common (
22412242 zval * return_value ,
@@ -2393,8 +2394,8 @@ PHP_FUNCTION(preg_replace_callback)
23932394 Z_PARAM_LONG (flags )
23942395 ZEND_PARSE_PARAMETERS_END ();
23952396
2396- replace_count = preg_replace_func_impl (return_value , regex_str , regex_ht ,
2397- & fci , & fcc ,
2397+ replace_count = php_preg_replace_func_impl (return_value , regex_str , regex_ht ,
2398+ & fcc ,
23982399 subject_str , subject_ht , limit , flags );
23992400 if (zcount ) {
24002401 ZEND_TRY_ASSIGN_REF_LONG (zcount , replace_count );
@@ -2445,7 +2446,7 @@ PHP_FUNCTION(preg_replace_callback_array)
24452446
24462447 ZVAL_COPY_VALUE (& fci .function_name , replace );
24472448
2448- replace_count += preg_replace_func_impl (& zv , str_idx_regex , /* regex_ht */ NULL , & fci , & fcc ,
2449+ replace_count += php_preg_replace_func_impl (& zv , str_idx_regex , /* regex_ht */ NULL , & fcc ,
24492450 subject_str , subject_ht , limit , flags );
24502451 switch (Z_TYPE (zv )) {
24512452 case IS_ARRAY :
0 commit comments