ec3f3d6
diff -Naur squidGuard-1.2.0/src/sgDiv.c squidGuard-1.2.0-patch/src/sgDiv.c
ec3f3d6
--- squidGuard-1.2.0/src/sgDiv.c	Tue May 15 05:01:37 2001
ec3f3d6
+++ squidGuard-1.2.0-patch/src/sgDiv.c	Tue Aug  6 14:39:55 2002
ec3f3d6
@@ -500,13 +500,13 @@
ec3f3d6
 #endif
ec3f3d6
 {
ec3f3d6
   struct sgRegExp *re;
ec3f3d6
-  regmatch_t pm;
ec3f3d6
+  regmatch_t pm[10];
ec3f3d6
   static char newstring[MAX_BUF];
ec3f3d6
   char *result = NULL, *p;
ec3f3d6
   int substlen;
ec3f3d6
   *newstring='\0';
ec3f3d6
   for(re = regexp; re != NULL; re = re->next){
ec3f3d6
-    if (regexec (re->compiled, pattern, 1, &pm, 0) != 0){
ec3f3d6
+    if (regexec (re->compiled, pattern, sizeof(pm) / sizeof(pm[0]), pm, 0) != 0){
ec3f3d6
       result = NULL;
ec3f3d6
     } else {
ec3f3d6
       substlen = strlen(re->substitute);
ec3f3d6
@@ -516,14 +516,65 @@
ec3f3d6
 	*newstring = '\0';
ec3f3d6
       p = newstring;
ec3f3d6
       do {
ec3f3d6
-	if((p - newstring)+ pm.rm_so  >= MAX_BUF)
ec3f3d6
+	if((p - newstring)+ pm[0].rm_so  >= MAX_BUF)
ec3f3d6
 	  break;
ec3f3d6
-	p = strncat(newstring,pattern,pm.rm_so);
ec3f3d6
-	if((p - newstring)+ substlen  >= MAX_BUF)
ec3f3d6
-	  break;
ec3f3d6
-	p = strcat(newstring,re->substitute);	
ec3f3d6
-	pattern = pattern + pm.rm_eo;
ec3f3d6
-      } while(regexec (re->compiled, pattern, 1, &pm, REG_NOTBOL)== 0 &&
ec3f3d6
+      p = strncat(newstring,pattern,pm[0].rm_so);
ec3f3d6
+      {
ec3f3d6
+          char *p_cur;
ec3f3d6
+          char *p_next;
ec3f3d6
+
ec3f3d6
+          for (p_next = p_cur = re->substitute;
ec3f3d6
+              p_next < (re->substitute + substlen);
ec3f3d6
+              p_next++)
ec3f3d6
+          {
ec3f3d6
+              if (*p_next == '\\')
ec3f3d6
+              {
ec3f3d6
+                  if (p_cur < p_next)
ec3f3d6
+                  {
ec3f3d6
+                      if (((p - newstring) + (p_next - p_cur)) >= MAX_BUF)
ec3f3d6
+                          goto err;
ec3f3d6
+                      p = strncat(newstring, p_cur, p_next - p_cur);
ec3f3d6
+                  }
ec3f3d6
+                  p_next++;
ec3f3d6
+                  if (p_next < (re->substitute + substlen)
ec3f3d6
+                      && '0' <= *p_next && *p_next <= '9')
ec3f3d6
+                  {
ec3f3d6
+                      int i = *p_next - '0';
ec3f3d6
+                      if ((p - newstring) + (pm[i].rm_eo - pm[i].rm_so) >= MAX_BUF)
ec3f3d6
+                          goto err;
ec3f3d6
+                      p = strncat(newstring, pattern + pm[i].rm_so, pm[i].rm_eo - pm[i].rm_so);
ec3f3d6
+                  }
ec3f3d6
+                  else
ec3f3d6
+                  {
ec3f3d6
+                      if ((p - newstring + 1) >= MAX_BUF)
ec3f3d6
+                          goto err;
ec3f3d6
+                      p = strncat(newstring, p_next, 1);
ec3f3d6
+                  }
ec3f3d6
+                  p_cur = p_next + 1;
ec3f3d6
+              }
ec3f3d6
+              else if (*p_next == '&')
ec3f3d6
+              {
ec3f3d6
+                  if (p_cur < p_next)
ec3f3d6
+                  {
ec3f3d6
+                      if (((p - newstring) + (p_next - p_cur)) >= MAX_BUF)
ec3f3d6
+                          goto err;
ec3f3d6
+                      p = strncat(newstring, p_cur, p_next - p_cur);
ec3f3d6
+                  }
ec3f3d6
+                  if (((p - newstring) + (pm[0].rm_eo - pm[0].rm_so)) >= MAX_BUF)
ec3f3d6
+                      goto err;
ec3f3d6
+                  p = strncat(newstring, pattern + pm[0].rm_so, pm[0].rm_eo - pm[0].rm_so);
ec3f3d6
+                  p_cur = p_next + 1;
ec3f3d6
+              }
ec3f3d6
+          }
ec3f3d6
+          if (p_cur < p_next)
ec3f3d6
+          {
ec3f3d6
+              if (((p - newstring) + (p_next - p_cur)) >= MAX_BUF)
ec3f3d6
+                  goto err;
ec3f3d6
+              p = strncat(newstring, p_cur, p_next - p_cur);
ec3f3d6
+          }
ec3f3d6
+      }
ec3f3d6
+      pattern = pattern + pm[0].rm_eo;
ec3f3d6
+     } while(regexec (re->compiled, pattern, sizeof(pm) / sizeof(pm[0]), pm, REG_NOTBOL)== 0 &&
ec3f3d6
 	      re->global);
ec3f3d6
       if((p - newstring)+ strlen(pattern)  <= MAX_BUF)
ec3f3d6
 	p = strcat(newstring,pattern);
ec3f3d6
@@ -531,6 +582,7 @@
ec3f3d6
       break;
ec3f3d6
     }
ec3f3d6
   }
ec3f3d6
+err:
ec3f3d6
   return result;
ec3f3d6
 }