Fixed infinite loop in formatComment due to backreferences in preg_replace replacemen...

diff --git a/includes/Linker.php b/includes/Linker.php
index 84e1bda..8da9612 100644 (file)
--- a/includes/Linker.php
+++ b/includes/Linker.php
@@ -726,6 +726,8 @@ class Linker {
                                        $match[1] = substr($match[1], 1);
                                $thelink = $this->makeLink( $match[1], $text, "", $trail );
                        }
+                       # Quote backreferences, then run preg_replace
+                       $thelink = strtr( $thelink, array( "\\" => "\\\\", '$' => "\\$" ) );
                        $comment = preg_replace( $linkRegexp, $thelink, $comment, 1 );
                }
                wfProfileOut( $fname );