gistfile1.diff

diff --git a/hphp/runtime/base/preg.cpp b/hphp/runtime/base/preg.cpp
index e9e637b..fcb0cbf 100644
--- a/hphp/runtime/base/preg.cpp
+++ b/hphp/runtime/base/preg.cpp
@@ -1064,6 +1064,12 @@ static Variant php_pcre_replace(const String& pattern, const String& subject,
                                     VMExecutionContext::InvokePseudoMain);
             eval_result = v;

+            // Make sure that we have enough space in result
+            if (eval_result.size() > alloc_len - result_len) {
+              alloc_len = 1 + result_len + 2 * eval_result.size();
+              result = (char *)realloc(result, alloc_len);
+            }
+
             memcpy(result + result_len, eval_result.data(), eval_result.size());
             result_len += eval_result.size();
           } else {