Bug #53273 [NEW]: mb_strcut() returns garbage with the excessive length parameter

From: moriyoshi Operating system: Irrelevant PHP version: Irrelevant Package: mbstring related Bug Type: Bug Bug description:mb_strcut() returns garbage with the excessive length parameter Description: ------------ mb_strcut() returns garbage when the following conditions are met: 1. The value specified to length parameter exceeds the length of the subject string. 2. mbstring.internal_encoding is set to some single-byte encoding. The garbage may consist of uncleared part of the heap that has previously been used for some purpose, which could lead to unexpected information exposure. This bug was originally reported by Mateusz Kocielski. Test script: --------------- <?php $b = "bbbbbbbbbbb"; str_repeat("THIS IS A SECRET MESSAGE, ISN'T IT?", 1); $var3 = mb_strcut($b, 0, 1000); echo $var3; ?> Expected result: ---------------- bbbbbbbbbbb Actual result: -------------- bbbbbbbbbbb??????D$Ј=m???=m?(?=m?`?=m??5<m??=m?THIS IS A SECRET MESSAGE, ISN'T IT??g?1@?=m?(?=m???=m?p?=m?var3 -- Edit bug report at http://bugs.php.net/bug.php?id=53273&edit=1 -- Try a snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=53273&r=trysnapshot52 Try a snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=53273&r=trysnapshot53 Try a snapshot (trunk): http://bugs.php.net/fix.php?id=53273&r=trysnapshottrunk Fixed in SVN: http://bugs.php.net/fix.php?id=53273&r=fixed Fixed in SVN and need be documented: http://bugs.php.net/fix.php?id=53273&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=53273&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=53273&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=53273&r=needscript Try newer version: http://bugs.php.net/fix.php?id=53273&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=53273&r=support Expected behavior: http://bugs.php.net/fix.php?id=53273&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=53273&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=53273&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=53273&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=53273&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=53273&r=dst IIS Stability: http://bugs.php.net/fix.php?id=53273&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=53273&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=53273&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=53273&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=53273&r=mysqlcfg