Bug #72405 [NoF->ReO]: mb_ereg_replace - mbc_to_code (oniguruma) - oob read access

Edit report at https://bugs.php.net/bug.php?id=72405&edit=1 ID: 72405 Updated by: cmb@php.net Reported by: shm@php.net Summary: mb_ereg_replace - mbc_to_code (oniguruma) - oob read access -Status: No Feedback +Status: Re-Opened Type: Bug Package: mbstring related Operating System: Linux PHP Version: 7.0Git-2016-06-14 (Git) Block user comment: N Private report: N New Comment: Obivously, feedback had been provided, so re-opening. Previous Comments: ------------------------------------------------------------------------ [2016-06-26 04:22:32] php-bugs at lists dot php dot net No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. ------------------------------------------------------------------------ [2016-06-20 18:06:27] shm@php.net Are you going to report it upstream? ------------------------------------------------------------------------ [2016-06-15 15:49:21] laruence@php.net hmm, this one seems really like a bug in oniguruma's bug.. ------------------------------------------------------------------------ [2016-06-15 09:54:26] shm@php.net For provided case it works perfectly, but we've got another case if user provided string shorter than 6 chars, like this one: <?php mb_ereg_replace("\xfc",$_,$_); Function reads oob (but it's not using pat_buf). 105 c = *p++; gdb-peda$ print p $7 = (const OnigUChar *) 0x60060004ffdc "" gdb-peda$ bt #0 mbc_to_code (p=0x60060004ffdc "", end=0x60060004ffd9 "") at /home/shm/src/php-src/ext/mbstring/oniguruma/enc/utf8.c:105 ------------------------------------------------------------------------ [2016-06-15 07:00:29] laruence@php.net According to https://github.com/php/php-src/blob/master/ext/mbstring/oniguruma/enc/utf8.c#L291 the max bytes are 6 so...I made a attempt to fix it here: https://github.com/php/php-src/commit/999a3553d58c537b4919821855b2cc8fb62b0b2f thanks ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=72405 -- Edit this bug report at https://bugs.php.net/bug.php?id=72405&edit=1