Bug #72405 [Com]: mb_ereg_replace - mbc_to_code (oniguruma) - oob read access
Edit report at https://bugs.php.net/bug.php?id=72405&edit=1
ID: 72405
Comment by: shm@php.net
Reported by: shm@php.net
Summary: mb_ereg_replace - mbc_to_code (oniguruma) - oob read
access
Status: Re-Opened
Type: Bug
Package: mbstring related
Operating System: Linux
PHP Version: 7.0Git-2016-06-14 (Git)
Block user comment: N
Private report: N
New Comment:
@laurence - have you pushed this bug upstream?
Previous Comments:
------------------------------------------------------------------------
[2016-06-28 16:46:24] cmb@php.net
Obivously, feedback had been provided, so re-opening.
------------------------------------------------------------------------
[2016-06-26 04:22:32] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
------------------------------------------------------------------------
[2016-06-20 18:06:27] shm@php.net
Are you going to report it upstream?
------------------------------------------------------------------------
[2016-06-15 15:49:21] laruence@php.net
hmm, this one seems really like a bug in oniguruma's bug..
------------------------------------------------------------------------
[2016-06-15 09:54:26] shm@php.net
For provided case it works perfectly, but we've got another case if user provided string
shorter than 6 chars, like this one:
<?php mb_ereg_replace("\xfc",$_,$_);
Function reads oob (but it's not using pat_buf).
105 c = *p++;
gdb-peda$ print p
$7 = (const OnigUChar *) 0x60060004ffdc ""
gdb-peda$ bt
#0 mbc_to_code (p=0x60060004ffdc "", end=0x60060004ffd9 "") at
/home/shm/src/php-src/ext/mbstring/oniguruma/enc/utf8.c:105
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=72405
--
Edit this bug report at https://bugs.php.net/bug.php?id=72405&edit=1
Thread (10 messages)