Bug #76319 [Ana->Csd]: mb_strtolower with default encoding causes BufferOverflow and termination

Edit report at https://bugs.php.net/bug.php?id=76319&edit=1 ID: 76319 Updated by: nikic@php.net Reported by: ion dot bazan at gmail dot com Summary: mb_strtolower with default encoding causes BufferOverflow and termination -Status: Analyzed +Status: Closed Type: Bug Package: mbstring related Operating System: Linux PHP Version: master-Git-2018-05-09 (Git) Block user comment: N Private report: N New Comment: Automatic comment on behalf of nikita.ppv@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=9d63f4dec1d180f2a9533d8b7b6b5c445917aee2 Log: Fixed bug #76319 Previous Comments: ------------------------------------------------------------------------ [2018-05-24 21:27:31] cmb@php.net BTW: doesn't the implementation of full case mapping[1] deserve a prominent entry in UPGRADING? [1] <http://git.php.net/?p=php-src.git;a=commit;h=582a65b06f3de125887cab02d5c561168fcf94bc> ------------------------------------------------------------------------ [2018-05-09 19:10:30] nikic@php.net We're getting 0x780000a1 as the character, the simple casemapping leaves it at 0x780000a1, but the full casemapping assigns special meaning to results that have a non-zero top byte. We'll have to add an explicit check for out of range characters before calling the casemapping functions. ------------------------------------------------------------------------ [2018-05-09 19:00:36] nikic@php.net <?php var_dump(mb_strtolower("a\xA1\x0B", 'UTF-8')); UTF-8 is the default encoding and \xA1\x0B is invalid UTF-8. Clearly something is going wrong with handling invalid UTF-8. ------------------------------------------------------------------------ [2018-05-09 18:50:42] ion dot bazan at gmail dot com Calling: mb_strtolower(urldecode('a%A1%C0b'), 'ASCII') works properly though. ------------------------------------------------------------------------ [2018-05-09 18:46:36] ion dot bazan at gmail dot com Change category ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=76319 -- Edit this bug report at https://bugs.php.net/bug.php?id=76319&edit=1