com php-src: Validate subject encoding in mb_split and mb _ereg_match: ext/mbstring/php_mbregex.c ext/mbstr ing/tests/bug77418.phpt

Commit: 0ecac37c40a27ffbd59f34b5920735ee0b7f994c Author: Nikita Popov <nikita.ppv@gmail.com> Mon, 11 Feb 2019 12:31:59 +0100 Committer: Stanislav Malyshev <stas@php.net> Wed, 27 Mar 2019 23:20:27 -0700 Parents: 40fe50daf6069f73d0be43d8fcd7d5953053c10d Branches: PHP-7.1 PHP-7.2 PHP-7.3 PHP-7.4 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=0ecac37c40a27ffbd59f34b5920735ee0b7f994c Log: Validate subject encoding in mb_split and mb_ereg_match We were already validating the subject encoding in most functions, but not these two. Changed paths: M ext/mbstring/php_mbregex.c M ext/mbstring/tests/bug77418.phpt Diff: diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c index ab4fe38..1b7133c 100644 --- a/ext/mbstring/php_mbregex.c +++ b/ext/mbstring/php_mbregex.c @@ -1114,6 +1114,11 @@ PHP_FUNCTION(mb_split) count--; } + if (!php_mb_check_encoding(string, string_len, + _php_mb_regex_mbctype2name(MBREX(current_mbctype)))) { + RETURN_FALSE; + } + /* create regex pattern buffer */ if ((re = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, MBREX(regex_default_options), MBREX(current_mbctype), MBREX(regex_default_syntax))) == NULL) { RETURN_FALSE; @@ -1203,6 +1208,11 @@ PHP_FUNCTION(mb_ereg_match) } } + if (!php_mb_check_encoding(string, string_len, + _php_mb_regex_mbctype2name(MBREX(current_mbctype)))) { + RETURN_FALSE; + } + if ((re = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, option, MBREX(current_mbctype), syntax)) == NULL) { RETURN_FALSE; } diff --git a/ext/mbstring/tests/bug77418.phpt b/ext/mbstring/tests/bug77418.phpt index b4acc45..32577bc 100644 --- a/ext/mbstring/tests/bug77418.phpt +++ b/ext/mbstring/tests/bug77418.phpt @@ -1,5 +1,5 @@ --TEST-- -Bug #77371 (Heap overflow in utf32be_mbc_to_code) +Bug #77418 (Heap overflow in utf32be_mbc_to_code) --SKIPIF-- <?php extension_loaded('mbstring') or die('skip mbstring not available'); ?> --FILE-- @@ -8,7 +8,4 @@ mb_regex_encoding("UTF-32"); var_dump(mb_split("\x00\x00\x00\x5c\x00\x00\x00B","000000000000000000000000000000")); ?> --EXPECT-- -array(1) { - [0]=> - string(30) "000000000000000000000000000000" -} +bool(false)