[php-src] master: Merge branch 'PHP-8.4' into PHP-8.5

Author: Arnaud Le Blanc (arnaud-lb) Date: 2026-07-27T18:02:30+02:00 Commit: https://github.com/php/php-src/commit/3de8e640b3ce28e0ea7208445c1bffde207b87a1 Raw diff: https://github.com/php/php-src/commit/3de8e640b3ce28e0ea7208445c1bffde207b87a1.diff Merge branch 'PHP-8.4' into PHP-8.5 * PHP-8.4: Forbid \C in UTF-8 patterns (#21139) Changed paths: A ext/pcre/tests/gh21134.phpt M NEWS M ext/pcre/php_pcre.c Diff: diff --git a/NEWS b/NEWS index ca863b4f3815..25c5af392c80 100644 --- a/NEWS +++ b/NEWS @@ -22,6 +22,10 @@ PHP NEWS . Fixed bug GH-22779 (mb_strrpos() returns the wrong position for a negative offset in a non-UTF-8 encoding). (Eyüp Can Akman) +- PCRE: + . Fixed bug GH-21134 (Crash with \C + UTF-8). Using \C in UTF-8 patterns is + now forbidden. (Arnaud) + - Sockets: . Fixed socket_set_option() validation error messages for UDP_SEGMENT and SO_LINGER options. (Weilin Du) diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c index 55299677fc69..50e2e8a93f39 100644 --- a/ext/pcre/php_pcre.c +++ b/ext/pcre/php_pcre.c @@ -725,6 +725,8 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, bo #ifdef PCRE2_UCP coptions |= PCRE2_UCP; #endif + /* The \C escape sequence is unsafe in PCRE2_UTF mode */ + coptions |= PCRE2_NEVER_BACKSLASH_C; break; case 'J': coptions |= PCRE2_DUPNAMES; break; @@ -778,8 +780,13 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, bo if (key != regex) { zend_string_release_ex(key, 0); } - pcre2_get_error_message(errnumber, error, sizeof(error)); - php_error_docref(NULL,E_WARNING, "Compilation failed: %s at offset %zu", error, erroffset); + const char *err_msg = (const char*) error; + if (errnumber == PCRE2_ERROR_BACKSLASH_C_CALLER_DISABLED) { + err_msg = "using \\C is incompatible with the 'u' modifier"; + } else { + pcre2_get_error_message(errnumber, error, sizeof(error)); + } + php_error_docref(NULL,E_WARNING, "Compilation failed: %s at offset %zu", err_msg, erroffset); pcre_handle_exec_error(PCRE2_ERROR_INTERNAL); efree(pattern); return NULL; diff --git a/ext/pcre/tests/gh21134.phpt b/ext/pcre/tests/gh21134.phpt new file mode 100644 index 000000000000..ddcf19a6e7a2 --- /dev/null +++ b/ext/pcre/tests/gh21134.phpt @@ -0,0 +1,15 @@ +--TEST-- +GH-21134: ASan negative-size-param in preg_match_all() with \C + UTF-8 multibyte input +--CREDITS-- +vi3tL0u1s +--FILE-- +<?php + +$r = preg_match_all("/(.*)\\C/u", "à", $m); +var_dump($r, $m); + +?> +--EXPECTF-- +Warning: preg_match_all(): Compilation failed: using \C is incompatible with the 'u' modifier at offset 6 in %s on line %d +bool(false) +NULL