com php-src: Fixed bug #72399 (Use-After-Free in MBString (search_re)): NEWS ext/mbstring/php_mbregex.c ext/mbstring/tests/bug72399.phpt

Commit: 3d5641872239cbd4ec8855b05c90f94fb0d11d7e Author: Xinchen Hui <laruence@gmail.com> Mon, 13 Jun 2016 18:20:26 -0700 Parents: d1ab974f0bfb202d9a49a6cc152293b4d013ef46 Branches: PHP-7.0 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=3d5641872239cbd4ec8855b05c90f94fb0d11d7e Log: Fixed bug #72399 (Use-After-Free in MBString (search_re)) Bugs: https://bugs.php.net/72399 Changed paths: M NEWS M ext/mbstring/php_mbregex.c A ext/mbstring/tests/bug72399.phpt Diff: diff --git a/NEWS b/NEWS index 2b2c4c4..4a8d686 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,8 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2016 PHP 7.0.9 +- Mbstring: + . Fixed bug #72399 (Use-After-Free in MBString (search_re)). (Laruence) - Standard: . Fixed bug #72306 (Heap overflow through proc_open and $env parameter). diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c index 73c94da..c1f9fc2 100644 --- a/ext/mbstring/php_mbregex.c +++ b/ext/mbstring/php_mbregex.c @@ -459,8 +459,12 @@ static php_mb_regex_t *php_mbregex_compile_pattern(const char *pattern, int patl retval = NULL; goto out; } + if (rc == MBREX(search_re)) { + /* reuse the new rc? see bug #72399 */ + MBREX(search_re) = NULL; + } zend_hash_str_update_ptr(&MBREX(ht_rc), (char *)pattern, patlen, retval); - } else if (rc) { + } else { retval = rc; } out: diff --git a/ext/mbstring/tests/bug72399.phpt b/ext/mbstring/tests/bug72399.phpt new file mode 100644 index 0000000..ba6ffb2 --- /dev/null +++ b/ext/mbstring/tests/bug72399.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #72399 (Use-After-Free in MBString (search_re)) +--FILE-- +<?php +$var5 = mbereg_search_init("","2"); +$var6 = mb_eregi_replace("2","",""); +$var13 = mbereg_search_pos(); +?> +--EXPECTF-- +Warning: mbereg_search_pos(): No regex given in %sbug72399.php on line %d