[php-src] PR #22954: Fix mbregex search state after cache invalidation
| From: | matthiasgoergens | Date: | Thu, 30 Jul 2026 17:25:30 +0000 |
| Subject: | [php-src] PR #22954: Fix mbregex search state after cache invalidation | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37386@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/22954
Author: matthiasgoergens
Fixes GH-21036.
php_mbregex_compile_pattern() may replace the cache entry currently referenced by
search_re. The replacement destroys that regex and clears search_re, but
leaves search_regs holding match offsets associated with the destroyed regex.
mb_ereg_search_getregs() then treats those registers as valid and dereferences the null
regex when processing named captures.
Free and clear search_regs whenever cache replacement clears search_re.
This preserves the existing invariant that match registers do not outlive their regex and makes
mb_ereg_search_getregs() return false instead of returning stale numeric
captures while losing named captures.
PR #21038 identified the crash and proposed guarding the named-capture lookup. This alternative also
discards the invalidated match state, following the approach used for the analogous invalid-pattern
path in commit 392ad206a4f63fedf61d8086e390c73de8b72767.