[php-src] PR #24522: Fix GH-24489: Restore mbstring buffer growth fix lost in merge
| From: | lazerg | Date: | Thu, 22 Oct 2026 01:24:02 +0000 |
| Subject: | [php-src] PR #24522: Fix GH-24489: Restore mbstring buffer growth fix lost in merge | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39687@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24522
Author: lazerg
The PHP-8.6 into master merge (9705fda1bb) dropped the
buf->out/buf->limit sync from the failure path of
mb_convert_buf_ensure(), along with its test. So when a second buffer growth fails,
buf->out still points into the old, freed buffer, and
mb_convert_buf_result() writes through it and computes a bogus length. With the tracked
allocator this trips the end >= p assertion in zend_memnstr() from
mb_substr_count(). This puts the three lines back and restores
oom_buf_growth.phpt from PHP-8.6, so the mbstring libmbfl code matches PHP-8.6 again.
Fixes GH-24489