[php-src] PR #24720: Fix mbregex fuzzer not being built and truncating its input

From: Date: Mon, 26 Oct 2026 06:32:40 +0000
Subject: [php-src] PR #24720: Fix mbregex fuzzer not being built and truncating its input
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39893@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24720 Author: yumasansansan Two problems in the mbregex fuzzer: 1. sapi/fuzzer/config.m4 builds php-fuzz-mbregex only if test -n "$enable_mbregex". Because sapi/*/config.m4 is evaluated before ext/*/config.m4, PHP_MBREGEX is not known yet, and enable_mbregex is only set if --enable-mbregex/--disable-mbregex is given on the command line. With ./configure --enable-fuzzer --enable-mbstring (as documented in the README), mbregex is compiled in (HAVE_MBREGEX is defined), but php-fuzz-mbregex is not built. 2. fuzzer_call_php_func() creates the arguments with ZVAL_STRING(), i.e. strlen(), so the pattern and subject end at the first NUL byte, and the part of the input space containing NUL bytes was never passed to Oniguruma. The fuzzer now passes the input with its length. For the input a\0b, onig_new() now receives a 3 byte pattern. The input format is unchanged, existing corpora stay valid.

« previous php.git-pulls (#39893) next »