[php-src] PR #24720: Fix mbregex fuzzer not being built and truncating its input
| From: | yumasansansan | Date: | Mon, 26 Oct 2026 06:32:40 +0000 |
| Subject: | [php-src] PR #24720: Fix mbregex fuzzer not being built and truncating its input | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39893@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24720
Author: yumasansansan
Two problems in the mbregex fuzzer:
1.
sapi/fuzzer/config.m4 builds php-fuzz-mbregex only if test -n
"$enable_mbregex". Because sapi/*/config.m4 is evaluated before
ext/*/config.m4, PHP_MBREGEX is not known yet, and
enable_mbregex is only set if
--enable-mbregex/--disable-mbregex is given on the command line. With
./configure --enable-fuzzer --enable-mbstring (as documented in the README), mbregex is
compiled in (HAVE_MBREGEX is defined), but php-fuzz-mbregex is not built.
2. fuzzer_call_php_func() creates the arguments with ZVAL_STRING(), i.e.
strlen(), so the pattern and subject end at the first NUL byte, and the part of the
input space containing NUL bytes was never passed to Oniguruma. The fuzzer now passes the input with
its length. For the input a\0b, onig_new() now receives a 3 byte pattern.
The input format is unchanged, existing corpora stay valid.