[php-src] PR #24772: Fix GH-24769: mb_ereg_replace() over-read on truncated trailing character
| From: | lazerg | Date: | Tue, 27 Oct 2026 03:38:23 +0000 |
| Subject: | [php-src] PR #24772: Fix GH-24769: mb_ereg_replace() over-read on truncated trailing character | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39947@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24772
Author: lazerg
mb_regex_substitute() copied every ordinary character of the replacement string using
the full width php_mb_mbchar_bytes() reports for its lead byte. When the replacement
ends with a truncated multibyte character (e.g. "x\xF0" in UTF-8), that
copied bytes past the end of the string into the result. This clamps the copy to the end of the
string, the same way the \k paths in this function already do since GH-23499.
Fixes #24769