diff options
| author | Christoph M. Becker <cmb@php.net> | 2016-07-30 11:49:19 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmb@php.net> | 2016-07-30 12:01:29 +0200 |
| commit | e5940aa7950effe1835e489024b840fb87f54a3c (patch) | |
| tree | 54e28f0ae9b4e1bf18523c1d5001e846d2ccff07 | |
| parent | 8a442a33c319a9663212e732dda4cd717d4efff6 (diff) | |
| parent | 1d32b809034ea4cd0e765ae9fda6ca16ae045fdd (diff) | |
| download | php-git-e5940aa7950effe1835e489024b840fb87f54a3c.tar.gz | |
Merge branch 'PHP-5.6' into PHP-7.0
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/mbstring/php_mbregex.c | 2 | ||||
| -rw-r--r-- | ext/mbstring/tests/bug72710.phpt | 12 |
3 files changed, 15 insertions, 1 deletions
@@ -71,6 +71,8 @@ PHP NEWS zero-width). (cmb) . Fixed bug #72694 (mb_ereg_search_setpos does not accept a string's last position). (cmb) + . Fixed bug #72710 (`mb_ereg` causes buffer overflow on regexp compile error). + (ju1ius) - Opcache: . Fixed bug #72590 (Opcache restart with kill_all_lockers does not work). diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c index fc0b1d43e2..ec1ed1aae0 100644 --- a/ext/mbstring/php_mbregex.c +++ b/ext/mbstring/php_mbregex.c @@ -454,7 +454,7 @@ static php_mb_regex_t *php_mbregex_compile_pattern(const char *pattern, int patl rc = zend_hash_str_find_ptr(&MBREX(ht_rc), (char *)pattern, patlen); if (!rc || rc->options != options || rc->enc != enc || rc->syntax != syntax) { if ((err_code = onig_new(&retval, (OnigUChar *)pattern, (OnigUChar *)(pattern + patlen), options, enc, syntax, &err_info)) != ONIG_NORMAL) { - onig_error_code_to_str(err_str, err_code, err_info); + onig_error_code_to_str(err_str, err_code, &err_info); php_error_docref(NULL, E_WARNING, "mbregex compile err: %s", err_str); retval = NULL; goto out; diff --git a/ext/mbstring/tests/bug72710.phpt b/ext/mbstring/tests/bug72710.phpt new file mode 100644 index 0000000000..19becc5010 --- /dev/null +++ b/ext/mbstring/tests/bug72710.phpt @@ -0,0 +1,12 @@ +--TEST-- +Bug #72710 (`mb_ereg` causes buffer overflow on regexp compile error) +--SKIPIF-- +<?php +if (!extension_loaded('mbstring')) die('skip ext/mbstring required'); +?> +--FILE-- +<?php +mb_ereg('(?<0>a)', 'a'); +?> +--EXPECTF-- +Warning: mb_ereg(): mbregex compile err: invalid group name <0> in %s on line %d |