Fix #72711: `mb_ereg` does not clear the `$regs` parameter on failure

When `mb_ereg` failed to match, it didn't update the `$regs` argument.
Now it will always set it to the empty array.

8 files changed, 108 insertions, 50 deletions

diff --git a/NEWS b/NEWS
index beed108cc7..19ee69d861 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,10 @@ PHP                                                                        NEWS
 - EXIF:
   . Fixed bug #72735 (Samsung picture thumb not read (zero size)). (Kalle, Remi)
 
+- mbstring:
+  . Fixed bug #72711 (`mb_ereg` does not clear the `$regs` parameter on
+    failure). (ju1ius)
+
 - Stream: 
   . Fixed bug #72743 (Out-of-bound read in php_stream_filter_create).
     (Loianhtuan)
diff --git a/UPGRADING b/UPGRADING
index 032d5e64e1..e24d589d47 100644
--- a/UPGRADING
+++ b/UPGRADING
@@ -71,6 +71,10 @@ PHP 7.1 UPGRADE NOTES
   . When calling json_encode with JSON_UNESCAPED_UNICODE option, U+2028 and
     U+2029 are escaped.
 
+- mbstring:
+  . mb_ereg() and mb_eregi() will now set the $regs argument to an empty array,
+    if nothing matched. Formerly, $regs was not modified in that case.
+
 - OpenSSL:
   . Dropped sslv2 stream.
 
diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c
index db37bd3739..a9e464fa64 100644
--- a/ext/mbstring/php_mbregex.c
+++ b/ext/mbstring/php_mbregex.c
@@ -713,6 +713,11 @@ static void _php_mb_regex_ereg_exec(INTERNAL_FUNCTION_PARAMETERS, int icase)
 		RETURN_FALSE;
 	}
 
+	if (array != NULL) {
+		zval_dtor(array);
+		array_init(array);
+	}
+
 	options = MBREX(regex_default_options);
 	if (icase) {
 		options |= ONIG_OPTION_IGNORECASE;
@@ -751,8 +756,6 @@ static void _php_mb_regex_ereg_exec(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	match_len = 1;
 	str = string;
 	if (array != NULL) {
-		zval_dtor(array);
-		array_init(array);
 
 		match_len = regs->end[0] - regs->beg[0];
 		for (i = 0; i < regs->num_regs; i++) {
diff --git a/ext/mbstring/tests/bug43994.phpt b/ext/mbstring/tests/bug43994.phpt
index 8fdb904a7c..b2fd867da9 100644
--- a/ext/mbstring/tests/bug43994.phpt
+++ b/ext/mbstring/tests/bug43994.phpt
@@ -49,7 +49,8 @@ With $regs arg:
 
 Warning: mb_ereg(): empty pattern in %s on line %d
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 2 --
 Without $regs arg:
@@ -60,7 +61,8 @@ With $regs arg:
 
 Warning: mb_ereg(): empty pattern in %s on line %d
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 3 --
 Without $regs arg:
@@ -71,7 +73,8 @@ With $regs arg:
 
 Warning: mb_ereg(): empty pattern in %s on line %d
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 4 --
 Without $regs arg:
@@ -82,7 +85,8 @@ With $regs arg:
 
 Warning: mb_ereg(): empty pattern in %s on line %d
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 5 --
 Without $regs arg:
@@ -93,7 +97,8 @@ With $regs arg:
 
 Warning: mb_ereg(): empty pattern in %s on line %d
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 6 --
 Without $regs arg:
@@ -104,7 +109,8 @@ With $regs arg:
 
 Warning: mb_ereg(): empty pattern in %s on line %d
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 7 --
 Without $regs arg:
@@ -115,7 +121,8 @@ With $regs arg:
 
 Warning: mb_ereg(): empty pattern in %s on line %d
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 8 --
 Without $regs arg:
@@ -126,4 +133,5 @@ With $regs arg:
 
 Warning: mb_ereg(): empty pattern in %s on line %d
 bool(false)
-NULL
+array(0) {
+}
diff --git a/ext/mbstring/tests/mb_ereg1.phpt b/ext/mbstring/tests/mb_ereg1.phpt
index 57884c0e02..c61cdb6da2 100644
--- a/ext/mbstring/tests/mb_ereg1.phpt
+++ b/ext/mbstring/tests/mb_ereg1.phpt
@@ -27,7 +27,8 @@ array(3) {
   [1]=>
   int(2)
   [2]=>
-  int(3)
+  array(0) {
+  }
 }
 
 Warning: mb_ereg(): empty pattern in %s on line %d
@@ -38,7 +39,8 @@ array(3) {
   [1]=>
   string(0) ""
   [2]=>
-  string(0) ""
+  array(0) {
+  }
 }
 
 Notice: Array to string conversion in %s on line %d
@@ -50,7 +52,8 @@ array(3) {
   [1]=>
   int(1)
   [2]=>
-  string(0) ""
+  array(0) {
+  }
 }
 
 Warning: mb_ereg() expects parameter 2 to be string, array given in %s on line %d
diff --git a/ext/mbstring/tests/mb_ereg_basic.phpt b/ext/mbstring/tests/mb_ereg_basic.phpt
index db28223393..6ab15f4a5b 100644
--- a/ext/mbstring/tests/mb_ereg_basic.phpt
+++ b/ext/mbstring/tests/mb_ereg_basic.phpt
@@ -113,5 +113,6 @@ array(3) {
   string(8) "MTIzNA=="
 }
 bool(false)
-NULL
-Done
\ No newline at end of file
+array(0) {
+}
+Done
diff --git a/ext/mbstring/tests/mb_ereg_variation1.phpt b/ext/mbstring/tests/mb_ereg_variation1.phpt
index 1f4419ddfe..3077bcbd5d 100644
--- a/ext/mbstring/tests/mb_ereg_variation1.phpt
+++ b/ext/mbstring/tests/mb_ereg_variation1.phpt
@@ -95,47 +95,58 @@ echo "Done";
 
 -- Iteration 1 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 2 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 3 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 4 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 5 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 6 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 7 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 8 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 9 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 10 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 11 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 12 --
 int(6)
@@ -153,13 +164,16 @@ array(1) {
 
 -- Iteration 14 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 15 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 16 --
 bool(false)
-NULL
+array(0) {
+}
 Done
diff --git a/ext/mbstring/tests/mb_ereg_variation2.phpt b/ext/mbstring/tests/mb_ereg_variation2.phpt
index d85c8bd560..291c1c1ec4 100644
--- a/ext/mbstring/tests/mb_ereg_variation2.phpt
+++ b/ext/mbstring/tests/mb_ereg_variation2.phpt
@@ -112,71 +112,88 @@ echo "Done";
 
 -- Iteration 1 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 2 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 3 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 4 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 5 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 6 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 7 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 8 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 9 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 10 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 11 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 12 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 13 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 14 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 15 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 16 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 17 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 18 --
 int(3)
@@ -194,19 +211,23 @@ array(1) {
 
 -- Iteration 20 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 21 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 22 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 23 --
 bool(false)
-NULL
+array(0) {
+}
 
 -- Iteration 24 --