Fixed bug #76319

While at it, also make sure that mbstring case conversion takes
into account the specified substitution character and substitution
mode.

1 files changed, 14 insertions, 1 deletions

diff --git a/ext/mbstring/php_unicode.c b/ext/mbstring/php_unicode.c
index 0cffec652e..ac452b6a20 100644
--- a/ext/mbstring/php_unicode.c
+++ b/ext/mbstring/php_unicode.c
@@ -312,6 +312,14 @@ static int convert_case_filter(int c, void *void_data)
 	struct convert_case_data *data = (struct convert_case_data *) void_data;
 	unsigned out[3];
 	unsigned len, i;
+
+	/* Handle invalid characters early, as we assign special meaning to
+	 * codepoints above 0xffffff. */
+	if (UNEXPECTED(c > 0xffffff)) {
+		(*data->next_filter->filter_function)(c, data->next_filter);
+		return 0;
+	}
+
 	switch (data->case_mode) {
 		case PHP_UNICODE_CASE_UPPER_SIMPLE:
 			out[0] = php_unicode_toupper_simple(c, data->no_encoding);
@@ -376,7 +384,7 @@ static int convert_case_filter(int c, void *void_data)
 
 MBSTRING_API char *php_unicode_convert_case(
 		int case_mode, const char *srcstr, size_t srclen, size_t *ret_len,
-		const mbfl_encoding *src_encoding)
+		const mbfl_encoding *src_encoding, int illegal_mode, int illegal_substchar)
 {
 	struct convert_case_data data;
 	mbfl_convert_filter *from_wchar, *to_wchar;
@@ -403,6 +411,11 @@ MBSTRING_API char *php_unicode_convert_case(
 		return NULL;
 	}
 
+	to_wchar->illegal_mode = illegal_mode;
+	to_wchar->illegal_substchar = illegal_substchar;
+	from_wchar->illegal_mode = illegal_mode;
+	from_wchar->illegal_substchar = illegal_substchar;
+
 	data.next_filter = from_wchar;
 	data.no_encoding = src_encoding->no_encoding;
 	data.case_mode = case_mode;