1 files changed, 52 insertions, 11 deletions

diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c
index ec1ed1aae0..a9e464fa64 100644
--- a/ext/mbstring/php_mbregex.c
+++ b/ext/mbstring/php_mbregex.c
@@ -703,6 +703,21 @@ static void _php_mb_regex_ereg_exec(INTERNAL_FUNCTION_PARAMETERS, int icase)
 		RETURN_FALSE;
 	}
 
+	if (!php_mb_check_encoding(
+	string,
+	string_len,
+	_php_mb_regex_mbctype2name(MBREX(current_mbctype))
+	)) {
+		zval_dtor(array);
+		array_init(array);
+		RETURN_FALSE;
+	}
+
+	if (array != NULL) {
+		zval_dtor(array);
+		array_init(array);
+	}
+
 	options = MBREX(regex_default_options);
 	if (icase) {
 		options |= ONIG_OPTION_IGNORECASE;
@@ -741,14 +756,12 @@ static void _php_mb_regex_ereg_exec(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	match_len = 1;
 	str = string;
 	if (array != NULL) {
-		zval_dtor(array);
-		array_init(array);
 
 		match_len = regs->end[0] - regs->beg[0];
 		for (i = 0; i < regs->num_regs; i++) {
 			beg = regs->beg[i];
 			end = regs->end[i];
-			if (beg >= 0 && beg < end && end <= string_len) {
+			if (beg >= 0 && beg < end && (size_t)end <= string_len) {
 				add_index_stringl(array, i, (char *)&str[beg], end - beg);
 			} else {
 				add_index_bool(array, i, 0);
@@ -807,7 +820,8 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp
 	smart_str out_buf = {0};
 	smart_str eval_buf = {0};
 	smart_str *pbuf;
-	int i, err, eval, n;
+	size_t i;
+	int err, eval, n;
 	OnigUChar *pos;
 	OnigUChar *string_lim;
 	char *description = NULL;
@@ -847,6 +861,14 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp
 			}
 		}
 
+		if (!php_mb_check_encoding(
+		string,
+		string_len,
+		_php_mb_regex_mbctype2name(MBREX(current_mbctype))
+		)) {
+			RETURN_NULL();
+		}
+
 		if (option_str != NULL) {
 			_php_mb_regex_init_options(option_str, option_str_len, &options, &syntax, &eval);
 		} else {
@@ -854,6 +876,9 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp
 			syntax = MBREX(regex_default_syntax);
 		}
 	}
+	if (eval && !is_callable) {
+		php_error_docref(NULL, E_DEPRECATED, "The 'e' option is deprecated, use mb_ereg_replace_callback instead");
+	}
 	if (Z_TYPE_P(arg_pattern_zval) == IS_STRING) {
 		arg_pattern = Z_STRVAL_P(arg_pattern_zval);
 		arg_pattern_len = Z_STRLEN_P(arg_pattern_zval);
@@ -926,7 +951,7 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp
 						n = p[1] - '0';
 					}
 					if (n >= 0 && n < regs->num_regs) {
-						if (regs->beg[n] >= 0 && regs->beg[n] < regs->end[n] && regs->end[n] <= string_len) {
+						if (regs->beg[n] >= 0 && regs->beg[n] < regs->end[n] && (size_t)regs->end[n] <= string_len) {
 							smart_str_appendl(pbuf, string + regs->beg[n], regs->end[n] - regs->beg[n]);
 						}
 						p += 2;
@@ -954,8 +979,11 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp
 				/* do eval */
 				if (zend_eval_stringl(ZSTR_VAL(eval_str), ZSTR_LEN(eval_str), &v, description) == FAILURE) {
 					efree(description);
-					php_error_docref(NULL,E_ERROR, "Failed evaluating code: %s%s", PHP_EOL, ZSTR_VAL(eval_str));
-					/* zend_error() does not return in this case */
+					zend_throw_error(NULL, "Failed evaluating code: %s%s", PHP_EOL, ZSTR_VAL(eval_str));
+					onig_region_free(regs, 0);
+					smart_str_free(&out_buf);
+					smart_str_free(&eval_buf);
+					RETURN_FALSE;
 				}
 
 				/* result of eval */
@@ -1100,7 +1128,7 @@ PHP_FUNCTION(mb_split)
 		beg = regs->beg[0], end = regs->end[0];
 		/* add it to the array */
 		if ((pos - (OnigUChar *)string) < end) {
-			if (beg < string_len && beg >= (chunk_pos - (OnigUChar *)string)) {
+			if ((size_t)beg < string_len && beg >= (chunk_pos - (OnigUChar *)string)) {
 				add_next_index_stringl(return_value, (char *)chunk_pos, ((OnigUChar *)(string + beg) - chunk_pos));
 				--count;
 			} else {
@@ -1351,14 +1379,22 @@ PHP_FUNCTION(mb_ereg_search_init)
 
 	ZVAL_DUP(&MBREX(search_str), arg_str);
 
-	MBREX(search_pos) = 0;
+	if (php_mb_check_encoding(
+	Z_STRVAL_P(arg_str),
+	Z_STRLEN_P(arg_str),
+	_php_mb_regex_mbctype2name(MBREX(current_mbctype))
+	)) {
+		MBREX(search_pos) = 0;
+		RETVAL_TRUE;
+	} else {
+		MBREX(search_pos) = Z_STRLEN_P(arg_str);
+		RETVAL_FALSE;
+	}
 
 	if (MBREX(search_regs) != NULL) {
 		onig_region_free(MBREX(search_regs), 1);
 		MBREX(search_regs) = NULL;
 	}
-
-	RETURN_TRUE;
 }
 /* }}} */
 
@@ -1408,6 +1444,11 @@ PHP_FUNCTION(mb_ereg_search_setpos)
 		return;
 	}
 
+	/* Accept negative position if length of search string can be determined */
+	if ((position < 0) && (!Z_ISUNDEF(MBREX(search_str))) && (Z_TYPE(MBREX(search_str)) == IS_STRING)) {
+		position += Z_STRLEN(MBREX(search_str));
+	}
+		
 	if (position < 0 || (!Z_ISUNDEF(MBREX(search_str)) && Z_TYPE(MBREX(search_str)) == IS_STRING && (size_t)position > Z_STRLEN(MBREX(search_str)))) {
 		php_error_docref(NULL, E_WARNING, "Position is out of range");
 		MBREX(search_pos) = 0;