diff options
Diffstat (limited to 'ext/pcre')
| -rw-r--r-- | ext/pcre/php_pcre.c | 6 | ||||
| -rw-r--r-- | ext/pcre/tests/bug70345.phpt | 24 |
2 files changed, 27 insertions, 3 deletions
diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c index 55ca8fa70e..3ec6e625a0 100644 --- a/ext/pcre/php_pcre.c +++ b/ext/pcre/php_pcre.c @@ -758,7 +758,7 @@ PHPAPI void php_pcre_match_impl(pcre_cache_entry *pce, char *subject, int subjec /* If subpatterns array has been passed, fill it in with values. */ if (subpats != NULL) { /* Try to get the list of substrings and display a warning if failed. */ - if (pcre_get_substring_list(subject, offsets, count, &stringlist) < 0) { + if ((offsets[1] - offsets[0] < 0) || pcre_get_substring_list(subject, offsets, count, &stringlist) < 0) { if (subpat_names) { efree(subpat_names); } @@ -1177,7 +1177,7 @@ PHPAPI zend_string *php_pcre_replace_impl(pcre_cache_entry *pce, zend_string *su piece = subject + start_offset; /* if (EXPECTED(count > 0 && (limit == -1 || limit > 0))) */ - if (EXPECTED(count > 0 && limit)) { + if (EXPECTED(count > 0 && (offsets[1] - offsets[0] >= 0) && limit)) { if (UNEXPECTED(replace_count)) { ++*replace_count; } @@ -1799,7 +1799,7 @@ PHPAPI void php_pcre_split_impl(pcre_cache_entry *pce, char *subject, int subjec } /* If something matched */ - if (count > 0) { + if (count > 0 && (offsets[1] - offsets[0] >= 0)) { if (!no_empty || &subject[offsets[0]] != last_match) { if (offset_capture) { diff --git a/ext/pcre/tests/bug70345.phpt b/ext/pcre/tests/bug70345.phpt new file mode 100644 index 0000000000..0947ba3daa --- /dev/null +++ b/ext/pcre/tests/bug70345.phpt @@ -0,0 +1,24 @@ +--TEST-- +Bug #70345 (Multiple vulnerabilities related to PCRE functions) +--FILE-- +<?php +$regex = '/(?=xyz\K)/'; +$subject = "aaaaxyzaaaa"; + +$v = preg_split($regex, $subject); +print_r($v); + +$regex = '/(a(?=xyz\K))/'; +$subject = "aaaaxyzaaaa"; +preg_match($regex, $subject, $matches); + +var_dump($matches); +--EXPECTF-- +Array +( + [0] => aaaaxyzaaaa +) + +Warning: preg_match(): Get subpatterns list failed in %s on line %d +array(0) { +} |