Validate subject encoding in mb_split and mb_ereg_match

nikic · smalyshev · commit 0ecac37c40a2 · 2019-03-27T23:20:27.000-07:00
We were already validating the subject encoding in most functions,
but not these two.
diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c
@@ -1114,6 +1114,11 @@ PHP_FUNCTION(mb_split)
 		count--;
 	}
 
+	if (!php_mb_check_encoding(string, string_len,
+			_php_mb_regex_mbctype2name(MBREX(current_mbctype)))) {
+		RETURN_FALSE;
+	}
+
 	/* create regex pattern buffer */
 	if ((re = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, MBREX(regex_default_options), MBREX(current_mbctype), MBREX(regex_default_syntax))) == NULL) {
 		RETURN_FALSE;
@@ -1203,6 +1208,11 @@ PHP_FUNCTION(mb_ereg_match)
 		}
 	}
 
+	if (!php_mb_check_encoding(string, string_len,
+			_php_mb_regex_mbctype2name(MBREX(current_mbctype)))) {
+		RETURN_FALSE;
+	}
+
 	if ((re = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, option, MBREX(current_mbctype), syntax)) == NULL) {
 		RETURN_FALSE;
 	}
diff --git a/ext/mbstring/tests/bug77418.phpt b/ext/mbstring/tests/bug77418.phpt
@@ -1,5 +1,5 @@
 --TEST--
-Bug #77371 (Heap overflow in utf32be_mbc_to_code)
+Bug #77418 (Heap overflow in utf32be_mbc_to_code)
 --SKIPIF--
 <?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
 --FILE--
@@ -8,7 +8,4 @@ mb_regex_encoding("UTF-32");
 var_dump(mb_split("\x00\x00\x00\x5c\x00\x00\x00B","000000000000000000000000000000"));
 ?>
 --EXPECT--
-array(1) {
-  [0]=>
-  string(30) "000000000000000000000000000000"
-}
+bool(false)

Original file line number	Diff line number	Diff line change
`@@ -1114,6 +1114,11 @@ PHP_FUNCTION(mb_split)`
`1114`	`1114`	`count--;`
`1115`	`1115`	`}`
`1116`	`1116`
	`1117`	`+ if (!php_mb_check_encoding(string, string_len,`
	`1118`	`+ _php_mb_regex_mbctype2name(MBREX(current_mbctype)))) {`
	`1119`	`+ RETURN_FALSE;`
	`1120`	`+ }`
	`1121`	`+`
`1117`	`1122`	`/* create regex pattern buffer */`
`1118`	`1123`	`if ((re = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, MBREX(regex_default_options), MBREX(current_mbctype), MBREX(regex_default_syntax))) == NULL) {`
`1119`	`1124`	`RETURN_FALSE;`
`@@ -1203,6 +1208,11 @@ PHP_FUNCTION(mb_ereg_match)`
`1203`	`1208`	`}`
`1204`	`1209`	`}`
`1205`	`1210`
	`1211`	`+ if (!php_mb_check_encoding(string, string_len,`
	`1212`	`+ _php_mb_regex_mbctype2name(MBREX(current_mbctype)))) {`
	`1213`	`+ RETURN_FALSE;`
	`1214`	`+ }`
	`1215`	`+`
`1206`	`1216`	`if ((re = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, option, MBREX(current_mbctype), syntax)) == NULL) {`
`1207`	`1217`	`RETURN_FALSE;`
`1208`	`1218`	`}`