Skip to content

Commit 402adc1

Browse files
smalyshevsmalyshev
committed
Merge branch 'PHP-7.1' into PHP-7.2
* PHP-7.1: Validate subject encoding in mb_split and mb_ereg_match Validate pattern against mbregex encoding SQLite3: add DEFENSIVE config for SQLite >= 3.26.0 as a mitigation strategy against potential security flaws
2 parents b7442f1 + 0ecac37 commit 402adc1

File tree

7 files changed

+28
-17
lines changed

7 files changed

+28
-17
lines changed

‎ext/mbstring/php_mbregex.c‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -448,13 +448,18 @@ static php_mb_regex_t *php_mbregex_compile_pattern(const char *pattern, int patl
448448
OnigErrorInfo err_info;
449449
OnigUChar err_str[ONIG_MAX_ERROR_MESSAGE_LEN];
450450

451+
if (!php_mb_check_encoding(pattern, patlen, _php_mb_regex_mbctype2name(enc))) {
452+
php_error_docref(NULL, E_WARNING,
453+
"Pattern is not valid under %s encoding", _php_mb_regex_mbctype2name(enc));
454+
return NULL;
455+
}
456+
451457
rc = zend_hash_str_find_ptr(&MBREX(ht_rc), (char *)pattern, patlen);
452458
if (!rc || onig_get_options(rc) != options || onig_get_encoding(rc) != enc || onig_get_syntax(rc) != syntax) {
453459
if ((err_code = onig_new(&retval, (OnigUChar *)pattern, (OnigUChar *)(pattern + patlen), options, enc, syntax, &err_info)) != ONIG_NORMAL) {
454460
onig_error_code_to_str(err_str, err_code, &err_info);
455461
php_error_docref(NULL, E_WARNING, "mbregex compile err: %s", err_str);
456-
retval = NULL;
457-
goto out;
462+
return NULL;
458463
}
459464
if (rc == MBREX(search_re)) {
460465
/* reuse the new rc? see bug #72399 */
@@ -464,7 +469,6 @@ static php_mb_regex_t *php_mbregex_compile_pattern(const char *pattern, int patl
464469
} else {
465470
retval = rc;
466471
}
467-
out:
468472
return retval;
469473
}
470474
/* }}} */
@@ -1107,6 +1111,11 @@ PHP_FUNCTION(mb_split)
11071111
count--;
11081112
}
11091113

1114+
if (!php_mb_check_encoding(string, string_len,
1115+
_php_mb_regex_mbctype2name(MBREX(current_mbctype)))) {
1116+
RETURN_FALSE;
1117+
}
1118+
11101119
/* create regex pattern buffer */
11111120
if ((re = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, MBREX(regex_default_options), MBREX(current_mbctype), MBREX(regex_default_syntax))) == NULL) {
11121121
RETURN_FALSE;
@@ -1196,6 +1205,11 @@ PHP_FUNCTION(mb_ereg_match)
11961205
}
11971206
}
11981207

1208+
if (!php_mb_check_encoding(string, string_len,
1209+
_php_mb_regex_mbctype2name(MBREX(current_mbctype)))) {
1210+
RETURN_FALSE;
1211+
}
1212+
11991213
if ((re = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, option, MBREX(current_mbctype), syntax)) == NULL) {
12001214
RETURN_FALSE;
12011215
}

‎ext/mbstring/tests/bug72994.phpt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,6 @@ var_dump($var1);
1414
--EXPECTF--
1515
Notice: Undefined variable: var in %s on line %d
1616

17-
Warning: mbereg_replace(): mbregex compile err: invalid code point value in %sbug72994.php on line %d
17+
Warning: mbereg_replace(): Pattern is not valid under UTF-8 encoding in %s on line %d
1818
bool(false)
1919
===DONE===

‎ext/mbstring/tests/bug77370.phpt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,5 @@ Bug #77370 (Buffer overflow on mb regex functions - fetch_token)
77
var_dump(mb_split(" \xfd",""));
88
?>
99
--EXPECTF--
10-
Warning: mb_split(): mbregex compile err: invalid code point value in %sbug77370.php on line %d
10+
Warning: mb_split(): Pattern is not valid under UTF-8 encoding in %s on line %d
1111
bool(false)

‎ext/mbstring/tests/bug77371.phpt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,5 @@ Bug #77371 (heap buffer overflow in mb regex functions - compile_string_node)
77
var_dump(mb_ereg("()0\xfc00000\xfc00000\xfc00000\xfc",""));
88
?>
99
--EXPECTF--
10-
Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77371.php on line %d
10+
Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
1111
bool(false)

‎ext/mbstring/tests/bug77381.phpt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,14 @@ var_dump(mb_ereg("0000\\"."\xf5","0"));
1010
var_dump(mb_ereg("(?i)FFF00000000000000000\xfd",""));
1111
?>
1212
--EXPECTF--
13-
Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
13+
Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
1414
bool(false)
1515

16-
Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
16+
Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
1717
bool(false)
1818

19-
Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
19+
Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
2020
bool(false)
2121

22-
Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
22+
Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
2323
bool(false)

‎ext/mbstring/tests/bug77418.phpt‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
--TEST--
2-
Bug #77371 (Heap overflow in utf32be_mbc_to_code)
2+
Bug #77418 (Heap overflow in utf32be_mbc_to_code)
33
--SKIPIF--
44
<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
55
--FILE--
@@ -8,7 +8,4 @@ mb_regex_encoding("UTF-32");
88
var_dump(mb_split("\x00\x00\x00\x5c\x00\x00\x00B","000000000000000000000000000000"));
99
?>
1010
--EXPECT--
11-
array(1) {
12-
[0]=>
13-
string(30) "000000000000000000000000000000"
14-
}
11+
bool(false)

‎ext/mbstring/tests/mb_ereg_replace_variation1.phpt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,15 +110,15 @@ string(10) "string_val"
110110

111111
-- Iteration 4 --
112112

113-
Warning: mb_ereg_replace(): mbregex compile err: invalid code point value in %smb_ereg_replace_variation1.php on line %d
113+
Warning: mb_ereg_replace(): Pattern is not valid under UTF-8 encoding in %s on line %d
114114
bool(false)
115115

116116
-- Iteration 5 --
117117
string(10) "string_val"
118118

119119
-- Iteration 6 --
120120

121-
Warning: mb_ereg_replace(): mbregex compile err: invalid code point value in %smb_ereg_replace_variation1.php on line %d
121+
Warning: mb_ereg_replace(): Pattern is not valid under UTF-8 encoding in %s on line %d
122122
bool(false)
123123

124124
-- Iteration 7 --

0 commit comments

Comments
 (0)