Skip to content

Commit 66c35b0

Browse files
smalyshevsmalyshev
committed
Merge branch 'PHP-7.2' into PHP-7.3
* PHP-7.2: Validate subject encoding in mb_split and mb_ereg_match Validate pattern against mbregex encoding SQLite3: add DEFENSIVE config for SQLite >= 3.26.0 as a mitigation strategy against potential security flaws
2 parents 62a652a + 402adc1 commit 66c35b0

File tree

8 files changed

+29
-23
lines changed

8 files changed

+29
-23
lines changed

‎ext/mbstring/php_mbregex.c‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -445,13 +445,18 @@ static php_mb_regex_t *php_mbregex_compile_pattern(const char *pattern, size_t p
445445
OnigErrorInfo err_info;
446446
OnigUChar err_str[ONIG_MAX_ERROR_MESSAGE_LEN];
447447

448+
if (!php_mb_check_encoding(pattern, patlen, _php_mb_regex_mbctype2name(enc))) {
449+
php_error_docref(NULL, E_WARNING,
450+
"Pattern is not valid under %s encoding", _php_mb_regex_mbctype2name(enc));
451+
return NULL;
452+
}
453+
448454
rc = zend_hash_str_find_ptr(&MBREX(ht_rc), (char *)pattern, patlen);
449455
if (!rc || onig_get_options(rc) != options || onig_get_encoding(rc) != enc || onig_get_syntax(rc) != syntax) {
450456
if ((err_code = onig_new(&retval, (OnigUChar *)pattern, (OnigUChar *)(pattern + patlen), options, enc, syntax, &err_info)) != ONIG_NORMAL) {
451457
onig_error_code_to_str(err_str, err_code, &err_info);
452458
php_error_docref(NULL, E_WARNING, "mbregex compile err: %s", err_str);
453-
retval = NULL;
454-
goto out;
459+
return NULL;
455460
}
456461
if (rc == MBREX(search_re)) {
457462
/* reuse the new rc? see bug #72399 */
@@ -461,7 +466,6 @@ static php_mb_regex_t *php_mbregex_compile_pattern(const char *pattern, size_t p
461466
} else {
462467
retval = rc;
463468
}
464-
out:
465469
return retval;
466470
}
467471
/* }}} */
@@ -1249,6 +1253,11 @@ PHP_FUNCTION(mb_split)
12491253
count--;
12501254
}
12511255

1256+
if (!php_mb_check_encoding(string, string_len,
1257+
_php_mb_regex_mbctype2name(MBREX(current_mbctype)))) {
1258+
RETURN_FALSE;
1259+
}
1260+
12521261
/* create regex pattern buffer */
12531262
if ((re = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, MBREX(regex_default_options), MBREX(current_mbctype), MBREX(regex_default_syntax))) == NULL) {
12541263
RETURN_FALSE;
@@ -1338,6 +1347,11 @@ PHP_FUNCTION(mb_ereg_match)
13381347
}
13391348
}
13401349

1350+
if (!php_mb_check_encoding(string, string_len,
1351+
_php_mb_regex_mbctype2name(MBREX(current_mbctype)))) {
1352+
RETURN_FALSE;
1353+
}
1354+
13411355
if ((re = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, option, MBREX(current_mbctype), syntax)) == NULL) {
13421356
RETURN_FALSE;
13431357
}

‎ext/mbstring/tests/bug72994.phpt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,6 @@ var_dump($var1);
1414
--EXPECTF--
1515
Notice: Undefined variable: var in %s on line %d
1616

17-
Warning: mb_ereg_replace(): mbregex compile err: invalid code point value in %sbug72994.php on line %d
17+
Warning: mb_ereg_replace(): Pattern is not valid under UTF-8 encoding in %sbug72994.php on line %d
1818
bool(false)
1919
===DONE===

‎ext/mbstring/tests/bug77367.phpt‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,5 @@ var_dump(mb_split("\\w", "\xfc"));
1212
?>
1313
===DONE===
1414
--EXPECT--
15-
array(2) {
16-
[0]=>
17-
string(0) ""
18-
[1]=>
19-
string(0) ""
20-
}
15+
bool(false)
2116
===DONE===

‎ext/mbstring/tests/bug77370.phpt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,5 @@ Bug #77370 (Buffer overflow on mb regex functions - fetch_token)
77
var_dump(mb_split(" \xfd",""));
88
?>
99
--EXPECTF--
10-
Warning: mb_split(): mbregex compile err: invalid code point value in %sbug77370.php on line %d
10+
Warning: mb_split(): Pattern is not valid under UTF-8 encoding in %s on line %d
1111
bool(false)

‎ext/mbstring/tests/bug77371.phpt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,5 @@ Bug #77371 (heap buffer overflow in mb regex functions - compile_string_node)
77
var_dump(mb_ereg("()0\xfc00000\xfc00000\xfc00000\xfc",""));
88
?>
99
--EXPECTF--
10-
Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77371.php on line %d
10+
Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
1111
bool(false)

‎ext/mbstring/tests/bug77381.phpt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,14 @@ var_dump(mb_ereg("0000\\"."\xf5","0"));
1010
var_dump(mb_ereg("(?i)FFF00000000000000000\xfd",""));
1111
?>
1212
--EXPECTF--
13-
Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
13+
Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
1414
bool(false)
1515

16-
Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
16+
Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
1717
bool(false)
1818

19-
Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
19+
Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
2020
bool(false)
2121

22-
Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
22+
Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
2323
bool(false)

‎ext/mbstring/tests/bug77418.phpt‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
--TEST--
2-
Bug #77371 (Heap overflow in utf32be_mbc_to_code)
2+
Bug #77418 (Heap overflow in utf32be_mbc_to_code)
33
--SKIPIF--
44
<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
55
--FILE--
@@ -8,7 +8,4 @@ mb_regex_encoding("UTF-32");
88
var_dump(mb_split("\x00\x00\x00\x5c\x00\x00\x00B","000000000000000000000000000000"));
99
?>
1010
--EXPECT--
11-
array(1) {
12-
[0]=>
13-
string(30) "000000000000000000000000000000"
14-
}
11+
bool(false)

‎ext/mbstring/tests/mb_ereg_replace_variation1.phpt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,15 +110,15 @@ string(10) "string_val"
110110

111111
-- Iteration 4 --
112112

113-
Warning: mb_ereg_replace(): mbregex compile err: invalid code point value in %smb_ereg_replace_variation1.php on line %d
113+
Warning: mb_ereg_replace(): Pattern is not valid under UTF-8 encoding in %s on line %d
114114
bool(false)
115115

116116
-- Iteration 5 --
117117
string(10) "string_val"
118118

119119
-- Iteration 6 --
120120

121-
Warning: mb_ereg_replace(): mbregex compile err: invalid code point value in %smb_ereg_replace_variation1.php on line %d
121+
Warning: mb_ereg_replace(): Pattern is not valid under UTF-8 encoding in %s on line %d
122122
bool(false)
123123

124124
-- Iteration 7 --

0 commit comments

Comments
 (0)