mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-23 01:44:06 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.3' into PHP-8.4

Browse Source 
* PHP-8.3:
  Fix GH-16184: UBSan address overflowed in ext/pcre/php_pcre.c
This commit is contained in:
Niels Dossche 2024-10-03 21:12:42 +02:00
commit 5839fc5dd9
No known key found for this signature in database
GPG Key ID: B8A8AD166DF0E2E5
3 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@ -58,6 +58,10 @@ PHP NEWS
. Fixed bug GH-16009 (Segmentation fault with frameless functions and
undefined CVs). (nielsdos)
- PCRE:
. Fixed bug GH-16184 (UBSan address overflowed in ext/pcre/php_pcre.c).
(nielsdos)
- PHPDBG:
. Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).
(cmb)

6
ext/pcre/php_pcre.c
View File

@ -1754,8 +1754,10 @@ matched:
}
if (preg_get_backref(&walk, &backref)) {
if (backref < count) {
match_len = offsets[(backref<<1)+1] - offsets[backref<<1];
walkbuf = zend_mempcpy(walkbuf, subject + offsets[backref << 1], match_len);
if (offsets[backref<<1] < SIZE_MAX) {
match_len = offsets[(backref<<1)+1] - offsets[backref<<1];
walkbuf = zend_mempcpy(walkbuf, subject + offsets[backref << 1], match_len);
}
}
continue;
}

13
ext/pcre/tests/gh16184.phpt Normal file
View File

@ -0,0 +1,13 @@
--TEST--
GH-16184 (UBSan address overflowed in ext/pcre/php_pcre.c)
--CREDITS--
YuanchengJiang
--FILE--
<?php
$string = 'This is a string. It contains numbers (0*9) as well as parentheses and some other things!';
echo preg_replace(array('/\b\w{1}s/', '/(\d{1})*(\d{1})/', '/[\(!\)]/'), array('test', '$1 to $2', '*'), $string), "\n";
?>
--EXPECT--
This test a string. It contains numbers * to 0* to 9* test well test parentheses and some other things*