Commit f453d1a

committed

Fix GH-16189: underflow on preg_match/preg_match_all start_offset.

1 parent f14e5cf commit f453d1aCopy full SHA for f453d1a

File tree

+27

-0

lines changed

+27

-0

lines changed

Lines changed: 3 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,9 @@ PHP NEWS`
`37`	`37`	`- OpenSSL:`
`38`	`38`	`. Fixed stub for openssl_csr_new. (Jakub Zelenka)`
`39`	`39`
	`40`	`+- PCRE:`
	`41`	`+ . Fixed GH-16189 (underflow on offset argument). (David Carlier)`
	`42`	`+`
`40`	`43`	`- PHPDBG:`
`41`	`44`	`. Fixed bug GH-15901 (phpdbg: Assertion failure on i funcs). (cmb)`
`42`	`45`	`. Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error).`

Lines changed: 5 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -1135,6 +1135,11 @@ static void php_do_pcre_match(INTERNAL_FUNCTION_PARAMETERS, int global) /* {{{ *`
`1135`	`1135`	`RETURN_FALSE;`
`1136`	`1136`	`}`
`1137`	`1137`
	`1138`	`+ if (start_offset == ZEND_LONG_MIN) {`
	`1139`	`+ zend_argument_value_error(5, "must be greater than " ZEND_LONG_FMT, ZEND_LONG_MIN);`
	`1140`	`+ RETURN_THROWS();`
	`1141`	`+ }`
	`1142`	`+`
`1138`	`1143`	`pce->refcount++;`
`1139`	`1144`	`php_pcre_match_impl(pce, subject, return_value, subpats,`
`1140`	`1145`	`global, ZEND_NUM_ARGS() >= 4, flags, start_offset);`

Lines changed: 19 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,19 @@`
	`1`	`+--TEST--`
	`2`	`+GH-16189 (preg_match/preg_match_all underflow on start_offset argument)`
	`3`	`+--FILE--`
	`4`	`+<?php`
	`5`	`+`
	`6`	`+try {`
	`7`	`+ preg_match( '/<(\w+)[\s\w\-]+ id="S44_i89ew">/', '<br><div id="S44_i89ew">', $matches, 0, PHP_INT_MIN);`
	`8`	`+} catch (\ValueError $e) {`
	`9`	`+ echo $e->getMessage() . PHP_EOL;`
	`10`	`+}`
	`11`	`+try {`
	`12`	`+ preg_match_all( '/<(\w+)[\s\w\-]+ id="S44_i89ew">/', '<br><div id="S44_i89ew">', $matches, 0, PHP_INT_MIN);`
	`13`	`+} catch (\ValueError $e) {`
	`14`	`+ echo $e->getMessage() . PHP_EOL;`
	`15`	`+}`
	`16`	`+?>`
	`17`	`+--EXPECTF--`
	`18`	`+preg_match(): Argument #5 ($offset) must be greater than %s`
	`19`	`+preg_match_all(): Argument #5 ($offset) must be greater than %s`

Comments

(0)