diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c index 2545320ea2f..fcf4c45f26b 100644 --- a/ext/pcre/php_pcre.c +++ b/ext/pcre/php_pcre.c @@ -1124,6 +1124,11 @@ static void php_do_pcre_match(INTERNAL_FUNCTION_PARAMETERS, bool global) /* {{{ RETURN_FALSE; } + if (start_offset == ZEND_LONG_MIN) { + zend_argument_value_error(5, "must be greater than " ZEND_LONG_FMT, ZEND_LONG_MIN); + RETURN_THROWS(); + } + pce->refcount++; php_pcre_match_impl(pce, subject, return_value, subpats, global, flags, start_offset); diff --git a/ext/pcre/tests/gh16189.phpt b/ext/pcre/tests/gh16189.phpt new file mode 100644 index 00000000000..c77ab7699ee --- /dev/null +++ b/ext/pcre/tests/gh16189.phpt @@ -0,0 +1,19 @@ +--TEST-- +GH-16189 (preg_match/preg_match_all underflow on start_offset argument) +--FILE-- +/', '
', $matches, 0, PHP_INT_MIN); +} catch (\ValueError $e) { + echo $e->getMessage() . PHP_EOL; +} +try { + preg_match_all( '/<(\w+)[\s\w\-]+ id="S44_i89ew">/', '
', $matches, 0, PHP_INT_MIN); +} catch (\ValueError $e) { + echo $e->getMessage() . PHP_EOL; +} +?> +--EXPECTF-- +preg_match(): Argument #5 ($offset) must be greater than %s +preg_match_all(): Argument #5 ($offset) must be greater than %s