archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.4'

Browse source 
* PHP-8.4:
  Fix GH-18901: integer overflow mb_split
This commit is contained in:
Niels Dossche 2025-06-22 13:09:09 +02:00
commit b727821c79
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
2 changed files with 55 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
ext/mbstring/php_mbregex.c
View file

@ -1178,7 +1178,7 @@ PHP_FUNCTION(mb_split)
size_t string_len;
int err;
zend_long count = -1;
zend_ulong count = -1; /* unsigned, it's a limit and we want to prevent signed overflow */
if (zend_parse_parameters(ZEND_NUM_ARGS(), "ss|l", &arg_pattern, &arg_pattern_len, &string, &string_len, &count) == FAILURE) {
RETURN_THROWS();

54
ext/mbstring/tests/gh18901.phpt Normal file
View file

@ -0,0 +1,54 @@
--TEST--
GH-18901 (integer overflow mb_split)
--EXTENSIONS--
mbstring
--SKIPIF--
<?php
if (!function_exists('mb_split')) die('skip mb_split() not available');
?>
--FILE--
<?php
$vals = [PHP_INT_MIN, PHP_INT_MAX, -1, 0, 1];
foreach ($vals as $val) {
var_dump(mb_split('\d', '123', $val));
}
?>
--EXPECT--
array(4) {
[0]=>
string(0) ""
[1]=>
string(0) ""
[2]=>
string(0) ""
[3]=>
string(0) ""
}
array(4) {
[0]=>
string(0) ""
[1]=>
string(0) ""
[2]=>
string(0) ""
[3]=>
string(0) ""
}
array(4) {
[0]=>
string(0) ""
[1]=>
string(0) ""
[2]=>
string(0) ""
[3]=>
string(0) ""
}
array(1) {
[0]=>
string(3) "123"
}
array(1) {
[0]=>
string(3) "123"
}