diff --git a/NEWS b/NEWS index f2c17a45365..1fa196547d7 100644 --- a/NEWS +++ b/NEWS @@ -37,6 +37,9 @@ PHP NEWS - OpenSSL: . Fixed stub for openssl_csr_new. (Jakub Zelenka) +- PCRE: + . Fixed GH-16189 (underflow on offset argument). (David Carlier) + - PHPDBG: . Fixed bug GH-15901 (phpdbg: Assertion failure on i funcs). (cmb) . Fixed bug GH-16181 (phpdbg: exit in exception handler reports fatal error). diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c index ea5e6a01ff0..4511d611d7a 100644 --- a/ext/pcre/php_pcre.c +++ b/ext/pcre/php_pcre.c @@ -1135,6 +1135,11 @@ static void php_do_pcre_match(INTERNAL_FUNCTION_PARAMETERS, int global) /* {{{ * RETURN_FALSE; } + if (start_offset == ZEND_LONG_MIN) { + zend_argument_value_error(5, "must be greater than " ZEND_LONG_FMT, ZEND_LONG_MIN); + RETURN_THROWS(); + } + pce->refcount++; php_pcre_match_impl(pce, subject, return_value, subpats, global, ZEND_NUM_ARGS() >= 4, flags, start_offset); diff --git a/ext/pcre/tests/gh16189.phpt b/ext/pcre/tests/gh16189.phpt new file mode 100644 index 00000000000..c77ab7699ee --- /dev/null +++ b/ext/pcre/tests/gh16189.phpt @@ -0,0 +1,19 @@ +--TEST-- +GH-16189 (preg_match/preg_match_all underflow on start_offset argument) +--FILE-- +/', '
', $matches, 0, PHP_INT_MIN); +} catch (\ValueError $e) { + echo $e->getMessage() . PHP_EOL; +} +try { + preg_match_all( '/<(\w+)[\s\w\-]+ id="S44_i89ew">/', '
', $matches, 0, PHP_INT_MIN); +} catch (\ValueError $e) { + echo $e->getMessage() . PHP_EOL; +} +?> +--EXPECTF-- +preg_match(): Argument #5 ($offset) must be greater than %s +preg_match_all(): Argument #5 ($offset) must be greater than %s