php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source 
* PHP-8.4:
  Fix GH-16184: UBSan address overflowed in ext/pcre/php_pcre.c
This commit is contained in:
Niels Dossche
2024-10-03 21:13:13 +02:00
parent dbcc77d0c2 5839fc5dd9
commit 0624eb4118
2 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ext/pcre/php_pcre.c
View File

@@ -1754,8 +1754,10 @@ matched:
}
if (preg_get_backref(&walk, &backref)) {
if (backref < count) {
match_len = offsets[(backref<<1)+1] - offsets[backref<<1];
walkbuf = zend_mempcpy(walkbuf, subject + offsets[backref << 1], match_len);
if (offsets[backref<<1] < SIZE_MAX) {
match_len = offsets[(backref<<1)+1] - offsets[backref<<1];
walkbuf = zend_mempcpy(walkbuf, subject + offsets[backref << 1], match_len);
}
}
continue;
}

13
ext/pcre/tests/gh16184.phpt Normal file
View File

@@ -0,0 +1,13 @@
--TEST--
GH-16184 (UBSan address overflowed in ext/pcre/php_pcre.c)
--CREDITS--
YuanchengJiang
--FILE--
<?php
$string = 'This is a string. It contains numbers (0*9) as well as parentheses and some other things!';
echo preg_replace(array('/\b\w{1}s/', '/(\d{1})*(\d{1})/', '/[\(!\)]/'), array('test', '$1 to $2', '*'), $string), "\n";
?>
--EXPECT--
This test a string. It contains numbers * to 0* to 9* test well test parentheses and some other things*