Skip to content

Fix GH-24769: mb_ereg_replace() over-read on truncated trailing character - #24772

Open
lazerg wants to merge 1 commit into
php:PHP-8.4from
lazerg:fix/gh-24769-mbregex-substitute-overread
Open

lazerg wants to merge 1 commit into
php:PHP-8.4from
lazerg:fix/gh-24769-mbregex-substitute-overread

Conversation

@lazerg

@lazerg lazerg commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

mb_regex_substitute() copied every ordinary character of the replacement string using the full width php_mb_mbchar_bytes() reports for its lead byte. When the replacement ends with a truncated multibyte character (e.g. "x\xF0" in UTF-8), that copied bytes past the end of the string into the result. This clamps the copy to the end of the string, the same way the \k paths in this function already do since GH-23499.

Fixes #24769

@iliaal iliaal left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks right, thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants