A multibyte lead byte at the end of a multipart field name made the
scan advance by the full character width past the terminating NUL,
reading out of bounds. Advance byte by byte and stop at the
terminator in both advance sites, as php_mb_rfc1867_substring_conf()
already does.
Closes GH-24498
- Replace bailout on OOM with UnwindExit
- Properly reset various globals that may be accessed during startup
Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Jakub Zelenka <bukka@php.net>
Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com>
Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
Add a hardening assertion that when `mb_wchar_to_uuencode()` needs to update
the length of the previous line, the location being written to is still part of
the same overall output string (i.e. at or after the start of the buffer's
`str`'s value pointer, and before the end of the char array).
The UTF-8 encoder turned surrogate codepoints into 3-byte sequences like
"\xED\xA0\x80", which are not valid UTF-8. Such codepoints come from
UCS-2, UCS-4 or HTML-ENTITIES input, or from mb_decode_numericentity().
Since mbstring marks the UTF-8 strings it returns as valid UTF-8,
functions that trust that flag, like mb_check_encoding(), mb_scrub() or
preg_match(), accepted them too.
Surrogates are now replaced by the substitute character, as codepoints
above U+10FFFF already are. The internal mode used by mb_strpos() and
similar functions still encodes them, so that different surrogates don't
match each other.
offset_to_pointer_utf8() walks the haystack using the UTF-8 mblen table.
For a truncated multibyte sequence, the lead byte's table entry can exceed
the remaining bytes and leave the search start pointer past the end.
Passing that pointer to zend_memnstr() triggers an assertion in debug
builds and an out-of-bounds read in release builds, producing bogus
offsets or a crash for sufficiently long haystacks.
Clamp the pointer to the end of the string, as mb_str_split() already does
for the same table walk. Add regression coverage for forward and reverse
searches, negative offsets, and offsets beyond the haystack.
Fixes GH-23106.
Closes#23107
Headers required by the generated code (zend_attributes.h, zend_constants.h, zend_enum.h) are collected during generation and emitted as includes at the top of the arginfo file, with the same preprocessor conditions and PHP version guards as the code that needs them.
Removes the manual zend_attributes.h and zend_enum.h includes from sources that only needed them for the arginfo file they include.
When a \k<name> backref in an mb_ereg_replace() replacement string lacks
its closing delimiter, the error path computed p = name_end + 1 past eos
and copied the trailing NUL terminator into the output; the multibyte
sibling path (p += clen after \k) could overshoot eos and read heap bytes
past the string. Both paths are now clamped to eos so verbatim fallback
never copies beyond the parsed name.
Closes GH-23499
mb_find_strpos() converts the haystack and needle to UTF-8 and does the length and offset math on the converted strings.
The negative-offset branch computed the needle length from the raw needle instead of needle_u8.
mb_fast_strlen_utf8() reads those bytes as UTF-8, so the count is wrong whenever they do not decode one to one.
A byte in 0x80-0xBF (ISO-8859-1) undercounts, and a wider encoding such as an ASCII needle in UTF-16 overcounts, so the reverse-search window is shifted.
Use needle_u8, the converted needle the rest of the branch already searches with.
A header field name with no value (input ending at the colon) leaves
fld_name allocated but unreleased, since the cleanup blocks only fire
when both fld_name and fld_val are set. Release the dangling fld_name in
both the loop-body and end-of-input branches.
Closes GH-22254
Arnaud Le Blanc