mirror of
https://github.com/php/php-src.git
synced 2026-10-28 17:56:50 +08:00
Yudai Takada
75f4e8d207
zend_multibyte_detect_utf_encoding() previously advanced the search position by four bytes after each NUL while looking for UTF-32-specific byte orders. When fewer than three bytes remained, the search length underflowed and allowed memchr() to read past the script buffer. Track search positions as offsets and only call memchr() while at least three bytes remain. This also avoids advancing a pointer beyond the script buffer and prevents BOM-less UTF-16 input from being misdetected as UTF-32. Closes #23527