Check remaining pattern length in str_lower_case_match

A text character can case-fold to more bytes than remain in the
pattern, e.g. U+00DF folds to "ss" against /s/i.  Such a character
cannot match, so stop there instead of comparing beyond the pattern.

Reported-by: Paul Ryan (https://hackerone.com/secpaul)
Co-Authored-By: Claude Mythos 5.1 <noreply@anthropic.com>
This commit is contained in:
Yusuke EndohandClaude Mythos 5.1 committed 2026-10-28 01:48:57 +09:00
1 parent 33ac6afea7
commit 93c45a96b5
2 files changed
+5
Notes: git 2026-10-27 16:49:32 +00:00

No files matched your search

+1
View File
@@ -4284,6 +4284,7 @@ str_lower_case_match(OnigEncoding enc, int case_fold_flag,
while (t < tend) {
lowlen = ONIGENC_MBC_CASE_FOLD(enc, case_fold_flag, &p, end, lowbuf);
if (tend - t < lowlen) return 0;
q = lowbuf;
while (lowlen > 0) {
if (*t++ != *q++) return 0;
+4
View File
@@ -1466,6 +1466,10 @@ class TestRegexp < Test::Unit::TestCase
assert_match(/^\u00df$/i, "ss")
#assert_match(/^(\u00df)\1$/i, "\u00dfss") # this must be bug...
assert_match(/^\u00df{2}$/i, "\u00dfss")
assert_no_match(/s/i, "\u00df")
assert_no_match(/is/i, "i\u00df")
assert_no_match(/f/i, "\ufb03")
assert_match(/ss/i, "\u00df")
assert_match(/^\u00c5$/i, "\u00c5")
assert_match(/^\u00c5$/i, "\u00e5")
assert_match(/^\u00c5$/i, "\u212b")