Skip to content

Commit a33be66

Browse files
committed
Fix segfault in mb_strrpos/mb_strripos with ASCII encoding and negative offset
We're setting the encoding from PHP_FUNCTION(mb_strpos), but mbfl_strpos would discard it, setting it to mbfl_encoding_pass, making zend_memnrstr fail due to a null-pointer exception. Fixes GH-11217
1 parent 6692477 commit a33be66

File tree

2 files changed

+14
-2
lines changed

2 files changed

+14
-2
lines changed

ext/mbstring/libmbfl/mbfl/mbfilter.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -594,7 +594,7 @@ mbfl_strpos(
594594
const unsigned char *offset_pointer;
595595

596596
if (haystack->encoding->no_encoding != mbfl_no_encoding_utf8) {
597-
mbfl_string_init(&_haystack_u8);
597+
mbfl_string_init_set(&_haystack_u8, haystack->encoding);
598598
haystack_u8 = mbfl_convert_encoding(haystack, &_haystack_u8, &mbfl_encoding_utf8);
599599
if (haystack_u8 == NULL) {
600600
result = MBFL_ERROR_ENCODING;
@@ -605,7 +605,7 @@ mbfl_strpos(
605605
}
606606

607607
if (needle->encoding->no_encoding != mbfl_no_encoding_utf8) {
608-
mbfl_string_init(&_needle_u8);
608+
mbfl_string_init_set(&_needle_u8, needle->encoding);
609609
needle_u8 = mbfl_convert_encoding(needle, &_needle_u8, &mbfl_encoding_utf8);
610610
if (needle_u8 == NULL) {
611611
result = MBFL_ERROR_ENCODING;

ext/mbstring/tests/gh11217.phpt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
--TEST--
2+
GH-11217: Segfault in mb_strrpos/mb_strripos with ASCII encoding and negative offset
3+
--EXTENSIONS--
4+
mbstring
5+
--FILE--
6+
<?php
7+
var_dump(mb_strrpos('foo', 'foo', -1, 'ASCII'));
8+
var_dump(mb_strripos('foo', 'foo', -1, 'ASCII'));
9+
?>
10+
--EXPECT--
11+
int(0)
12+
int(0)

0 commit comments

Comments
 (0)