Fixed bug #77514

diff --git a/NEWS b/NEWS
index ca3bcc7f0e902509a12a5532b0c72045bad9ff33..5f32b5a924639270fa91347e61332882682d539e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,10 +1,15 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.3
--Core:
+
+- Core:
   . Fixed bug #77494 (Disabling class causes segfault on member access).
     (Dmitry)
 
+- Mbstring:
+  . Fixed bug #77514 (mb_ereg_replace() with trailing backslash adds null byte).
+    (Nikita)
+
 - Opcache:
   . Fixed bug #77287 (Opcache literal compaction is incompatible with EXT
     opcodes). (Nikita)

diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c
index cc96e04f39f618682817b5578a54c27b39633d5b..319ee567c631f32daea065233c48c7dd602ba4ca 100644 (file)
--- a/ext/mbstring/php_mbregex.c
+++ b/ext/mbstring/php_mbregex.c
@@ -713,8 +713,7 @@ static inline void mb_regex_substitute(
                sp = p; /* save position */
                clen = (int) php_mb_mbchar_bytes_ex(++p, enc);
                if (clen != 1 || p == eos) {
-                       /* skip escaped multibyte char */
-                       p += clen;
+                       /* skip backslash followed by multibyte char */
                        smart_str_appendl(pbuf, sp, p - sp);
                        continue;
                }

diff --git a/ext/mbstring/tests/bug77514.phpt b/ext/mbstring/tests/bug77514.phpt
new file mode 100644 (file)
index 0000000..efcbea2
--- /dev/null
+++ b/ext/mbstring/tests/bug77514.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #77514: mb_ereg_replace() with trailing backslash adds null byte
+--FILE--
+<?php
+
+$a="abc123";
+var_dump(mb_ereg_replace("123","def\\",$a));
+
+?>
+--EXPECT--
+string(7) "abcdef\"