Fix #79149: SEGV in mb_convert_encoding with non-string encodings

We must not assume that `hash_entry` `IS_STRING`, but rather use
`encoding_str` which is guaranteed to be.

diff --git a/NEWS b/NEWS
index 2f59ce7987dd72a20e4cd76b840e0fd8e135b552..3b7b792db8dabb6e5a5ca56fd0ebf91e8bc8d667 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,10 @@ PHP                                                                        NEWS
   . Fixed bug #79112 (IMAP extension can't find OpenSSL libraries at configure
     time). (Nikita)
 
+- MBString:
+  . Fixed bug #79149 (SEGV in mb_convert_encoding with non-string encodings).
+    (cmb)
+
 - MySQLnd:
   . Fixed bug #79084 (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH).
     (cmb)

diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index a18d237df29a35c44827e63d88f17ff1fa6ed8cd..c0ba05cba38d83515046e4f72dc9b49bd4f12f15 100644 (file)
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -3369,12 +3369,12 @@ PHP_FUNCTION(mb_convert_encoding)
 
                                        if ( _from_encodings) {
                                                l = strlen(_from_encodings);
-                                               n = strlen(Z_STRVAL_P(hash_entry));
+                                               n = strlen(ZSTR_VAL(encoding_str));
                                                _from_encodings = erealloc(_from_encodings, l+n+2);
                                                memcpy(_from_encodings + l, ",", 1);
-                                               memcpy(_from_encodings + l + 1, Z_STRVAL_P(hash_entry), Z_STRLEN_P(hash_entry) + 1);
+                                               memcpy(_from_encodings + l + 1, ZSTR_VAL(encoding_str), ZSTR_LEN(encoding_str) + 1);
                                        } else {
-                                               _from_encodings = estrdup(Z_STRVAL_P(hash_entry));
+                                               _from_encodings = estrdup(ZSTR_VAL(encoding_str));
                                        }
                                        zend_string_release(encoding_str);
                                } ZEND_HASH_FOREACH_END();

diff --git a/ext/mbstring/tests/bug79149.phpt b/ext/mbstring/tests/bug79149.phpt
new file mode 100644 (file)
index 0000000..fc3751d
--- /dev/null
+++ b/ext/mbstring/tests/bug79149.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #79149 (SEGV in mb_convert_encoding with non-string encodings)
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+?>
+--FILE--
+<?php
+var_dump(mb_convert_encoding("", "UTF-8", [0]));
+var_dump(mb_convert_encoding('foo', 'UTF-8', array(['bar'], ['baz'])));
+?>
+--EXPECTF--
+Warning: mb_convert_encoding(): Illegal character encoding specified in %s on line %d
+string(0) ""
+
+Notice: Array to string conversion in %s on line %d
+
+Notice: Array to string conversion in %s on line %d
+
+Warning: mb_convert_encoding(): Illegal character encoding specified in %s on line %d
+string(3) "foo"