- Fixed possible crash in mb_ereg_search_init() using empty pattern

diff --git a/NEWS b/NEWS
index 87c5793fcc4aab11f584a7bc9f410c1b8dee39bd..a472c323bbba800d7145b1a7464ab3517b0e07e3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -45,6 +45,7 @@ PHP                                                                        NEWS
 - Mbstring
   . Fixed bug #60306 (Characters lost while converting from cp936 to utf8).
     (Laruence)
+  . Fixed possible crash in mb_ereg_search_init() using empty pattern. (Felipe)
 
 - CLI SAPI:
   . Fixed bug #60159 (Router returns false, but POST is not passed to requested

diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c
index ba71835478749ca00ee532300d3044d93336b54e..d77ff95bfa0a17d6c5702a6e191de5555417ecc2 100644 (file)
--- a/ext/mbstring/php_mbregex.c
+++ b/ext/mbstring/php_mbregex.c
@@ -1245,14 +1245,19 @@ PHP_FUNCTION(mb_ereg_search_init)
 {
        size_t argc = ZEND_NUM_ARGS();
        zval *arg_str;
-       char *arg_pattern, *arg_options;
-       int arg_pattern_len, arg_options_len;
+       char *arg_pattern = NULL, *arg_options = NULL;
+       int arg_pattern_len = 0, arg_options_len = 0;
        OnigSyntaxType *syntax = NULL;
        OnigOptionType option;
 
        if (zend_parse_parameters(argc TSRMLS_CC, "z|ss", &arg_str, &arg_pattern, &arg_pattern_len, &arg_options, &arg_options_len) == FAILURE) {
                return;
        }
+       
+       if (arg_pattern_len == 0) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Empty pattern");
+               RETURN_FALSE;
+       }
 
        option = MBREX(regex_default_options);
        syntax = MBREX(regex_default_syntax);

diff --git a/ext/mbstring/tests/empty_pattern.phpt b/ext/mbstring/tests/empty_pattern.phpt
new file mode 100644 (file)
index 0000000..e395604
--- /dev/null
+++ b/ext/mbstring/tests/empty_pattern.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Check for empty pattern
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+
+mb_ereg_search_init("","","");
+mb_split("","");
+mb_ereg_search_regs();
+
+?>
+--EXPECTF--
+Warning: mb_ereg_search_init(): Empty pattern in %s on line %d
+
+Warning: mb_split(): Empty regular expression in %s on line %d
+
+Warning: mb_ereg_search_regs(): No regex given in %s on line %d