Merge branch 'PHP-5.6' into PHP-7.0

diff --cc NEWS
index cb66a0bd47c60d986eae4ee15ea2187126a4e3d0,49d6c3207e4594a5b6a418822e60a5c8755b41d7..babe2c23b0bf985848a32834938704f359b66aa0
--- 1/NEWS
--- 2/NEWS
+++ b/NEWS
@@@ -71,14 -54,11 +71,16 @@@ PH
      zero-width). (cmb)
    . Fixed bug #72694 (mb_ereg_search_setpos does not accept a string's last
      position). (cmb)
+   . Fixed bug #72710 (`mb_ereg` causes buffer overflow on regexp compile error).
+     (ju1ius)
  
 +- Opcache:
 +  . Fixed bug #72590 (Opcache restart with kill_all_lockers does not work).
 +    (Keyur)
 +
  - PCRE:
    . Fixed bug #72688 (preg_match missing group names in matches). (cmb)
 +  . Upgraded to PCRE 8.39. (Anatol)
  
  - PDO_pgsql:
    . Fixed bug #70313 (PDO statement fails to throw exception). (Matteo)

diff --cc ext/mbstring/php_mbregex.c
index fc0b1d43e2c3a89dac496f72b70d809a5e468d93,7e9756fa158ccfa86d16add842e01188102aebd0..ec1ed1aae057f9553e696364f895a8176accfed9
--- 1/ext/mbstring/php_mbregex.c
--- 2/ext/mbstring/php_mbregex.c
+++ b/ext/mbstring/php_mbregex.c
@@@ -451,11 -453,11 +451,11 @@@ static php_mb_regex_t *php_mbregex_comp
        OnigErrorInfo err_info;
        OnigUChar err_str[ONIG_MAX_ERROR_MESSAGE_LEN];
  
 -      found = zend_hash_find(&MBREX(ht_rc), (char *)pattern, patlen+1, (void **) &rc);
 -      if (found == FAILURE || (*rc)->options != options || (*rc)->enc != enc || (*rc)->syntax != syntax) {
 +      rc = zend_hash_str_find_ptr(&MBREX(ht_rc), (char *)pattern, patlen);
 +      if (!rc || rc->options != options || rc->enc != enc || rc->syntax != syntax) {
                if ((err_code = onig_new(&retval, (OnigUChar *)pattern, (OnigUChar *)(pattern + patlen), options, enc, syntax, &err_info)) != ONIG_NORMAL) {
-                       onig_error_code_to_str(err_str, err_code, err_info);
+                       onig_error_code_to_str(err_str, err_code, &err_info);
 -                      php_error_docref(NULL TSRMLS_CC, E_WARNING, "mbregex compile err: %s", err_str);
 +                      php_error_docref(NULL, E_WARNING, "mbregex compile err: %s", err_str);
                        retval = NULL;
                        goto out;
                }