From: Christoph M. Becker <cmb@php.net>
Date: Thu, 28 Jul 2016 11:56:40 +0000 (+0200)
Subject: Fix #72693: mb_ereg_search increments search position when a match zero-width
X-Git-Tag: php-7.0.10RC1~25^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=56cdaecb284b2b292ce1ecb076c1f8b041e47a02;p=php

Fix #72693: mb_ereg_search increments search position when a match zero-width

That's caused by an off-by-one error, which we fix.
---

diff --git a/NEWS b/NEWS
index 962be02581..7a0e890869 100644
--- a/NEWS
+++ b/NEWS
@@ -44,6 +44,8 @@ PHP                                                                        NEWS
 - mbstring:
   . Fixed bug #72691 (mb_ereg_search raises a warning if a match zero-width).
     (cmb)
+  . Fixed Bug #72693 (mb_ereg_search increments search position when a match
+    zero-width). (cmb)
 
 - PCRE:
   . Fixed bug #72688 (preg_match missing group names in matches). (cmb)
diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c
index 3509165ca9..a295f54e4e 100644
--- a/ext/mbstring/php_mbregex.c
+++ b/ext/mbstring/php_mbregex.c
@@ -1261,7 +1261,7 @@ _php_mb_regex_ereg_search_exec(INTERNAL_FUNCTION_PARAMETERS, int mode)
 			break;
 		}
 		end = MBREX(search_regs)->end[0];
-		if (pos < end) {
+		if (pos <= end) {
 			MBREX(search_pos) = end;
 		} else {
 			MBREX(search_pos) = pos + 1;
diff --git a/ext/mbstring/tests/bug72691.phpt b/ext/mbstring/tests/bug72691.phpt
index d914a508e0..08f6b153da 100644
--- a/ext/mbstring/tests/bug72691.phpt
+++ b/ext/mbstring/tests/bug72691.phpt
@@ -26,12 +26,12 @@ var_dump(mb_ereg_search_getpos());
 var_dump(mb_ereg_search_getregs());
 ?>
 --EXPECT--
-int(1)
+int(0)
 array(1) {
   [0]=>
   string(0) ""
 }
-int(2)
+int(0)
 array(1) {
   [0]=>
   string(0) ""
@@ -39,9 +39,9 @@ array(1) {
 int(3)
 array(1) {
   [0]=>
-  string(1) "o"
+  string(3) "foo"
 }
-int(4)
+int(3)
 array(1) {
   [0]=>
   string(0) ""
diff --git a/ext/mbstring/tests/bug72693.phpt b/ext/mbstring/tests/bug72693.phpt
new file mode 100644
index 0000000000..f269e57f0f
--- /dev/null
+++ b/ext/mbstring/tests/bug72693.phpt
@@ -0,0 +1,41 @@
+--TEST--
+Bug #72693 (mb_ereg_search increments search position when a match zero-width)
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip ext/mbstring required');
+?>
+--FILE--
+<?php
+mb_ereg_search_init('foo');
+
+var_dump(mb_ereg_search('\A'));
+var_dump(mb_ereg_search_getpos());
+
+var_dump(mb_ereg_search('\s*'));
+var_dump(mb_ereg_search_getpos());
+
+var_dump(mb_ereg_search('\w+'));
+var_dump(mb_ereg_search_getpos());
+var_dump(mb_ereg_search_getregs());
+
+var_dump(mb_ereg_search('\s*'));
+var_dump(mb_ereg_search_getpos());
+
+var_dump(mb_ereg_search('\Z'));
+var_dump(mb_ereg_search_getpos());
+?>
+--EXPECT--
+bool(true)
+int(0)
+bool(true)
+int(0)
+bool(true)
+int(3)
+array(1) {
+  [0]=>
+  string(3) "foo"
+}
+bool(true)
+int(3)
+bool(true)
+int(3)