From: Christoph M. Becker <cmb@php.net>
Date: Sat, 30 Jul 2016 09:49:19 +0000 (+0200)
Subject: Merge branch 'PHP-5.6' into PHP-7.0
X-Git-Tag: php-7.0.10RC1~13
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e5940aa7950effe1835e489024b840fb87f54a3c;p=php

Merge branch 'PHP-5.6' into PHP-7.0
---

e5940aa7950effe1835e489024b840fb87f54a3c
diff --cc NEWS
index cb66a0bd47,49d6c3207e..babe2c23b0
--- a/NEWS
+++ b/NEWS
@@@ -71,14 -54,11 +71,16 @@@ PH
      zero-width). (cmb)
    . Fixed bug #72694 (mb_ereg_search_setpos does not accept a string's last
      position). (cmb)
+   . Fixed bug #72710 (`mb_ereg` causes buffer overflow on regexp compile error).
+     (ju1ius)
  
 +- Opcache:
 +  . Fixed bug #72590 (Opcache restart with kill_all_lockers does not work).
 +    (Keyur)
 +
  - PCRE:
    . Fixed bug #72688 (preg_match missing group names in matches). (cmb)
 +  . Upgraded to PCRE 8.39. (Anatol)
  
  - PDO_pgsql:
    . Fixed bug #70313 (PDO statement fails to throw exception). (Matteo)
diff --cc ext/mbstring/php_mbregex.c
index fc0b1d43e2,7e9756fa15..ec1ed1aae0
--- a/ext/mbstring/php_mbregex.c
+++ b/ext/mbstring/php_mbregex.c
@@@ -451,11 -453,11 +451,11 @@@ static php_mb_regex_t *php_mbregex_comp
  	OnigErrorInfo err_info;
  	OnigUChar err_str[ONIG_MAX_ERROR_MESSAGE_LEN];
  
 -	found = zend_hash_find(&MBREX(ht_rc), (char *)pattern, patlen+1, (void **) &rc);
 -	if (found == FAILURE || (*rc)->options != options || (*rc)->enc != enc || (*rc)->syntax != syntax) {
 +	rc = zend_hash_str_find_ptr(&MBREX(ht_rc), (char *)pattern, patlen);
 +	if (!rc || rc->options != options || rc->enc != enc || rc->syntax != syntax) {
  		if ((err_code = onig_new(&retval, (OnigUChar *)pattern, (OnigUChar *)(pattern + patlen), options, enc, syntax, &err_info)) != ONIG_NORMAL) {
- 			onig_error_code_to_str(err_str, err_code, err_info);
+ 			onig_error_code_to_str(err_str, err_code, &err_info);
 -			php_error_docref(NULL TSRMLS_CC, E_WARNING, "mbregex compile err: %s", err_str);
 +			php_error_docref(NULL, E_WARNING, "mbregex compile err: %s", err_str);
  			retval = NULL;
  			goto out;
  		}