From: Nikita Popov <nikita.ppv@gmail.com>
Date: Thu, 1 Oct 2020 14:41:51 +0000 (+0200)
Subject: Fix out of bounds offset handling with empty needle
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f82414e935c18c1ff45ef1f006e24220631f5717;p=php

Fix out of bounds offset handling with empty needle

For strrpos with positive out of bounds offsets was not detected.
---

diff --git a/ext/intl/grapheme/grapheme_util.c b/ext/intl/grapheme/grapheme_util.c
index 2625a93263..55fa009f56 100644
--- a/ext/intl/grapheme/grapheme_util.c
+++ b/ext/intl/grapheme/grapheme_util.c
@@ -127,13 +127,13 @@ int32_t grapheme_strpos_utf16(char *haystack, size_t haystack_len, char *needle,
 	STRPOS_CHECK_STATUS(status, "Failed to set up iterator");
 
 	if (uneedle_len == 0) {
-		offset_pos = grapheme_get_haystack_offset(bi, last && offset >= 0 ? uhaystack_len : offset);
+		offset_pos = grapheme_get_haystack_offset(bi, offset);
 		if (offset_pos == -1) {
 			zend_argument_value_error(3, "must be contained in argument #1 ($haystack)");
 			ret_pos = -1;
 			goto finish;
 		}
-		ret_pos = offset_pos;
+		ret_pos = last && offset >= 0 ? uhaystack_len : offset_pos;
 		goto finish;
 	}
 
diff --git a/ext/intl/tests/grapheme_out_of_bounds.phpt b/ext/intl/tests/grapheme_out_of_bounds.phpt
index e563096d7e..831ab87408 100644
--- a/ext/intl/tests/grapheme_out_of_bounds.phpt
+++ b/ext/intl/tests/grapheme_out_of_bounds.phpt
@@ -118,6 +118,49 @@ try {
 }
 echo "\n";
 
+// Empty needle +  out of bounds
+try {
+    var_dump(grapheme_strpos("äöü", "", 4));
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump(grapheme_stripos("äöü", "", 4));
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump(grapheme_strrpos("äöü", "", 4));
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump(grapheme_strripos("äöü", "", 4));
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump(grapheme_strpos("äöü", "", -4));
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump(grapheme_stripos("äöü", "", -4));
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump(grapheme_strrpos("äöü", "", -4));
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    var_dump(grapheme_strripos("äöü", "", -4));
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+echo "\n";
+
 var_dump(grapheme_substr("foo", 3));
 var_dump(grapheme_substr("foo", -3));
 var_dump(grapheme_substr("foo", 4));
@@ -181,6 +224,15 @@ grapheme_stripos(): Argument #3 ($offset) must be contained in argument #1 ($hay
 grapheme_strrpos(): Argument #3 ($offset) must be contained in argument #1 ($haystack)
 grapheme_strripos(): Argument #3 ($offset) must be contained in argument #1 ($haystack)
 
+grapheme_strpos(): Argument #3 ($offset) must be contained in argument #1 ($haystack)
+grapheme_stripos(): Argument #3 ($offset) must be contained in argument #1 ($haystack)
+grapheme_strrpos(): Argument #3 ($offset) must be contained in argument #1 ($haystack)
+grapheme_strripos(): Argument #3 ($offset) must be contained in argument #1 ($haystack)
+grapheme_strpos(): Argument #3 ($offset) must be contained in argument #1 ($haystack)
+grapheme_stripos(): Argument #3 ($offset) must be contained in argument #1 ($haystack)
+grapheme_strrpos(): Argument #3 ($offset) must be contained in argument #1 ($haystack)
+grapheme_strripos(): Argument #3 ($offset) must be contained in argument #1 ($haystack)
+
 string(0) ""
 string(3) "foo"
 string(0) ""