From 3c98c2d0cbf476432a4fa6264afc5e43c58fb38f Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Thu, 24 Jan 2019 15:13:49 +0100
Subject: [PATCH] Fixed bug #77514

---
 NEWS                             |  7 ++++++-
 ext/mbstring/php_mbregex.c       |  3 +--
 ext/mbstring/tests/bug77514.phpt | 11 +++++++++++
 3 files changed, 18 insertions(+), 3 deletions(-)
 create mode 100644 ext/mbstring/tests/bug77514.phpt

diff --git a/NEWS b/NEWS
index ca3bcc7f0e..5f32b5a924 100644
--- a/NEWS
+++ b/NEWS
@@ -1,10 +1,15 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.3
--Core:
+
+- Core:
   . Fixed bug #77494 (Disabling class causes segfault on member access).
     (Dmitry)
 
+- Mbstring:
+  . Fixed bug #77514 (mb_ereg_replace() with trailing backslash adds null byte).
+    (Nikita)
+
 - Opcache:
   . Fixed bug #77287 (Opcache literal compaction is incompatible with EXT
     opcodes). (Nikita)
diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c
index cc96e04f39..319ee567c6 100644
--- a/ext/mbstring/php_mbregex.c
+++ b/ext/mbstring/php_mbregex.c
@@ -713,8 +713,7 @@ static inline void mb_regex_substitute(
 		sp = p; /* save position */
 		clen = (int) php_mb_mbchar_bytes_ex(++p, enc);
 		if (clen != 1 || p == eos) {
-			/* skip escaped multibyte char */
-			p += clen;
+			/* skip backslash followed by multibyte char */
 			smart_str_appendl(pbuf, sp, p - sp);
 			continue;
 		}
diff --git a/ext/mbstring/tests/bug77514.phpt b/ext/mbstring/tests/bug77514.phpt
new file mode 100644
index 0000000000..efcbea24d7
--- /dev/null
+++ b/ext/mbstring/tests/bug77514.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #77514: mb_ereg_replace() with trailing backslash adds null byte
+--FILE--
+<?php
+
+$a="abc123";
+var_dump(mb_ereg_replace("123","def\\",$a));
+
+?>
+--EXPECT--
+string(7) "abcdef\"
-- 
2.49.0