Don't use opaque for encoding detection score

opaque is used by the htmlentities filter, which means that we
end up trying to free the score value as a pointer. Don't try to
be overly tricky here and simply allocate a separate structure
to hold the number of illegal characters and the score.

Author: nikic

ext/mbstring/libmbfl/mbfl/mbfilter.c

@@ -285,24 +285,23 @@ size_t mbfl_buffer_illegalchars(mbfl_buffer_converter *convd)
 /*
  * encoding detector
  */
-static int mbfl_estimate_encoding_likelihood(int c, void* data)
+static int mbfl_estimate_encoding_likelihood(int c, void *void_data)
 {
-	mbfl_convert_filter *filter = *((mbfl_convert_filter**)data);
-	uintptr_t *score = (uintptr_t*)(&filter->opaque);
+	mbfl_encoding_detector_data *data = void_data;
 
 	/* Receive wchars decoded from test string using candidate encoding
 	 * If the test string was invalid in the candidate encoding, we assume
 	 * it's the wrong one. */
 	if (c & MBFL_WCSGROUP_THROUGH) {
-		filter->num_illegalchar++;
+		data->num_illegalchars++;
 	} else if (php_unicode_is_cntrl(c) || php_unicode_is_private(c)) {
 		/* Otherwise, count how many control characters and 'private use'
 		 * codepoints we see. Those are rarely used and may indicate that
 		 * the candidate encoding is not the right one. */
-		*score += 10;
+		data->score += 10;
 	} else if (php_unicode_is_punct(c)) {
 		/* Punctuation is also less common than letters/digits */
-		(*score)++;
+		data->score++;
 	}
 	return c;
 }
@@ -315,14 +314,14 @@ mbfl_encoding_detector *mbfl_encoding_detector_new(const mbfl_encoding **elist,
 
 	mbfl_encoding_detector *identd = emalloc(sizeof(mbfl_encoding_detector));
 	identd->filter_list = ecalloc(elistsz, sizeof(mbfl_convert_filter*));
+	identd->filter_data = ecalloc(elistsz, sizeof(mbfl_encoding_detector_data));
 
 	int filter_list_size = 0;
 	for (int i = 0; i < elistsz; i++) {
 		mbfl_convert_filter *filter = mbfl_convert_filter_new(elist[i], &mbfl_encoding_wchar,
-			mbfl_estimate_encoding_likelihood, NULL, &identd->filter_list[i]);
+			mbfl_estimate_encoding_likelihood, NULL, &identd->filter_data[filter_list_size]);
 		if (filter) {
 			identd->filter_list[filter_list_size++] = filter;
-			filter->opaque = (void*)0;
 		}
 	}
 	identd->filter_list_size = filter_list_size;
@@ -336,6 +335,7 @@ void mbfl_encoding_detector_delete(mbfl_encoding_detector *identd)
 		mbfl_convert_filter_delete(identd->filter_list[i]);
 	}
 	efree(identd->filter_list);
+	efree(identd->filter_data);
 	efree(identd);
 }
 
@@ -351,7 +351,7 @@ int mbfl_encoding_detector_feed(mbfl_encoding_detector *identd, mbfl_string *str
 			mbfl_convert_filter *filter = identd->filter_list[i];
 			if (!filter->num_illegalchar) {
 				(*filter->filter_function)(*p, filter);
-				if (filter->num_illegalchar) {
+				if (identd->filter_data[i].num_illegalchars) {
 					bad++;
 				}
 			}
@@ -374,14 +374,15 @@ int mbfl_encoding_detector_feed(mbfl_encoding_detector *identd, mbfl_string *str
 
 const mbfl_encoding *mbfl_encoding_detector_judge(mbfl_encoding_detector *identd)
 {
-	uintptr_t best_score = UINT_MAX; /* Low score is 'better' */
+	size_t best_score = SIZE_MAX; /* Low score is 'better' */
 	const mbfl_encoding *enc = NULL;
 
 	for (int i = 0; i < identd->filter_list_size; i++) {
 		mbfl_convert_filter *filter = identd->filter_list[i];
-		if (!filter->num_illegalchar && (uintptr_t)filter->opaque < best_score) {
+		mbfl_encoding_detector_data *data = &identd->filter_data[i];
+		if (!data->num_illegalchars && data->score < best_score) {
 			enc = filter->from;
-			best_score = (uintptr_t)filter->opaque;
+			best_score = data->score;
 		}
 	}
 

ext/mbstring/libmbfl/mbfl/mbfilter.h

@@ -154,8 +154,14 @@ MBFLAPI extern size_t mbfl_buffer_illegalchars(mbfl_buffer_converter *convd);
  */
 typedef struct _mbfl_encoding_detector mbfl_encoding_detector;
 
+typedef struct {
+	size_t num_illegalchars;
+	size_t score;
+} mbfl_encoding_detector_data;
+
 struct _mbfl_encoding_detector {
 	mbfl_convert_filter **filter_list;
+	mbfl_encoding_detector_data *filter_data;
 	int filter_list_size;
 	int strict;
 };

ext/mbstring/tests/bug81298.phpt

@@ -3,10 +3,16 @@ Bug #81298: mb_detect_encoding() segfaults when 7bit encoding is specified
 --FILE--
 <?php
 
-var_dump(mb_detect_encoding("foobar", "7bit"));
-var_dump(mb_detect_encoding("foobar", "7bit,ascii"));
+var_dump(mb_detect_encoding("foobar.", "7bit"));
+var_dump(mb_detect_encoding("foobar.", "7bit,ascii"));
+var_dump(mb_detect_encoding("foobar.", "7bit,ascii,utf8"));
+var_dump(mb_detect_encoding("foobar.", "html"));
+var_dump(mb_detect_encoding("foobar.", "ascii,html"));
 
 ?>
 --EXPECT--
 bool(false)
 string(5) "ASCII"
+string(5) "ASCII"
+string(13) "HTML-ENTITIES"
+string(5) "ASCII"