From 90dc05af05f8e8719abcc4de720de4a6a25aee74 Mon Sep 17 00:00:00 2001 From: Ilija Tovilo Date: Tue, 12 Dec 2023 20:38:51 +0100 Subject: [PATCH] Fix pcre out-of-bounds when using closing symbols as opening delimiter Apparently we support using closing symbols )]}> as opening and closing delimiters. Fixes oss-fuzz #65021 --- ext/pcre/php_pcre.c | 2 +- ext/pcre/tests/oss-fuzz-65021.phpt | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) create mode 100644 ext/pcre/tests/oss-fuzz-65021.phpt diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c index 075d9fc5263b5..ef7a10d94ddb4 100644 --- a/ext/pcre/php_pcre.c +++ b/ext/pcre/php_pcre.c @@ -655,7 +655,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, bo } start_delimiter = delimiter; - if ((pp = strchr("([{< )]}>", delimiter))) + if ((pp = strchr("([{< )]}> )]}>", delimiter))) delimiter = pp[5]; end_delimiter = delimiter; diff --git a/ext/pcre/tests/oss-fuzz-65021.phpt b/ext/pcre/tests/oss-fuzz-65021.phpt new file mode 100644 index 0000000000000..38e1ebc1c7bc9 --- /dev/null +++ b/ext/pcre/tests/oss-fuzz-65021.phpt @@ -0,0 +1,11 @@ +--TEST-- +oss-fuzz #65021 +--FILE-- +","")); +var_dump(preg_match(">foo>i","FOO")); +?> +--EXPECTF-- +Warning: preg_match(): No ending delimiter '>' found in %s on line %d +bool(false) +int(1)