[php-src] Issue #22279: mb_check_encoding doesn't respect UTF-8 RFC3629
[email protected] (LLyaudet) Thu, 11 Jun 2026 08:56:32 +0000
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/22279
Author: LLyaudet
### Description
Hello,
RFC3629 says:
```
The definition of UTF-8 prohibits encoding character numbers between
U+D800 and U+DFFF, which are reserved for use with the UTF-16
encoding form (as surrogate pairs) and do not directly represent
characters.
```
But both of mb_check_encoding and preg_match('//u', $input) doesn't detect when such characters occurs.
I found this whilst validating my code here:
https://github.com/Seldaek/jsonlint/pull/91
I had to comment out the fast path relying on mb_check_encoding and preg_match.
Maybe there are related security issues.
Have a nice day, best regards,
Laurent Lyaudet
### PHP Version
```plain
PHP 8.5.4 (cli) (built: May 25 2026 12:19:37) (NTS)
Copyright (c) The PHP Group
Built by Ubuntu
Zend Engine v4.5.4, Copyright (c) Zend Technologies
with Zend OPcache v8.5.4, Copyright (c), by Zend Technologies
```
### Operating System
Ubuntu 26.04