[GIT-PULLS] [php-src] PR #22954: Fix mbregex search state after cache invalidation
[email protected] (matthiasgoergens) Thu, 30 Jul 2026 17:25:30 +0000
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/22954 Author: matthiasgoergens Fixes GH-21036. `php_mbregex_compile_pattern()` may replace the cache entry currently referenced by `search_re`. The replacement destroys that regex and clears `search_re`, but leaves `search_regs` holding match offsets associated with the destroyed regex. `mb_ereg_search_getregs()` then treats those registers as valid and dereferences the null regex when processing named captures. Free and clear `search_regs` whenever cache replacement clears `search_re`. This preserves the existing invariant that match registers do not outlive their regex and makes `mb_ereg_search_getregs()` return `false` instead of returning stale numeric captures while losing named captures. PR #21038 identified the crash and proposed guarding the named-capture lookup. This alternative also discards the invalidated match state, following the approach used for the analogous invalid-pattern path in commit `392ad206a4f63fedf61d8086e390c73de8b72767`.