Skip to content

Commit 355700c

Browse files
mvoriseknielsdos
authored andcommitted
Remove PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK from pcre compile options
This option is semi-deprecated [1] and shouldn't influence much anyway. The anticipated BC break is low. [1] PCRE2Project/pcre2#736 (comment) [2] PCRE2Project/pcre2#736 (comment) Closes GH-18150.
1 parent d20e3e6 commit 355700c

File tree

5 files changed

+42
-13
lines changed

5 files changed

+42
-13
lines changed

Diff for: NEWS

+2
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,8 @@ PHP NEWS
9696

9797
- PCRE:
9898
. Upgraded to pre2lib from 10.44 to 10.45. (nielsdos)
99+
. Remove PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK from pcre compile options.
100+
(mvorisek)
99101

100102
- PDO_PGSQL:
101103
. Added Iterable support for PDO::pgsqlCopyFromArray. (KentarouTakeda)

Diff for: UPGRADING

+5
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,11 @@ PHP 8.5 UPGRADE NOTES
5959
. pcntl_exec() now throws ValueErrors when entries or keys of the
6060
$env_vars parameter contain null bytes.
6161

62+
- PCRE:
63+
. The extension is compiled without semi-deprecated
64+
PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK compile option.
65+
https://github.com/PCRE2Project/pcre2/issues/736#issuecomment-2754024651
66+
6267
- PDO:
6368
. The constructor arguments set in conjunction with PDO::FETCH_CLASS now
6469
follow the usual CUFA (call_user_func_array) semantics.

Diff for: ext/pcre/php_pcre.c

+1-10
Original file line numberDiff line numberDiff line change
@@ -199,13 +199,6 @@ static void php_pcre_efree(void *block, void *data)
199199
efree(block);
200200
}
201201

202-
#ifdef PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK
203-
/* pcre 10.38 needs PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK, disabled by default */
204-
#define PHP_PCRE_DEFAULT_EXTRA_COPTIONS PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK
205-
#else
206-
#define PHP_PCRE_DEFAULT_EXTRA_COPTIONS 0
207-
#endif
208-
209202
#define PHP_PCRE_PREALLOC_MDATA_SIZE 32
210203

211204
static void php_pcre_init_pcre2(uint8_t jit)
@@ -226,8 +219,6 @@ static void php_pcre_init_pcre2(uint8_t jit)
226219
}
227220
}
228221

229-
pcre2_set_compile_extra_options(cctx, PHP_PCRE_DEFAULT_EXTRA_COPTIONS);
230-
231222
if (!mctx) {
232223
mctx = pcre2_match_context_create(gctx);
233224
if (!mctx) {
@@ -590,7 +581,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, bo
590581
#else
591582
uint32_t coptions = 0;
592583
#endif
593-
uint32_t eoptions = PHP_PCRE_DEFAULT_EXTRA_COPTIONS;
584+
uint32_t eoptions = 0;
594585
PCRE2_UCHAR error[128];
595586
PCRE2_SIZE erroffset;
596587
int errnumber;

Diff for: ext/pcre/tests/bug70345.phpt

+8-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
--TEST--
22
Bug #70345 (Multiple vulnerabilities related to PCRE functions)
3+
--SKIPIF--
4+
<?php
5+
if (PCRE_VERSION_MAJOR == 10 && PCRE_VERSION_MINOR < 38) {
6+
die("skip old pcre version");
7+
}
38
--FILE--
49
<?php
510
$regex = '/(?=xyz\K)/';
@@ -14,8 +19,8 @@ preg_match($regex, $subject, $matches);
1419
var_dump($matches);
1520
?>
1621
--EXPECTF--
22+
Warning: preg_split(): Compilation failed: \K is not allowed in lookarounds (but see PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK) at offset 9 in %s on line %d
1723
bool(false)
1824

19-
Warning: preg_match(): Get subpatterns list failed in %s on line %d
20-
array(0) {
21-
}
25+
Warning: preg_match(): Compilation failed: \K is not allowed in lookarounds (but see PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK) at offset 12 in %s on line %d
26+
NULL

Diff for: ext/pcre/tests/bug70345_old.phpt

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
--TEST--
2+
Bug #70345 (Multiple vulnerabilities related to PCRE functions)
3+
--SKIPIF--
4+
<?php
5+
if (PCRE_VERSION_MAJOR != 10 || PCRE_VERSION_MINOR >= 38) {
6+
die("skip new pcre version");
7+
}
8+
--FILE--
9+
<?php
10+
$regex = '/(?=xyz\K)/';
11+
$subject = "aaaaxyzaaaa";
12+
13+
var_dump(preg_split($regex, $subject));
14+
15+
$regex = '/(a(?=xyz\K))/';
16+
$subject = "aaaaxyzaaaa";
17+
preg_match($regex, $subject, $matches);
18+
19+
var_dump($matches);
20+
?>
21+
--EXPECTF--
22+
bool(false)
23+
24+
Warning: preg_match(): Get subpatterns list failed in %s on line %d
25+
array(0) {
26+
}

0 commit comments

Comments
 (0)