Skip to content

Remove PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK from pcre compile options #18150

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions UPGRADING
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,11 @@ PHP 8.5 UPGRADE NOTES
have run and the output handlers have been cleaned up.
This is a consequence of fixing GH-18033.

- PCRE:
. The extension is compiled without semi-deprecated
PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK compile option.
https://github.com/PCRE2Project/pcre2/issues/736#issuecomment-2754024651

- Intl:
. The extension now requires at least ICU 57.1.

Expand Down
11 changes: 1 addition & 10 deletions ext/pcre/php_pcre.c
Original file line number Diff line number Diff line change
Expand Up @@ -199,13 +199,6 @@ static void php_pcre_efree(void *block, void *data)
efree(block);
}

#ifdef PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK
/* pcre 10.38 needs PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK, disabled by default */
#define PHP_PCRE_DEFAULT_EXTRA_COPTIONS PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK
#else
#define PHP_PCRE_DEFAULT_EXTRA_COPTIONS 0
#endif

#define PHP_PCRE_PREALLOC_MDATA_SIZE 32

static void php_pcre_init_pcre2(uint8_t jit)
Expand All @@ -226,8 +219,6 @@ static void php_pcre_init_pcre2(uint8_t jit)
}
}

pcre2_set_compile_extra_options(cctx, PHP_PCRE_DEFAULT_EXTRA_COPTIONS);

if (!mctx) {
mctx = pcre2_match_context_create(gctx);
if (!mctx) {
Expand Down Expand Up @@ -590,7 +581,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, bo
#else
uint32_t coptions = 0;
#endif
uint32_t eoptions = PHP_PCRE_DEFAULT_EXTRA_COPTIONS;
uint32_t eoptions = 0;
PCRE2_UCHAR error[128];
PCRE2_SIZE erroffset;
int errnumber;
Expand Down
11 changes: 8 additions & 3 deletions ext/pcre/tests/bug70345.phpt
Original file line number Diff line number Diff line change
@@ -1,5 +1,10 @@
--TEST--
Bug #70345 (Multiple vulnerabilities related to PCRE functions)
--SKIPIF--
<?php
if (PCRE_VERSION_MAJOR == 10 && PCRE_VERSION_MINOR < 38) {
die("skip old pcre version");
}
--FILE--
<?php
$regex = '/(?=xyz\K)/';
Expand All @@ -14,8 +19,8 @@ preg_match($regex, $subject, $matches);
var_dump($matches);
?>
--EXPECTF--
Warning: preg_split(): Compilation failed: \K is not allowed in lookarounds (but see PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK) at offset 9 in %s on line %d
bool(false)

Warning: preg_match(): Get subpatterns list failed in %s on line %d
array(0) {
}
Warning: preg_match(): Compilation failed: \K is not allowed in lookarounds (but see PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK) at offset 12 in %s on line %d
NULL
26 changes: 26 additions & 0 deletions ext/pcre/tests/bug70345_old.phpt
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
--TEST--
Bug #70345 (Multiple vulnerabilities related to PCRE functions)
--SKIPIF--
<?php
if (PCRE_VERSION_MAJOR != 10 || PCRE_VERSION_MINOR >= 38) {
die("skip new pcre version");
}
--FILE--
<?php
$regex = '/(?=xyz\K)/';
$subject = "aaaaxyzaaaa";

var_dump(preg_split($regex, $subject));

$regex = '/(a(?=xyz\K))/';
$subject = "aaaaxyzaaaa";
preg_match($regex, $subject, $matches);

var_dump($matches);
?>
--EXPECTF--
bool(false)

Warning: preg_match(): Get subpatterns list failed in %s on line %d
array(0) {
}
Loading