Fix preg_replace_callback_array() pattern validation

Closes GH-11301
php · May 24, 2023 · 7c7698f · 7c7698f
1 parent 4676d9b
commit 7c7698f
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 0 deletions.
diff --git a/NEWS b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.2.8
 
+- PCRE:
+  . Fix preg_replace_callback_array() pattern validation. (ilutov)
+
 - Standard:
   . Fix access on NULL pointer in array_merge_recursive(). (ilutov)
 

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
@@ -2425,6 +2425,10 @@ PHP_FUNCTION(preg_replace_callback_array)
 			zend_argument_type_error(1, "must contain only valid callbacks");
 			goto error;
 		}
+		if (!str_idx_regex) {
+			zend_argument_type_error(1, "must contain only string patterns as keys");
+			goto error;
+		}
 
 		ZVAL_COPY_VALUE(&fci.function_name, replace);
 

diff --git a/ext/pcre/tests/preg_replace_callback_array_numeric_index_error.phpt b/ext/pcre/tests/preg_replace_callback_array_numeric_index_error.phpt
@@ -0,0 +1,15 @@
+--TEST--
+preg_replace_callback_array() invalid pattern
+--FILE--
+<?php
+preg_replace_callback_array(
+    [42 => function () {}],
+    'a',
+);
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: preg_replace_callback_array(): Argument #1 ($pattern) must contain only string patterns as keys in %s:%d
+Stack trace:
+#0 %s(%d): preg_replace_callback_array(Array, 'a')
+#1 {main}
+  thrown in %s on line %d