Description:
------------
Passing certain inputs to mb_ereg_match() as a regular expression will cause an out of bounds heap read access in the function mbc_to_code(). This code belongs to oniguruma, therefore it may be that the bug is in there (I'll try to reproduce it with "plain" oniguruma later).

To see this bug one needs to compile php with address sanitizer (-fsanitize=address in CFLAGS/LDFLAGS) and disable zend memory allocation (USE_ZEND_ALLOC=0). I'll post a short example PHP code that triggers this bug below.

Note: I saw the open bug #72405 which seems very similar, but not the same (stack oob, not heap, but same function). I can't reproduce #72405 however, maybe it has already been silently fixed.


Full Address Sanitizer stack trace:
==15625==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000027fc0 at pc 0x10a251b bp 0x7fffe51d98b0 sp 0x7fffe51d98a0
READ of size 1 at 0x603000027fc0 thread T0
    #0 0x10a251a in mbc_to_code /f/php/php-7.0.10/ext/mbstring/oniguruma/enc/utf8.c:105
    #1 0x106332d in fetch_token /f/php/php-7.0.10/ext/mbstring/oniguruma/regparse.c:3146
    #2 0x1070b0d in parse_exp /f/php/php-7.0.10/ext/mbstring/oniguruma/regparse.c:5090
    #3 0x107f55c in parse_branch /f/php/php-7.0.10/ext/mbstring/oniguruma/regparse.c:5435
    #4 0x107ffde in parse_subexp /f/php/php-7.0.10/ext/mbstring/oniguruma/regparse.c:5472
    #5 0x10814de in parse_regexp /f/php/php-7.0.10/ext/mbstring/oniguruma/regparse.c:5516
    #6 0x10814de in onig_parse_make_tree /f/php/php-7.0.10/ext/mbstring/oniguruma/regparse.c:5543
    #7 0xff7b5c in onig_compile /f/php/php-7.0.10/ext/mbstring/oniguruma/regcomp.c:5300
    #8 0xffe6ea in onig_new /f/php/php-7.0.10/ext/mbstring/oniguruma/regcomp.c:5545
    #9 0x11e9c35 in php_mbregex_compile_pattern /f/php/php-7.0.10/ext/mbstring/php_mbregex.c:456
    #10 0x11e9c35 in zif_mb_ereg_match /f/php/php-7.0.10/ext/mbstring/php_mbregex.c:1172
    #11 0x1f358dc in ZEND_DO_ICALL_SPEC_HANDLER /f/php/php-7.0.10/Zend/zend_vm_execute.h:586
    #12 0x1e96595 in execute_ex /f/php/php-7.0.10/Zend/zend_vm_execute.h:414
    #13 0x22bf5ae in zend_execute /f/php/php-7.0.10/Zend/zend_vm_execute.h:458
    #14 0x1c661db in zend_execute_scripts /f/php/php-7.0.10/Zend/zend.c:1427
    #15 0x198c06f in php_execute_script /f/php/php-7.0.10/main/main.c:2494
    #16 0x22ca6dc in do_cli /f/php/php-7.0.10/sapi/cli/php_cli.c:974
    #17 0x4713b8 in main /f/php/php-7.0.10/sapi/cli/php_cli.c:1344
    #18 0x7f103b8b078f in __libc_start_main (/lib64/libc.so.6+0x2078f)
    #19 0x4723f8 in _start (/mnt/ram/php/php+0x4723f8)

0x603000027fc0 is located 0 bytes to the right of 32-byte region [0x603000027fa0,0x603000027fc0)
allocated by thread T0 here:
    #0 0x7f103cf6b707 in malloc (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.3/libasan.so.1+0x57707)
    #1 0x1fb9f87 in zend_string_alloc /f/php/php-7.0.10/Zend/zend_string.h:121
    #2 0x1fb9f87 in ZEND_CONCAT_SPEC_CONST_TMPVAR_HANDLER /f/php/php-7.0.10/Zend/zend_vm_execute.h:10404

SUMMARY: AddressSanitizer: heap-buffer-overflow /f/php/php-7.0.10/ext/mbstring/oniguruma/enc/utf8.c:105 mbc_to_code
Shadow bytes around the buggy address:
  0x0c067fffcfa0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fffcfb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fffcfc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fffcfd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fffcfe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c067fffcff0: fa fa fa fa 00 00 00 00[fa]fa fd fd fd fd fa fa
  0x0c067fffd000: fd fd fd fd fa fa fd fd fd fd fa fa 00 00 00 00
  0x0c067fffd010: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
  0x0c067fffd020: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
  0x0c067fffd030: 00 00 00 00 fa fa 00 00 00 fa fa fa 00 00 00 fa
  0x0c067fffd040: fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==15625==ABORTING


Test script:
---------------
<?php mb_ereg_match("0000".chr(0xfb), "");