Patch from the upstream git

remicollet · remicollet · commit 703be4f77e66 · 2017-07-05T09:26:06.000+02:00
kkos/oniguruma#60 (CVE-2017-9228) Thanks to Mamoru TASAKA <mtasaka@fedoraproject.org>
diff --git a/ext/mbstring/oniguruma/regparse.c b/ext/mbstring/oniguruma/regparse.c
@@ -4068,7 +4068,9 @@ next_state_class(CClassNode* cc, OnigCodePoint* vs, enum CCVALTYPE* type,
     }
   }
 
-  *state = CCS_VALUE;
+  if (*state != CCS_START)
+    *state = CCS_VALUE;
+
   *type  = CCV_CLASS;
   return 0;
 }

Original file line number	Diff line number	Diff line change
`@@ -4068,7 +4068,9 @@ next_state_class(CClassNode* cc, OnigCodePoint* vs, enum CCVALTYPE* type,`
`4068`	`4068`	`}`
`4069`	`4069`	`}`
`4070`	`4070`
`4071`		`- *state = CCS_VALUE;`
	`4071`	`+ if (*state != CCS_START)`
	`4072`	`+ *state = CCS_VALUE;`
	`4073`	`+`
`4072`	`4074`	`*type = CCV_CLASS;`
`4073`	`4075`	`return 0;`
`4074`	`4076`	`}`