Patch from the upstream git

remicollet · remicollet · commit bdf7393ddb15 · 2017-07-05T09:25:49.000+02:00
kkos/oniguruma#58 (CVE-2017-9227) Thanks to Mamoru TASAKA <mtasaka@fedoraproject.org>
diff --git a/ext/mbstring/oniguruma/regexec.c b/ext/mbstring/oniguruma/regexec.c
@@ -3123,6 +3123,8 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
     }
     else {
       UChar *q = p + reg->dmin;
+
+      if (q >= end) return 0; /* fail */
       while (p < q) p += enclen(reg->enc, p);
     }
   }

Original file line number	Diff line number	Diff line change
`@@ -3123,6 +3123,8 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,`
`3123`	`3123`	`}`
`3124`	`3124`	`else {`
`3125`	`3125`	`UChar *q = p + reg->dmin;`
	`3126`	`+`
	`3127`	`+ if (q >= end) return 0; /* fail */`
`3126`	`3128`	`while (p < q) p += enclen(reg->enc, p);`
`3127`	`3129`	`}`
`3128`	`3130`	`}`