From 83fa6a3f7504f6c1e890ebf5f78944598c83fd09 Mon Sep 17 00:00:00 2001
From: lacatoire <la.catoire@gmail.com>
Date: Thu, 19 Feb 2026 23:11:55 +0100
Subject: [PATCH] Fix preg_grep() returning partial array instead of false on
 error

When a PCRE execution error occurs (e.g. malformed UTF-8 with /u
modifier), preg_grep() was returning a partial result array containing
only the entries processed before the error. All other preg_* functions
return false on execution errors.

After the match loop, check PCRE_G(error_code) and if an error
occurred, destroy the partial array and return false instead.

Fixes GH-11936
---
 ext/pcre/php_pcre.c                      |  5 +++
 ext/pcre/tests/preg_grep_error_utf8.phpt | 44 ++++++++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 ext/pcre/tests/preg_grep_error_utf8.phpt

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index b59bd87f92385..96889dd01ba9b 100644
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -2986,6 +2986,11 @@ PHPAPI void  php_pcre_grep_impl(pcre_cache_entry *pce, zval *input, zval *return
 	if (match_data != mdata) {
 		pcre2_match_data_free(match_data);
 	}
+
+	if (PCRE_G(error_code) != PHP_PCRE_NO_ERROR) {
+		zend_array_destroy(Z_ARR_P(return_value));
+		RETVAL_FALSE;
+	}
 }
 /* }}} */
 
diff --git a/ext/pcre/tests/preg_grep_error_utf8.phpt b/ext/pcre/tests/preg_grep_error_utf8.phpt
new file mode 100644
index 0000000000000..efdd7632ab711
--- /dev/null
+++ b/ext/pcre/tests/preg_grep_error_utf8.phpt
@@ -0,0 +1,44 @@
+--TEST--
+preg_grep() returns false on match execution error (e.g. malformed UTF-8)
+--FILE--
+<?php
+// preg_grep should return false when a match execution error occurs,
+// consistent with preg_match behavior. See GH-11936.
+
+// Test 1: preg_match returns false on malformed UTF-8 with /u modifier
+var_dump(preg_match('/.*/u', hex2bin('ff')));
+var_dump(preg_last_error() === PREG_BAD_UTF8_ERROR);
+
+// Test 2: preg_grep should also return false (not an empty/partial array)
+var_dump(preg_grep('/.*/u', [hex2bin('ff')]));
+var_dump(preg_last_error() === PREG_BAD_UTF8_ERROR);
+
+// Test 3: preg_grep with valid entries before the invalid one should
+// return false, not a partial array
+var_dump(preg_grep('/.*/u', ['foo', hex2bin('ff'), 'bar']));
+var_dump(preg_last_error() === PREG_BAD_UTF8_ERROR);
+
+// Test 4: preg_grep with PREG_GREP_INVERT should also return false on error
+var_dump(preg_grep('/.*/u', [hex2bin('ff')], PREG_GREP_INVERT));
+var_dump(preg_last_error() === PREG_BAD_UTF8_ERROR);
+
+// Test 5: preg_grep without error still returns an array
+var_dump(preg_grep('/.*/u', ['foo', 'bar']));
+var_dump(preg_last_error() === PREG_NO_ERROR);
+?>
+--EXPECTF--
+bool(false)
+bool(true)
+bool(false)
+bool(true)
+bool(false)
+bool(true)
+bool(false)
+bool(true)
+array(2) {
+  [0]=>
+  string(3) "foo"
+  [1]=>
+  string(3) "bar"
+}
+bool(true)