From 29bb9af8b37d9e772e241f65ec6df4becc9b1257 Mon Sep 17 00:00:00 2001
From: Vishnu Srivatsava <vishnusrivatsava@gmail.com>
Date: Sun, 1 Nov 2026 16:34:28 +0530
Subject: [PATCH] Fix GH-23106: mb_strpos() reads past the end of a haystack
 ending in a truncated UTF-8 sequence

Backport of master commit cc22056f9d (PR #23107), requested in GH-25025.
On this branch the offset walk lives in mbfl_find_offset_utf8() in
libmbfl. The forward walk can land past the end of the haystack on a
truncated multi-byte sequence, and the returned pointer is then used by
zend_memnstr() despite violating its end >= pointer invariant. Clamp
the pointer to the end of the haystack.
---
 ext/mbstring/libmbfl/mbfl/mbfilter.c |  3 +++
 ext/mbstring/tests/gh23106.phpt      | 22 ++++++++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 ext/mbstring/tests/gh23106.phpt

diff --git a/ext/mbstring/libmbfl/mbfl/mbfilter.c b/ext/mbstring/libmbfl/mbfl/mbfilter.c
index b7be95567615..65b8b0afa317 100644
--- a/ext/mbstring/libmbfl/mbfl/mbfilter.c
+++ b/ext/mbstring/libmbfl/mbfl/mbfilter.c
@@ -567,6 +567,9 @@ static const unsigned char *mbfl_find_offset_utf8(
 			}
 			pos += u8_tbl[*pos];
 		}
+		if (pos > end) {
+			pos = end;
+		}
 		return pos;
 	}
 }
diff --git a/ext/mbstring/tests/gh23106.phpt b/ext/mbstring/tests/gh23106.phpt
new file mode 100644
index 000000000000..f55df0f2f081
--- /dev/null
+++ b/ext/mbstring/tests/gh23106.phpt
@@ -0,0 +1,22 @@
+--TEST--
+GH-23106 (mb_strpos() reads past the end of a haystack ending in a truncated UTF-8 sequence)
+--EXTENSIONS--
+mbstring
+--FILE--
+<?php
+var_dump(mb_strpos("AA\xf0\x90", "xyz", 3));
+var_dump(mb_strpos("AA\xf0\x90", "x", 3));
+var_dump(mb_strrpos("AA\xf0\x90", "A", 3));
+var_dump(mb_strrpos("AA\xf0\x90", "A", -1));
+try {
+    mb_strpos("AA\xf0\x90", "xyz", 4);
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+bool(false)
+bool(false)
+bool(false)
+int(1)
+mb_strpos(): Argument #3 ($offset) must be contained in argument #1 ($haystack)