CVE-2019-19203

Se detectó un problema en Oniguruma versiones 6.x anteriores a 6.9.4_rc2. En la función gb18030_mbc_enc_len en el archivo gb18030.c, un puntero UChar es desreferenciado sin comprobar si pasó el final de la cadena coincidente. Esto conlleva a una lectura excesiva de búfer en la región heap de la memoria.

An out-of-bounds read vulnerability was found in the way Oniguruma handled regular expressions with GB18030 character encoding. A UChar pointer is dereferenced without checking if it passed the end of the matched string, leading to a heap-based buffer over-read. A remote attacker could abuse this flaw by providing a malformed regular expression that, when processed by an application linked to Oniguruma, might crash the application causing a denial of service.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Issues addressed include buffer over-read, buffer overflow, code execution, information leakage, integer overflow, null pointer, out of bounds read, and use-after-free vulnerabilities.