Commit 33a61f765a9 for php

commit 33a61f765a94e018a8d55d962a73e8c8331ee256
Author: Yuma Kakei <yumasansansan@gmail.com>
Date:   Mon Oct 26 15:20:33 2026 +0900

    Fix mbregex fuzzer not being built and truncating its input

    The mbregex fuzzer was only built if --enable-mbregex was passed
    explicitly. SAPIs are configured before extensions, so only
    enable_mbregex is available here, and it is unset unless the option is
    given, although mbregex is enabled by default together with mbstring.

    The fuzzer also passed its input through strlen(), dropping everything
    after the first NUL byte, although mb_ereg() accepts NUL bytes in both
    the pattern and the subject.

diff --git a/sapi/fuzzer/config.m4 b/sapi/fuzzer/config.m4
index 21a44cd6d88..47ebfef7622 100644
--- a/sapi/fuzzer/config.m4
+++ b/sapi/fuzzer/config.m4
@@ -69,7 +69,8 @@ if test "$PHP_FUZZER" != "no"; then
   fi
   if test -n "$enable_mbstring" && test "$enable_mbstring" != "no"; then
     PHP_FUZZER_TARGET([mbstring], [PHP_FUZZER_MBSTRING_OBJS])
-    if test -n "$enable_mbregex" && test "$enable_mbregex" != "no"; then
+    dnl mbregex is enabled by default, so enable_mbregex is usually unset here.
+    if test "$enable_mbregex" != "no"; then
       PHP_FUZZER_TARGET([mbregex], [PHP_FUZZER_MBREGEX_OBJS])
     fi
   fi
diff --git a/sapi/fuzzer/fuzzer-mbregex.c b/sapi/fuzzer/fuzzer-mbregex.c
index bd119a65626..2607fb46d6a 100644
--- a/sapi/fuzzer/fuzzer-mbregex.c
+++ b/sapi/fuzzer/fuzzer-mbregex.c
@@ -33,32 +33,23 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 		return 0;
 	}

-	char *args[2];
-	char *data = malloc(Size+1);
-	memcpy(data, Data, Size);
-	data[Size] = '\0';
-
 	fuzzer_setup_dummy_frame();

-	args[0] = data;
-	args[1] = "test123";
-	fuzzer_call_php_func("mb_ereg", 2, args);
-
-	args[0] = data;
-	args[1] = "test123";
-	fuzzer_call_php_func("mb_eregi", 2, args);
+	/* Pass the input with its length, as strlen() would cut it off at the first NUL byte. */
+	zval args[2];
+	ZVAL_STRINGL(&args[0], (const char *) Data, Size);
+	ZVAL_STRING(&args[1], "test123");
+	fuzzer_call_php_func_zval("mb_ereg", 2, args);
+	fuzzer_call_php_func_zval("mb_eregi", 2, args);
+	zval_ptr_dtor(&args[1]);

-	args[0] = data;
-	args[1] = data;
-	fuzzer_call_php_func("mb_ereg", 2, args);
-
-	args[0] = data;
-	args[1] = data;
-	fuzzer_call_php_func("mb_eregi", 2, args);
+	ZVAL_COPY(&args[1], &args[0]);
+	fuzzer_call_php_func_zval("mb_ereg", 2, args);
+	fuzzer_call_php_func_zval("mb_eregi", 2, args);
+	zval_ptr_dtor(&args[0]);
+	zval_ptr_dtor(&args[1]);

 	fuzzer_request_shutdown();
-
-	free(data);
 #else
 	fprintf(stderr, "\n\nERROR:\nPHP built without mbstring, recompile with --enable-mbstring to use this fuzzer\n");
 	exit(1);