From 9624fcd938453feee05bc4d0079e62c696a6e876 Mon Sep 17 00:00:00 2001
From: lazerg <lazerg2@gmail.com>
Date: Tue, 27 Oct 2026 08:38:12 +0500
Subject: [PATCH] Fix GH-24769: mb_ereg_replace() over-read on truncated
 trailing character

---
 ext/mbstring/php_mbregex.c      |  5 +++--
 ext/mbstring/tests/gh24769.phpt | 19 +++++++++++++++++++
 2 files changed, 22 insertions(+), 2 deletions(-)
 create mode 100644 ext/mbstring/tests/gh24769.phpt

diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c
index aeb1a9b84f11..07fd67d5c218 100644
--- a/ext/mbstring/php_mbregex.c
+++ b/ext/mbstring/php_mbregex.c
@@ -737,8 +737,9 @@ static inline void mb_regex_substitute(
 		clen = (int) php_mb_mbchar_bytes(p, enc);
 		if (clen != 1 || p == eos || p[0] != '\\') {
 			/* skip anything that's not an ascii backslash */
-			smart_str_appendl(pbuf, p, clen);
-			p += clen;
+			sp = p;
+			p = MIN(p + clen, eos);
+			smart_str_appendl(pbuf, sp, p - sp);
 			continue;
 		}
 		sp = p; /* save position */
diff --git a/ext/mbstring/tests/gh24769.phpt b/ext/mbstring/tests/gh24769.phpt
new file mode 100644
index 000000000000..833fef9af6e3
--- /dev/null
+++ b/ext/mbstring/tests/gh24769.phpt
@@ -0,0 +1,19 @@
+--TEST--
+GH-24769 (mb_ereg_replace() reads past the replacement on a truncated trailing multibyte character)
+--EXTENSIONS--
+mbstring
+--SKIPIF--
+<?php
+if (!function_exists('mb_ereg')) die('skip mbregex support not available');
+?>
+--FILE--
+<?php
+mb_regex_encoding('UTF-8');
+var_dump(bin2hex(mb_ereg_replace('a', "x\xF0", 'a')));
+var_dump(bin2hex(mb_ereg_replace('a', "x\xE2\x82", 'a')));
+var_dump(bin2hex(mb_ereg_replace('a', "\xF0\x9F", 'bab')));
+?>
+--EXPECT--
+string(4) "78f0"
+string(6) "78e282"
+string(8) "62f09f62"