Skip to content

Fix memory-safety crash on invalid UTF-8 variable names - #602

Merged
GrahamCampbell merged 3 commits into
masterfrom
fix/utf8-name-validation-modifier
Aug 24, 2026
Merged

GrahamCampbell merged 3 commits into
masterfrom
fix/utf8-name-validation-modifier

Conversation

@GrahamCampbell

@GrahamCampbell GrahamCampbell commented Aug 24, 2026 •

Copy link
Copy Markdown
Collaborator

Variable-name validation enabled PCRE UTF-8 mode with the in-pattern (*UTF8) verb rather than the u modifier, so PHP never checked that the subject was valid UTF-8 before matching. On a malformed byte sequence reaching Dotenv::parse or Parser::parse, where string input is not passed through the file reader's UTF-8 normalisation, the matcher reads past the end of the subject buffer, producing nondeterministic accept and reject results and a reproducible segmentation fault. Switching to the u modifier makes PHP validate the subject and reject invalid UTF-8 deterministically, which is exactly what name validation intends, and leaves every valid ASCII and UTF-8 name untouched. The name grammar itself, the export prefix strip, the quote delimiter checks and their length guard, is now handled with byte operations too, because running it through mbstring meant that on PHP 8.3.2 and later with a non-default substitute character configured, the replacement of malformed bytes could synthesise a valid-looking name, quote pair or export prefix and let an invalid name slip past validation, in the worst case colliding with a legitimate key defined earlier in the file. This is intended to land before v5.7.0 is tagged.

@GrahamCampbell
GrahamCampbell changed the base branch from master to types/option-result-precision August 24, 2026 10:42
@GrahamCampbell
GrahamCampbell force-pushed the fix/utf8-name-validation-modifier branch from b3d755d to cc880ae Compare August 24, 2026 10:42
@GrahamCampbell
GrahamCampbell force-pushed the types/option-result-precision branch 2 times, most recently from 8b76297 to 46e982e Compare August 24, 2026 17:28
@GrahamCampbell
GrahamCampbell force-pushed the fix/utf8-name-validation-modifier branch from 558a54a to 5249b62 Compare August 24, 2026 17:28
Base automatically changed from types/option-result-precision to master August 24, 2026 17:42
@GrahamCampbell
GrahamCampbell force-pushed the fix/utf8-name-validation-modifier branch from 5249b62 to 1c2769e Compare August 24, 2026 17:43
@GrahamCampbell
GrahamCampbell merged commit 8bf174e into master Aug 24, 2026
42 checks passed
@GrahamCampbell
GrahamCampbell deleted the fix/utf8-name-validation-modifier branch August 24, 2026 17:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant