#1146111 php8.4: please update bundled pcre2 (allocation overflow, commit 8156b39)

Package:
php8.4
Source:
php8.4
Submitter:
Gajendra Nath Soren
Date:
2026-08-30 03:03:02 UTC
Severity:
normal
Tags:
#1146111#5
Date:
2026-08-29 22:12:58 UTC
From:
To:
php8.4 vendors a copy of pcre2 at:
ext/pcre/pcre2lib/pcre2_substring.c

This copy predates commit 8156b39 (August 9, 2026) which fixes an
integer overflow in pcre2_substring.c and pcre2_convert.c. The fix
adds an overflow guard:

if (size > ((PCRE2_SIZE_MAX - sizeof(pcre2_memctl)) / CU2BYTES(1)) - 1)
return PCRE2_ERROR_NOMEMORY;

Note: the canonical Debian pcre2 package (10.46-1) also does not yet
contain this fix.

No CVE has been assigned yet. The fix is public at:
https://github.com/PCRE2Project/pcre2/commit/8156b39

Please update the bundled pcre2 to the latest upstream version.

Found by: Attack of the Clones GSoC 2026 pipeline
(salsa.debian.org/rouca/gsoc2026)

Gajendra Nath Soren
gajendranath025@gmail.com
#1146111#10
Date:
2026-08-30 02:56:29 UTC
From:
To: