ext/mbstring: Fix truncated encoding names resolving to full names

NEWS

@@ -59,6 +59,7 @@ PHP                                                                        NEWS
     a truncated UTF-8 sequence). (Lazizbek Ergashev)
   . Fixed mbstring functions emitting surrogates in UTF-8 output and flagging
     it as valid UTF-8. (Nicolas Grekas)
+  . Fixed bug GH-23958 (truncated encoding names resolving to full names). (Kamil Tekiela)
 
 - MySQLi:
   . Fix GH-22854: Fixed failed assertion when accessing mysqli property after

ext/mbstring/libmbfl/mbfl/mbfl_encoding.c

@@ -339,7 +339,7 @@ const mbfl_encoding *mbfl_name2encoding_ex(const char *name, size_t name_len)
 			int8_t offset = mbfl_encoding_ptr_list_after_hashing[key];
 			if (offset >= 0) {
 				encoding = mbfl_encoding_ptr_list + offset;
-				if (strncasecmp((*encoding)->name, name, name_len) == 0) {
+				if (strlen((*encoding)->name) == name_len && strncasecmp((*encoding)->name, name, name_len) == 0) {
 					return *encoding;
 				}
 			}

ext/mbstring/mbstring.c

@@ -275,7 +275,7 @@ static const mbfl_encoding *php_mb_get_encoding(zend_string *encoding_name, uint
 }
 
 static const mbfl_encoding *php_mb_get_encoding_or_pass(const char *encoding_name, size_t encoding_name_len) {
-	if (strncmp(encoding_name, "pass", encoding_name_len) == 0) {
+	if (encoding_name_len == strlen("pass") && strncmp(encoding_name, "pass", encoding_name_len) == 0) {
 		return &mbfl_encoding_pass;
 	}
 
@@ -335,7 +335,7 @@ static zend_result php_mb_parse_encoding_list(const char *value, size_t value_le
 			}
 			size_t p1_length = p - p1 + 1;
 			/* convert to the encoding number and check encoding */
-			if (strncasecmp(p1, "auto", p1_length) == 0) {
+			if (p1_length == strlen("auto") && strncasecmp(p1, "auto", p1_length) == 0) {
 				if (!included_auto) {
 					const enum mbfl_no_encoding *src = MBSTRG(default_detect_order_list);
 					const size_t identify_list_size = MBSTRG(default_detect_order_list_size);

ext/mbstring/tests/gh15824.phpt

@@ -17,8 +17,8 @@ var_dump(mb_detect_encoding("\x9D", 'US-ASCII, CP1254, cyrillic', false));
 echo "== mime name ==\n";
 var_dump(mb_detect_encoding('abc', 'ANSI_X3.4-1968, ISO-8859-1'));
 var_dump(mb_detect_encoding('abc', 'CP50220, ANSI_X3.4-1968'));
-/* last comma is not mistake, intentionally */
-var_dump(mb_detect_encoding(bin2hex('1b24422422242424262428242a1b2842'), 'CP50220, ANSI_X3.4-1968,', false));
+
+var_dump(mb_detect_encoding(bin2hex('1b24422422242424262428242a1b2842'), 'CP50220, ANSI_X3.4-1968', false));
 var_dump(mb_detect_encoding('😄', 'US-ASCII, UTF-8-Mobile#KDDI-B, UTF-8'));
 ?>
 --EXPECT--

ext/mbstring/tests/gh23958.phpt

@@ -0,0 +1,35 @@
+--TEST--
+GH-23958: Truncated encoding names must not be accepted
+--EXTENSIONS--
+mbstring
+--FILE--
+<?php
+foreach (['pa', 'UCS-', '',] as $name) {
+    try {
+        mb_http_output($name);
+    } catch (ValueError $e) {
+        echo $e->getMessage(), "\n";
+    }
+}
+try {
+    mb_detect_order('aut');
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+var_dump(ini_set('mbstring.detect_order', ','));
+
+try {
+    mb_detect_encoding(bin2hex('1b24422422242424262428242a1b2842'), 'CP50220, ANSI_X3.4-1968,', false);
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECTF--
+mb_http_output(): Argument #1 ($encoding) must be a valid encoding, "pa" given
+mb_http_output(): Argument #1 ($encoding) must be a valid encoding, "UCS-" given
+mb_http_output(): Argument #1 ($encoding) must be a valid encoding, "" given
+mb_detect_order(): Argument #1 ($encoding) contains invalid encoding "aut"
+
+Warning: ini_set(): INI setting contains invalid encoding "" in %s on line %d
+bool(false)
+mb_detect_encoding(): Argument #2 ($encodings) contains invalid encoding ""