Fixed bug #77514

Author: nikic

NEWS

@@ -1,10 +1,15 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.3
--Core:
+
+- Core:
   . Fixed bug #77494 (Disabling class causes segfault on member access).
     (Dmitry)
 
+- Mbstring:
+  . Fixed bug #77514 (mb_ereg_replace() with trailing backslash adds null byte).
+    (Nikita)
+
 - Opcache:
   . Fixed bug #77287 (Opcache literal compaction is incompatible with EXT
     opcodes). (Nikita)

ext/mbstring/php_mbregex.c

@@ -713,8 +713,7 @@ static inline void mb_regex_substitute(
 		sp = p; /* save position */
 		clen = (int) php_mb_mbchar_bytes_ex(++p, enc);
 		if (clen != 1 || p == eos) {
-			/* skip escaped multibyte char */
-			p += clen;
+			/* skip backslash followed by multibyte char */
 			smart_str_appendl(pbuf, sp, p - sp);
 			continue;
 		}

ext/mbstring/tests/bug77514.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #77514: mb_ereg_replace() with trailing backslash adds null byte
+--FILE--
+<?php
+
+$a="abc123";
+var_dump(mb_ereg_replace("123","def\\",$a));
+
+?>
+--EXPECT--
+string(7) "abcdef\"