# PHP mbstring / Oniguruma multiple remote heap/stack corruptions

Six memory corruption flaws in Oniguruma regex engine (used by PHP mbstring, Ruby) triggered by malformed regexes, enabling remote heap/stack corruption or DoS.

- Payout: $1,500
- Severity: critical
- Program: Internet Bug Bounty
- Found by: xixabangm4
- Disclosed: 2019-10-14
- CVE: CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/237915
- Library page: https://bugbountylibrary.com/r/h1%3A237915
- Tags: area:oss domain:oss impact:dos impact:rce kind:bounty platform:hackerone sev:critical tech:php tech:ruby technique:source-review vuln:dos vuln:memory-corruption

**Target:** Oniguruma regex engine (PHP mbstring, Ruby)
**Root cause:** A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc().
**Steps:**
1. Craft a regular expression containing an octal escape larger than 0xff, e.g. `\700`.
2. Pass the regex to a regex API backed by Oniguruma 6.2.0 (PHP mbstring, Ruby).
3. During compilation fetch_token()/fetch_token_in_cc() mishandle the octal value, producing an invalid code point >0xff in next_state_val().
4. The invalid code point causes an out-of-bounds heap write (CVE-2017-9226); related malformed regexes trigger stack OOB reads (CVE-2017-9224, CVE-2017-9227), uninitialized-variable heap write in bitset_set_range() (CVE-2017-9228), and SIGSEGV in left_adjust_char_head() (CVE-2017-9229).
**Exploitation:** If regex APIs are exposed to network-supplied patterns, a malformed regex triggers heap/stack corruption or immediate DoS in products using Oniguruma (PHP5/7, Ruby).
**Insight:** Regex engines are attack surface when patterns come from untrusted input; octal escapes above 0xff and state-transition edge cases in char-class parsing are fruitful for OOB writes.