CVE-2017-9226

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in
Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds
write or read occurs in next_state_val() during regular expression
compilation. Octal numbers larger than 0xff are not handled correctly in
fetch_token() and fetch_token_in_cc(). A malformed regular expression
containing an octal number in the form of ‘\700’ would produce an invalid
code point value larger than 0xff in next_state_val(), resulting in an
out-of-bounds write memory corruption.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863314&gt;
• <https://github.com/kkos/oniguruma/issues/55&gt;