mb_strpos matches illegal character when needle is '?'

[youkidearitai]

Description

The following code:

<?php
var_dump(mb_strpos("AあいうえおBBcC", "?", 0, "ISO-2022-JP"));
var_dump(mb_stripos("AあいうえおBBcC", "?", 0, "ISO-2022-JP"));
var_dump(mb_strpos("AあいうえおBBcC", "?", 0, "SJIS"));
var_dump(mb_stripos("AあいうえおBBcC", "?", 0, "SJIS"));

Resulted in this output:

int(1)
int(5)
int(1)
int(5)

But I expected this output instead:

bool(false)
bool(false)
bool(false)
bool(false)

note: mb_stripos is affect mb_substitute_character, but mb_strpos is not affect it is (3v4l: https://3v4l.org/872nB )

PHP Version

PHP 8.1.x

Operating System

Ubuntu 20.04 on WSL2

[cmb69]

This does not look like a bug, because the actual character encoding of "AあいうえおBBcC" is UTF-8, but you tell mb_strpos() to treat that as ISO-2022-JP and SJIS, respectively. If you convert to the desired encodings, you get what you've expected: https://3v4l.org/f4oW8.

[youkidearitai]

@cmb69 Thanks for checking. Please read below🙇

I'm talking about bad bytes, not different encodings. For example, if you send a control character, why? will match. This can be used for some attacks.

I create illegal byte from bin2hex("1b204422433222ebbb1b2842")

https://3v4l.org/5VFTv

[youkidearitai]

https://github.com/php/php-src/blob/master/ext/mbstring/libmbfl/mbfl/mbfl_convert.c#L108
As you can see, the ? is hardcoded in illegal_substchar. I'm guessing that this is the reason why invalid bytes are caught.

[cmb69]

Oh, indeed, there is something wrong as of PHP 8.1.0.