Out-of-Bounds Write

PHP is vulnerable to out-of-bounds write vulnerability. The vulnerability exists in next_state_val() during regular expression compilation in in Oniguruma. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of ‘\700’ would produce an invalid code point value larger than 0xff in next_state_val() leading to a memory corruption.