Merge branch 'PHP-8.6'

# Conflicts:
#	NEWS

Author: jorgsowa

ext/mbstring/mbstring.c

@@ -601,8 +601,10 @@ static char *php_mb_rfc1867_getword(const zend_encoding *encoding, char **line,
 				++pos;
 			}
 		} else {
-			pos += php_mb_mbchar_bytes(pos, (const mbfl_encoding *)encoding);
-
+			size_t len = php_mb_mbchar_bytes(pos, (const mbfl_encoding *)encoding);
+			while (len-- > 0 && *pos) {
+				++pos;
+			}
 		}
 	}
 	if (*pos == '\0') {
@@ -614,7 +616,10 @@ static char *php_mb_rfc1867_getword(const zend_encoding *encoding, char **line,
 	res = estrndup(*line, pos - *line);
 
 	while (*pos == stop) {
-		pos += php_mb_mbchar_bytes(pos, (const mbfl_encoding *)encoding);
+		size_t len = php_mb_mbchar_bytes(pos, (const mbfl_encoding *)encoding);
+		while (len-- > 0 && *pos) {
+			++pos;
+		}
 	}
 
 	*line = pos;

ext/mbstring/tests/mb_rfc1867_getword_overread.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Over-read in php_mb_rfc1867_getword() on a multibyte field name (mbstring.encoding_translation=On)
+--EXTENSIONS--
+mbstring
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=blah
+
+--blah
+Content-Disposition: form-data; name=a×
+
+x
+--blah--
+--INI--
+mbstring.encoding_translation=On
+--FILE--
+<?php
+var_dump(count($_POST));
+echo "Done\n";
+?>
+--EXPECT--
+int(1)
+Done