Index: php-5.3.17/ext/mbstring/oniguruma/regparse.c
===================================================================
--- php-5.3.17.orig/ext/mbstring/oniguruma/regparse.c	2019-03-11 18:09:27.706595336 +0100
+++ php-5.3.17/ext/mbstring/oniguruma/regparse.c	2019-03-11 18:10:18.406839678 +0100
@@ -267,6 +267,7 @@ strdup_with_null(OnigEncoding enc, UChar
   c = ONIGENC_MBC_TO_CODE(enc, p, end); \
   pfetch_prev = p; \
   p += ONIGENC_MBC_ENC_LEN(enc, p); \
+  if(UNEXPECTED(p > end)) p = end; \
 } while (0)
 
 #define PPEEK        (p < end ? ONIGENC_MBC_TO_CODE(enc, p, end) : PEND_VALUE)
@@ -3380,7 +3381,9 @@ fetch_token(OnigToken* tok, UChar** src,
 	tok->u.code = (OnigCodePoint )num;
       }
       else { /* string */
-	p = tok->backp + enc_len(enc, tok->backp);
+	int len;
+        SAFE_ENC_LEN(enc, tok->backp, end, len);
+        p = tok->backp + len;
       }
       break;
     }
Index: php-5.3.17/ext/mbstring/oniguruma/regcomp.c
===================================================================
--- php-5.3.17.orig/ext/mbstring/oniguruma/regcomp.c	2019-03-11 18:09:27.706595336 +0100
+++ php-5.3.17/ext/mbstring/oniguruma/regcomp.c	2019-03-11 18:10:18.406839678 +0100
@@ -447,13 +447,13 @@ compile_length_string_node(Node* node, r
   ambig = NSTRING_IS_AMBIG(node);
 
   p = prev = sn->s;
-  prev_len = enc_len(enc, p);
+  SAFE_ENC_LEN(enc, p, sn->end, prev_len);
   p += prev_len;
   slen = 1;
   rlen = 0;
 
   for (; p < sn->end; ) {
-    len = enc_len(enc, p);
+    SAFE_ENC_LEN(enc, p, sn->end, len);
     if (len == prev_len) {
       slen++;
     }
@@ -496,12 +496,12 @@ compile_string_node(Node* node, regex_t*
   ambig = NSTRING_IS_AMBIG(node);
 
   p = prev = sn->s;
-  prev_len = enc_len(enc, p);
+  SAFE_ENC_LEN(enc, p, end, prev_len);
   p += prev_len;
   slen = 1;
 
   for (; p < end; ) {
-    len = enc_len(enc, p);
+    SAFE_ENC_LEN(enc, p, end, len);
     if (len == prev_len) {
       slen++;
     }
Index: php-5.3.17/ext/mbstring/oniguruma/regparse.h
===================================================================
--- php-5.3.17.orig/ext/mbstring/oniguruma/regparse.h	2019-03-11 18:09:27.710595355 +0100
+++ php-5.3.17/ext/mbstring/oniguruma/regparse.h	2019-03-11 18:10:18.406839678 +0100
@@ -325,4 +325,28 @@ extern int onig_print_names(FILE*, regex
 #endif
 #endif
 
+#if (defined (__GNUC__) && __GNUC__ > 2 ) && !defined(DARWIN) && !defined(__hpux) && !defined(_AIX)
+# define UNEXPECTED(condition) __builtin_expect(condition, 0)
+#else
+# define UNEXPECTED(condition) (condition)
+#endif
+
+#define SAFE_ENC_LEN(enc, p, end, res) do {  \
+    int __res = enc_len(enc, p);              \
+    if (UNEXPECTED(p + __res > end)) __res = end - p;    \
+       res = __res;                             \
+} while(0);
+
+#if (defined (__GNUC__) && __GNUC__ > 2 ) && !defined(DARWIN) && !defined(__hpux) && !defined(_AIX)
+# define UNEXPECTED(condition) __builtin_expect(condition, 0)
+#else
+# define UNEXPECTED(condition) (condition)
+#endif
+
+#define SAFE_ENC_LEN(enc, p, end, res) do {  \
+    int __res = enc_len(enc, p);              \
+    if (UNEXPECTED(p + __res > end)) __res = end - p;    \
+       res = __res;                             \
+} while(0);
+
 #endif /* REGPARSE_H */
Index: php-5.3.17/ext/mbstring/oniguruma/enc/utf16_be.c
===================================================================
--- php-5.3.17.orig/ext/mbstring/oniguruma/enc/utf16_be.c	2019-03-11 18:10:18.410839699 +0100
+++ php-5.3.17/ext/mbstring/oniguruma/enc/utf16_be.c	2019-03-11 18:12:15.343403559 +0100
@@ -79,11 +79,13 @@ utf16be_mbc_to_code(const UChar* p, cons
   OnigCodePoint code;
 
   if (UTF16_IS_SURROGATE_FIRST(*p)) {
+    if (end - p < 4) return 0;
     code = ((((p[0] - 0xd8) << 2) + ((p[1] & 0xc0) >> 6) + 1) << 16)
          + ((((p[1] & 0x3f) << 2) + (p[2] - 0xdc)) << 8)
          + p[3];
   }
   else {
+    if (end - p < 2) return 0;
     code = p[0] * 256 + p[1];
   }
   return code;
Index: php-5.3.17/ext/mbstring/oniguruma/enc/utf16_le.c
===================================================================
--- php-5.3.17.orig/ext/mbstring/oniguruma/enc/utf16_le.c	2019-03-11 18:10:18.410839699 +0100
+++ php-5.3.17/ext/mbstring/oniguruma/enc/utf16_le.c	2019-03-11 18:12:40.919526894 +0100
@@ -87,6 +87,7 @@ utf16le_mbc_to_code(const UChar* p, cons
   UChar c1 = *(p+1);
 
   if (UTF16_IS_SURROGATE_FIRST(c1)) {
+    if (end - p < 4) return 0;
     code = ((((c1 - 0xd8) << 2) + ((c0  & 0xc0) >> 6) + 1) << 16)
          + ((((c0 & 0x3f) << 2) + (p[3] - 0xdc)) << 8)
          + p[2];
Index: php-5.3.17/ext/mbstring/oniguruma/enc/utf32_be.c
===================================================================
--- php-5.3.17.orig/ext/mbstring/oniguruma/enc/utf32_be.c	2019-03-11 18:09:27.710595355 +0100
+++ php-5.3.17/ext/mbstring/oniguruma/enc/utf32_be.c	2019-03-11 18:10:18.410839699 +0100
@@ -56,6 +56,7 @@ utf32be_is_mbc_newline(const UChar* p, c
 static OnigCodePoint
 utf32be_mbc_to_code(const UChar* p, const UChar* end)
 {
+  if (end - p < 4) return 0;
   return (OnigCodePoint )(((p[0] * 256 + p[1]) * 256 + p[2]) * 256 + p[3]);
 }
 
Index: php-5.3.17/ext/mbstring/oniguruma/enc/utf32_le.c
===================================================================
--- php-5.3.17.orig/ext/mbstring/oniguruma/enc/utf32_le.c	2019-03-11 18:09:27.710595355 +0100
+++ php-5.3.17/ext/mbstring/oniguruma/enc/utf32_le.c	2019-03-11 18:10:18.410839699 +0100
@@ -56,6 +56,7 @@ utf32le_is_mbc_newline(const UChar* p, c
 static OnigCodePoint
 utf32le_mbc_to_code(const UChar* p, const UChar* end)
 {
+  if (end - p < 4) return 0;
   return (OnigCodePoint )(((p[3] * 256 + p[2]) * 256 + p[1]) * 256 + p[0]);
 }
 
