From:
Operating system: all
PHP version: 5.3.2
Package: PCRE related
Bug Type: Bug
Bug description:Segfault with preg_replace
Description:
------------
You can make a segfault with a particular regexp (that appears to be used
in Mysqli, or in Zend Framework at least).
This bug appears on :
PHP 5.3.2
PHP 5.2.10
PHP 4
with internal pcrelib of course.
NOTE:
I cannot reproduce this bug everytime. Once in a while, the segfault is not
triggered (weird ...).
NOTE 2:
Same bug (segfault) with preg_match or preg_match_all
Test script:
---------------
<?php
preg_replace("/'(\\\\'|\\\\{2}|[^'])*'/",
'',
"'".str_repeat("a", 50000)
);
// Note : the bug can be triggered with str_repeat('a', 5000) also.
// Longer the string is, more chance you have to trigger the segfault
Expected result:
----------------
working code :)
Actual result:
--------------
Segmentation fault
match (eptr=0xb750b3b7 'a' <repeats 200 times>..., ecode=0x8dcd78e "_",
mstart=0xb7508c64 "'", 'a' <repeats 199 times>..., offset_top=4,
md=0xbfdced54, ims=0, eptrb=0x0, flags=0, rdepth=20133) at
/usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:454
454 {
#0 match (eptr=0xb750b3b7 'a' <repeats 200 times>..., ecode=0x8dcd78e "_",
mstart=0xb7508c64 "'", 'a' <repeats 199 times>..., offset_top=4,
md=0xbfdced54, ims=0, eptrb=0x0, flags=0, rdepth=20133) at
/usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:454
#1 0x080ebc9a in match (eptr=Variable "eptr" is not available.
) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:1533
#2 0x080e78f4 in match (eptr=Variable "eptr" is not available.
) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:734
#3 0x080ebc9a in match (eptr=Variable "eptr" is not available.
) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:1533
#4 0x080e78f4 in match (eptr=Variable "eptr" is not available.
) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:734
#5 0x080ebc9a in match (eptr=Variable "eptr" is not available.
) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:1533
#6 0x080e78f4 in match (eptr=Variable "eptr" is not available.
) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:734
[ ... snip because backtrace shows what appears to be a loop ... ]
#20131 0x080ebc9a in match (eptr=Variable "eptr" is not available.
) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:1533
#20132 0x080e78f4 in match (eptr=Variable "eptr" is not available.
) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:734
#20133 0x080e7df8 in match (eptr=Variable "eptr" is not available.
) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:1395
#20134 0x080f235a in php_pcre_exec (argument_re=0x8dcd760,
extra_data=0xbfdceef4, subject=0xb7508c64 "'", 'a' <repeats 199 times>...,
length=50001, start_offset=0, options=Variable "options" is not
available.
) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:5641
#20135 0x080f62a9 in php_pcre_replace_impl (pce=0x8dcd8f8,
subject=0xb7508c64 "'", 'a' <repeats 199 times>..., subject_len=50001,
replace_val=0xb74fad54, is_callable_replace=0, result_len=0xbfdcf088,
limit=-1, replace_count=0xbfdcf074)
at /usr/src/php/php-5.3.2/ext/pcre/php_pcre.c:1040
#20136 0x080f6fc5 in php_pcre_replace (regex=0xb74fb284
"/'(\\\\'|\\\\{2}|[^'])*'/", regex_len=21,
subject=0xb7508c64 "'", 'a' <repeats 199 times>..., subject_len=50001,
replace_val=0xb74fad54, is_callable_replace=0, result_len=0xbfdcf088,
limit=-1, replace_count=0xbfdcf074) at
/usr/src/php/php-5.3.2/ext/pcre/php_pcre.c:950
#20137 0x080f7542 in php_replace_in_subject (regex=0xb74fad70,
replace=Variable "replace" is not available.
) at /usr/src/php/php-5.3.2/ext/pcre/php_pcre.c:1267
#20138 0x080f7bb6 in preg_replace_impl (ht=Variable "ht" is not available.
) at /usr/src/php/php-5.3.2/ext/pcre/php_pcre.c:1365
#20139 0x084b3c81 in zend_do_fcall_common_helper_SPEC
(execute_data=0xb7470028) at zend_vm_execute.h:313
#20140 0x084acf86 in execute (op_array=0xb74fb1ec) at
zend_vm_execute.h:104
#20141 0x08484fe6 in zend_execute_scripts (type=8, retval=0x0,
file_count=3) at /usr/src/php/php-5.3.2/Zend/zend.c:1194
#20142 0x0842c036 in php_execute_script (primary_file=0xbfdd16f4) at
/usr/src/php/php-5.3.2/main/main.c:2260
#20143 0x085157e8 in main (argc=2, argv=0xbfdd1854) at
/usr/src/php/php-5.3.2/sapi/cli/php_cli.c:1192
--
Edit bug report at http://bugs.php.net/bug.php?id=51238&edit=1
--
Try a snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=51238&r=trysnapshot52
Try a snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=51238&r=trysnapshot53
Try a snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=51238&r=trysnapshot60
Fixed in SVN:
http://bugs.php.net/fix.php?id=51238&r=fixed
Fixed in SVN and need be documented:
http://bugs.php.net/fix.php?id=51238&r=needdocs
Fixed in release:
http://bugs.php.net/fix.php?id=51238&r=alreadyfixed
Need backtrace:
http://bugs.php.net/fix.php?id=51238&r=needtrace
Need Reproduce Script:
http://bugs.php.net/fix.php?id=51238&r=needscript
Try newer version:
http://bugs.php.net/fix.php?id=51238&r=oldversion
Not developer issue:
http://bugs.php.net/fix.php?id=51238&r=support
Expected behavior:
http://bugs.php.net/fix.php?id=51238&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=51238&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=51238&r=submittedtwice
register_globals:
http://bugs.php.net/fix.php?id=51238&r=globals
PHP 4 support discontinued: http://bugs.php.net/fix.php?id=51238&r=php4
Daylight Savings: http://bugs.php.net/fix.php?id=51238&r=dst
IIS Stability:
http://bugs.php.net/fix.php?id=51238&r=isapi
Install GNU Sed:
http://bugs.php.net/fix.php?id=51238&r=gnused
Floating point limitations:
http://bugs.php.net/fix.php?id=51238&r=float
No Zend Extensions:
http://bugs.php.net/fix.php?id=51238&r=nozend
MySQL Configuration Error:
http://bugs.php.net/fix.php?id=51238&r=mysqlcfg
