From: ilya at lebedev dot net
Operating system: Win32
PHP version: 4CVS-2003-10-04 (stable)
PHP Bug Type: Reproducible crash
Bug description: preg_replace and preg_replace_callback are crash on long matches
Description:
------------
Regular expression from the J.Friedl's "Mastering regular expressions"
book that matches pair html tags:
#<tag([^>]*)>(((?!</?tag(?:[^>]*)>).)*)</tag>#si
When between <tag> and </tag> are more then 2100 bytes (symbols), Apache
crashes.
Same happens without "s" modifier, if string has no "newline" codes.
Reproduce code:
---------------
===
preg_replace("#<tag([^>]*)>(((?!</?tag(?:[^>]*)>).)*)</tag>#si","","<tag>
2200 symbols</tag>");
===
or
===
function callback (&$m) { return "";};
preg_replace_callback
("#<tag([^>]*)>(((?!</?tag(?:[^>]*)>).)*)</tag>#si","callback","<tag> 2200
symbols </tag>");
===
Expected result:
----------------
Match blocks bigger then 2100 symbols long.
Actual result:
--------------
With more then 2100 sybmols between tags Apache crashes.
--
Edit bug report at http://bugs.php.net/?id=25754&edit=1
--
Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=25754&r=trysnapshot4
Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=25754&r=trysnapshot5
Fixed in CVS: http://bugs.php.net/fix.php?id=25754&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=25754&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=25754&r=needtrace
Try newer version: http://bugs.php.net/fix.php?id=25754&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=25754&r=support
Expected behavior: http://bugs.php.net/fix.php?id=25754&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=25754&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=25754&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=25754&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=25754&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=25754&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=25754&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=25754&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=25754&r=float
