Bug #52368 [Com]: crash in preg_replace_impl
Edit report at http://bugs.php.net/bug.php?id=52368edit=1
ID: 52368
Comment by: cobexer at gmail dot com
Reported by:cobexer at gmail dot com
Summary:crash in preg_replace_impl
Status: Feedback
Type: Bug
Package:PCRE related
Operating System: Debian Lenny (5.0.5)
PHP Version:5.2.13
Block user comment: N
New Comment:
i found a workaround for the crash:
as soon as i removed the $count parameter(and the $limit) tha crash was
gone =)
mixed preg_replace_callback ( mixed $pattern , callback $callback ,
mixed $subject [, int $limit = -1 [, int $count ]] )
regards cobexer
Previous Comments:
[2010-08-12 21:19:59] cobexer at gmail dot com
I did a quick test today
using http://snaps.php.net/php5.3-latest.tar.gz (from yesterday) does
not crash(as expected since the problem didn't exist there anyway).
however using http://snaps.php.net/php5.2-latest.tar.gz (from yesterday)
still crashes on the same line as before.
(tested on i586 openSuSE 11.4(Factory))
regards cobexer
[2010-08-09 03:19:31] fel...@php.net
Please try using this snapshot:
http://snaps.php.net/php5.3-latest.tar.gz
For Windows:
http://windows.php.net/snapshots/
[2010-07-30 21:24:40] cobexer at gmail dot com
hmm that crash is hard to nail down,
it doesn't crash on all of my computers, therefore i did the following:
* created crashing test script (currently ~150 Lines)
* compiled php 5.2.14 (with -O0) (in /php) on a i586 openSUSE Factory(a
bit newer than 11.3)
* created a core dump
* tar'gz ed it together
and uploaded that to http://gomorrah-online.de/php-5.2.14-crash.tar.gz
important contents:
scrash.php : the php script with the code to crash (run with php -e)
scrash.php.log : the output of the script till it crashed
php-bt.txt : output of bt and bt full
core : the coredump itself
maybe that helps already,
regards cobexer
[2010-07-18 19:39:03] fel...@php.net
Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves.
A proper reproducing script starts with ?php and ends with ?,
is max. 10-20 lines long and does not require any external
resources such as databases, etc. If the script requires a
database to demonstrate the issue, please make sure it creates
all necessary tables, stored procedures etc.
Please avoid embedding huge scripts into the report.
[2010-07-17 23:48:30] cobexer at gmail dot com
Description:
the crash occuring is most likely related to very high integer/double
values(10M) being inserted in a long string(~20K).
the problem does not occur on PHP5.3.something so it might be a simple
backport :). unless somebody can tell me how i get more information out
of the crashing process this is all i have (trying to print local
variables of the crashing function results in:
(gdb) p **regex
Cannot access memory at address 0x686f72393438343e
os similar
the regular expression involved is most likely:
'/\{([A-Z0-9_]*)(?:\|(?Pescaper[A-Z0-9_]+))?\}/'
executed by preg_replace_callback, where the callback is an
array('class_name', 'some_private_function')
if required i try to build a small test script and attach that - but i
guess its not required.
probably related to http://bugs.php.net/bug.php?id=39016
reproducible: always
Test script:
---
?php
//no test script currently available
?
Expected result:
no php crash correctly replaced string
Actual result:
--
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f877c078750 (LWP 6259)]
preg_replace_impl (ht=5, return_value=0x12a8a90,
return_value_ptr=0x137c970, this_ptr=0xb9e82fb02f28a27c,
return_value_used=0, is_callable_replace=0 '\0')
at /usr/src/php5/source/php5-5.2.13/Zend/zend_variables.h:32
warning: Source file is more recent than executable.
32 if (zvalue-type = IS_BOOL) {
(gdb) bt
#0 preg_replace_impl (ht=5, return_value=0x12a8a90,
return_value_ptr=0x137c970, this_ptr=0xb9e82fb02f28a27c,
return_value_used=0,
is_callable_replace=0 '\0') at
/usr/src/php5/source/php5-5.2.13/Zend/zend_variables.h:32
#1 0x7f8774cef3cd in zend_do_fcall_common_helper_SPEC
(execute_data=0x7fff5410) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:200
#2 0x7f8774cd8134 in execute (op_array=0xf02040) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:92
#3 0x7f8774ceecde in zend_do_fcall_common_helper_SPEC
Bug #52368 [Com]: crash in preg_replace_impl
Edit report at http://bugs.php.net/bug.php?id=52368edit=1
ID: 52368
Comment by: cobexer at gmail dot com
Reported by:cobexer at gmail dot com
Summary:crash in preg_replace_impl
Status: Feedback
Type: Bug
Package:PCRE related
Operating System: Debian Lenny (5.0.5)
PHP Version:5.2.13
Block user comment: N
New Comment:
I did a quick test today
using http://snaps.php.net/php5.3-latest.tar.gz (from yesterday) does
not crash(as expected since the problem didn't exist there anyway).
however using http://snaps.php.net/php5.2-latest.tar.gz (from yesterday)
still crashes on the same line as before.
(tested on i586 openSuSE 11.4(Factory))
regards cobexer
Previous Comments:
[2010-08-09 03:19:31] fel...@php.net
Please try using this snapshot:
http://snaps.php.net/php5.3-latest.tar.gz
For Windows:
http://windows.php.net/snapshots/
[2010-07-30 21:24:40] cobexer at gmail dot com
hmm that crash is hard to nail down,
it doesn't crash on all of my computers, therefore i did the following:
* created crashing test script (currently ~150 Lines)
* compiled php 5.2.14 (with -O0) (in /php) on a i586 openSUSE Factory(a
bit newer than 11.3)
* created a core dump
* tar'gz ed it together
and uploaded that to http://gomorrah-online.de/php-5.2.14-crash.tar.gz
important contents:
scrash.php : the php script with the code to crash (run with php -e)
scrash.php.log : the output of the script till it crashed
php-bt.txt : output of bt and bt full
core : the coredump itself
maybe that helps already,
regards cobexer
[2010-07-18 19:39:03] fel...@php.net
Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves.
A proper reproducing script starts with ?php and ends with ?,
is max. 10-20 lines long and does not require any external
resources such as databases, etc. If the script requires a
database to demonstrate the issue, please make sure it creates
all necessary tables, stored procedures etc.
Please avoid embedding huge scripts into the report.
[2010-07-17 23:48:30] cobexer at gmail dot com
Description:
the crash occuring is most likely related to very high integer/double
values(10M) being inserted in a long string(~20K).
the problem does not occur on PHP5.3.something so it might be a simple
backport :). unless somebody can tell me how i get more information out
of the crashing process this is all i have (trying to print local
variables of the crashing function results in:
(gdb) p **regex
Cannot access memory at address 0x686f72393438343e
os similar
the regular expression involved is most likely:
'/\{([A-Z0-9_]*)(?:\|(?Pescaper[A-Z0-9_]+))?\}/'
executed by preg_replace_callback, where the callback is an
array('class_name', 'some_private_function')
if required i try to build a small test script and attach that - but i
guess its not required.
probably related to http://bugs.php.net/bug.php?id=39016
reproducible: always
Test script:
---
?php
//no test script currently available
?
Expected result:
no php crash correctly replaced string
Actual result:
--
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f877c078750 (LWP 6259)]
preg_replace_impl (ht=5, return_value=0x12a8a90,
return_value_ptr=0x137c970, this_ptr=0xb9e82fb02f28a27c,
return_value_used=0, is_callable_replace=0 '\0')
at /usr/src/php5/source/php5-5.2.13/Zend/zend_variables.h:32
warning: Source file is more recent than executable.
32 if (zvalue-type = IS_BOOL) {
(gdb) bt
#0 preg_replace_impl (ht=5, return_value=0x12a8a90,
return_value_ptr=0x137c970, this_ptr=0xb9e82fb02f28a27c,
return_value_used=0,
is_callable_replace=0 '\0') at
/usr/src/php5/source/php5-5.2.13/Zend/zend_variables.h:32
#1 0x7f8774cef3cd in zend_do_fcall_common_helper_SPEC
(execute_data=0x7fff5410) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:200
#2 0x7f8774cd8134 in execute (op_array=0xf02040) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:92
#3 0x7f8774ceecde in zend_do_fcall_common_helper_SPEC
(execute_data=0x7fff5760) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:234
#4 0x7f8774cd8134 in execute (op_array=0xef48b0) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:92
#5 0x7f8774ceecde in zend_do_fcall_common_helper_SPEC
(execute_data=0x7fff5e70) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:234
#6 0x7f8774cd8134 in execute
Bug #52368 [Com]: crash in preg_replace_impl
Edit report at http://bugs.php.net/bug.php?id=52368edit=1
ID: 52368
Comment by: cobexer at gmail dot com
Reported by:cobexer at gmail dot com
Summary:crash in preg_replace_impl
Status: Feedback
Type: Bug
Package:PCRE related
Operating System: Debian Lenny (5.0.5)
PHP Version:5.2.13
Block user comment: N
New Comment:
hmm that crash is hard to nail down,
it doesn't crash on all of my computers, therefore i did the following:
* created crashing test script (currently ~150 Lines)
* compiled php 5.2.14 (with -O0) (in /php) on a i586 openSUSE Factory(a
bit newer than 11.3)
* created a core dump
* tar'gz ed it together
and uploaded that to http://gomorrah-online.de/php-5.2.14-crash.tar.gz
important contents:
scrash.php : the php script with the code to crash (run with php -e)
scrash.php.log : the output of the script till it crashed
php-bt.txt : output of bt and bt full
core : the coredump itself
maybe that helps already,
regards cobexer
Previous Comments:
[2010-07-18 19:39:03] fel...@php.net
Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves.
A proper reproducing script starts with ?php and ends with ?,
is max. 10-20 lines long and does not require any external
resources such as databases, etc. If the script requires a
database to demonstrate the issue, please make sure it creates
all necessary tables, stored procedures etc.
Please avoid embedding huge scripts into the report.
[2010-07-17 23:48:30] cobexer at gmail dot com
Description:
the crash occuring is most likely related to very high integer/double
values(10M) being inserted in a long string(~20K).
the problem does not occur on PHP5.3.something so it might be a simple
backport :). unless somebody can tell me how i get more information out
of the crashing process this is all i have (trying to print local
variables of the crashing function results in:
(gdb) p **regex
Cannot access memory at address 0x686f72393438343e
os similar
the regular expression involved is most likely:
'/\{([A-Z0-9_]*)(?:\|(?Pescaper[A-Z0-9_]+))?\}/'
executed by preg_replace_callback, where the callback is an
array('class_name', 'some_private_function')
if required i try to build a small test script and attach that - but i
guess its not required.
probably related to http://bugs.php.net/bug.php?id=39016
reproducible: always
Test script:
---
?php
//no test script currently available
?
Expected result:
no php crash correctly replaced string
Actual result:
--
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f877c078750 (LWP 6259)]
preg_replace_impl (ht=5, return_value=0x12a8a90,
return_value_ptr=0x137c970, this_ptr=0xb9e82fb02f28a27c,
return_value_used=0, is_callable_replace=0 '\0')
at /usr/src/php5/source/php5-5.2.13/Zend/zend_variables.h:32
warning: Source file is more recent than executable.
32 if (zvalue-type = IS_BOOL) {
(gdb) bt
#0 preg_replace_impl (ht=5, return_value=0x12a8a90,
return_value_ptr=0x137c970, this_ptr=0xb9e82fb02f28a27c,
return_value_used=0,
is_callable_replace=0 '\0') at
/usr/src/php5/source/php5-5.2.13/Zend/zend_variables.h:32
#1 0x7f8774cef3cd in zend_do_fcall_common_helper_SPEC
(execute_data=0x7fff5410) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:200
#2 0x7f8774cd8134 in execute (op_array=0xf02040) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:92
#3 0x7f8774ceecde in zend_do_fcall_common_helper_SPEC
(execute_data=0x7fff5760) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:234
#4 0x7f8774cd8134 in execute (op_array=0xef48b0) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:92
#5 0x7f8774ceecde in zend_do_fcall_common_helper_SPEC
(execute_data=0x7fff5e70) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:234
#6 0x7f8774cd8134 in execute (op_array=0xf03780) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:92
#7 0x7f8774ceecde in zend_do_fcall_common_helper_SPEC
(execute_data=0x7fff6330) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:234
#8 0x7f8774cd8134 in execute (op_array=0xf02c90) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:92
#9 0x7f8774ceecde in zend_do_fcall_common_helper_SPEC
(execute_data=0x7fff9ac0) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:234
#10 0x7f8774cd8134 in execute (op_array=0xa2aa70) at
/usr/src/php5/source/php5-5.2.13/Zend/zend_vm_execute.h:92
#11 0x7f8774cb41c8 in zend_execute_scripts (type=32767, retval=0x0,
file_count=-25624) at
