ID: 47811
Updated by: fel...@php.net
Reported By: travis at wikihow dot com
Status: Assigned
Bug Type: Reproducible crash
Operating System: CentOS release 4.4 & Mac OS 10.4
PHP Version: 5.2.9
Assigned To: nlopess
New Comment:
This stack overflow is expected. See the earlies bug reports.
Previous Comments:
------------------------------------------------------------------------
[2009-04-02 12:27:26] Phil dot H at gmx dot net
Another php preg_match crash using php 5.2.9-1 on Windows XP and
2003R2:
<?php
$string = str_repeat('blub ', 100000);
$regexp = '/ \G (?P<text> (?:.(?!\[% ))*.(?=\[%| $))/isx';
if (preg_match($regexp, $string, $aMatches, PREG_OFFSET_CAPTURE, 0)) {
echo "matched\n";
}
echo "finished";
?>
------------------------------------------------------------------------
[2009-03-30 12:22:15] paj...@php.net
Nuno, can you take a look please? Can reproduce it here too.
------------------------------------------------------------------------
[2009-03-30 11:24:40] scope at planetavent dot de
Here's another snippet:
<?php
$s =
"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";
$pattern = "@(X)*@";
$return = preg_match( $pattern, $s );
echo $return;
?>
This one crashes apache 2.2.8 and 2.2.11 with php-5.2.9 and php-5.2.9-1
on windows 2003.
------------------------------------------------------------------------
[2009-03-27 23:53:44] dennis dot birkholz at nexxes dot net
I have a similar segfault testcase for preg_match. It always crashes at
a stringlength of around 6700. PHP is 5.2.8 on gentoo linux.
# Create my test-string
for ($i=0; $i<20000; $i++) {
$string .= 'a';
}
# The pattern matches for \\, \", everything except " and "
$pattern = '/^(\\\\|\\"|[^"]|")+$/';
print "Trying with string length " . "\033" . '[s';
for ($counter=6600; $counter<strlen($string); $counter++) {
if (preg_match($pattern, substr($string,0,$counter), $matches)) {
print "\033" . '[u' . $counter . '...';
flush();
list($dummy, $aa) = $matches;
}
}
print "\n";
------------------------------------------------------------------------
[2009-03-27 17:26:38] travis at wikihow dot com
Description:
------------
Run a preg_match with source text attached and get a seg fault. Apache
2.2 / PHP 5.2.9 and PHP 5.2.4.
preg_match('@<object(.|\n)*</object>@im', $text, $matches);
Reproduce code:
---------------
http://wikidiy.com/php_bug_crash.txt
Expected result:
----------------
Apache not supposed to crash, completes preg_match, dumps $matches
array.
Actual result:
--------------
Apache seg faults
[Fri Mar 27 12:16:05 2009] [notice] child pid 6391 exit signal
Segmentation fault (11)
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=47811&edit=1
