#38401 [NEW]: preg_match segfaults with large negative lookaheads (pcre bug)

From: ibexris at gmail dot com Operating system: FC5 PHP version: 5.1.4 PHP Bug Type: Reproducible crash Bug description: preg_match segfaults with large negative lookaheads (pcre bug) Description: ------------ This is a rehash/update of Bug #27525 (http://bugs.php.net/bug.php?id=27525), which I can't update (you guys really need a way for new people to add comments to existing tickets). Not sure if the original submitter ever emailed Philip, but after bumping my head against this problem yesterday, I contacted him myself. He is now able to reproduce the bug in the current version of pcre (6.7), and expects to have a fix sometime in september or october (the first chance he'll have to actually look at the code). I've created this new ticket because there will be a pending fix upstream. fyi, better code to reproduce: <?php $string = str_repeat('x', 11000); $pattern = '/(.(?!b))*/'; echo preg_match($pattern, $string); ?> And a workaround, since none was posted before: <?php $pattern = '/(.(?!b)){0,540}/'; ?> You can't go above 540 because preg_replace complains about the pattern being too large. -- Edit bug report at http://bugs.php.net/?id=38401&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=38401&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=38401&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=38401&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=38401&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=38401&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=38401&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=38401&r=needscript Try newer version: http://bugs.php.net/fix.php?id=38401&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=38401&r=support Expected behavior: http://bugs.php.net/fix.php?id=38401&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=38401&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=38401&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=38401&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=38401&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=38401&r=dst IIS Stability: http://bugs.php.net/fix.php?id=38401&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=38401&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=38401&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=38401&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=38401&r=mysqlcfg