#38401 [Opn->Bgs]: preg_match segfaults with large negative lookaheads (pcre bug)

ID: 38401 Updated by: tony2001@php.net Reported By: ibexris at gmail dot com -Status: Open +Status: Bogus Bug Type: Reproducible crash Operating System: FC5 PHP Version: 5.1.4 New Comment: Not reproducible, because run-time configurable backtracking/recursion limits were added in PHP 5.2.0RC1. Also, PCRE bugs do not belong here, this system is for PHP bugs. Previous Comments: ------------------------------------------------------------------------ [2006-08-09 20:27:02] ibexris at gmail dot com Please test what? I said that the pcre author knows about the problem, can replicate it, and that it will someday be fixed, not that it *is* fixed. Anyway, I can't run a prerelease version of php -- all of my systems are in production, so it'll have to wait until php releases a new version that gets picked up by redhat/fedora. ------------------------------------------------------------------------ [2006-08-09 19:16:37] tony2001@php.net Please try using this CVS snapshot: http://snaps.php.net/php5.2-latest.tar.gz For Windows: http://snaps.php.net/win32/php5.2-win32-latest.zip ------------------------------------------------------------------------ [2006-08-09 18:50:01] ibexris at gmail dot com Description: ------------ This is a rehash/update of Bug #27525 (http://bugs.php.net/bug.php?id=27525), which I can't update (you guys really need a way for new people to add comments to existing tickets). Not sure if the original submitter ever emailed Philip, but after bumping my head against this problem yesterday, I contacted him myself. He is now able to reproduce the bug in the current version of pcre (6.7), and expects to have a fix sometime in september or october (the first chance he'll have to actually look at the code). I've created this new ticket because there will be a pending fix upstream. fyi, better code to reproduce: <?php $string = str_repeat('x', 11000); $pattern = '/(.(?!b))*/'; echo preg_match($pattern, $string); ?> And a workaround, since none was posted before: <?php $pattern = '/(.(?!b)){0,540}/'; ?> You can't go above 540 because preg_replace complains about the pattern being too large. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=38401&edit=1