Bug #15829 Updated: using nonexistingn back reference in regex crashes PHP

ID: 15829 Updated by: sniper@php.net Reported By: sander@php.net -Status: Feedback +Status: Closed Bug Type: Reproducible crash Operating System: Debian (Sid) Linux PHP Version: 4.0CVS-2002-03-0 New Comment: Good, closing these then. Previous Comments: ------------------------------------------------------------------------ [2002-06-17 18:44:46] msopacua@idg.nl Repository revision: 1.63 /repository/php4/ext/standard/reg.c,v fixes the issue for me. ------------------------------------------------------------------------ [2002-06-17 17:34:39] sniper@php.net There was some patch put in just today..could you try the latest snapshot (or preferrably get all the stuff straight from CVS..if you don't do that already :) ------------------------------------------------------------------------ [2002-06-17 17:19:02] msopacua@idg.nl As referred from dupe 17786. I can't get a good backtrace, but I'm sure I have a debug build, since phpinfo() says so and I have several leak reports my error log, when running chora 1.1. I also was able to reproduce it in apache, but the debug info is exactly the same. Even forcing CFLAGS=-g doesn't help. ------------------------------------------------------------------------ [2002-04-12 15:42:10] cynic@php.net I'm afraid this will get through terribly mangled... roman@roman ~/install/php4-latest > cat ~/tmp/ereg.test 141:1 <? $foo = "abc123"; echo ereg_replace("123", 'def\1ghi', $foo); echo "\n"; ?> roman@roman ~/install/php4-latest > ./php -c /dev/null -qC ~/tmp/ereg.test 142:0 zsh: 84733 segmentation fault (core dumped) ./php -c /dev/null -qC ~/tmp/ereg.test roman@roman ~/install/php4-latest > gdb ./php ./php.core 144:0 GNU gdb 4.18 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"... Core was generated by `php'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/lib/libhistory.so.4...done. Reading symbols from /usr/lib/libreadline.so.4...done. Reading symbols from /usr/lib/libncurses.so.5...done. Reading symbols from /usr/local/lib/libgiconv.so.2...done. Reading symbols from /usr/local/lib/libintl.so.1...done. Reading symbols from /usr/lib/libssl.so.2...done. Reading symbols from /usr/lib/libcrypto.so.2...done. Reading symbols from /usr/local/lib/libcurl.so.2...done. Reading symbols from /usr/lib/libbz2.so.1...done. Reading symbols from /usr/lib/libz.so.2...done. Reading symbols from /usr/lib/libcrypt.so.2...done. Reading symbols from /usr/lib/libm.so.2...done. Reading symbols from /usr/lib/libc.so.4...done. Reading symbols from /usr/libexec/ld-elf.so.1...done. #0 0x284c7c82 in memcpy () from /usr/lib/libc.so.4 (gdb) bt #0 0x284c7c82 in memcpy () from /usr/lib/libc.so.4 #1 0xd570337c in ?? () #2 0x80cd88a in php_ereg_replace (ht=3, return_value=0x820b864, this_ptr=0x0, return_value_used=1, icase=0) at /home/roman/install/php4-latest/ext/standard/reg.c:476 #3 0x80cd9d8 in zif_ereg_replace (ht=3, return_value=0x820b864, this_ptr=0x0, return_value_used=1) at /home/roman/install/php4-latest/ext/standard/reg.c:494 #4 0x815633a in execute (op_array=0x820c724) at /home/roman/install/php4-latest/Zend/zend_execute.c:1598 #5 0x8145f6d in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/roman/install/php4-latest/Zend/zend.c:810 #6 0x8118b69 in php_execute_script (primary_file=0xbfbffa78) at /home/roman/install/php4-latest/main/main.c:1405 #7 0x815baf4 in main (argc=5, argv=0xbfbffaf4) at /home/roman/install/php4-latest/sapi/cgi/cgi_main.c:1020 #8 0x8064819 in _start () (gdb) ------------------------------------------------------------------------ [2002-04-12 15:22:41] sander@php.net I reported this BEFORE 4.2.0 was branched. I can't reproduce it anymore with todya's HEAD. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/15829 -- Edit this bug report at http://bugs.php.net/?id=15829&edit=1