#47520 [NEW]: PHP segfaulted in preg_replace on processing long string
From: pahan at hubbitus dot spb dot su
Operating system: Linux
PHP version: 5.3.0beta1
PHP Bug Type: PCRE related
Bug description: PHP segfaulted in preg_replace on processing long string
Description:
------------
PHP segfaulted when I try replace in long string by next regexp:
'((?>(?:[^']|(?<=\\\)')*))'
Some comments to reproduce code comments to case 1 and 2 is clearly.
In case 3 and 4 I just run script several times, like (assume file named
test.php):
for (( i=100; i>0; i-- )) ; do echo -n $i: ; ./test.php ; done
Sample results of its run you may see here:
http://ru.bir.ru/_temp/php-pcre-bug/2/4965.log
for 3 (files named by length
of tested string), and for 4 -
http://ru.bir.ru/_temp/php-pcre-bug/2/4967.log
Coredump may be downloaded here:
http://ru.bir.ru/_temp/php-pcre-bug/2/core.10135
Also, please note, I add construction (?> ... ) to speedup and dissallow
recursion, so, it is must be different from bugs
http://bugs.php.net/bug.php?id=27492 , http://bugs.php.net/bug.php?id=47376
, http://bugs.php.net/bug.php?id=47376 and
http://bugs.php.net/bug.php?id=27310 .
Reproduce code:
---------------
<?
$cont = "'" . str_pad('', 5000, '-');<->//1: Always
"segmantation fault"
//$cont = "'" . str_pad('', 4000, '-');>//2: "Never"
(Is I can see in 1000
iterations) "segmantation fault"
//$cont = "'" . str_pad('', 4965, '-');>//3: Segfaulted from
times to
times ~ 1-2 times from 100 executions
//$cont = "'" . str_pad('', 4967, '-');>//4: Segfaulted 50/50%
$reg = "#'((?>(?:[^']|(?<=\\\)')*))'#";
preg_replace($reg, '', $cont);
echo "OK\n";
?>
Expected result:
----------------
OK
Actual result:
--------------
Segmentation fault
--
Edit bug report at http://bugs.php.net/?id=47520&edit=1
--
Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=47520&r=trysnapshot52
Try a CVS snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=47520&r=trysnapshot53
Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=47520&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=47520&r=fixedcvs
Fixed in CVS and need be documented: http://bugs.php.net/fix.php?id=47520&r=needdocs
Fixed in release: http://bugs.php.net/fix.php?id=47520&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=47520&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=47520&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=47520&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=47520&r=support
Expected behavior: http://bugs.php.net/fix.php?id=47520&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=47520&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=47520&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=47520&r=globals
PHP 4 support discontinued: http://bugs.php.net/fix.php?id=47520&r=php4
Daylight Savings: http://bugs.php.net/fix.php?id=47520&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=47520&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=47520&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=47520&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=47520&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=47520&r=mysqlcfg
Thread (9 messages)
- pahan at hubbitus dot spb dot su