#47520 [Opn->Bgs]: PHP segfaulted in preg_replace on processing long string
ID: 47520
Updated by: felipe@php.net
Reported By: pahan at hubbitus dot spb dot su
-Status: Open
+Status: Bogus
Bug Type: PCRE related
Operating System: Linux
PHP Version: 5.3.0beta1
New Comment:
Please, check the previous reports about this issue:
http://bugs.php.net/search.php?search_for=&boolean=1&limit=10&order_by=id&direction=DESC&cmd=display&status=Bogus&bug_type%5B%5D=PCRE+related&php_os=&phpver=&assign=&author_email=&bug_age=0
http://docs.php.net/manual/en/pcre.configuration.php
Previous Comments:
------------------------------------------------------------------------
[2009-02-27 11:13:58] pahan at hubbitus dot spb dot su
Description:
------------
PHP segfaulted when I try replace in long string by next regexp:
'((?>(?:[^']|(?<=\\\)')*))'
Some comments to reproduce code comments to case 1 and 2 is clearly.
In case 3 and 4 I just run script several times, like (assume file
named test.php):
for (( i=100; i>0; i-- )) ; do echo -n $i: ; ./test.php ; done
Sample results of its run you may see here:
http://ru.bir.ru/_temp/php-pcre-bug/2/4965.log
for 3 (files named by
length of tested string), and for 4 -
http://ru.bir.ru/_temp/php-pcre-bug/2/4967.log
Coredump may be downloaded here:
http://ru.bir.ru/_temp/php-pcre-bug/2/core.10135
Also, please note, I add construction (?> ... ) to speedup and
dissallow recursion, so, it is must be different from bugs
http://bugs.php.net/bug.php?id=27492 ,
http://bugs.php.net/bug.php?id=47376 ,
http://bugs.php.net/bug.php?id=47376 and
http://bugs.php.net/bug.php?id=27310 .
Reproduce code:
---------------
<?
$cont = "'" . str_pad('', 5000, '-');<->//1: Always
"segmantation
fault"
//$cont = "'" . str_pad('', 4000, '-');>//2: "Never"
(Is I can see in
1000 iterations) "segmantation fault"
//$cont = "'" . str_pad('', 4965, '-');>//3: Segfaulted from
times to
times ~ 1-2 times from 100 executions
//$cont = "'" . str_pad('', 4967, '-');>//4: Segfaulted 50/50%
$reg = "#'((?>(?:[^']|(?<=\\\)')*))'#";
preg_replace($reg, '', $cont);
echo "OK\n";
?>
Expected result:
----------------
OK
Actual result:
--------------
Segmentation fault
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=47520&edit=1
Thread (9 messages)