Bug #7509 Updated: Problem (buffer overflow?) with ereg()
| From: | estelle at megaphone dot ch | Date: | Wed, 10 Jul 2002 18:24:58 +0000 |
| Subject: | Bug #7509 Updated: Problem (buffer overflow?) with ereg() | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-13759@lists.php.net to get a copy of this message | ||
ID: 7509
Updated by: estelle@megaphone.ch
Reported By: ignacio@openservices.net
Status: Closed
Bug Type: Regexps related
Operating System: Red Hat Linux 6.2
PHP Version: 4.0 Latest CVS (28/10/2000)
New Comment:
Solaris 8, php 4.1.2, apache 1.3.26 (dso). Recompiled PHP
--with-regex=php : problem still here.
httpd child takes 100% CPU on the ereg function.
Previous Comments:
------------------------------------------------------------------------
[2000-10-30 12:57:37] ignacio@openservices.net
Hmm... configured with '--with-regex=php' and it works fine now. Oh
well. Time to dig through the source and send Red Hat a bug report I
suppose.
------------------------------------------------------------------------
[2000-10-28 06:12:58] ignacio@openservices.net
When I give ereg() a sufficiently complex RE, PHP seems to roll over
and die or something the next time it calls ereg(). It has exhibited
this behavior since 4.0.1pl2, when we first put the code in place.
Here's the code:
"""
while
(ereg("^((.|\n)*)<[[:space:]]*[Ff][Oo][Rr][Mm][Ss][Ee][Tt][[:space:]]*([Tt][Yy][Pp][Ee]=(\"[^\"]*\"|[^\">]*))?[[:space:]]*>((.|\n)*)$",
$string, $out))
{
error_log("after 1",0);
flush();
if ($out[4][0]=="\"")
{
error_log("after 2",0);
flush();
$type=substr($out[4], 1, -1);
error_log("after 3",0);
flush();
}
else
{
error_log("after 4",0);
flush();
$type=$out[4];
error_log("after 5",0);
flush();
};
error_log("after 6",0);
$string=$out[1].FORMSETFUN($type).$out[5];
error_log("after 7",0);
flush();
$formexists=1;
};
error_log("after formset",0);
flush();
"""
It gets to "after 7" and then dies. If the 'while' is changed to an
'if', the problem exhibits itself on subsequent calls to ereg() further
down.
PHP is configured to use the system RE libs, so I'm wondering if the
problem might be in there. Nonetheless, I'm putting it in the PHP bug
list so I can be sure.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=7509&edit=1