Bug #51238 [NEW]: Segfault with preg_replace

From: Operating system: all PHP version: 5.3.2 Package: PCRE related Bug Type: Bug Bug description:Segfault with preg_replace Description: ------------ You can make a segfault with a particular regexp (that appears to be used in Mysqli, or in Zend Framework at least). This bug appears on : PHP 5.3.2 PHP 5.2.10 PHP 4 with internal pcrelib of course. NOTE: I cannot reproduce this bug everytime. Once in a while, the segfault is not triggered (weird ...). NOTE 2: Same bug (segfault) with preg_match or preg_match_all Test script: --------------- <?php preg_replace("/'(\\\\'|\\\\{2}|[^'])*'/", '', "'".str_repeat("a", 50000) ); // Note : the bug can be triggered with str_repeat('a', 5000) also. // Longer the string is, more chance you have to trigger the segfault Expected result: ---------------- working code :) Actual result: -------------- Segmentation fault match (eptr=0xb750b3b7 'a' <repeats 200 times>..., ecode=0x8dcd78e "_", mstart=0xb7508c64 "'", 'a' <repeats 199 times>..., offset_top=4, md=0xbfdced54, ims=0, eptrb=0x0, flags=0, rdepth=20133) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:454 454 { #0 match (eptr=0xb750b3b7 'a' <repeats 200 times>..., ecode=0x8dcd78e "_", mstart=0xb7508c64 "'", 'a' <repeats 199 times>..., offset_top=4, md=0xbfdced54, ims=0, eptrb=0x0, flags=0, rdepth=20133) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:454 #1 0x080ebc9a in match (eptr=Variable "eptr" is not available. ) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:1533 #2 0x080e78f4 in match (eptr=Variable "eptr" is not available. ) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:734 #3 0x080ebc9a in match (eptr=Variable "eptr" is not available. ) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:1533 #4 0x080e78f4 in match (eptr=Variable "eptr" is not available. ) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:734 #5 0x080ebc9a in match (eptr=Variable "eptr" is not available. ) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:1533 #6 0x080e78f4 in match (eptr=Variable "eptr" is not available. ) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:734 [ ... snip because backtrace shows what appears to be a loop ... ] #20131 0x080ebc9a in match (eptr=Variable "eptr" is not available. ) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:1533 #20132 0x080e78f4 in match (eptr=Variable "eptr" is not available. ) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:734 #20133 0x080e7df8 in match (eptr=Variable "eptr" is not available. ) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:1395 #20134 0x080f235a in php_pcre_exec (argument_re=0x8dcd760, extra_data=0xbfdceef4, subject=0xb7508c64 "'", 'a' <repeats 199 times>..., length=50001, start_offset=0, options=Variable "options" is not available. ) at /usr/src/php/php-5.3.2/ext/pcre/pcrelib/pcre_exec.c:5641 #20135 0x080f62a9 in php_pcre_replace_impl (pce=0x8dcd8f8, subject=0xb7508c64 "'", 'a' <repeats 199 times>..., subject_len=50001, replace_val=0xb74fad54, is_callable_replace=0, result_len=0xbfdcf088, limit=-1, replace_count=0xbfdcf074) at /usr/src/php/php-5.3.2/ext/pcre/php_pcre.c:1040 #20136 0x080f6fc5 in php_pcre_replace (regex=0xb74fb284 "/'(\\\\'|\\\\{2}|[^'])*'/", regex_len=21, subject=0xb7508c64 "'", 'a' <repeats 199 times>..., subject_len=50001, replace_val=0xb74fad54, is_callable_replace=0, result_len=0xbfdcf088, limit=-1, replace_count=0xbfdcf074) at /usr/src/php/php-5.3.2/ext/pcre/php_pcre.c:950 #20137 0x080f7542 in php_replace_in_subject (regex=0xb74fad70, replace=Variable "replace" is not available. ) at /usr/src/php/php-5.3.2/ext/pcre/php_pcre.c:1267 #20138 0x080f7bb6 in preg_replace_impl (ht=Variable "ht" is not available. ) at /usr/src/php/php-5.3.2/ext/pcre/php_pcre.c:1365 #20139 0x084b3c81 in zend_do_fcall_common_helper_SPEC (execute_data=0xb7470028) at zend_vm_execute.h:313 #20140 0x084acf86 in execute (op_array=0xb74fb1ec) at zend_vm_execute.h:104 #20141 0x08484fe6 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/php/php-5.3.2/Zend/zend.c:1194 #20142 0x0842c036 in php_execute_script (primary_file=0xbfdd16f4) at /usr/src/php/php-5.3.2/main/main.c:2260 #20143 0x085157e8 in main (argc=2, argv=0xbfdd1854) at /usr/src/php/php-5.3.2/sapi/cli/php_cli.c:1192 -- Edit bug report at http://bugs.php.net/bug.php?id=51238&edit=1 -- Try a snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=51238&r=trysnapshot52 Try a snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=51238&r=trysnapshot53 Try a snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=51238&r=trysnapshot60 Fixed in SVN: http://bugs.php.net/fix.php?id=51238&r=fixed Fixed in SVN and need be documented: http://bugs.php.net/fix.php?id=51238&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=51238&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=51238&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=51238&r=needscript Try newer version: http://bugs.php.net/fix.php?id=51238&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=51238&r=support Expected behavior: http://bugs.php.net/fix.php?id=51238&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=51238&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=51238&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=51238&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=51238&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=51238&r=dst IIS Stability: http://bugs.php.net/fix.php?id=51238&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=51238&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=51238&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=51238&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=51238&r=mysqlcfg