Bug #18528 Updated: Php crashes upon using eregi_replace

ID: 18528 Updated by: derick@php.net Reported By: flash@daaw.org -Status: Open +Status: Feedback Bug Type: Reproducible crash Operating System: Redhat linux 7.1 (kernel 2.4.18) PHP Version: 4.2.2 New Comment: That doesn't make much sense, as 4.2.2 is exactly the same as 4.2.1 + the security fix and a new configure script. I suspect the problem lies in the configure script used. If you have autoconf 2.52 isntalled (check with autoconf --version) then you can try this: cd php-4.2.2 rm configure ./cvsclean ./buildconf ./configure --your options make If this doesn't solve it, you can try try to add --with-regex=system to your configure options. Derick Previous Comments: ------------------------------------------------------------------------ [2002-07-24 04:26:20] flash@daaw.org I just updated to php 4.2.2 from 4.2.1 and I didnt have the problem in 4.2.1 so it has to have something to do with 4.2.2 since I used thesame configure commands. ------------------------------------------------------------------------ [2002-07-24 04:16:48] msopacua@idg.nl strike that please - that's the unescaped pipe ('or') I used. ------------------------------------------------------------------------ [2002-07-24 04:10:41] msopacua@idg.nl Derick: I don't think it's an actual crash :-) He just runs outof memory, not realizing that the meta-character "&" is 'the match' - but the bug is in PHP, as it is resolving the & character in the result of the operation! So it seems a recursion eval in ereg functions. Example: ?php $text="bla&|&bla2"; $a = eregi_replace("&|&", ":", $text); $b = str_replace("&|&", ":", $text); $c = eregi_replace("\\\&|\\\&", ":", $text); echo "$a\n$b\n$c"; ?> Output: $ php -f ./tmp.php bla:|:bla2 bla:bla2 bla&|&bla2 ------------------------------------------------------------------------ [2002-07-24 04:03:17] flash@daaw.org Backtrace (I dont see errors) [root@lhurgoyf bin]# gdb ./httpd GNU gdb Red Hat Linux (5.1-0.71) Copyright 2001 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux"... (gdb) run -X Starting program: /usr/local/apache/bin/./httpd -X Program exited with code 01. (gdb) bt No stack. (gdb) ------------------------------------------------------------------------ [2002-07-24 03:50:38] derick@php.net Please make a backtrace as asked in an earlier reply. The location with info on how to do this is: http://bugs.php.net/bugs-generating-backtrace.php Derick ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/18528 -- Edit this bug report at http://bugs.php.net/?id=18528&edit=1