Bug #18528 Updated: Php crashes upon using eregi_replace

ID: 18528 Updated by: flash@daaw.org Reported By: flash@daaw.org -Status: Feedback +Status: Open Bug Type: Reproducible crash Operating System: Redhat linux 7.1 (kernel 2.4.18) PHP Version: 4.2.2 New Comment: I used the same configure script as with version 4.2.1 and I just now went back again to 4.2.1 and the problem is gone again. here are my configure options: ./configure --with-apxs=/usr/local/apache/bin/apxs \ --with-config-file-path=/usr/local/apache/conf \ --with-mysql=/usr/local \ --with-gd \ --with-system-regex I will retry in a minute with the options as you said. Previous Comments: ------------------------------------------------------------------------ [2002-07-24 04:32:23] derick@php.net That doesn't make much sense, as 4.2.2 is exactly the same as 4.2.1 + the security fix and a new configure script. I suspect the problem lies in the configure script used. If you have autoconf 2.52 isntalled (check with autoconf --version) then you can try this: cd php-4.2.2 rm configure ./cvsclean ./buildconf ./configure --your options make If this doesn't solve it, you can try try to add --with-regex=system to your configure options. Derick ------------------------------------------------------------------------ [2002-07-24 04:26:20] flash@daaw.org I just updated to php 4.2.2 from 4.2.1 and I didnt have the problem in 4.2.1 so it has to have something to do with 4.2.2 since I used thesame configure commands. ------------------------------------------------------------------------ [2002-07-24 04:16:48] msopacua@idg.nl strike that please - that's the unescaped pipe ('or') I used. ------------------------------------------------------------------------ [2002-07-24 04:10:41] msopacua@idg.nl Derick: I don't think it's an actual crash :-) He just runs outof memory, not realizing that the meta-character "&" is 'the match' - but the bug is in PHP, as it is resolving the & character in the result of the operation! So it seems a recursion eval in ereg functions. Example: ?php $text="bla&|&bla2"; $a = eregi_replace("&|&", ":", $text); $b = str_replace("&|&", ":", $text); $c = eregi_replace("\\\&|\\\&", ":", $text); echo "$a\n$b\n$c"; ?> Output: $ php -f ./tmp.php bla:|:bla2 bla:bla2 bla&|&bla2 ------------------------------------------------------------------------ [2002-07-24 04:03:17] flash@daaw.org Backtrace (I dont see errors) [root@lhurgoyf bin]# gdb ./httpd GNU gdb Red Hat Linux (5.1-0.71) Copyright 2001 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux"... (gdb) run -X Starting program: /usr/local/apache/bin/./httpd -X Program exited with code 01. (gdb) bt No stack. (gdb) ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/18528 -- Edit this bug report at http://bugs.php.net/?id=18528&edit=1