Bug #66059 [NEW]: Segmentation fault with backslashes in output

From: chris dot riesen at gmail dot com Operating system: Linux PHP version: Irrelevant Package: Reproducible crash Bug Type: Bug Bug description:Segmentation fault with backslashes in output Description: ------------ On executing some code within the symfony framework this bug has shown up. It appears to be a problem with a large number of backslashes. This is a valid use case as it can happen with messages that are escaped (my example was escaped json, which led me to this bug). This has been tested and is reproducible on these environments: - suse enterprise linux x64, php 5.3.17, full physical machine - ubuntu 13.10 x64, php 5.5.3, virtual box From what I see it's the preg_replace_callback that makes it go haywire: https://github.com/symfony/symfony/blob/master/src/Symfony/Component/Console/Formatter/OutputFormatter.php#L150 To simply reproduce, install a blank symfony project with composer, make a script with the autoloader in it then use the code below. Test script: --------------- $formatter = new Symfony\Component\Console\Formatter\OutputFormatter(true); $formatter->format('<error>Error</error>' . str_repeat("\\", 14000)); Expected result: ---------------- Anything but a segfault. Actual result: -------------- Core was generated by `php test.php'. Program terminated with signal 11, Segmentation fault. #0 0x00007f40db9acd57 in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3 (gdb) bt #0 0x00007f40db9acd57 in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3 #1 0x00007f40db9ae02d in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3 Same line, just different memory location for a while until: #10892 0x00007f40db9afae5 in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3 #10893 0x00007f40db9ba89b in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3 #10894 0x00007f40db9bd93c in pcre_exec () from /lib/x86_64-linux-gnu/libpcre.so.3 #10895 0x00000000004a7b95 in php_pcre_replace_impl () #10896 0x00000000004a8a79 in ?? () #10897 0x00000000004a9078 in ?? () #10898 0x000000000079b9aa in ?? () #10899 0x0000000000715458 in execute_ex () #10900 0x00000000006ed290 in zend_execute_scripts () #10901 0x000000000068d5d5 in php_execute_script () #10902 0x000000000079d75e in ?? () #10903 0x0000000000461bc0 in main () -- Edit bug report at https://bugs.php.net/bug.php?id=66059&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=66059&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=66059&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=66059&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=66059&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=66059&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=66059&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=66059&r=needscript Try newer version: https://bugs.php.net/fix.php?id=66059&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=66059&r=support Expected behavior: https://bugs.php.net/fix.php?id=66059&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=66059&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=66059&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=66059&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=66059&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=66059&r=dst IIS Stability: https://bugs.php.net/fix.php?id=66059&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=66059&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=66059&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=66059&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=66059&r=mysqlcfg