Bug #68626 [NEW]: A particular string and preg_replace \p{Z} causes seg fault

From: swong at uco dot com Operating system: Linux PHP version: 5.6.4 Package: PCRE related Bug Type: Bug Bug description:A particular string and preg_replace \p{Z} causes seg fault Description: ------------ Also tested on * 5.6.4 (compiled from source) on Ubuntu 14.04 x64 * 5.5.9 (from apt) on Ubuntu 14.04 x64 * 5.4.28 (from apt) on Ubuntu 10.04.4 x64 * 5.4.13 (binary) VC9 x86 on Windows In short: $text = "栖霞区"; $text = preg_replace('/^\p{Z}*|\p{Z}*$/u', "", $text); // Segfault and crash. --- 栖 in UTF-8 is "E6 A0 96" Characters "E7 A0 96" (砖) will also repro. Characters "E6 A1 96" (桖) does NOT repro. Note: Unicode character U+00A0 is "non breaking space" which is in the category of \p{Z}. Test script: --------------- <?php // Function 1 and Function 2 are logically the same // Yet the preg_replace in function 1 will segfault in particular case // Both functions is to trim spaces (of all kinds) around a string. Function1(' TEST '); // prints [TEST], as expected Function2(' TEST '); // prints [TEST], as expected Function1('桖霞区'); // prints [桖霞区], as expected Function2('桖霞区'); // prints [桖霞区], as expected Function1('栖霞区'); // Segmentation Fault! Function2('栖霞区'); // prints [栖霞区], as expected Function1(' 栖霞区'); // prints [栖霞区], as expected (does not crash) Function2(' 栖霞区'); // prints [栖霞区], as expected function Function1($text) { $text = preg_replace('/^\p{Z}*|\p{Z}*$/u', "", $text); print "[$text]\n"; } function Function2($text) { $text = preg_replace('/^\p{Z}*/u', "", $text); $text = preg_replace('/\p{Z}*$/u', "", $text); print "[$text]\n"; } -- Edit bug report at https://bugs.php.net/bug.php?id=68626&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68626&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68626&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68626&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68626&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68626&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68626&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68626&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68626&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68626&r=support Expected behavior: https://bugs.php.net/fix.php?id=68626&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68626&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68626&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68626&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68626&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68626&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68626&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68626&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68626&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68626&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68626&r=mysqlcfg