Bug #68628 [Opn]: preg_match() causes stack overflow exception

Edit report at https://bugs.php.net/bug.php?id=68628&edit=1 ID: 68628 User updated by: roman dot paska at gmail dot com Reported by: roman dot paska at gmail dot com Summary: preg_match() causes stack overflow exception Status: Open Type: Bug Package: *Regular Expressions Operating System: Windows 7 PHP Version: 5.4.36 Block user comment: N Private report: N New Comment: I was able to reproduce this without Drupal 7. Code sample ----------- <?php $url = 'mailto:inquiries@lifenethealth.org?subject=Join%20me%20in%20Saving%20Lives%20and%20Restoring%20Health!&body=I%20just%20made%20a%20charitable%20contribution%20to%20support%20the%20LifeNet%20Health%20Foundation%20in%20their%20mission%20of%20Saving%20Lives%20and%20Restoring%20Health.%20%20Please%20join%20me%20by%20following%20the%20link%20below%20and%20consider%20making%20a%20contribution.%20%20Even%20a%20small%20gift%20of%20%245%2C%20%2410%2C%20or%20%2415%20can%20make%20a%20real%20impact!%0A%0AYour%20donation%20will%20support%3A%0A%0A%E2%80%A2%09Quality%20educational%20programs%20for%20the%20general%20public%20and%20the%20healthcare%20community%20regarding%20organ%20and%20tissue%20donation%2C%0A%E2%80%A2%09Donor%20Family%20Services%20activities%2C%20such%20as%20grief%20materials%2C%20workshops%2C%20newsletters%20and%20special%20events%2C%20and%3B%0A%E2%80%A2%09LifeNet%20Health%E2%80%99s%20research%20and%20development%20initiatives%2C%20including%20the%20new%20Institute! %20of%20Regenerative%20Medicine%20that%20will%20help%20to%20further%20the%20mission%20of%20Saving%20Lives%20and%20Restoring%20Health%20with%20breakthroughs%20in%20cellular%20therapy%20research.%0A%0AYour%20financial%20contribution%20to%20the%20LifeNet%20Health%20Foundation%20is%20an%20investment%20that%20will%20directly%20affect%20people%E2%80%99s%20lives.%20%20Please%20consider%20becoming%20a%20partner%20in%20Saving%20Lives%20and%20Restoring%20Health.%0A'; preg_match("/^(?:[\w#!:\.\?\+=&@$'~*,;\/\(\)\[\]\-]|%[0-9a-f]{2})+$/i", $url); It works from PHP CLI, but crashes Apache via Browser. PHP connected as a Apache module. Apache 2.2.17 and 2.4.10 affected. Hard to say whether it's Apache or PHP issue. Previous Comments: ------------------------------------------------------------------------ [2014-12-19 09:22:35] roman dot paska at gmail dot com Description: ------------ preg_match() crashes PHP & Apache with stack overflow exception on Windows 7. I'm not able to reproduce it with plain PHP code. It crashes using Drupal 7 under some circumstances. Regular expression is preg_match("/^(?:[\w#!:\.\?\+=&@$'~*,;\/\(\)\[\]\-]|%[0-9a-f]{2})+$/i", $url) More details to follow. Actual result: -------------- In httpd__PID__6364__Date__12_19_2014__Time_10_40_54AM__870__Second_Chance_Exception_C00000FD.dmp the assembly instruction at php5ts!php_pcre_compile+99c8 in C:\Program Files\PHP54\php5ts.dll from The PHP Group has caused a stack overflow exception (0xC00000FD) when trying to write to memory location 0x00000001 on thread 9 Type of Analysis Performed - Combined Crash/Hang Analysis Operating System - Windows 7Service Pack 1 Number Of Processors - 4 Process ID - 6364 Process Image - c:\Program Files\Apache Software Foundation\Apache24\bin\httpd.exe System Up-Time - 1 day(s) 00:06:33 Process Up-Time - 00:00:04 Processor Type - X86 Process Bitness - 32-Bit Thread 9 - System ID 2100 Entry point libhttpd!ap_regkey_value_remove+11a0 Create time 19.12.2014 10:40:50 Time spent in user mode 0 Days 00:00:00.390 Time spent in kernel mode 0 Days 00:00:00.156 This thread is not fully resolved and may or may not be a problem. Further analysis of these threads may be required. Function php5ts!php_pcre_compile+99c8 0x00989680 php5ts!php_pcre_match_impl+269 php5ts!pcre_get_compiled_regex_cache+4a9 php5ts!php_pcre_grep_impl+394 php5ts!php_pcre_grep_impl+3b6 php5ts!zval_copy_ctor_func+4a8 php5ts!zval_add_ref+1385 php5ts!execute+1fe php5ts!zend_call_function+379 php5ts!zval_add_ref+2c22 php5ts!php_error_log_ex+323 php5ts!zval_copy_ctor_func+4a8 php5ts!add_assoc_stringl_ex+1b9 php5ts!zval_add_ref+1385 php5ts!execute+1fe php5ts!zend_call_function+379 php5ts!zval_add_ref+2c22 php5ts!php_error_log_ex+323 php5ts!zval_copy_ctor_func+4a8 php5ts!add_assoc_stringl_ex+286 php5ts!zval_add_ref+1385 php5ts!execute+1fe php5ts!zend_execute_scripts+15a php5ts!ts_resource_ex+14 php5ts!php_execute_script+1c5 php5ts!php_execute_script+a8 KERNELBASE!WaitForSingleObjectEx+cb php_mbstring!mbfl_name2language+2b5 php_xsl!get_module+2ec libapr_1!apr_pmemdup+2a libapr_1!apr_pstrdup+29 php5apache2_4+18c7 mod_rewrite+7061 libhttpd!ap_run_handler+25 libhttpd!ap_invoke_handler+a1 libhttpd!ap_internal_redirect+36 mod_rewrite+80fa libhttpd!ap_run_handler+25 libhttpd!ap_invoke_handler+a1 libhttpd!ap_die+39c libhttpd!ap_die+42f libhttpd!ap_psignature+14c8 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68628&edit=1