Bug #68626 [Opn->Sus]: A particular string and preg_replace \p{Z} causes seg fault

Edit report at https://bugs.php.net/bug.php?id=68626&edit=1 ID: 68626 Updated by: aharvey@php.net Reported by: swong at uco dot com Summary: A particular string and preg_replace \p{Z} causes seg fault -Status: Open +Status: Suspended Type: Bug Package: PCRE related Operating System: Linux PHP Version: 5.6.4 Block user comment: N Private report: N New Comment: This appears to be a bug in PCRE itself: after compiling 8.36 (the current stable) version and linking PHP to it, I still get a segfault. The backtrace: #0 0x00007ffff79688be in match (eptr=0x7ffff7e55fff <error: Cannot access memory at address 0x7ffff7e55fff>, ecode=0x1090f4f "\031x", mstart=0x7ffff7ec9d71 "\240\226霞区", offset_top=2, md=0x7fffffffa6f0, eptrb=0x0, rdepth=0) at pcre_exec.c:5610 #1 0x00007ffff796d2af in pcre_exec (argument_re=0x1090f00, extra_data=0x7fffffffa910, subject=0x7ffff7ec9d70 "栖霞区", length=9, start_offset=1, options=8192, offsets=0x7ffff7fe1218, offsetcount=3) at pcre_exec.c:6923 #2 0x000000000047b6e8 in php_pcre_replace_impl (pce=0x1090a00, subject=0x7ffff7ec9d70 "栖霞区", subject_len=9, replace_val=0x7ffff7fe03e0, is_callable_replace=0, result_len=0x7fffffffaacc, limit=-1, replace_count=0x7fffffffaad0) at /home/vagrant/php-src/5.5/ext/pcre/php_pcre.c:1091 #3 0x000000000047b3c9 in php_pcre_replace (regex=0x7ffff7ec9e90 "/^\\p{Z}*|\\p{Z}*$/u", regex_len=18, subject=0x7ffff7ec9d70 "栖霞区", subject_len=9, replace_val=0x7ffff7fe03e0, is_callable_replace=0, result_len=0x7fffffffaacc, limit=-1, replace_count=0x7fffffffaad0) at /home/vagrant/php-src/5.5/ext/pcre/php_pcre.c:997 #4 0x000000000047c627 in php_replace_in_subject (regex=0x7ffff7fe02f0, replace=0x7ffff7fe03e0, subject=0x7ffff7fa83d8, result_len=0x7fffffffaacc, limit=-1, is_callable_replace=0, replace_count=0x7fffffffaad0) at /home/vagrant/php-src/5.5/ext/pcre/php_pcre.c:1318 #5 0x000000000047d098 in preg_replace_impl (ht=3, return_value=0x7ffff7fe0368, return_value_ptr=0x0, this_ptr=0x0, return_value_used=1, is_callable_replace=0, is_filter=0) at /home/vagrant/php-src/5.5/ext/pcre/php_pcre.c:1416 #6 0x000000000047d1b6 in zif_preg_replace (ht=3, return_value=0x7ffff7fe0368, return_value_ptr=0x0, this_ptr=0x0, return_value_used=1) at /home/vagrant/php-src/5.5/ext/pcre/php_pcre.c:1436 #7 0x000000000082179a in zend_do_fcall_common_helper_SPEC (execute_data=0x7ffff7fa8318) at /home/vagrant/php-src/5.5/Zend/zend_vm_execute.h:550 #8 0x00000000008260cd in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0x7ffff7fa8318) at /home/vagrant/php-src/5.5/Zend/zend_vm_execute.h:2332 #9 0x0000000000820e8d in execute_ex (execute_data=0x7ffff7fa8318) at /home/vagrant/php-src/5.5/Zend/zend_vm_execute.h:363 #10 0x0000000000820f16 in zend_execute (op_array=0x7ffff7fdde48) at /home/vagrant/php-src/5.5/Zend/zend_vm_execute.h:388 #11 0x00000000007e202d in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/vagrant/php-src/5.5/Zend/zend.c:1327 #12 0x000000000074b10c in php_execute_script (primary_file=0x7fffffffd1f0) at /home/vagrant/php-src/5.5/main/main.c:2506 #13 0x0000000000890c8b in do_cli (argc=2, argv=0xf15a50) at /home/vagrant/php-src/5.5/sapi/cli/php_cli.c:994 #14 0x0000000000891fb9 in main (argc=2, argv=0xf15a50) at /home/vagrant/php-src/5.5/sapi/cli/php_cli.c:1378 This needs to be reported to PCRE at http://bugs.exim.org/enter_bug.cgi?product=PCRE. Previous Comments: ------------------------------------------------------------------------ [2014-12-19 03:28:12] swong at uco dot com Description: ------------ Also tested on * 5.6.4 (compiled from source) on Ubuntu 14.04 x64 * 5.5.9 (from apt) on Ubuntu 14.04 x64 * 5.4.28 (from apt) on Ubuntu 10.04.4 x64 * 5.4.13 (binary) VC9 x86 on Windows In short: $text = "栖霞区"; $text = preg_replace('/^\p{Z}*|\p{Z}*$/u', "", $text); // Segfault and crash. --- 栖 in UTF-8 is "E6 A0 96" Characters "E7 A0 96" (砖) will also repro. Characters "E6 A1 96" (桖) does NOT repro. Note: Unicode character U+00A0 is "non breaking space" which is in the category of \p{Z}. Test script: --------------- <?php // Function 1 and Function 2 are logically the same // Yet the preg_replace in function 1 will segfault in particular case // Both functions is to trim spaces (of all kinds) around a string. Function1(' TEST '); // prints [TEST], as expected Function2(' TEST '); // prints [TEST], as expected Function1('桖霞区'); // prints [桖霞区], as expected Function2('桖霞区'); // prints [桖霞区], as expected Function1('栖霞区'); // Segmentation Fault! Function2('栖霞区'); // prints [栖霞区], as expected Function1(' 栖霞区'); // prints [栖霞区], as expected (does not crash) Function2(' 栖霞区'); // prints [栖霞区], as expected function Function1($text) { $text = preg_replace('/^\p{Z}*|\p{Z}*$/u', "", $text); print "[$text]\n"; } function Function2($text) { $text = preg_replace('/^\p{Z}*/u', "", $text); $text = preg_replace('/\p{Z}*$/u', "", $text); print "[$text]\n"; } ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68626&edit=1