From: james dot h dot cracknell at gmail dot com
Operating system: Windows Server 2008 R2
PHP version: 7.0.0alpha1
Package: PCRE related
Bug Type: Bug
Bug description:Segfault in preg_replace_callback
Description:
------------
Note the following in the provided stack trace:
struct real_pcre * argument_re = 0x00000001
I believe what is occurring here is if you use preg_replace_callback
with a callback making (very) extensive use of PCRE functions, the outer
regular expression gets evicted from the PCRE cache and freed before
preg_replace_callback completes.
Looking at pcre_get_compiled_regex_cache, it looks as though no checks
are performed to prevent this from happening:
https://github.com/php/php-src/blob/php-7.0.0alpha1/ext/pcre/php_pcre.c#L446
Switching to an approach using preg_match_all with manual replacement
obviously sidesteps the issue.
Stack trace follows, less the subject string value:
php7!php_pcre_exec(struct real_pcre * argument_re = 0x00000001, struct
pcre_extra * extra_data = 0x0d6074b8, char * subject = 0x0598fa10
"(snip)", int length = 0n1235, int start_offset = 0n997, int options =
0n8192, int * offsets = 0x052ac3f0, int offsetcount = 0n21)+0x149
[c:\php-sdk\php70dev\vc14\x86\php-7.0.0alpha1\ext\pcre\pcrelib\pcre_exec.c
@ 6420]
php7!php_pcre_replace_impl(struct pcre_cache_entry * pce = 0x00ee58d8,
struct _zend_string * subject_str = 0x0598fa00, char * subject =
0x0598fa10 "(snip)", int subject_len = 0n1235, struct _zval_struct *
replace_val = 0x008143d0, int is_callable_replace = 0n1, int limit =
0n-1, int * replace_count = 0x052ac534)+0x148
[c:\php-sdk\php70dev\vc14\x86\php-7.0.0alpha1\ext\pcre\php_pcre.c @
1120]
php7!php_pcre_replace+0x33
[c:\php-sdk\php70dev\vc14\x86\php-7.0.0alpha1\ext\pcre\php_pcre.c @
1026]
php7!php_replace_in_subject(struct _zval_struct * regex = 0x008143c0,
struct _zval_struct * replace = 0x008143d0, struct _zval_struct *
subject = 0x008143e0, int limit = 0n-1, int is_callable_replace = 0n1,
int * replace_count = 0x052ac534)+0x258
[c:\php-sdk\php70dev\vc14\x86\php-7.0.0alpha1\ext\pcre\php_pcre.c @
1353]
php7!preg_replace_impl(struct _zval_struct * return_value = 0x00814370,
struct _zval_struct * regex = 0x008143c0, struct _zval_struct * replace
= 0x008143d0, struct _zval_struct * subject = 0x008143e0, int limit_val
= 0n-1, int is_callable_replace = 0n1, int is_filter = 0n0)+0x264
[c:\php-sdk\php70dev\vc14\x86\php-7.0.0alpha1\ext\pcre\php_pcre.c @
1411]
php7!zif_preg_replace_callback(struct _zend_execute_data * execute_data
= <Value unavailable error>, struct _zval_struct * return_value =
0x00814370)+0x173
[c:\php-sdk\php70dev\vc14\x86\php-7.0.0alpha1\ext\pcre\php_pcre.c @
1494]
php7!ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER+0x2e6e14
[c:\php-sdk\php70dev\vc14\x86\php-7.0.0alpha1\zend\zend_vm_execute.h @
701]
--
Edit bug report at https://bugs.php.net/bug.php?id=69864&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69864&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69864&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69864&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=69864&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=69864&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=69864&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=69864&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=69864&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=69864&r=support
Expected behavior: https://bugs.php.net/fix.php?id=69864&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=69864&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=69864&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=69864&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69864&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=69864&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=69864&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=69864&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=69864&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=69864&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=69864&r=mysqlcfg