Bug #69864 [PATCH]: Segfault in preg_replace_callback

Edit report at https://bugs.php.net/bug.php?id=69864&edit=1 ID: 69864 Patch added by: cmb@php.net Reported by: james dot h dot cracknell at gmail dot com Summary: Segfault in preg_replace_callback Status: Open Type: Bug Package: PCRE related Operating System: Windows Server 2008 R2 PHP Version: 7.0.0alpha1 Block user comment: N Private report: N New Comment: The following patch has been added/updated: Patch Name: quick-hack Revision: 1434578591 URL: https://bugs.php.net/patch-display.php?bug=69864&patch=quick-hack&revision=1434578591 Previous Comments: ------------------------------------------------------------------------ [2015-06-17 18:58:30] james dot h dot cracknell at gmail dot com Ah look, try again with echoed output: http://3v4l.org/1cRNo ------------------------------------------------------------------------ [2015-06-17 18:54:34] james dot h dot cracknell at gmail dot com At minimum Win x86 NTS still crashes at the most recent available snap (r7db113f@2015-06-17). ------------------------------------------------------------------------ [2015-06-17 18:34:27] cmb@php.net Indeed, it does crash under 7.0.0alpha1 on Linux: <http://3v4l.org/RY30H>. I can't reproduce the problem on Windows, though (neither x86 nor x64, neither NTS nor TS). Anyhow, the problem seems to have been fixed (see php7@20150601 result). ------------------------------------------------------------------------ [2015-06-17 18:19:07] james dot h dot cracknell at gmail dot com This will crash on Windows and Linux: preg_replace_callback('/a/', function($m) { for($i = 0; $i < 10000; $i++) preg_replace('/foo'.$i.'bar/', 'baz', '???foo'.$i.'bar???'); return 'b'; }, 'aa'); ------------------------------------------------------------------------ [2015-06-17 17:53:48] rasmus@php.net Do you have a reproducing example? PCRE_CACHE_SIZE is 4096 elements. That sounds like more than "very extensive use" that sounds like "insane use". ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=69864 -- Edit this bug report at https://bugs.php.net/bug.php?id=69864&edit=1