Bug #69864 [Com]: Segfault in preg_replace_callback

Edit report at https://bugs.php.net/bug.php?id=69864&edit=1 ID: 69864 Comment by: james dot h dot cracknell at gmail dot com Reported by: james dot h dot cracknell at gmail dot com Summary: Segfault in preg_replace_callback Status: Open Type: Bug Package: PCRE related Operating System: Windows Server 2008 R2 PHP Version: 7.0.0alpha1 Block user comment: N Private report: N New Comment: The patch looks as though it should do the trick. > I'd rather fix the issue, if feasible, than to tag it as WONTFIX. Well it's definitely a bug; as it stands once you are in preg_replace_callback, the PCRE functions are a timebomb; e.g: <https://github.com/WordPress/WordPress/blob/f62bf61b2c59bf5484888f22d0b7dff0f0df050a/wp-includes/shortcodes.php#L200> Previous Comments: ------------------------------------------------------------------------ [2015-06-17 22:03:56] cmb@php.net I'm still haven't been able to reproduce a segfault, but indeed the results of the script are wrong. And yes, it is as you suspected, James. The pcre_cache_entry is deleted even though it's used later on. Interestingly, pcre_cache_entry has a member refcount which doesn't seem to be used (at least in master). This member might be used to prevent entries that will still be needed later to be deleted. See the attached patch "quick-hack" for a draft. > That sounds like more than "very extensive use" that sounds like > "insane use". I agree. However, I'd rather fix the issue, if feasible, than to tag it as WONTFIX. :) ------------------------------------------------------------------------ [2015-06-17 22:03:11] cmb@php.net The following patch has been added/updated: Patch Name: quick-hack Revision: 1434578591 URL: https://bugs.php.net/patch-display.php?bug=69864&patch=quick-hack&revision=1434578591 ------------------------------------------------------------------------ [2015-06-17 18:58:30] james dot h dot cracknell at gmail dot com Ah look, try again with echoed output: http://3v4l.org/1cRNo ------------------------------------------------------------------------ [2015-06-17 18:54:34] james dot h dot cracknell at gmail dot com At minimum Win x86 NTS still crashes at the most recent available snap (r7db113f@2015-06-17). ------------------------------------------------------------------------ [2015-06-17 18:34:27] cmb@php.net Indeed, it does crash under 7.0.0alpha1 on Linux: <http://3v4l.org/RY30H>. I can't reproduce the problem on Windows, though (neither x86 nor x64, neither NTS nor TS). Anyhow, the problem seems to have been fixed (see php7@20150601 result). ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=69864 -- Edit this bug report at https://bugs.php.net/bug.php?id=69864&edit=1