Bug #71937 [NEW]: Php regular expression error with a large pattern

From: Date: Fri, 01 Apr 2016 05:59:08 +0000
Subject: Bug #71937 [NEW]: Php regular expression error with a large pattern
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-200278@lists.php.net to get a copy of this message 
From:             aayaresko at gmail dot com
Operating system: Linux debian 3.16.0-4-amd64 #1 S
PHP version:      7.0.5
Package:          *Regular Expressions
Bug Type:         Bug
Bug description:Php regular expression error with a large pattern

Description:
------------
Performing any regular expression function with pattern similar to this
one 
'/(:(?:nth-last-child|nth-of-type|nth-last-of-type|first-child|last-child|first-of-type|last-of-type|only-child|only-of-type|nth-child|first|last|gt|lt|eq|root|nth|empty|not|has|contains|parent|link|visited|hover|active)(?:\((?>[^()]|(?R))*\))?|\[(?>[^\[\]]|(?R))*\]|[#.][\w-]+)/'

causes a php error.
On linux operating systems this error can be reproduced with php-cli
(command line interface) in interactive mode.
Running php-fpm on this example leads to a similar result.

Test script:
---------------
preg_split('/(:(?:nth-last-child|nth-of-type|nth-last-of-type|first-child|last-child|first-of-type|last-of-type|only-child|only-of-type|nth-child|first|last|gt|lt|eq|root|nth|empty|not|has|contains|parent|link|visited|hover|active)(?:\((?>[^()]|(?R))*\))?|\[(?>[^\[\]]|(?R))*\]|[#.][\w-]+)/',
'#hello-world', 0, PREG_SPLIT_DELIM_CAPTURE | PREG_SPLIT_NO_EMPTY);

preg_match('/(:(?:nth-last-child|nth-of-type|nth-last-of-type|first-child|last-child|first-of-type|last-of-type|only-child|only-of-type|nth-child|first|last|gt|lt|eq|root|nth|empty|not|has|contains|parent|link|visited|hover|active)(?:\((?>[^()]|(?R))*\))?|\[(?>[^\[\]]|(?R))*\]|[#.][\w-]+)/',
'#hello-world');

Actual result:
--------------
*** Error in `php': free(): invalid pointer: 0x00007ff5bb019564 ***

*** Error in `php': malloc(): smallbin double linked list corrupted:
0x0000000002c4dca0 ***


-- 
Edit bug report at https://bugs.php.net/bug.php?id=71937&edit=1
-- 
Try a snapshot (PHP 5.4):   https://bugs.php.net/fix.php?id=71937&r=trysnapshot54
Try a snapshot (PHP 5.5):   https://bugs.php.net/fix.php?id=71937&r=trysnapshot55
Try a snapshot (trunk):     https://bugs.php.net/fix.php?id=71937&r=trysnapshottrunk
Fixed in SVN:               https://bugs.php.net/fix.php?id=71937&r=fixed
Fixed in release:           https://bugs.php.net/fix.php?id=71937&r=alreadyfixed
Need backtrace:             https://bugs.php.net/fix.php?id=71937&r=needtrace
Need Reproduce Script:      https://bugs.php.net/fix.php?id=71937&r=needscript
Try newer version:          https://bugs.php.net/fix.php?id=71937&r=oldversion
Not developer issue:        https://bugs.php.net/fix.php?id=71937&r=support
Expected behavior:          https://bugs.php.net/fix.php?id=71937&r=notwrong
Not enough info:            https://bugs.php.net/fix.php?id=71937&r=notenoughinfo
Submitted twice:            https://bugs.php.net/fix.php?id=71937&r=submittedtwice
register_globals:           https://bugs.php.net/fix.php?id=71937&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71937&r=php4
Daylight Savings:           https://bugs.php.net/fix.php?id=71937&r=dst
IIS Stability:              https://bugs.php.net/fix.php?id=71937&r=isapi
Install GNU Sed:            https://bugs.php.net/fix.php?id=71937&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=71937&r=float
No Zend Extensions:         https://bugs.php.net/fix.php?id=71937&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=71937&r=mysqlcfg

Thread (23 messages)

« previous php.bugs (#200278) next »