Edit report at https://bugs.php.net/bug.php?id=71937&edit=1
ID: 71937
Updated by: ab@php.net
Reported by: aayaresko at gmail dot com
Summary: Php regular expression error with a large pattern
-Status: Open
+Status: Feedback
Type: Bug
Package: *Regular Expressions
Operating System: Linux debian 3.16.0-4-amd64 #1 S
PHP Version: 7.0.5
Block user comment: N
Private report: N
New Comment:
Thanks for the report. Sadly i don't reproduce any crash on Jessie and Windows. Could you
please provide a backtrace?
Thanks.
Previous Comments:
------------------------------------------------------------------------
[2016-04-01 05:59:00] aayaresko at gmail dot com
Description:
------------
Performing any regular expression function with pattern similar to this one
'/(:(?:nth-last-child|nth-of-type|nth-last-of-type|first-child|last-child|first-of-type|last-of-type|only-child|only-of-type|nth-child|first|last|gt|lt|eq|root|nth|empty|not|has|contains|parent|link|visited|hover|active)(?:\((?>[^()]|(?R))*\))?|\[(?>[^\[\]]|(?R))*\]|[#.][\w-]+)/'
causes a php error.
On linux operating systems this error can be reproduced with php-cli (command line interface) in
interactive mode.
Running php-fpm on this example leads to a similar result.
Test script:
---------------
preg_split('/(:(?:nth-last-child|nth-of-type|nth-last-of-type|first-child|last-child|first-of-type|last-of-type|only-child|only-of-type|nth-child|first|last|gt|lt|eq|root|nth|empty|not|has|contains|parent|link|visited|hover|active)(?:\((?>[^()]|(?R))*\))?|\[(?>[^\[\]]|(?R))*\]|[#.][\w-]+)/',
'#hello-world', 0, PREG_SPLIT_DELIM_CAPTURE | PREG_SPLIT_NO_EMPTY);
preg_match('/(:(?:nth-last-child|nth-of-type|nth-last-of-type|first-child|last-child|first-of-type|last-of-type|only-child|only-of-type|nth-child|first|last|gt|lt|eq|root|nth|empty|not|has|contains|parent|link|visited|hover|active)(?:\((?>[^()]|(?R))*\))?|\[(?>[^\[\]]|(?R))*\]|[#.][\w-]+)/',
'#hello-world');
Actual result:
--------------
*** Error in `php': free(): invalid pointer: 0x00007ff5bb019564 ***
*** Error in `php': malloc(): smallbin double linked list corrupted: 0x0000000002c4dca0 ***
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=71937&edit=1