Req #53685 [Opn->Dup]: Raise E_WARNING before returning NULL from preg_replace()

Edit report at https://bugs.php.net/bug.php?id=53685&edit=1 ID: 53685 Updated by: cmb@php.net Reported by: tstarling at wikimedia dot org Summary: Raise E_WARNING before returning NULL from preg_replace() -Status: Open +Status: Duplicate Type: Feature/Change Request Package: PCRE related PHP Version: 5.3SVN-2011-01-07 (SVN) -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: This is a duplicate of request #51103. Previous Comments: ------------------------------------------------------------------------ [2011-01-07 03:51:39] tstarling at wikimedia dot org Description: ------------ php_pcre_replace_impl() responds to all errors in pcre_exec() by doing: } else { pcre_handle_exec_error(count TSRMLS_CC); efree(result); result = NULL; break; } No warning is raised. This is very scary, since unexpectedly large user input may trigger PCRE_ERROR_MATCHLIMIT or similar. Most code that calls preg_replace() does not check for an error condition, the return value is simply converted to a string. So the net effect is that the string is deleted instead of just having some bits changed in it. Raising a warning would allow this condition to be more easily detected during testing, and more easily diagnosed during debugging. It would allow fuzz testing to be used. And it would bring preg_replace() into line with general conventions for error reporting in PHP internal functions. Test script: --------------- ini_set('pcre.backtrack_limit', 100) print preg_replace( '/a.*a/', '', 'a'.str_repeat('b', 1000)) Expected result: ---------------- PHP Warning: pcre.backtrack_limit exceeded in preg_replace() in .... Actual result: -------------- Silence. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=53685&edit=1