Bug #71937 [Opn->Csd]: Php regular expression error with a large pattern

Edit report at https://bugs.php.net/bug.php?id=71937&edit=1 ID: 71937 Updated by: cmb@php.net Reported by: aayaresko at gmail dot com Summary: Php regular expression error with a large pattern -Status: Open +Status: Closed Type: Bug Package: *Regular Expressions Operating System: Linux debian 3.16.0-4-amd64 #1 S PHP Version: 7.0.5 -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: > we could track down the problem to the version of the pcre > extension. > […] Thanks for the fine analysis. Note that it's possible to build PHP with a system (i.e. not the bundled) PCRE (use --with-pcre-regex=DIR and --with-pcre-dir=DIR), what may be the default for distros. Previous Comments: ------------------------------------------------------------------------ [2016-06-29 08:36:21] esteban dot marin at bithost dot ch we could track down the problem to the version of the pcre extension. on the system where the issue occurs, we have PCRE Library Version 8.35 2014-04-04 on the system where it works, we have PCRE Library Version 8.38 2015-11-23 So updating the PCRE Library Version by updating the PHP version should fix the problem. However on our system with Debian + PHP7.0.7 the PCRE Library Version should already be 8.38, but actually is 8.35, so it might not have been included in the debian package. See also https://bugs.php.net/bug.php?id=71659 https://github.com/gplessis/dotdeb-php/issues/124 https://bugs.exim.org/show_bug.cgi?id=1803 A quick-fix if you cannot update: set the following php.ini setting: pcre.jit = 0 ------------------------------------------------------------------------ [2016-06-29 07:51:52] esteban dot marin at bithost dot ch we also have the same issue with a different php software (TYPO3) which only occurs on a specific hosting system with Debian 8.5+PHP 7.0.8, but does not occur on other systems (Ubuntu14+PHP7.0.6, Mac OS X 10.11.4+PHP7.0.0, Mac OS X 10.11.4+PHP7.0.8), so it seems to depend on the configuration/hosting environment: Core: Error handler (BE): PHP Warning: preg_replace_callback(): Internal pcre_fullinfo() error -4 in typo3_src-7.6.9/typo3/sysext/core/Classes/Http/Uri.php line 735 An explanation was found here: http://last-horse.nenicirene.net/viewtopic.php?t=398&sid=8fc16478210b8bc1fcd1c1821de2ae92 PCRE_ERROR_BADMAGIC (-4) PCRE stores a 4-byte "magic number" at the start of the compiled code, to catch the case when it is passed a junk pointer and to detect when a pattern that was compiled in an environment of one endianness is run in an environment with the other endianness. This is the error that PCRE gives when the magic number is not present. In typo3_src-7.6.9/typo3/sysext/core/Classes/Http/Uri.php line 735 the following function call is made: $a = preg_replace_callback( '/(?:[^' . 'a-zA-Z0-9_\-\.~' . '!\$&\'\(\)\*\+,;=' . '%:@\/\?]+|%(?![A-Fa-f0-9]{2}))/', function ($matches) { return rawurlencode($matches[0]); }, $value ); ------------------------------------------------------------------------ [2016-06-29 07:36:19] esteban dot marin at bithost dot ch hey, we are also experiencing this problem with Debian 8.5+PHP7.0.7-1~dotdeb+8.1. please also note that others are having the same issue too: https://github.com/monkeysuffrage/advanced_html_dom/issues/2 ------------------------------------------------------------------------ [2016-05-11 05:49:12] aayaresko at gmail dot com php7 is updated to latest repository version but it still results in sigfault when executing a script that contains a regex. root@debian:~# gdb php-cgi7.0 GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1 Copyright (C) 2014 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from php-cgi7.0...(no debugging symbols found)...done. (gdb) run /var/www/demo/script.php Starting program: /usr/bin/php-cgi7.0 /var/www/demo/script.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". *** Error in `/usr/bin/php-cgi7.0': free(): invalid pointer: 0x00007ffff7f51564 *** Program received signal SIGABRT, Aborted. 0x00007ffff5899067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 0x00007ffff5899067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x00007ffff589a448 in __GI_abort () at abort.c:89 #2 0x00007ffff58d71b4 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7ffff59cc530 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175 #3 0x00007ffff58dc98e in malloc_printerr (action=1, str=0x7ffff59c8646 "free(): invalid pointer", ptr=<optimized out>) at malloc.c:4996 #4 0x00007ffff58dd696 in _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3840 #5 0x00007ffff6f1e3f5 in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3 #6 0x00007ffff6f438ef in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3 #7 0x00007ffff6f464a5 in pcre_study () from /lib/x86_64-linux-gnu/libpcre.so.3 #8 0x00000000004af33a in pcre_get_compiled_regex_cache () #9 0x00000000004b35fd in ?? () #10 0x000000000071f54a in dtrace_execute_internal () #11 0x00000000007b4190 in ?? () #12 0x000000000076f71b in execute_ex () #13 0x000000000071f3d8 in dtrace_execute_ex () #14 0x00000000007c39f7 in zend_execute () #15 0x000000000072f863 in zend_execute_scripts () #16 0x00000000006d0350 in php_execute_script () #17 0x000000000046fc22 in main () ------------------------------------------------------------------------ [2016-04-24 17:16:57] aayareslp at gmail dot com Thanks for the reply! It looks like you're right but setting 'unlimited' for 'stack size' and enormous '100000000000' for 'pcre.recursion_limit' still results in sigfault when script executes. root@debian:/# ulimit -a|grep stack stack size (kbytes, -s) unlimited root@debian:/# cat /etc/php/7.0/cgi/php.ini |grep recursion_limit pcre.recursion_limit=100000000000 root@debian:/#gdb /usr/bin/php-cgi (gdb) run /script.php Starting program: /usr/bin/php-cgi /script.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". *** Error in `/usr/bin/php-cgi': free(): invalid pointer: 0x00002aaaaaad2564 *** Program received signal SIGABRT, Aborted. 0x00002aaaaced0067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 0x00002aaaaced0067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x00002aaaaced1448 in __GI_abort () at abort.c:89 #2 0x00002aaaacf0e1b4 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x2aaaad003530 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175 #3 0x00002aaaacf1398e in malloc_printerr (action=1, str=0x2aaaacfff646 "free(): invalid pointer", ptr=<optimized out>) at malloc.c:4996 #4 0x00002aaaacf14696 in _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3840 #5 0x00002aaaab96c3f5 in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3 #6 0x00002aaaab9918ef in ?? () from /lib/x86_64-linux-gnu/libpcre.so.3 #7 0x00002aaaab9944a5 in pcre_study () from /lib/x86_64-linux-gnu/libpcre.so.3 #8 0x00000000004af0ca in pcre_get_compiled_regex_cache () #9 0x00000000004b0696 in ?? () #10 0x000000000071eb7a in dtrace_execute_internal () #11 0x00000000007b3370 in ?? () #12 0x000000000076e8ab in execute_ex () #13 0x000000000071ea08 in dtrace_execute_ex () #14 0x00000000007c27f7 in zend_execute () #15 0x000000000072ee83 in zend_execute_scripts () #16 0x00000000006cfb20 in php_execute_script () #17 0x000000000046fa12 in main () ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=71937 -- Edit this bug report at https://bugs.php.net/bug.php?id=71937&edit=1