#19386 [Opn->Bgs]: crash at if (preg_match('/(.|[\r\n])+/', $x)):

ID: 19386 Updated by: wez@php.net Reported By: paul.dodd@usb.unibe.ch -Status: Open +Status: Bogus Bug Type: PCRE related Operating System: * PHP Version: 4.2.3, 4.3.0-dev New Comment: ulimit -S -s 1024 (1MB stack) Crashes on a length of 1800. ulimit -S -s 10240 (10MB stack) Crashes on 18200. ulimit -S -s 10240 (100MB stack) Crashes on 182000. (takes a very long time to get there) This feels pretty bogus to me, since that pattern is looking for a match on all characters or all CRLF on or more times; it seems like an expensive way of setting $y = 1 :-) This is really a bug in pcrelib and not in PHP, so I'm marking this as bogus. A workaround if you insist on using this particular pattern is to increase your stack size. A better solution for the code sample you provided probably looks like this: if (strlen($x)) $y = 1; Previous Comments: ------------------------------------------------------------------------ [2002-09-26 12:51:04] wez@php.net I know this might sound dumb, but do you have any stack size limits in place? ------------------------------------------------------------------------ [2002-09-26 11:28:56] sniper@php.net I'm not gonna put the whole backtrace here..it's quite long.. :) But here's the start of it. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1024 (runnable)] 0x818d0d1 in match (eptr=0x853feb2 "", ecode=0x8543979 "H", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe0225c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3438 3438 } (gdb) bt #0 0x818d0d1 in match (eptr=0x853feb2 "", ecode=0x8543979 "H", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe0225c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3438 #1 0x818ddd1 in match (eptr=0x853feb1 "*", ecode=0x854397c "\0178", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe0225c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3931 #2 0x818d207 in match (eptr=0x853feb1 "*", ecode=0x8543979 "H", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe0225c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3538 #3 0x818ddd1 in match (eptr=0x853feb0 "**", ecode=0x854397c "\0178", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe0249c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3931 #4 0x818d207 in match (eptr=0x853feb0 "**", ecode=0x8543979 "H", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe0249c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3538 #5 0x818ddd1 in match (eptr=0x853feaf "***", ecode=0x854397c "\0178", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe026dc, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3931 #6 0x818d207 in match (eptr=0x853feaf "***", ecode=0x8543979 "H", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe026dc, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3538 #7 0x818ddd1 in match (eptr=0x853feae "****", ecode=0x854397c "\0178", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe0291c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3931 #8 0x818d207 in match (eptr=0x853feae "****", ecode=0x8543979 "H", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe0291c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3538 #9 0x818ddd1 in match (eptr=0x853fead "*****", ecode=0x854397c "\0178", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe02b5c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3931 #10 0x818d207 in match (eptr=0x853fead "*****", ecode=0x8543979 "H", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe02b5c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3538 #11 0x818ddd1 in match (eptr=0x853feac "******", ecode=0x854397c "\0178", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe02d9c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3931 #12 0x818d207 in match (eptr=0x853feac "******", ecode=0x8543979 "H", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe02d9c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3538 #13 0x818ddd1 in match (eptr=0x853feab "*******", ecode=0x854397c "\0178", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe02fdc, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3931 #14 0x818d207 in match (eptr=0x853feab "*******", ecode=0x8543979 "H", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe02fdc, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3538 #15 0x818ddd1 in match (eptr=0x853feaa "********", ecode=0x854397c "\0178", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe0321c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3931 #16 0x818d207 in match (eptr=0x853feaa "********", ecode=0x8543979 "H", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe0321c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3538 #17 0x818ddd1 in match (eptr=0x853fea9 "*********", ecode=0x854397c "\0178", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe0345c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3931 #18 0x818d207 in match (eptr=0x853fea9 "*********", ecode=0x8543979 "H", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe0345c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3538 #19 0x818ddd1 in match (eptr=0x853fea8 "**********", ecode=0x854397c "\0178", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe0369c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3931 #20 0x818d207 in match (eptr=0x853fea8 "**********", ecode=0x8543979 "H", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe0369c, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3538 #21 0x818ddd1 in match (eptr=0x853fea7 '*' <repeats 11 times>, ecode=0x854397c "\0178", offset_top=4, md=0xbfffd348, ims=0, eptrb=0xbfe038dc, flags=2) at /usr/src/web/php/php4/ext/pcre/pcrelib/pcre.c:3931 #22 0x818d207 in match (eptr=0x853fea7 '*' <repeats 11 times>, ecode=0x8543979 "H", offset_top=4, md=0xbfffd348, ------------------------------------------------------------------------ [2002-09-26 11:21:58] wez@php.net How about a backtrace? (Jani?) Is it PHP or PCRE that's causing this problem? ------------------------------------------------------------------------ [2002-09-20 07:21:16] sniper@php.net I still can reproduce it with latest CVS HEAD and RH 6.2/x86 ------------------------------------------------------------------------ [2002-09-20 04:45:55] devon@sitetronics.com I cannot reproduce this bug using the latest cvs on redhat 7.3. The script just keeps going. I cut it off after 20000 chars. I also do not experience this problem with the latest cvs release on FreeBSD 4.6-STABLE. Devon ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/19386 -- Edit this bug report at http://bugs.php.net/?id=19386&edit=1