Bug #74588 [NEW]: Infinite recursion within get_min_match_length() leads to SEGV

From: l dot wei at ntu dot edu dot sg Operating system: * PHP version: 7.1.5 Package: mbstring related Bug Type: Bug Bug description:Infinite recursion within get_min_match_length() leads to SEGV Description: ------------ Version tested: PHP-5.6.30 on x86_6; PHP-7.1.5 / x86 likely affected too. Build bin/php with -fsanitize=address, --enable-mbstring Test script: --------------- $ cat get_min_match_len/recurse.php <?php if (!extension_loaded('mbstring')) print "mbstring not loaded.\n"; if (!function_exists('mb_ereg_replace')) print "mb_ereg_replace() is not available\n"; echo "*** Testing mb_ereg_replace() ***\n"; echo mb_ereg_replace("(\\2)(\\1)", "1", "a"); ?> Expected result: ---------------- No crash Actual result: -------------- $ php get_min_match_len/recurse.php *** Testing mb_ereg_replace() *** ASAN:SIGSEGV ================================================================= ==11343==ERROR: AddressSanitizer: stack-overflow on address 0x7ffec8781ff8 (pc 0x0000008d5ed6 bp 0x7ffec8782000 sp 0x7ffec8782000 T0) #0 0x8d5ed5 in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2025 #1 0x8d6d82 in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2122 #2 0x8d626c in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2041 #3 0x8d6d82 in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2122 #4 0x8d626c in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2041 #5 0x8d6d82 in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2122 #6 0x8d626c in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2041 #7 0x8d6d82 in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2122 #8 0x8d626c in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2041 <..240 lines cut..> #249 0x8d6d82 in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2122 #250 0x8d626c in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2041 #251 0x8d6d82 in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2122 SUMMARY: AddressSanitizer: stack-overflow /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2025 get_min_match_length ==11343==ABORTING -- Edit bug report at https://bugs.php.net/bug.php?id=74588&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74588&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74588&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74588&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=74588&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=74588&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=74588&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=74588&r=needscript Try newer version: https://bugs.php.net/fix.php?id=74588&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=74588&r=support Expected behavior: https://bugs.php.net/fix.php?id=74588&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=74588&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=74588&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=74588&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74588&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=74588&r=dst IIS Stability: https://bugs.php.net/fix.php?id=74588&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=74588&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=74588&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=74588&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=74588&r=mysqlcfg