Bug #74588 [Com]: Infinite recursion within get_min_match_length() leads to SEGV

Edit report at https://bugs.php.net/bug.php?id=74588&edit=1 ID: 74588 Comment by: andrew dot nester dot dev at gmail dot com Reported by: l dot wei at ntu dot edu dot sg Summary: Infinite recursion within get_min_match_length() leads to SEGV Status: Open Type: Bug Package: mbstring related Operating System: * PHP Version: 7.1.5 Block user comment: N Private report: N New Comment: I guess issue relates to bundled library oniguruma library which is used for regexp things. https://github.com/kkos/oniguruma Previous Comments: ------------------------------------------------------------------------ [2017-05-14 06:28:43] l dot wei at ntu dot edu dot sg Description: ------------ Version tested: PHP-5.6.30 on x86_6; PHP-7.1.5 / x86 likely affected too. Build bin/php with -fsanitize=address, --enable-mbstring Test script: --------------- $ cat get_min_match_len/recurse.php <?php if (!extension_loaded('mbstring')) print "mbstring not loaded.\n"; if (!function_exists('mb_ereg_replace')) print "mb_ereg_replace() is not available\n"; echo "*** Testing mb_ereg_replace() ***\n"; echo mb_ereg_replace("(\\2)(\\1)", "1", "a"); ?> Expected result: ---------------- No crash Actual result: -------------- $ php get_min_match_len/recurse.php *** Testing mb_ereg_replace() *** ASAN:SIGSEGV ================================================================= ==11343==ERROR: AddressSanitizer: stack-overflow on address 0x7ffec8781ff8 (pc 0x0000008d5ed6 bp 0x7ffec8782000 sp 0x7ffec8782000 T0) #0 0x8d5ed5 in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2025 #1 0x8d6d82 in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2122 #2 0x8d626c in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2041 #3 0x8d6d82 in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2122 #4 0x8d626c in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2041 #5 0x8d6d82 in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2122 #6 0x8d626c in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2041 #7 0x8d6d82 in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2122 #8 0x8d626c in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2041 <..240 lines cut..> #249 0x8d6d82 in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2122 #250 0x8d626c in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2041 #251 0x8d6d82 in get_min_match_length /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2122 SUMMARY: AddressSanitizer: stack-overflow /home/xie/php-5.6.30/ext/mbstring/oniguruma/regcomp.c:2025 get_min_match_length ==11343==ABORTING ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=74588&edit=1