Bug #75207 [Ana]: preg_match bug

Edit report at https://bugs.php.net/bug.php?id=75207&edit=1 ID: 75207 Updated by: ab@php.net Reported by: qflbapp at gmail dot com Summary: preg_match bug Status: Analyzed Type: Bug Package: PCRE related Operating System: Linux Ubuntu PHP Version: 7.1.9 Assigned To: ab Block user comment: N Private report: N New Comment: Thanks for the ping, Christoph. I'd be not a big fan of upgrading PCRE, especially in 7.0. The diff is huge not only for PCRE itself, but for ext/pcre, too. With 7.1, too. Not only that, but also it'll require to backport the valgrind support for ext/pcre and run-tests.php, etc. The weight of this issue certainly doesn't justify the backport effort and possible impacts. IMHO, applying the upstream patch is more appropriate. I'll be checking for possible directions. Regards Anatol Previous Comments: ------------------------------------------------------------------------ [2017-09-18 18:16:11] spam2 at rhsoft dot net just update PCRE! not so long ago i had to recompile mod_security without prce-jit-support because we had segfaults due a dist-upgrade which leade to segfaults because the *path* of a roundcuebmail javascript https://bugzilla.redhat.com/show_bug.cgi?id=1215701 in the meantime no problem any longer ------------------------------------------------------------------------ [2017-09-18 17:12:12] cmb@php.net Thanks, Philip, that was very helpful. Anatol, the bug Philip mentions has been assigned CVE-2016-1283[1], but PHP-7.0 and PHP-7.1 still ship 8.38. Should these be updated, even though that does not qualify as security issue for PHP, since arbitrary regexps should never be accepted from untrusted input, IMO. [1] <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283> ------------------------------------------------------------------------ [2017-09-18 16:45:46] Philip dot Hazel at gmail dot com Thanks for checking it out. I too can reproduce with 8.38, but not with 8.39 or 8.41 (latest - I didn't bother with 8.40) or with PCRE2 (10.30). Clearly this bug has been fixed. The 8.39 ChangeLog, on a quick scan, does show a bugfix (#14) which is probably the one. 8.38 is nearly 2 years old now. I am going to close the PCRE bug report as already fixed. ------------------------------------------------------------------------ [2017-09-18 16:22:04] cmb@php.net > I cannot reproduce a problem with the given pattern […] Neither can I with PCRE 8.41 (PCRE 8.38 exhibits the bad behavior, though). @qflbapp Please provide the PCRE_VERSION you are using. > […] with or without the backslashes (does PHP remove them?). PHP requires to enclose the regular expression with an arbitrary character (in this case a slash has been chosen), to separate the actual regexp from the modifier characters (if any). ------------------------------------------------------------------------ [2017-09-18 14:30:51] Philip dot Hazel at gmail dot com It has now been reported to the PCRE maintainers, but with no information about the PCRE version. I cannot reproduce a problem with the given pattern - it gives an immediate "unmatched parentheses" error, with or without the backslashes (does PHP remove them?). ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=75207 -- Edit this bug report at https://bugs.php.net/bug.php?id=75207&edit=1