Bug #76640 [NEW]: stack-overflow in match (ext/pcre/pcrelib/pcre_exec.c)

From: geeknik at protonmail dot ch Operating system: Debian 9 x64 PHP version: 7.2.7 Package: PCRE related Bug Type: Bug Bug description:stack-overflow in match (ext/pcre/pcrelib/pcre_exec.c) Description: ------------ ./php-727 -r '$foo = "1HnyFwSJDjWFexD7oRr4HGTFwD8N6NsrfX"; $pattern = "[((?:(?(?<!):a?)+a?)+|\1)\8\C]u"; preg_match($pattern, $foo, $matches, PREG_OFFSET_CAPTURE, 3); print_r($matches);' Increasing ulimit -s from the default of 8192 to 156275 seems to make this go away on a consistent basis. Expected result: ---------------- No crash. Actual result: -------------- ==28465==ERROR: AddressSanitizer: stack-overflow on address 0x7ffc87ca4ff8 (pc 0x0000006032f1 bp 0x7ffc87ca53c0 sp 0x7ffc87ca4fe0 T0) #0 0x6032f0 in match /root/php-7.2.7/ext/pcre/pcrelib/pcre_exec.c:516 #1 0x60630b in match /root/php-7.2.7/ext/pcre/pcrelib/pcre_exec.c:1612:7 #2 0x60a657 in match /root/php-7.2.7/ext/pcre/pcrelib/pcre_exec.c:1388:7 #3 0x62c3d0 in match /root/php-7.2.7/ext/pcre/pcrelib/pcre_exec.c:2061:7 #4 0x62c3d0 in match /root/php-7.2.7/ext/pcre/pcrelib/pcre_exec.c:2061:7 **SNIP** #244 0x62c3d0 in match /root/php-7.2.7/ext/pcre/pcrelib/pcre_exec.c:2061:7 #245 0x62c3d0 in match /root/php-7.2.7/ext/pcre/pcrelib/pcre_exec.c:2061:7 #246 0x62c3d0 in match /root/php-7.2.7/ext/pcre/pcrelib/pcre_exec.c:2061:7 #247 0x62c3d0 in match /root/php-7.2.7/ext/pcre/pcrelib/pcre_exec.c:2061:7 #248 0x62c3d0 in match /root/php-7.2.7/ext/pcre/pcrelib/pcre_exec.c:2061:7 SUMMARY: AddressSanitizer: stack-overflow /root/php-7.2.7/ext/pcre/pcrelib/pcre_exec.c:516 in match ==28465==ABORTING -- Edit bug report at https://bugs.php.net/bug.php?id=76640&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=76640&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=76640&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=76640&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=76640&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=76640&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=76640&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=76640&r=needscript Try newer version: https://bugs.php.net/fix.php?id=76640&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=76640&r=support Expected behavior: https://bugs.php.net/fix.php?id=76640&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=76640&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=76640&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=76640&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=76640&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=76640&r=dst IIS Stability: https://bugs.php.net/fix.php?id=76640&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=76640&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=76640&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=76640&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=76640&r=mysqlcfg