Bug #81240 [NEW]: Conditional jump or move in preg_match

From: danack Operating system: Debian PHP version: 8.1Git-2021-07-09 (Git) Package: PCRE related Bug Type: Bug Bug description:Conditional jump or move in preg_match Description: ------------ It appears there is a read from uninitialized memory somewhere in preg_match. This doesn't happen when php is configured with --enable-debug so the backtrace is a bit useless. # USE_ZEND_ALLOC=0 valgrind --track-origins=yes php debug.php ==314== Memcheck, a memory error detector ==314== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al. ==314== Using Valgrind-3.12.0.SVN and LibVEX; rerun with -h for copyright info ==314== Command: php debug.php ==314== ==314== Conditional jump or move depends on uninitialised value(s) ==314== at 0x407FAAD: ??? ==314== by 0xDE0BE27: ??? ==314== by 0xDE0BE27: ??? ==314== by 0xDE0BE2D: ??? ==314== by 0xD979B9F: ??? ==314== by 0xDE0BE27: ??? ==314== Uninitialised value was created by a heap allocation ==314== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==314== by 0x4B49D8: __zend_malloc (zend_alloc.c:3043) ==314== by 0x560CCC: zend_string_alloc (zend_string.h:141) ==314== by 0x560CCC: zend_string_init (zend_string.h:163) ==314== by 0x560CCC: zend_new_interned_string_request (zend_string.c:245) ==314== by 0x4BB051: zval_make_interned_string (zend_compile.c:507) ==314== by 0x4BB051: zend_insert_literal (zend_compile.c:519) ==314== by 0x4BB051: zend_add_literal (zend_compile.c:540) ==314== by 0x4BB101: zend_emit_op (zend_compile.c:2099) ==314== by 0x4C83F7: zend_compile_args.part.58 (zend_compile.c:3631) ==314== by 0x4C8B32: zend_compile_args (zend_compile.c:3680) ==314== by 0x4C8B32: zend_compile_call_common (zend_compile.c:3684) ==314== by 0x4C92AB: zend_compile_call (zend_compile.c:4471) ==314== by 0x4C8144: zend_compile_var_inner (zend_compile.c:10063) ==314== by 0x4C8144: zend_compile_var (zend_compile.c:10089) ==314== by 0x4C45D8: zend_compile_expr_inner (zend_compile.c:9924) ==314== by 0x4C45D8: zend_compile_expr (zend_compile.c:10044) ==314== by 0x4CC6EF: zend_compile_stmt (zend_compile.c:9886) ==314== by 0x4CFD1B: zend_compile_top_stmt (zend_compile.c:9773) Test script: --------------- <?php preg_match('/(a)(b)*(c)/', 'xxxxxx', $matches); var_dump($matches); -- Edit bug report at https://bugs.php.net/bug.php?id=81240&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=81240&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=81240&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=81240&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=81240&r=needscript Try newer version: https://bugs.php.net/fix.php?id=81240&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=81240&r=support Expected behavior: https://bugs.php.net/fix.php?id=81240&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=81240&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=81240&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=81240&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=81240&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=81240&r=dst IIS Stability: https://bugs.php.net/fix.php?id=81240&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=81240&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=81240&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=81240&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=81240&r=mysqlcfg