#27070 [Fbk->Bgs]: preg_match() crashes Apache on VERY SIMPLE pattern but large subject size

From: Date: Thu, 29 Jan 2004 05:29:13 +0000
Subject: #27070 [Fbk->Bgs]: preg_match() crashes Apache on VERY SIMPLE pattern but large subject size
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-54108@lists.php.net to get a copy of this message 
 ID:               27070
 Updated by:       sniper@php.net
 Reported By:      pages at inrp dot fr
-Status:           Feedback
+Status:           Bogus
 Bug Type:         Reproducible crash
 Operating System: Fedora Core 1 (Linux)
 PHP Version:      5.0.0b3 (beta3)
 New Comment:

This is PCRE limitation. See also: http://www.pcre.org/pcre.txt



Previous Comments:
------------------------------------------------------------------------

[2004-01-28 07:58:41] derick@php.net

Thank you for this bug report. To properly diagnose the problem, we
need a backtrace to see what is happening behind the scenes. To
find out how to generate a backtrace, please read
http://bugs.php.net/bugs-generating-backtrace.php

Once you have generated a backtrace, please submit it to this bug
report and change the status back to "Open". Thank you for helping
us make PHP better.

------------------------------------------------------------------------

[2004-01-28 06:16:59] pages at inrp dot fr

Description:
------------
After running the script bellow, /var/log/httpd/error_log
says:

 [Wed Jan 28 00:19:30 2004] [notice] child pid 13744 exit signal
Segmentation fault (11)

It has been tested on 3 different system :
 - Red Hat 8.0 + Apache 2.0.40 + PHP 4.2.2
 - Red Hat 9 + Apache 2.0.40 + PHP 4.2.2
 - Fedora Core 1 + Apache 2.0.48 + 5.0.0b3

Some statistics :
  - with pattern "/(a)*/", it crashes with a subject
    length > 13800
  - with pattern "/((a))*/", it crashes with a subject
    length > 9200
  - with pattern "/(((a)))*/", it crashes with a subject
    length > 6900
  - with pattern "/((((a))))*/", it crashes with a subject
    length > 5600
  - with pattern "/(((((a)))))*/", it crashes with a
    subject length > 4600
  - with pattern "/((((((a))))))*/", it crashes with a
    subject length > 4000
  - etc...


Reproduce code:
---------------
<?php
# This script crashes Apache :

$subject = str_repeat("a",13800);
preg_match("/(a)*/",$subject);
echo "OK";

# NB: The length of $subject (here 13800) may depend on
# your system. It seems to be related to the memory_limit
# directive (mine is 8M) but not in the way that
# one would expect (it doesn't seem to be something
# like "If I give more memory, then I need a larger
# subject to crash Apache").
# It doesn't crash if I use the pattern "/a*/" instead
# of "/(a)*/".
?>


Expected result:
----------------
No crash

Actual result:
--------------
Crash :-(


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=27070&edit=1

Thread (4 messages)

« previous php.bugs (#54108) next »