#27525 [Opn->Bgs]: preg_match segfaults on certain patterns involving lookahead assertions
| From: | derick@php.net | Date: | Mon, 08 Mar 2004 09:00:13 +0000 |
| Subject: | #27525 [Opn->Bgs]: preg_match segfaults on certain patterns involving lookahead assertions | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-56082@lists.php.net to get a copy of this message | ||
ID: 27525
Updated by: derick@php.net
Reported By: valvatne at pvv dot org
-Status: Open
+Status: Bogus
Bug Type: Reproducible crash
Operating System: RedHat Linux 9 - Kernel 2.4.20-8
PHP Version: 4CVS-2004-03-08 (stable)
New Comment:
Nope, the PCRE library crashes, not PHP so there is nothing we *can*
fix here. Perhaps you can file a bug with the PCRE guys (Philip Hazel
<ph10 (at) cam dot ac dot uk>); we will be happy to upgrade our bundled
library if they fix it.
Previous Comments:
------------------------------------------------------------------------
[2004-03-08 03:36:39] valvatne at pvv dot org
You're probably right, but should PHP crash when fed such a pattern?
The bug I'm reporting is the crash, not a limitation in PCRE.
------------------------------------------------------------------------
[2004-03-08 03:28:56] derick@php.net
This is a PCRE limitation, as your pattern creates to many recursive
lookups. There is nothing we can do here for you.
------------------------------------------------------------------------
[2004-03-08 03:08:46] valvatne at pvv dot org
Description:
------------
PHP segfaults when running preg_match() with a simple pattern intended
to match any sequence of characters which are not followed by a given
character (lookahead assertion). The segfault only happens if the
string being matched approaches 10k characters in length, but at that
point it seems to be 100% reproducible.
Config line:
./configure --with-apxs2=/usr/local/apache2/bin/apxs --with-mysql
--with-pgsql --enable-sockets --enable-debug
Reproduce code:
---------------
$strlen = 10000;
$string = '';
for($i=0;$i<$strlen;$i++) {
$string .= "a";
}
$pattern = '/(.(?!b))*/';
echo preg_match($pattern, $string);
Expected result:
----------------
1
Actual result:
--------------
Segmentation fault. I can't seem to get gdb to behave right now, so if
someone else could reproduce the bug and post a backtrace, that would
be nice.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=27525&edit=1