#27922 [Fbk->NoF]: str_ireplace crashes if length(search) > length(replace)

ID: 27922 Updated by: sniper@php.net Reported By: mauricio dot seeberger at iwi dot unibe dot ch -Status: Feedback +Status: No Feedback Bug Type: Reproducible crash Operating System: Gentoo Linux 2.6.4 / Apache2 PHP Version: 5.0.0RC1 New Comment: No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Open". Thank you. Previous Comments: ------------------------------------------------------------------------ [2004-04-08 14:11:16] pollita@php.net Please try using this CVS snapshot: http://snaps.php.net/php5-latest.tar.gz For Windows: http://snaps.php.net/win32/php5-win32-latest.zip ------------------------------------------------------------------------ [2004-04-08 13:36:12] mauricio dot seeberger at iwi dot unibe dot ch Description: ------------ If the first argument of str_ireplace is shorter than the second one, the function crashes (segfault). diff php.ini-dist /etc/php/apache2-php5/php.ini 79c79 < short_open_tag = On --- > short_open_tag = Off 410c410 < ;default_charset = "iso-8859-1" --- > default_charset = "iso-8859-1" 438c438 < extension_dir = "./" --- > extension_dir = /usr/lib/php/extensions/no-debug-non-zts-20040316 496c496,498 < allow_url_fopen = On --- > ; allow_url_fopen = On > ; Closed for security - <robbat2@gentoo.org> > allow_url_fopen = Off 534c536 < ; extension_dir directive above. --- > ; extension_dir = /usr/lib/php/extensions/no-debug-non-zts-20040316 879c881 < session.cookie_lifetime = 0 --- > session.cookie_lifetime = 1800 The configure line from phpinfo(): './configure' '--prefix=/usr' '--host=i686-pc-linux-gnu' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--datadir=/usr/share' '--sysconfdir=/etc' '--localstatedir=/var/lib' '--with-apxs2=/usr/sbin/apxs2' '--with-ndbm=/usr' '--with-db4=/usr' '--with-mcrypt=/usr' '--with-mhash=/usr' '--without-interbase' '--without-ming' '--without-swf' '--without-sybase' '--with-gdbm=/usr' '--without-fdftk' '--without-java' '--with-mcal=/usr' '--with-unixODBC=/usr' '--with-pgsql=/usr' '--without-snmp' '--with-pdflib=/usr' '--with-gd' '--enable-gd-native-ttf' '--with-png=/usr' '--with-png-dir=/usr' '--with-jpeg=/usr' '--with-jpeg-dir=/usr' '--enable-exif' '--with-tiff=/usr' '--with-tiff-dir=/usr' '--with-mysql=/usr' '--with-mysql-sock=/var/run/mysqld/mysqld.sock' '--with-freetype-dir=/usr' '--with-ttf=/usr' '--with-t1lib=/usr' '--with-gettext' '--without-qtdom' '--with-pspell=/usr' '--with-openssl=/usr' '--with-imap=/usr' '--with-ldap=/usr' '--with-dom=/usr' '--with-dom-xslt=/usr' '--with-dom-exslt=/usr' '--with-kerberos=/usr' '--with-pam' '--disable-memory-limit' '--disable-ipv6' '--without-yaz' '--without-curl' '--enable-dbx' '--with-imap-ssl' '--with-zlib=/usr' '--with-zlib-dir=/usr' '--with-sablot=/usr' '--enable-xslt' '--with-xslt-sablot' '--with-xmlrpc' '--enable-wddx' '--with-xml' '--enable-mbstring=all' '--enable-mbregex' '--with-bz2=/usr' '--with-crack=/usr' '--with-cdb' '--enable-pcntl' '--enable-bcmath' '--enable-calendar' '--enable-dbase' '--enable-filepro' '--enable-ftp' '--with-mime-magic=/usr/share/misc/file/magic.mime' '--enable-sockets' '--enable-sysvsem' '--enable-sysvshm' '--enable-sysvipc' '--with-iconv' '--enable-shmop' '--enable-dio' '--enable-yp' '--without-ncurses' '--without-readline' '--enable-inline-optimization' '--enable-track-vars' '--enable-trans-sid' '--enable-versioning' '--with-config-file-path=/etc/php/apache2-php5' Reproduce code: --------------- echo(str_ireplace('es','q','test')); Expected result: ---------------- output should be: tqt Actual result: -------------- An error occurred while loading http://..../test.php: Connection to host ... is broken In Apache2 error log I get following: [Thu Apr 08 19:20:43 2004] [notice] child pid 636 exit signal Segmentation fault (11) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=27922&edit=1