#29549 [NEW]: xpath() output makes PHP segfault or run out of memory when used in preg_match

From: r dot korving at xit dot nl Operating system: debian linux 2.4.26 kernel PHP version: 5.0.0 PHP Bug Type: SimpleXML related Bug description: xpath() output makes PHP segfault or run out of memory when used in preg_match Description: ------------ When I use the output of $xmlobject->xpath() in a preg_match("/whatever pattern/", $xpathoutput) it makes memory usage explode or the whole script segfaults. The problem can be manually solved by typecasting the $xpathoutput to a string, but nonetheless, a segfault should never ever be desired behaviour. In fact, in one case I actually saw PHP tried to allocate over 1 gigabyte of memory. Reproduce code: --------------- #!/usr/bin/php5 <? $xml = simplexml_load_file("test.xml"); $val = $xml->xpath("/rootelem/testelems"); for ($i=0; $i < 20; $i++) { if (preg_match("/abc/", $val[0])) echo "Y"; else echo "N"; } ?> test.xml: <rootelem> <testelems>this is one</testelems> <testelems>this is another one !</testelems> </rootelem> Expected result: ---------------- NNNNNNNNNNNNNNNNNNNN Actual result: -------------- NSegmentation fault -- Edit bug report at http://bugs.php.net/?id=29549&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=29549&r=trysnapshot4 Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=29549&r=trysnapshot5 Fixed in CVS: http://bugs.php.net/fix.php?id=29549&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=29549&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=29549&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=29549&r=needscript Try newer version: http://bugs.php.net/fix.php?id=29549&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=29549&r=support Expected behavior: http://bugs.php.net/fix.php?id=29549&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=29549&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=29549&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=29549&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=29549&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=29549&r=dst IIS Stability: http://bugs.php.net/fix.php?id=29549&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=29549&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=29549&r=float