#32950 [NEW]: possible segfault with mb_ereg_replace

From: kameshj at fastmail dot fm Operating system: All PHP version: 5.0.4 PHP Bug Type: mbstring related Bug description: possible segfault with mb_ereg_replace Description: ------------ Function _php_mb_regex_ereg_replace_exec in php_mbregex.c returns RETVAL_STRINGL((char *)out_buf.c, out_buf.len - 1, 0); //At the end of the function 0 as the 3rd argument to RETVAL_STRINGL Macro does not duplicate the content and sets a retval zval same as out_buf.c. out_buf.c is allocated using malloc/realloc family not emalloc/erealloc. While zval_ptr_dtor is called on mb_reg_replace's retval, calls efree(which it should not.). Hence in the macro REMOVE_POINTER_FROM_LIST p->pLast->pNext = p->pNext; \ line causes a seg fault.(As p->pLast is null or some strange pointer not within the control of the running program) Patch for 5.0 tree is available here http://puggy.symonds.net/~kameshj/php_mbregex.c.patch Reproduce code: --------------- <?php echo mb_ereg_replace( ' ', '-', 'a b c d e' ); ?> Expected result: ---------------- a-b-c-d-e Actual result: -------------- Segfault -- Edit bug report at http://bugs.php.net/?id=32950&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=32950&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=32950&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=32950&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=32950&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=32950&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=32950&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=32950&r=needscript Try newer version: http://bugs.php.net/fix.php?id=32950&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=32950&r=support Expected behavior: http://bugs.php.net/fix.php?id=32950&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=32950&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=32950&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=32950&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=32950&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=32950&r=dst IIS Stability: http://bugs.php.net/fix.php?id=32950&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=32950&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=32950&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=32950&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=32950&r=mysqlcfg