#34790 [Asn]: preg_match_all(), named capturing groups, variable assignment/return => crash

ID: 34790 Updated by: tony2001@php.net Reported By: savzen at gmail dot com Status: Assigned Bug Type: PCRE related Operating System: Linux PHP Version: 5CVS, 4CVS (2005-10-08) (snap) Assigned To: dmitry New Comment: This is what I get with Zend MM disabled: http://tony2001.phpclub.net/dev/tmp/pcre_valgrind.txt Previous Comments: ------------------------------------------------------------------------ [2005-10-10 23:26:54] nlopess@php.net I've reproduced it with PHP 5.1. I haven't tried anything else. Dmitry probably is the best guy to look at this, as it seems an engine problem. ------------------------------------------------------------------------ [2005-10-10 01:14:45] savzen at gmail dot com I get errors in output and a segmentation fault. Reproduce code: ----------------------------- <?php function func1(){ $string = 'what the word and the other word the'; preg_match_all('/(?P<word>the)/', $string, $matches); return $matches['word']; } $words = func1(); var_dump($words); ?> Expected result: ---------------------------- array(4) { [0]=> string(3) "the" [1]=> string(3) "the" [2]=> string(3) "the" [3]=> string(3) "the" } Actual result: --------------------------- array(4) { [0]=> string(3) "the" [1]=> string(3) "the" [2]=> string(3) "the" [3]=> string(3) "q9" } Segmentation fault This is the backtrace without --enable-debug, because it doesn't crash with it enabled. Only output is UNKNOWN:0 -------------------------------------------------- (gdb) bt #0 0x402429fc in malloc () from /lib/i686/libc.so.6 #1 0x083047f8 in ?? () #2 0x402ec6a0 in __check_rhosts_file () from /lib/i686/libc.so.6 Cannot access memory at address 0x10000 ------------------------------------------------------------------------ [2005-10-09 20:48:17] iliaa@php.net Please try using this CVS snapshot: http://snaps.php.net/php5-latest.tar.gz For Windows: http://snaps.php.net/win32/php5-win32-latest.zip Tried latest CVS, works fine and no valgrind errors. ------------------------------------------------------------------------ [2005-10-09 01:42:25] nlopess@php.net I've tried to fix the bug, but I couldn't find a clue. The problem is triggered when destroying a hash table (in zend_hash.c), but I don't know which hash table is. This should be much easier to a Engine expert. Anyway, I've made a simpler reproduce script, which is enough to trigger valgrind errors. <? preg_match_all('/(?P<word>the)/', '', $matches); ?> ------------------------------------------------------------------------ [2005-10-09 00:17:13] nlopess@php.net Ouch... 193 valgrind errors :) ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/34790 -- Edit this bug report at http://bugs.php.net/?id=34790&edit=1