#37113 [NEW]: Malicious Memory Management(?)

From: oliver dot block at lycos dot de Operating system: Unix PHP version: 5.1.2 PHP Bug Type: PCRE related Bug description: Malicious Memory Management(?) Description: ------------ preg_replace_callback returns content that should not be in memory! Reproduce code: --------------- input: 1. "Tue, 11 Apr 2006 17:09:22 GMT" 2. "Tue, 11 Apr 2006 20:26:57 +0000 (GMT)" 3. "" function check_date($s) { $muster = "/(Mon, |Tue, |Wed, |Thu, |Fri, |Sat, |Sun, )?(\d\d?) (.{3}) (\d\d\d\d) (\d\d:\d\d(:\d\d)?) (([+-](\d\d(\d\d)))|GMT)/"; $result = ""; $result = preg_replace_callback($muster, create_function('$match', '$mon = array("Jan" => "01", "Feb" => "02", "Mar" => "03", "Apr" => "04", "May" => "05", "Jun" => "06", "Jul" => "07", "Aug" => "08", "Sep" => "09", "Okt" => "10", "Nov" => "11", "Dez" => "12"); $mm = $mon[$match[3]]; return "{$match[2]}.{$mm}.{$match[4]}"; '), $s); return $result; } Expected result: ---------------- 1. "11.04.2006" 2. "11.04.2006" 3. "" Actual result: -------------- 1. "11.04.2006" 2. "11.04.2006 (GMT)" 3. "" -- Edit bug report at http://bugs.php.net/?id=37113&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=37113&r=trysnapshot44 Try a CVS snapshot (PHP 5.1): http://bugs.php.net/fix.php?id=37113&r=trysnapshot51 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=37113&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=37113&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=37113&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=37113&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=37113&r=needscript Try newer version: http://bugs.php.net/fix.php?id=37113&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=37113&r=support Expected behavior: http://bugs.php.net/fix.php?id=37113&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=37113&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=37113&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=37113&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=37113&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=37113&r=dst IIS Stability: http://bugs.php.net/fix.php?id=37113&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=37113&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=37113&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=37113&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=37113&r=mysqlcfg