PHP 4.0 Bug #7509 Updated: Problem (buffer overflow?) with ereg()
| From: | ignacio at openservices dot net | Date: | Mon, 30 Oct 2000 17:57:37 +0000 |
| Subject: | PHP 4.0 Bug #7509 Updated: Problem (buffer overflow?) with ereg() | ||
| Groups: | php.dev | ||
| Request: | Send a blank email to php-dev+get-36466@lists.php.net to get a copy of this message | ||
ID: 7509
User Update by: ignacio@openservices.net
Old-Status: Open
Status: Closed
Bug Type: Regexps related
Description: Problem (buffer overflow?) with ereg()
Hmm... configured with '--with-regex=php' and it works fine now. Oh well. Time to dig
through the source and send Red Hat a bug report I suppose.
Previous Comments:
---------------------------------------------------------------------------
[2000-10-28 06:12:58] ignacio@openservices.net
When I give ereg() a sufficiently complex RE, PHP seems to roll over and die or something the next
time it calls ereg(). It has exhibited this behavior since 4.0.1pl2, when we first put the code in
place.
Here's the code:
"""
while
(ereg("^((.|n)*)<[[:space:]]*[Ff][Oo][Rr][Mm][Ss][Ee][Tt][[:space:]]*([Tt][Yy][Pp][Ee]=("[^"]*"|[^">]*))?[[:space:]]*>((.|n)*)$",
$string, $out))
{
error_log("after 1",0);
flush();
if ($out[4][0]==""")
{
error_log("after 2",0);
flush();
$type=substr($out[4], 1, -1);
error_log("after 3",0);
flush();
}
else
{
error_log("after 4",0);
flush();
$type=$out[4];
error_log("after 5",0);
flush();
};
error_log("after 6",0);
$string=$out[1].FORMSETFUN($type).$out[5];
error_log("after 7",0);
flush();
$formexists=1;
};
error_log("after formset",0);
flush();
"""
It gets to "after 7" and then dies. If the 'while' is changed to an
'if', the problem exhibits itself on subsequent calls to ereg() further down.
PHP is configured to use the system RE libs, so I'm wondering if the problem might be in there.
Nonetheless, I'm putting it in the PHP bug list so I can be sure.
---------------------------------------------------------------------------
Full Bug description available at: http://bugs.php.net/?id=7509