Bug #13618: preg_match_all causes segmentation fault

From: ijones@mbcomp.co.uk Operating system: RedHat 6.2 PHP version: 4.0CVS-2001-10-09 PHP Bug Type: Reproducible crash Bug description: preg_match_all causes segmentation fault this script reproduces the problem, the problem doesn't occur if the input to the preg is under 16000 chars or so. for ($x=0;$x<5000;$x++){$result.="'test \'test\' test'";} preg_match_all ("/((\\'|[^'])+)/",$result,$output); this is the gbd output #0 0x80b5fd5 in match ( eptr=0x82a1449 "st''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' te"..., ecode=0x829c82d "\020\001'8", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf800108, flags=2) at pcre.c:3465 3465 { (gdb) bt #0 0x80b5fd5 in match ( eptr=0x82a1449 "st''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' te"..., ecode=0x829c82d "\020\001'8", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf800108, flags=2) at pcre.c:3465 #1 0x80b6089 in match ( eptr=0x82a1449 "st''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' te"..., ecode=0x829c82a "H", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf800108, flags=2) at pcre.c:3527 #2 0x80b6a52 in match ( eptr=0x82a1449 "st''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' te"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf8002e0, flags=2) at pcre.c:3911 #3 0x80b6089 in match ( eptr=0x82a1448 "est''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' t"..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf8002e0, flags=2) at pcre.c:3527 #4 0x80b6a52 in match ( eptr=0x82a1448 "est''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' t"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf8004b8, flags=2) at pcre.c:3911 #5 0x80b6089 in match ( eptr=0x82a1447 "test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' "..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf8004b8, flags=2) at pcre.c:3527 #6 0x80b6a52 in match ( eptr=0x82a1447 "test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' "..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf800690, flags=2) at pcre.c:3911 ---Type <return> to continue, or q <return> to quit--- #7 0x80b6089 in match ( eptr=0x82a1446 " test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\'"..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf800690, flags=2) at pcre.c:3527 #8 0x80b6a52 in match ( eptr=0x82a1446 " test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\'"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf800868, flags=2) at pcre.c:3911 #9 0x80b6089 in match ( eptr=0x82a1445 "' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\"..., ecode=0x829c82a "H", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf800868, flags=2) at pcre.c:3527 #10 0x80b6a52 in match ( eptr=0x82a1445 "' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf800a40, flags=2) at pcre.c:3911 #11 0x80b6089 in match ( eptr=0x82a1444 "\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test"..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf800a40, flags=2) at pcre.c:3527 #12 0x80b6a52 in match ( eptr=0x82a1444 "\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf800c18, flags=2) at pcre.c:3911 #13 0x80b6089 in match ( eptr=0x82a1443 "t\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'tes"..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0, eptrb=0xbf800c18, flags=2) at pcre.c:3527 -- Edit bug report at: http://bugs.php.net/?id=13618&edit=1