Bug #1738: ereg causes segfault

From: sasha@forum.swarthmore.edu Operating system: Linux 2.2.5-22 RH6.0 PHP version: 3.0.11 PHP Bug Type: Reproduceable crash Bug description: ereg causes segfault the following expression causes inconsistent segfaults (works fine under mod_php 3.0.7): if (ereg($filter, $key, $regs)) { echo "yes \n"; } where the 3rd argument is optional (sefaults with or without it). httpd log: [notice] child pid 3747 exit signal Segmentation fault (11).. apache 1.3.6 mod_php 3.0.11 (DSO) mod_php compile flags: CFLAGS="-fPIC" ./configure --prefix=/usr \ --with-apxs=/usr/sbin/apxs \ --with-config-file-path=/etc/httpd \ --enable-safe-mode \ --with-exec-dir=/usr/bin \ --with-system-regex \ --disable-debug \ --with-zlib \ --enable-debugger \ --enable-magic-quotes \ --enable-track-vars gdb trace on the process (no core file): Program received signal SIGSEGV, Segmentation fault. 0x400fc543 in __bzero (dstpp=0x4020af38, len=256) at ../sysdeps/i386/bzero.c:63 ../sysdeps/i386/bzero.c:63: No such file or directory. (gdb) bt #0 0x400fc543 in __bzero (dstpp=0x4020af38, len=256) at ../sysdeps/i386/bzero.c:63 #1 0x40134a4e in __re_compile_fastmap (bufp=0xbfffeba0) at regex.c:3172 #2 0x40134ea2 in __re_search_2 (bufp=0xbfffeba0, string1=0x0, size1=0, string2=0x80b81a8 "username", size2=8, startpos=0, range=8, regs=0xbfffebc0, stop=8) at regex.c:3564 #3 0x4013799e in __regexec (preg=0xbfffec60, string=0x80b81a8 "username", nmatch=10, pmatch=0xbfffec10, eflags=0) at regex.c:3480 #4 0x402392f9 in _php3_ereg () #5 0x40239597 in php3_ereg () #6 0x4024f206 in cs_functioncall_post_variable_passing () #7 0x4025286e in phpparse () #8 0x40209fb5 in php3_parse () #9 0x4020a35e in apache_php3_module_main () #10 0x40206b42 in send_php3 () #11 0x40206baa in send_parsed_php3 () #12 0x80517e1 in ap_invoke_handler () #13 0x805e28b in ap_some_auth_required () #14 0x805e2db in ap_process_request () #15 0x8058c88 in ap_child_terminate () #16 0x8058dbf in ap_child_terminate () #17 0x8058eb9 in ap_child_terminate () #18 0x8059368 in ap_child_terminate () #19 0x8059920 in main () #20 0x400b5cb3 in __libc_start_main (main=0x80596e0 <main>, argc=2, argv=0xbffffd94, init=0x804da1c <_init>, fini=0x8065a8c <_fini>, rtld_fini=0x4000a350 <_dl_fini>, stack_end=0xbffffd8c) at ../sysdeps/generic/libc-start.c:78