#47811 [Com]: preg_match that can cause segmentation fault

 ID:               47811
 Comment by:       dennis dot birkholz at nexxes dot net
 Reported By:      travis at wikihow dot com
 Status:           Open
 Bug Type:         Reproducible crash
 Operating System: CentOS release 4.4 & Mac OS 10.4
 PHP Version:      5.2.9
 New Comment:

I have a similar segfault testcase for preg_match. It always crashes at
a stringlength of around 6700. PHP is 5.2.8 on gentoo linux.

# Create my test-string
for ($i=0; $i<20000; $i++) {
	$string .= 'a';
}

# The pattern matches for \\, \", everything except " and "
$pattern = '/^(\\\\|\\"|[^"]|")+$/';

print "Trying with string length " . "\033" . '[s';

for ($counter=6600; $counter<strlen($string); $counter++) {
	if (preg_match($pattern, substr($string,0,$counter), $matches)) {
		print "\033" . '[u' . $counter . '...';
		flush();
		
		list($dummy, $aa) = $matches;
	}
}
print "\n";


Previous Comments:
------------------------------------------------------------------------

[2009-03-27 17:26:38] travis at wikihow dot com

Description:
------------
Run a preg_match with source text attached and get a seg fault. Apache
2.2 / PHP 5.2.9 and PHP 5.2.4. 

preg_match('@<object(.|\n)*</object>@im', $text, $matches);




Reproduce code:
---------------
http://wikidiy.com/php_bug_crash.txt

Expected result:
----------------
Apache not supposed to crash, completes preg_match, dumps $matches
array.

Actual result:
--------------
Apache seg faults

[Fri Mar 27 12:16:05 2009] [notice] child pid 6391 exit signal
Segmentation fault (11)


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=47811&edit=1