#47811 [Opn->Asn]: preg_match that can cause segmentation fault

 ID:               47811
 Updated by:       [email protected]
 Reported By:      travis at wikihow dot com
-Status:           Open
+Status:           Assigned
 Bug Type:         Reproducible crash
 Operating System: CentOS release 4.4 & Mac OS 10.4
 PHP Version:      5.2.9
-Assigned To:      
+Assigned To:      nlopess
 New Comment:

Nuno, can you take a look please? Can reproduce it here too.


Previous Comments:
------------------------------------------------------------------------

[2009-03-30 11:24:40] scope at planetavent dot de

Here's another snippet:

<?php

$s =
"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";

$pattern = "@(X)*@";

$return = preg_match( $pattern, $s );

echo $return;

?>

This one crashes apache 2.2.8 and 2.2.11 with php-5.2.9 and php-5.2.9-1
on windows 2003.

------------------------------------------------------------------------

[2009-03-27 23:53:44] dennis dot birkholz at nexxes dot net

I have a similar segfault testcase for preg_match. It always crashes at
a stringlength of around 6700. PHP is 5.2.8 on gentoo linux.

# Create my test-string
for ($i=0; $i<20000; $i++) {
	$string .= 'a';
}

# The pattern matches for \\, \", everything except " and "
$pattern = '/^(\\\\|\\"|[^"]|")+$/';

print "Trying with string length " . "\033" . '[s';

for ($counter=6600; $counter<strlen($string); $counter++) {
	if (preg_match($pattern, substr($string,0,$counter), $matches)) {
		print "\033" . '[u' . $counter . '...';
		flush();
		
		list($dummy, $aa) = $matches;
	}
}
print "\n";

------------------------------------------------------------------------

[2009-03-27 17:26:38] travis at wikihow dot com

Description:
------------
Run a preg_match with source text attached and get a seg fault. Apache
2.2 / PHP 5.2.9 and PHP 5.2.4. 

preg_match('@<object(.|\n)*</object>@im', $text, $matches);




Reproduce code:
---------------
http://wikidiy.com/php_bug_crash.txt

Expected result:
----------------
Apache not supposed to crash, completes preg_match, dumps $matches
array.

Actual result:
--------------
Apache seg faults

[Fri Mar 27 12:16:05 2009] [notice] child pid 6391 exit signal
Segmentation fault (11)


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=47811&edit=1