php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #44214 Crash using preg_replace_callback and global variable
Submitted: 2008-02-22 15:01 UTC Modified: 2008-03-08 13:12 UTC
Votes:1
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: php at bouchery dot fr Assigned:
Status: Closed Package: Reproducible crash
PHP Version: 5.3.0-dev OS: Windows XP
Private report: No CVE-ID: None
View Developer Edit
 [2008-02-22 15:01 UTC] php at bouchery dot fr 
Description:
------------
When assigning callback parameter of preg_replace_callback into a global variable, PHP CLI interpreter crash at the end of the script.
I generate this error with PHP v5.2.3.3, and I try the last 5.2.5.5, but the result is the same.

Reproduce code:
---------------
<?php
$string = 'aaa bbb ccc ddd eee ccc aaa bbb';

$array = array();

function myCallBack( $match ) {
    global $array;
    $array[] = $match;
    return 'xxx';
}

echo preg_replace_callback( '`a+`', 'myCallBack', $string);
?>

Expected result:
----------------
No crash at the end of the script.

Actual result:
--------------
Windows crash report with signature error.
---
AppName: php.exe  AppVer: 5.2.5.5  ModName: php5ts.dll
ModVer: 5.2.5.5  Offset: 0009a10a
--

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-03-03 15:27 UTC] php at bouchery dot fr 
Same problem with nightly built "PHP 5.3.0-dev (cli) (built: Mar  3 2008 08:18:24)"
 [2008-03-03 22:31 UTC] nlopess@php.net 
uhm, nice.. on windows I get the following stack trace:

zend_hash_destroy(_hashtable * ht=0x01f10318)  Line 525 + 0x5 bytes
_zval_dtor_func(_zval_struct * zvalue=0x01f0e9b8)  Line 44
_zval_ptr_dtor(_zval_struct * * zval_ptr=0x01f0eac4)  Line 422 + 0xe bytes
zend_hash_destroy(_hashtable * ht=0x01f0e438)  Line 526 + 0x6 bytes
_zval_dtor_func(_zval_struct * zvalue=0x01f101a8)  Line 44
_zval_ptr_dtor(_zval_struct * * zval_ptr=0x01f10224)  Line 422 + 0xe bytes
zend_hash_apply_deleter(_hashtable * ht=0x01e1e888, bucket * p=0x01f10218)  Line 611 + 0x6 bytes
zend_hash_graceful_reverse_destroy(_hashtable * ht=0x01e1e888)  Line 647
shutdown_executor(void * * * tsrm_ls=0x002d2640)  Line 246 + 0x17 bytes
zend_deactivate(void * * * tsrm_ls=0x002d2640)  Line 882
php_request_shutdown(void * dummy=0x00000000)  Line 1497

I don't have time to look at this today, though. The problem is related with the global variable referencing and/or some reference counting bug.
 [2008-03-08 13:12 UTC] nlopess@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Mon Oct 27 10:00:01 2025 UTC