php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #39005 mb_ereg_replace
Submitted: 2006-09-30 19:50 UTC Modified: 2007-05-04 01:00 UTC
From: php at edwardk dot info Assigned:
Status: No Feedback Package: mbstring related
PHP Version: 5.2.1 OS: Windows 2003
Private report: No CVE-ID: None
View Developer Edit
 [2006-09-30 19:50 UTC] php at edwardk dot info 
Description:
------------
Opteron 246, Windows 2003 Std SP1
Apache 1.3.37
PHP 4.4.4

Also tried php4-win32-STABLE-200609301230, also crashing.

Apache crashes every 3-10 seconds upon first starting the Apache service.
drwatson seems to indicate it's a PHP fault, log is included.

Requests made while apache is up seem to work fine.
Apache's parent process survives and auto-restarts the child process.

Reproduce code:
---------------
Server runs too many scripts to tell specifically.

Expected result:
----------------
Apache/PHP shouldn't crash

Actual result:
--------------
Microsoft (R) DrWtsn32
Copyright (C) 1985-2002 Microsoft Corp. All rights reserved.



Application exception occurred:
        App: C:\Program Files\Apache Group\Apache\Apache.exe (pid=2020)
        When: 9/30/2006 @ 14:33:08.797
        Exception number: c0000005 (access violation)

*----> System Information <----*
        Computer Name: LT2
        User Name: SYSTEM
        Terminal Session Id: 0
        Number of Processors: 2
        Processor Type: x86 Family 15 Model 37 Stepping 1
        Windows Version: 5.2
        Current Build: 3790
        Service Pack: 1
        Current Type: Multiprocessor Free
        Registered Organization: Windows-2003
        Registered Owner: Windows-2003

*----> Task List <----*
   0 System Process
   4 System
 716 smss.exe
 788 csrss.exe
 868 winlogon.exe
 924 services.exe
 936 lsass.exe
1096 svchost.exe
1200 svchost.exe
1256 svchost.exe
1280 svchost.exe
1332 svchost.exe
1548 spoolsv.exe
1576 msdtc.exe
1772 svchost.exe
1912 G6FTPSERVER.EXE
2384 mysqld-max.exe
2404 mysqld-max.exe
2420 mysqld-max.exe
3644 PDAgent.exe
3860 svchost.exe
3876 PDEngine.exe
4088 alg.exe
2452 csrss.exe
3620 winlogon.exe
2208 csrss.exe
 884 winlogon.exe
5724 rdpclip.exe
5940 rdpclip.exe
6076 Explorer.EXE
2284 ctfmon.exe
 380 Explorer.EXE
2132 TSVNCache.exe
5588 wmiprvse.exe
3688 ADSM.exe
 476 jusched.exe
4324 G6FTPTray.exe
4684 mailserver.exe
4592 pg2.exe
4484 daemon.exe
4692 ADSM.exe
5128 ApacheMonitor.exe
4596 PowerMenu.exe
1500 flashfxp.exe
4240 TaskInfo.exe
4496 mmc.exe
3312 Explorer.EXE
5716 logon.scr
5264 Share.exe
5028 mirc.exe
4572 Apache.exe
3360 Apache.exe
2900 Apache.exe
3044 TextPad.exe
3676 wmiprvse.exe
3040 regedit.exe
2020 Apache.exe
4360 cmd.exe
3072 cmd.exe
5280 cmd.exe
4340 cmd.exe
4140 rotatelogs.exe
1624 cmd.exe
4224 cmd.exe
2948 rotatelogs.exe
3172 cmd.exe
3132 rotatelogs.exe
2968 cmd.exe
5468 rotatelogs.exe
3432 cmd.exe
 320 cmd.exe
4764 rotatelogs.exe
5344 cmd.exe
4680 cmd.exe
3444 cmd.exe
3120 cmd.exe
1440 rotatelogs.exe
5380 cmd.exe
 660 rotatelogs.exe
2260 cmd.exe
5200 cmd.exe
1748 rotatelogs.exe
 472 rotatelogs.exe
5984 rotatelogs.exe
4836 rotatelogs.exe
2176 rotatelogs.exe
4416 rotatelogs.exe
3700 rotatelogs.exe
5216 rotatelogs.exe
5304 rotatelogs.exe
2648 rotatelogs.exe
3652 drwtsn32.exe
2596 Error 0x8007012B

*----> Module List <----*
0000000000400000 - 0000000000405000: C:\Program Files\Apache Group\Apache\Apache.exe
0000000000a00000 - 0000000000a17000: C:\WINDOWS\system32\odbcint.dll
0000000000a60000 - 0000000000bd7000: C:\php\extensions\php_mbstring.dll
0000000000be0000 - 0000000000c10000: C:\php\extensions\php_curl.dll
0000000000c10000 - 0000000000c41000: C:\WINDOWS\system32\SSLEAY32.dll
0000000000c50000 - 0000000000d58000: C:\WINDOWS\system32\LIBEAY32.dll
0000000000de0000 - 0000000000ded000: C:\php\extensions\php_exif.dll
0000000000df0000 - 0000000000ec5000: C:\php\extensions\php_gd2.dll
0000000010000000 - 0000000010161000: C:\php\php4ts.dll
000000001c0f0000 - 000000001c0f5000: C:\Program Files\Apache Group\Apache\Win9xConHook.dll
000000004bf70000 - 000000004bfad000: C:\WINDOWS\system32\ODBC32.dll
000000005f270000 - 000000005f2c9000: C:\WINDOWS\system32\hnetcfg.dll
0000000060000000 - 0000000060007000: c:\php\sapi\php4apache.dll
0000000062d80000 - 0000000062d89000: C:\WINDOWS\system32\LPK.DLL
0000000069500000 - 0000000069517000: C:\WINDOWS\system32\faultrep.dll
000000006fe40000 - 000000006fe45000: c:\program files\apache group\apache\modules\mod_status.so
000000006fe60000 - 000000006fe6b000: c:\program files\apache group\apache\modules\mod_rewrite.so
000000006fe90000 - 000000006fe95000: c:\program files\apache group\apache\modules\mod_headers.so
000000006fea0000 - 000000006fea5000: c:\program files\apache group\apache\modules\mod_expires.so
000000006ff60000 - 000000006ffb8000: C:\Program Files\Apache Group\Apache\ApacheCore.dll
0000000071ae0000 - 0000000071ae8000: C:\WINDOWS\System32\wshtcpip.dll
0000000071b20000 - 0000000071b61000: C:\WINDOWS\system32\mswsock.dll
0000000071bb0000 - 0000000071bb9000: C:\WINDOWS\system32\WSOCK32.dll
0000000071bc0000 - 0000000071bc8000: C:\WINDOWS\system32\rdpsnd.dll
0000000071bf0000 - 0000000071bf8000: C:\WINDOWS\system32\WS2HELP.dll
0000000071c00000 - 0000000071c17000: C:\WINDOWS\system32\WS2_32.dll
0000000071c40000 - 0000000071c98000: C:\WINDOWS\system32\NETAPI32.dll
0000000075490000 - 00000000754f1000: C:\WINDOWS\system32\USP10.dll
0000000076290000 - 00000000762ad000: C:\WINDOWS\system32\IMM32.DLL
00000000762b0000 - 00000000762fa000: C:\WINDOWS\system32\comdlg32.dll
0000000076920000 - 00000000769e4000: C:\WINDOWS\system32\USERENV.dll
0000000076aa0000 - 0000000076acd000: C:\WINDOWS\system32\WINMM.dll
0000000076b70000 - 0000000076b7b000: C:\WINDOWS\system32\PSAPI.DLL
0000000076ed0000 - 0000000076eff000: C:\WINDOWS\system32\DNSAPI.dll
0000000076f10000 - 0000000076f3e000: C:\WINDOWS\system32\WLDAP32.dll
0000000076f70000 - 0000000076f77000: C:\WINDOWS\System32\winrnr.dll
0000000076f80000 - 0000000076f88000: C:\WINDOWS\system32\rasadhlp.dll
00000000770e0000 - 00000000771ea000: C:\WINDOWS\system32\SETUPAPI.dll
00000000771f0000 - 0000000077201000: C:\WINDOWS\system32\WINSTA.dll
0000000077380000 - 0000000077412000: C:\WINDOWS\system32\USER32.dll
0000000077420000 - 0000000077523000: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.3790.1830_x-ww_7AE38CCF\comctl32.dll
0000000077530000 - 00000000775c7000: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_5.82.3790.1830_x-ww_1B6F474A\COMCTL32.dll
0000000077670000 - 00000000777a4000: C:\WINDOWS\system32\ole32.dll
0000000077b90000 - 0000000077b98000: C:\WINDOWS\system32\VERSION.dll
0000000077ba0000 - 0000000077bfa000: C:\WINDOWS\system32\msvcrt.dll
0000000077c00000 - 0000000077c48000: C:\WINDOWS\system32\GDI32.dll
0000000077c50000 - 0000000077cef000: C:\WINDOWS\system32\RPCRT4.dll
0000000077d00000 - 0000000077d8c000: C:\WINDOWS\system32\OLEAUT32.dll
0000000077da0000 - 0000000077df2000: C:\WINDOWS\system32\SHLWAPI.dll
0000000077e40000 - 0000000077f42000: C:\WINDOWS\system32\kernel32.dll
0000000077f50000 - 0000000077fec000: C:\WINDOWS\system32\ADVAPI32.dll
000000007c800000 - 000000007c8c0000: C:\WINDOWS\system32\ntdll.dll
000000007c8d0000 - 000000007d0d4000: C:\WINDOWS\system32\SHELL32.dll

*----> State Dump for Thread Id 0x11e0 <----*

eax=0fc7e7e0 ebx=0fc1d5a0 ecx=0fc11410 edx=0fc1d5a0 esi=0f6dcc50 edi=00000000
eip=00000061 esp=044afc78 ebp=00000000 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202

function: <nosymbols>
No prior disassembly possible
        00000061 ??               ???
        00000063 ??               ???
        00000065 ??               ???
        00000067 ??               ???
FAULT ->00000061 ??               ???
Error 0x00000001
        00000063 ??               ???
        00000065 ??               ???
        00000067 ??               ???
        00000069 ??               ???
        0000006b ??               ???

*----> Stack Back Trace <----*
*** WARNING: Unable to verify checksum for C:\php\php4ts.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\php\php4ts.dll - 
ChildEBP RetAddr  Args to Child              
WARNING: Frame IP not in any known module. Following frames may be wrong.
044afc74 1000d329 0fc11410 0fc1d5a0 0f6dcc50 0x61
00000000 00000000 00000000 00000000 00000000 php4ts!sapi_handle_post+0x29

*----> Raw Stack Dump <----*
00000000044afc78  29 d3 00 10 10 14 c1 0f - a0 d5 c1 0f 50 cc 6d 0f  )...........P.m.
00000000044afc88  50 cc 6d 0f fe ab 00 10 - a0 d5 c1 0f 50 cc 6d 0f  P.m.........P.m.
00000000044afc98  88 71 11 10 50 cc 6d 0f - 00 00 00 00 01 00 00 00  .q..P.m.........
00000000044afca8  00 00 00 00 00 00 00 00 - 92 54 00 10 00 00 00 00  .........T......
00000000044afcb8  00 00 00 00 00 00 00 00 - 50 cc 6d 0f 80 fd 4a 04  ........P.m...J.
00000000044afcc8  9c 0b c6 0f 88 fd 4a 04 - 50 cc 6d 0f 00 00 00 00  ......J.P.m.....
00000000044afcd8  a2 60 62 00 00 00 00 00 - a0 60 62 00 00 00 00 00  .`b......`b.....
00000000044afce8  00 00 00 00 01 00 00 00 - 01 00 00 00 3e 2a 3a 77  ............>*:w
00000000044afcf8  0f 00 00 00 0e 00 00 00 - 11 00 00 00 11 00 00 00  ................
00000000044afd08  0e 00 00 00 10 00 00 00 - e4 71 11 10 d4 71 11 10  .........q...q..
00000000044afd18  c0 71 11 10 ac 71 11 10 - 9c 71 11 10 8c 71 11 10  .q...q...q...q..
00000000044afd28  00 00 00 00 36 3e 00 10 - 01 cc 6d 0f 00 00 00 00  ....6>....m.....
00000000044afd38  50 cc 6d 0f 00 00 00 00 - d4 fe 4a 04 00 63 bc 0b  P.m.......J..c..
00000000044afd48  74 fe 4a 04 9c 0b c6 0f - 1c fe 4a 04 30 16 00 60  t.J.......J.0..`
00000000044afd58  a8 ff 4a 04 00 00 00 00 - 30 32 43 56 00 00 00 00  ..J.....02CV....
00000000044afd68  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
00000000044afd78  00 00 00 00 00 00 00 00 - 00 00 00 00 f5 cd ba 01  ................
00000000044afd88  10 fe 4a 04 d9 2d 00 60 - 50 cc 6d 0f 00 00 00 00  ..J..-.`P.m.....
00000000044afd98  98 4f bc 0b 50 cc 6d 0f - e4 04 00 00 01 00 00 00  .O..P.m.........
00000000044afda8  28 53 00 60 11 59 bc 0b - b0 d1 64 0a 61 5a bc 77  (S.`.Y....d.aZ.w

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-10-02 09:10 UTC] tony2001@php.net 
Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves. 

A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external 
resources such as databases, etc. If the script requires a 
database to demonstrate the issue, please make sure it creates 
all necessary tables, stored procedures etc.

Please avoid embedding huge scripts into the report.
 [2006-10-04 06:52 UTC] php at edwardk dot info 
Can a PHP 4.4.4 Win32 debug pack be created? I'm having a very difficult time isolating the script for this problem.
 [2006-10-04 09:05 UTC] edink@php.net 
Unfortunatelly we are not able to generate debug pack for PHP4. You would have to come up with reproducing script the old fashioned, trial and error way :)
 [2006-10-12 01:00 UTC] php-bugs at lists dot php dot net 
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2007-02-21 12:16 UTC] php at edwardk dot info 
I have since upgraded to PHP 5.2.1.
I've isolated this bug to a specific function, an example script is shown here:

<?php
$test = 'afds #blah@irc.freenode.net sfda';
echo $test.'<br>';
$test = mb_ereg_replace('\#([^,]+?)\@(irc(\.[\w\-]+)+)','<a class="irc" href="irc://\2/\1">#\1@\2</a>', $test);
echo $test;
?>

the intended use for this code segment is to replace irc links in text with clickable ones, eg, "#blah@irc.freenode.net" becomes "<a href="irc://irc.freenode.net/blah">#blah@irc.freenode.net</a>

Crashes can be reproduced with ab (ApacheBench) with the following command line:
ab -n 1000 -c 50 http://url/

Crashes occur faster when concurrency is higher, at -c 2 or so crashes don't happen.

Workaround:
Replacing mb_ereg_replace with ereg_replace stops the crashing from occuring, but with loss of multibyte support.
 [2007-02-21 12:30 UTC] php at edwardk dot info 
Further testing shows that ereg_replace throws an error on the particular regex while mb_ereg_replace does not.
 [2007-04-26 10:04 UTC] tony2001@php.net 
Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5.2-win32-latest.zip

Cannot reproduce, your code works just fine on Linux both in prefork and threaded mode.
 [2007-05-04 01:00 UTC] php-bugs at lists dot php dot net 
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Wed Nov 26 21:00:01 2025 UTC