php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #27525 preg_match segfaults on certain patterns involving lookahead assertions
Submitted: 2004-03-08 03:08 UTC Modified: 2004-03-08 04:00 UTC
From: valvatne at pvv dot org Assigned:
Status: Not a bug Package: Reproducible crash
PHP Version: 4CVS-2004-03-08 (stable) OS: RedHat Linux 9 - Kernel 2.4.20-8
Private report: No CVE-ID: None
 [2004-03-08 03:08 UTC] valvatne at pvv dot org
Description:
------------
PHP segfaults when running preg_match() with a simple pattern intended to match any sequence of characters which are not followed by a given character (lookahead assertion). The segfault only happens if the string being matched approaches 10k characters in length, but at that point it seems to be 100% reproducible.

Config line:
./configure --with-apxs2=/usr/local/apache2/bin/apxs --with-mysql --with-pgsql --enable-sockets --enable-debug

Reproduce code:
---------------
$strlen = 10000;
$string = '';
for($i=0;$i<$strlen;$i++) {
    $string .= "a";
}
$pattern = '/(.(?!b))*/';
echo preg_match($pattern, $string);

Expected result:
----------------
1

Actual result:
--------------
Segmentation fault. I can't seem to get gdb to behave right now, so if someone else could reproduce the bug and post a backtrace, that would be nice.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-03-08 03:28 UTC] derick@php.net
This is a PCRE limitation, as your pattern creates to many recursive lookups. There is nothing we can do here for you.
 [2004-03-08 03:36 UTC] valvatne at pvv dot org
You're probably right, but should PHP crash when fed such a pattern? The bug I'm reporting is the crash, not a limitation in PCRE.
 [2004-03-08 04:00 UTC] derick@php.net
Nope, the PCRE library crashes, not PHP so there is nothing we *can* fix here. Perhaps you can file a bug with the PCRE guys  (Philip Hazel <ph10 (at) cam dot ac dot uk>); we will be happy to upgrade our bundled library if they fix it.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Mon May 27 05:01:31 2024 UTC