php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #27922 str_ireplace crashes if length(search) > length(replace)
Submitted: 2004-04-08 13:36 UTC Modified: 2004-04-12 17:53 UTC
From: mauricio dot seeberger at iwi dot unibe dot ch Assigned:
Status: No Feedback Package: Reproducible crash
PHP Version: 5.0.0RC1 OS: Gentoo Linux 2.6.4 / Apache2
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: mauricio dot seeberger at iwi dot unibe dot ch
New email:
PHP Version: OS:

 

 [2004-04-08 13:36 UTC] mauricio dot seeberger at iwi dot unibe dot ch
Description:
------------
If the first argument of str_ireplace is shorter than the  
second one, the function crashes (segfault).  
 
diff php.ini-dist /etc/php/apache2-php5/php.ini 
79c79 
< short_open_tag = On 
--- 
> short_open_tag = Off 
410c410 
< ;default_charset = "iso-8859-1" 
--- 
> default_charset = "iso-8859-1" 
438c438 
< extension_dir = "./" 
--- 
> extension_dir 
= /usr/lib/php/extensions/no-debug-non-zts-20040316 
496c496,498 
< allow_url_fopen = On 
--- 
> ; allow_url_fopen = On 
> ; Closed for security - <robbat2@gentoo.org> 
> allow_url_fopen = Off 
534c536 
< ; extension_dir directive above. 
--- 
> ; extension_dir 
= /usr/lib/php/extensions/no-debug-non-zts-20040316 
879c881 
< session.cookie_lifetime = 0 
--- 
> session.cookie_lifetime = 1800 
 
 
The configure line from phpinfo(): 
'./configure' '--prefix=/usr' '--host=i686-pc-linux-gnu' 
'--mandir=/usr/share/man' '--infodir=/usr/share/info' 
'--datadir=/usr/share' '--sysconfdir=/etc' 
'--localstatedir=/var/lib' '--with-apxs2=/usr/sbin/apxs2' 
'--with-ndbm=/usr' '--with-db4=/usr' '--with-mcrypt=/usr' 
'--with-mhash=/usr' '--without-interbase' '--without-ming' 
'--without-swf' '--without-sybase' '--with-gdbm=/usr' 
'--without-fdftk' '--without-java' '--with-mcal=/usr' 
'--with-unixODBC=/usr' '--with-pgsql=/usr' 
'--without-snmp' '--with-pdflib=/usr' '--with-gd' 
'--enable-gd-native-ttf' '--with-png=/usr' 
'--with-png-dir=/usr' '--with-jpeg=/usr' 
'--with-jpeg-dir=/usr' '--enable-exif' '--with-tiff=/usr' 
'--with-tiff-dir=/usr' '--with-mysql=/usr' 
'--with-mysql-sock=/var/run/mysqld/mysqld.sock' 
'--with-freetype-dir=/usr' '--with-ttf=/usr' 
'--with-t1lib=/usr' '--with-gettext' '--without-qtdom' 
'--with-pspell=/usr' '--with-openssl=/usr' 
'--with-imap=/usr' '--with-ldap=/usr' '--with-dom=/usr' 
'--with-dom-xslt=/usr' '--with-dom-exslt=/usr' 
'--with-kerberos=/usr' '--with-pam' 
'--disable-memory-limit' '--disable-ipv6' '--without-yaz' 
'--without-curl' '--enable-dbx' '--with-imap-ssl' 
'--with-zlib=/usr' '--with-zlib-dir=/usr' 
'--with-sablot=/usr' '--enable-xslt' '--with-xslt-sablot' 
'--with-xmlrpc' '--enable-wddx' '--with-xml' 
'--enable-mbstring=all' '--enable-mbregex' 
'--with-bz2=/usr' '--with-crack=/usr' '--with-cdb' 
'--enable-pcntl' '--enable-bcmath' '--enable-calendar' 
'--enable-dbase' '--enable-filepro' '--enable-ftp' 
'--with-mime-magic=/usr/share/misc/file/magic.mime' 
'--enable-sockets' '--enable-sysvsem' '--enable-sysvshm' 
'--enable-sysvipc' '--with-iconv' '--enable-shmop' 
'--enable-dio' '--enable-yp' '--without-ncurses' 
'--without-readline' '--enable-inline-optimization' 
'--enable-track-vars' '--enable-trans-sid' 
'--enable-versioning' 
'--with-config-file-path=/etc/php/apache2-php5'  

Reproduce code:
---------------
echo(str_ireplace('es','q','test'));


Expected result:
----------------
output should be: 
tqt 

Actual result:
--------------
An error occurred while loading http://..../test.php: 
Connection to host ... is broken 
 
In Apache2 error log I get following: 
[Thu Apr 08 19:20:43 2004] [notice] child pid 636 exit 
signal Segmentation fault (11) 
 

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-04-08 14:11 UTC] pollita@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5-win32-latest.zip


 [2004-04-12 17:53 UTC] sniper@php.net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Open". Thank you.


 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun May 05 07:01:32 2024 UTC