php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #27525 preg_match segfaults on certain patterns involving lookahead assertions
Submitted: 2004-03-08 03:08 UTC Modified: 2004-03-08 04:00 UTC
From: valvatne at pvv dot org Assigned:
Status: Not a bug Package: Reproducible crash
PHP Version: 4CVS-2004-03-08 (stable) OS: RedHat Linux 9 - Kernel 2.4.20-8
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: valvatne at pvv dot org
New email:
PHP Version: OS:

 

 [2004-03-08 03:08 UTC] valvatne at pvv dot org
Description:
------------
PHP segfaults when running preg_match() with a simple pattern intended to match any sequence of characters which are not followed by a given character (lookahead assertion). The segfault only happens if the string being matched approaches 10k characters in length, but at that point it seems to be 100% reproducible.

Config line:
./configure --with-apxs2=/usr/local/apache2/bin/apxs --with-mysql --with-pgsql --enable-sockets --enable-debug

Reproduce code:
---------------
$strlen = 10000;
$string = '';
for($i=0;$i<$strlen;$i++) {
    $string .= "a";
}
$pattern = '/(.(?!b))*/';
echo preg_match($pattern, $string);

Expected result:
----------------
1

Actual result:
--------------
Segmentation fault. I can't seem to get gdb to behave right now, so if someone else could reproduce the bug and post a backtrace, that would be nice.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-03-08 03:28 UTC] derick@php.net
This is a PCRE limitation, as your pattern creates to many recursive lookups. There is nothing we can do here for you.
 [2004-03-08 03:36 UTC] valvatne at pvv dot org
You're probably right, but should PHP crash when fed such a pattern? The bug I'm reporting is the crash, not a limitation in PCRE.
 [2004-03-08 04:00 UTC] derick@php.net
Nope, the PCRE library crashes, not PHP so there is nothing we *can* fix here. Perhaps you can file a bug with the PCRE guys  (Philip Hazel <ph10 (at) cam dot ac dot uk>); we will be happy to upgrade our bundled library if they fix it.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Wed Jul 02 07:01:33 2025 UTC