php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #40004 preg_match() with /u flag corrupts memory
Submitted: 2007-01-03 00:10 UTC Modified: 2007-01-11 09:49 UTC
From: php at koterov dot ru Assigned:
Status: Not a bug Package: PCRE related
PHP Version: 4.4.4 OS: Windows XP
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: php at koterov dot ru
New email:
PHP Version: OS:

 

 [2007-01-03 00:10 UTC] php at koterov dot ru
Description:
------------
Seems preg_match with /u modifier corrupts process memory or returns pointer to nirvana instead of pointer to a string.

Reproduce code:
---------------
<?
preg_match('/(.{0,20})$/us', " ", $m);
var_export($m);
?>

Expected result:
----------------
space

Actual result:
--------------
something like

array ( 
  0 => ' kjwekwjn',
  1 => ' wereinoiu',
)

where "kjwekwjn" and "wereinoiu" are random strings with random binary data (useless to copy-paste them here).

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-01-03 00:16 UTC] php at koterov dot ru
This is also reproducible in command-line php.exe

PHP 4.4.4
PHP 5.1.6 (!)

Cannot reproduce on PHP 5.2.0.
 [2007-01-11 09:49 UTC] tony2001@php.net
First of all, it's a PCRE library problem.
And it's fixed in newer PCRE versions which are bundled in recent PHP releases.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Tue May 13 07:01:26 2025 UTC