php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #55465 preg_match segmentation fault when subject too large
Submitted: 2011-08-19 21:10 UTC Modified: 2011-08-19 22:42 UTC
From: zedwoodnoreply at zedwood dot com Assigned:
Status: Not a bug Package: PCRE related
PHP Version: 5.3.7 OS: Ubuntu 10.04
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: zedwoodnoreply at zedwood dot com
New email:
PHP Version: OS:

 

 [2011-08-19 21:10 UTC] zedwoodnoreply at zedwood dot com
Description:
------------
When I change $n_times to 80000, and run the command line script php -f myscript.php, I get "Segmentation Fault".  The error also occurs when run via apache: [Fri Aug 19 15:05:14 2011] [notice] child pid 11995 exit signal Segmentation fault (11)

If you change $n_times to be sufficiently large, preg_match seems to consistently seg fault.

If I change $n_times to  something lower like 1000, there is no seg fault.

Test script:
---------------
<?php
$n_times = 80000;
$string = str_repeat('a',$n_times);

//regex from: http://w3.org/International/questions/qa-forms-utf-8.html
echo preg_match('%^(?:
		[\x09\x0A\x0D\x20-\x7E]            # ASCII
	| [\xC2-\xDF][\x80-\xBF]             # non-overlong 2-byte
	|  \xE0[\xA0-\xBF][\x80-\xBF]        # excluding overlongs
	| [\xE1-\xEC\xEE\xEF][\x80-\xBF]{2}  # straight 3-byte
	|  \xED[\x80-\x9F][\x80-\xBF]        # excluding surrogates
	|  \xF0[\x90-\xBF][\x80-\xBF]{2}     # planes 1-3
	| [\xF1-\xF3][\x80-\xBF]{3}          # planes 4-15
	|  \xF4[\x80-\x8F][\x80-\xBF]{2}     # plane 16
)*$%xs', $string) ? 'y' : 'n';
die("\n");


Expected result:
----------------
'y' or 'n'

Actual result:
--------------
command line:
Segmentation Fault

via apache error.log
[Fri Aug 19 15:05:14 2011] [notice] child pid 11995 exit signal Segmentation fault (11)


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-08-19 22:42 UTC] felipe@php.net
-Status: Open +Status: Bogus
 [2011-08-19 22:42 UTC] felipe@php.net
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

This is a known behavior from PCRE library, it's not a PHP bug.

http://docs.php.net/manual/en/pcre.configuration.php
 [2013-06-01 13:26 UTC] masakielastic at gmail dot com
This report is a duplicate. See https://bugs.php.net/bug.php?id=36463
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Fri May 02 10:01:28 2025 UTC