php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #13618 preg_match_all causes segmentation fault
Submitted: 2001-10-09 15:55 UTC Modified: 2001-10-23 10:21 UTC
From: ijones at mbcomp dot co dot uk Assigned: andrei (profile)
Status: Closed Package: PCRE related
PHP Version: 4.0CVS-2001-10-09 OS: RedHat 6.2
Private report: No CVE-ID: None
 [2001-10-09 15:55 UTC] ijones at mbcomp dot co dot uk
this script reproduces the problem, the problem doesn't occur if the input to the preg is under 16000 chars or so.

  for ($x=0;$x<5000;$x++){$result.="'test \'test\' test'";}
  preg_match_all ("/((\\'|[^'])+)/",$result,$output);

this is the gbd output

#0  0x80b5fd5 in match (
    eptr=0x82a1449 "st''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' te"..., ecode=0x829c82d "\020\001'8", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800108, flags=2) at pcre.c:3465
3465    {
(gdb) bt
#0  0x80b5fd5 in match (
    eptr=0x82a1449 "st''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' te"..., ecode=0x829c82d "\020\001'8", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800108, flags=2) at pcre.c:3465
#1  0x80b6089 in match (
    eptr=0x82a1449 "st''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' te"..., ecode=0x829c82a "H", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800108, flags=2) at pcre.c:3527
#2  0x80b6a52 in match (
    eptr=0x82a1449 "st''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' te"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf8002e0, flags=2) at pcre.c:3911
#3  0x80b6089 in match (
    eptr=0x82a1448 "est''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' t"..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf8002e0, flags=2) at pcre.c:3527
#4  0x80b6a52 in match (
    eptr=0x82a1448 "est''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' t"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf8004b8, flags=2) at pcre.c:3911
#5  0x80b6089 in match (
    eptr=0x82a1447 "test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' "..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf8004b8, flags=2) at pcre.c:3527
#6  0x80b6a52 in match (
    eptr=0x82a1447 "test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' "..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800690, flags=2) at pcre.c:3911
---Type <return> to continue, or q <return> to quit---
#7  0x80b6089 in match (
    eptr=0x82a1446 " test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\'"..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800690, flags=2) at pcre.c:3527
#8  0x80b6a52 in match (
    eptr=0x82a1446 " test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\'"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800868, flags=2) at pcre.c:3911
#9  0x80b6089 in match (
    eptr=0x82a1445 "' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\"..., ecode=0x829c82a "H", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800868, flags=2) at pcre.c:3527
#10 0x80b6a52 in match (
    eptr=0x82a1445 "' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800a40, flags=2) at pcre.c:3911
#11 0x80b6089 in match (
    eptr=0x82a1444 "\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test"..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800a40, flags=2) at pcre.c:3527
#12 0x80b6a52 in match (
    eptr=0x82a1444 "\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800c18, flags=2) at pcre.c:3911
#13 0x80b6089 in match (
    eptr=0x82a1443 "t\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'tes"..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800c18, flags=2) at pcre.c:3527

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-10-23 10:21 UTC] andrei@php.net
This is a limitation of the underlying PCRE library -- the string and pattern you use result in a deeply recursive call which exhausts the stack space. Use a little saner arrangement next time, i.e. check for string length and the type of pattern used.
 
PHP Copyright © 2001-2018 The PHP Group
All rights reserved.
Last updated: Sun Nov 19 01:31:42 2017 UTC