PHP :: Bug #13618 :: preg_match_all causes segmentation fault

Bug #13618	preg_match_all causes segmentation fault
Submitted:	2001-10-09 15:55 UTC	Modified:	2001-10-23 10:21 UTC
From:	ijones at mbcomp dot co dot uk	Assigned:	andrei (profile)
Status:	Closed	Package:	PCRE related
PHP Version:	4.0CVS-2001-10-09	OS:	RedHat 6.2
Private report:	No	CVE-ID:	None

View Developer Edit

[2001-10-09 15:55 UTC] ijones at mbcomp dot co dot uk

this script reproduces the problem, the problem doesn't occur if the input to the preg is under 16000 chars or so.

  for ($x=0;$x<5000;$x++){$result.="'test \'test\' test'";}
  preg_match_all ("/((\\'|[^'])+)/",$result,$output);

this is the gbd output

#0  0x80b5fd5 in match (
    eptr=0x82a1449 "st''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' te"..., ecode=0x829c82d "\020\001'8", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800108, flags=2) at pcre.c:3465
3465    {
(gdb) bt
#0  0x80b5fd5 in match (
    eptr=0x82a1449 "st''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' te"..., ecode=0x829c82d "\020\001'8", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800108, flags=2) at pcre.c:3465
#1  0x80b6089 in match (
    eptr=0x82a1449 "st''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' te"..., ecode=0x829c82a "H", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800108, flags=2) at pcre.c:3527
#2  0x80b6a52 in match (
    eptr=0x82a1449 "st''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' te"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf8002e0, flags=2) at pcre.c:3911
#3  0x80b6089 in match (
    eptr=0x82a1448 "est''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' t"..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf8002e0, flags=2) at pcre.c:3527
#4  0x80b6a52 in match (
    eptr=0x82a1448 "est''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' t"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf8004b8, flags=2) at pcre.c:3911
#5  0x80b6089 in match (
    eptr=0x82a1447 "test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' "..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf8004b8, flags=2) at pcre.c:3527
#6  0x80b6a52 in match (
    eptr=0x82a1447 "test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' "..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800690, flags=2) at pcre.c:3911
---Type <return> to continue, or q <return> to quit---
#7  0x80b6089 in match (
    eptr=0x82a1446 " test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\'"..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800690, flags=2) at pcre.c:3527
#8  0x80b6a52 in match (
    eptr=0x82a1446 " test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\'"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800868, flags=2) at pcre.c:3911
#9  0x80b6089 in match (
    eptr=0x82a1445 "' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\"..., ecode=0x829c82a "H", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800868, flags=2) at pcre.c:3527
#10 0x80b6a52 in match (
    eptr=0x82a1445 "' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800a40, flags=2) at pcre.c:3911
#11 0x80b6089 in match (
    eptr=0x82a1444 "\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test"..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800a40, flags=2) at pcre.c:3527
#12 0x80b6a52 in match (
    eptr=0x82a1444 "\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test"..., ecode=0x829c835 ":", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800c18, flags=2) at pcre.c:3911
#13 0x80b6089 in match (
    eptr=0x82a1443 "t\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'test\\' test''test \\'tes"..., ecode=0x829c830 "8", offset_top=6, md=0xbfffe714, ims=0,
    eptrb=0xbf800c18, flags=2) at pcre.c:3527

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2001-10-23 10:21 UTC] andrei@php.net

This is a limitation of the underlying PCRE library -- the string and pattern you use result in a deeply recursive call which exhausts the stack space. Use a little saner arrangement next time, i.e. check for string length and the type of pattern used.

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2024 The PHP Group All rights reserved.	Last updated: Sat Dec 21 13:01:31 2024 UTC