php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #37239 Regxp couses PHP script crach on Windows
Submitted: 2006-04-28 18:41 UTC Modified: 2006-10-04 01:00 UTC
Votes:10
Avg. Score:3.1 ± 0.9
Reproduced:2 of 3 (66.7%)
Same Version:2 (100.0%)
Same OS:1 (50.0%)
From: dimox at inbox dot lv Assigned:
Status: No Feedback Package: Reproducible crash
PHP Version: 4.4.4 OS: Windows XP Pro SP2
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2006-04-28 18:41 UTC] dimox at inbox dot lv
Description:
------------
Regxp couses PHP script crach on Windows. On Linux Server it works fine, but I use Windows server on my PC for development. 
I try this code on my own PC with Apache/1.3.34 (Win32) PHP/4.4.2 and on another PC with Apache/1.3.34 (Win32) PHP/4.4.1. On my PC this code souses Apache crash, but on another PC this code couses only script crash. I looking information about this bug anywere, but can't find anything useful, except http://bugs.php.net/bug.php?id=27735. I try with logs disconnection, but it doesn't change anything. 
Help ...

Reproduce code:
---------------
$regex = '/block\s*name=\"([^\"]+)\"\s*\%\>((.(?!(block\s)))+?)\blockend/is';
while(preg_match_all($regex, $text, $block_matches, PREG_SET_ORDER)){
...
}

Expected result:
----------------
$block_matches array with results of regular expression matches. I need in this to parse blocks like 

block name="name1"
  something
    block name="name2"
      something else
      ...
    blockend
blockend

Actual result:
--------------
"Server not found" or "The page cannot be displayed" in browser. 
After simplification of code to:
 
$regex = '/block\s*name=\"([^\"]+)\"\s*\%\>(.+?)\blockend/is';
while(preg_match_all($regex, $text, $block_matches, PREG_SET_ORDER)){
...
}

all works fine(remooved lookahead assertion). If i add () around the '.' - script crash again.

$regex = '/block\s*name=\"([^\"]+)\"\s*\%\>((.)+?)\blockend/is';

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-04-28 19:58 UTC] dimox at inbox dot lv
While i symlificate the code i forgot to remove \%\> from example and posted text for parsig was too small to cause error. I found, that block content must be more tan 1330-1360 simbols to couse script crash - until this values it works fine! I increased all "memory size" values in php.ini and in the code, but problem still exist. 

Changed code:

$text = '<block name="name1">
  something
    <block name="name2">1223567890 qwertyuiop[[[]asdfghjkl;???? \zxcvbnm,./zxcvbnmm, xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;???? \zxcvbnm,./zxcvbnmm, xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;???? \zxcvbnm,./zxcvbnmm, xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;???? \zxcvbnm,./zxcvbnmm, xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;???? \zxcvbnm,./zxcvbnmm, xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;???? \zxcvbnm,./zxcvbnmm, xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;???? \zxcvbnm,./zxcvbnmm, xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;???? \zxcvbnm,./zxcvbnmm, xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;???? \zxcvbnm,./zxcvbnmm, xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;???? \zxcvbnm,./zxcvbnmm, xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;???? \zxcvbnm,./zxcvbnmm, xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;???? \zxcvbnm,./zxcvbnmm, xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;???? \zxcvbnm,./zxcvbnmm, xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1234567890123456789012345678901234567890123456789012345678901
<blockend>
<blockend>';

$regex ='/\<block\s*name=\"([^\"]+)\"\s*\>((.(?!\<block\s))+?)\<blockend\>/is';

while(preg_match_all($regex, $text, $block_matches,PREG_SET_ORDER)){
  ...
  $text = preg_replace($regex, '', $text);
}
 [2006-04-29 01:42 UTC] bjori@php.net
Thank you for this bug report. To properly diagnose the problem, we
need a backtrace to see what is happening behind the scenes. To
find out how to generate a backtrace, please read
http://bugs.php.net/bugs-generating-backtrace.php for *NIX and
http://bugs.php.net/bugs-generating-backtrace-win32.php for Win32

Once you have generated a backtrace, please submit it to this bug
report and change the status back to "Open". Thank you for helping
us make PHP better.


 [2006-05-02 11:03 UTC] dimox at inbox dot lv
Can I get trial version of MSVC6? If it exist, can you add link for me? I'm only web-programmer and I has no tools for C++ development/debugging. 

Maybe you can run file test_bug.php on your oun PC with this tools and generate this debug backtrace?
------------
test_bug.php
------------ 
<?php
$text = '<block name="name1">
  something
    <block name="name2">1223567890 qwertyuiop[[[]asdfghjkl;rrrr
\zxcvbnm,./zxcvbnmm, xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;rrrr \zxcvbnm,./zxcvbnmm,
xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;rrrr \zxcvbnm,./zxcvbnmm,
xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;rrrr \zxcvbnm,./zxcvbnmm,
xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;rrrr \zxcvbnm,./zxcvbnmm,
xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;rrrr \zxcvbnm,./zxcvbnmm,
xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;rrrr \zxcvbnm,./zxcvbnmm,
xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;rrrr \zxcvbnm,./zxcvbnmm,
xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;rrrr \zxcvbnm,./zxcvbnmm,
xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;rrrr \zxcvbnm,./zxcvbnmm,
xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;rrrr \zxcvbnm,./zxcvbnmm,
xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;rrrr \zxcvbnm,./zxcvbnmm,
xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
1223567890 qwertyuiop[[[]asdfghjkl;rrrr \zxcvbnm,./zxcvbnmm,
xsxasxaxaxae dsvvzs vsv  bdbdb<> <>><<<
123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
<blockend>
<blockend>';

$regex='/\<block\s*name=\"([^\"]+)\"\s*\>((.(?!\<block\s))+?)\<blockend\>/is';

while(preg_match_all($regex, $text, $block_matches,PREG_SET_ORDER)){
  foreach($block_matches AS $block)
  	echo '<pre>'; print_r($block_matches);
  $text = preg_replace($regex, '', $text);
}
?>

This file causes 100% crash on my Win32 server. I realy want to help PHP better.
 [2006-05-12 20:03 UTC] beagle-php at sector99 dot com
I have used Dimox's code on a Windows 2000 server running IIS and PHP 4.4.2 and have reproduced the problem. The regular expression commands on this server combination seem to be susceptible to crashing like this.
 [2006-05-14 12:28 UTC] tony2001@php.net
Works perfectly fine on Linux.
Please provide more information.
 [2006-05-15 21:26 UTC] dimox at inbox dot lv
Yes, its works on Linux. This bug is Windows only.
On Apache/1.3.29 (Win32) PHP/4.3.10 this code works fine too.

What information I can provide, except backtrace?
 [2006-05-15 21:34 UTC] beagle-php at sector99 dot com
I have confirmed this problem on another box, this one running XPSP2 / IIS like the original poster. I don't have a Linux environment with 4.4.2 on it to test that but I hope to shortly.

I can try running a trace but I'm a total noob with that kind of stuff. I don't see a debug version of PHP 4.4.2 on the snaps page -- just one for 5.x and 6.x. I tried using the Win32 debug download as referenced in bug #37188 (see 25 Apr) but couldn't get it to work. Any suggestions where to get a debug version?

Thanks for your help!
 [2006-06-01 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2006-09-21 08:37 UTC] dimox at inbox dot lv
Version 4.4.4 still has this problem :( If I run this script on version 4.3.11 (and other 4.3.x versions) - all works fine, but version 4.4.0 and all versions after it has this bug (on Windows! not Linux).
 [2006-09-26 22:20 UTC] tony2001@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php4-STABLE-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-STABLE-latest.zip

It looks pretty much like a problem of PCRELib, but I can't tell anything for sure without a backtrace.
 [2006-10-04 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Apr 26 20:01:29 2024 UTC