php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #40004 preg_match() with /u flag corrupts memory
Submitted: 2007-01-03 00:10 UTC Modified: 2007-01-11 09:49 UTC
From: php at koterov dot ru Assigned:
Status: Not a bug Package: PCRE related
PHP Version: 4.4.4 OS: Windows XP
Private report: No CVE-ID: None
 [2007-01-03 00:10 UTC] php at koterov dot ru
Description:
------------
Seems preg_match with /u modifier corrupts process memory or returns pointer to nirvana instead of pointer to a string.

Reproduce code:
---------------
<?
preg_match('/(.{0,20})$/us', " ", $m);
var_export($m);
?>

Expected result:
----------------
space

Actual result:
--------------
something like

array ( 
  0 => ' kjwekwjn',
  1 => ' wereinoiu',
)

where "kjwekwjn" and "wereinoiu" are random strings with random binary data (useless to copy-paste them here).

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-01-03 00:16 UTC] php at koterov dot ru
This is also reproducible in command-line php.exe

PHP 4.4.4
PHP 5.1.6 (!)

Cannot reproduce on PHP 5.2.0.
 [2007-01-11 09:49 UTC] tony2001@php.net
First of all, it's a PCRE library problem.
And it's fixed in newer PCRE versions which are bundled in recent PHP releases.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Tue May 13 06:01:27 2025 UTC