|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #44214 Crash using preg_replace_callback and global variable
Submitted: 2008-02-22 15:01 UTC Modified: 2008-03-08 13:12 UTC
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: php at bouchery dot fr Assigned:
Status: Closed Package: Reproducible crash
PHP Version: 5.3.0-dev OS: Windows XP
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please !
Your email address:
Solve the problem:
17 + 47 = ?
Subscribe to this entry?

 [2008-02-22 15:01 UTC] php at bouchery dot fr
When assigning callback parameter of preg_replace_callback into a global variable, PHP CLI interpreter crash at the end of the script.
I generate this error with PHP v5.2.3.3, and I try the last, but the result is the same.

Reproduce code:
$string = 'aaa bbb ccc ddd eee ccc aaa bbb';

$array = array();

function myCallBack( $match ) {
    global $array;
    $array[] = $match;
    return 'xxx';

echo preg_replace_callback( '`a+`', 'myCallBack', $string);

Expected result:
No crash at the end of the script.

Actual result:
Windows crash report with signature error.
AppName: php.exe  AppVer:  ModName: php5ts.dll
ModVer:  Offset: 0009a10a


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2008-03-03 15:27 UTC] php at bouchery dot fr
Same problem with nightly built "PHP 5.3.0-dev (cli) (built: Mar  3 2008 08:18:24)"
 [2008-03-03 22:31 UTC]
uhm, nice.. on windows I get the following stack trace:

zend_hash_destroy(_hashtable * ht=0x01f10318)  Line 525 + 0x5 bytes
_zval_dtor_func(_zval_struct * zvalue=0x01f0e9b8)  Line 44
_zval_ptr_dtor(_zval_struct * * zval_ptr=0x01f0eac4)  Line 422 + 0xe bytes
zend_hash_destroy(_hashtable * ht=0x01f0e438)  Line 526 + 0x6 bytes
_zval_dtor_func(_zval_struct * zvalue=0x01f101a8)  Line 44
_zval_ptr_dtor(_zval_struct * * zval_ptr=0x01f10224)  Line 422 + 0xe bytes
zend_hash_apply_deleter(_hashtable * ht=0x01e1e888, bucket * p=0x01f10218)  Line 611 + 0x6 bytes
zend_hash_graceful_reverse_destroy(_hashtable * ht=0x01e1e888)  Line 647
shutdown_executor(void * * * tsrm_ls=0x002d2640)  Line 246 + 0x17 bytes
zend_deactivate(void * * * tsrm_ls=0x002d2640)  Line 882
php_request_shutdown(void * dummy=0x00000000)  Line 1497

I don't have time to look at this today, though. The problem is related with the global variable referencing and/or some reference counting bug.
 [2008-03-08 13:12 UTC]
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
Thank you for the report, and for helping us make PHP better.

PHP Copyright © 2001-2022 The PHP Group
All rights reserved.
Last updated: Thu Jan 20 09:03:33 2022 UTC