php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #55465 preg_match segmentation fault when subject too large
Submitted: 2011-08-19 21:10 UTC Modified: 2011-08-19 22:42 UTC
From: zedwoodnoreply at zedwood dot com Assigned:
Status: Not a bug Package: PCRE related
PHP Version: 5.3.7 OS: Ubuntu 10.04
Private report: No CVE-ID: None
 [2011-08-19 21:10 UTC] zedwoodnoreply at zedwood dot com
Description:
------------
When I change $n_times to 80000, and run the command line script php -f myscript.php, I get "Segmentation Fault".  The error also occurs when run via apache: [Fri Aug 19 15:05:14 2011] [notice] child pid 11995 exit signal Segmentation fault (11)

If you change $n_times to be sufficiently large, preg_match seems to consistently seg fault.

If I change $n_times to  something lower like 1000, there is no seg fault.

Test script:
---------------
<?php
$n_times = 80000;
$string = str_repeat('a',$n_times);

//regex from: http://w3.org/International/questions/qa-forms-utf-8.html
echo preg_match('%^(?:
		[\x09\x0A\x0D\x20-\x7E]            # ASCII
	| [\xC2-\xDF][\x80-\xBF]             # non-overlong 2-byte
	|  \xE0[\xA0-\xBF][\x80-\xBF]        # excluding overlongs
	| [\xE1-\xEC\xEE\xEF][\x80-\xBF]{2}  # straight 3-byte
	|  \xED[\x80-\x9F][\x80-\xBF]        # excluding surrogates
	|  \xF0[\x90-\xBF][\x80-\xBF]{2}     # planes 1-3
	| [\xF1-\xF3][\x80-\xBF]{3}          # planes 4-15
	|  \xF4[\x80-\x8F][\x80-\xBF]{2}     # plane 16
)*$%xs', $string) ? 'y' : 'n';
die("\n");


Expected result:
----------------
'y' or 'n'

Actual result:
--------------
command line:
Segmentation Fault

via apache error.log
[Fri Aug 19 15:05:14 2011] [notice] child pid 11995 exit signal Segmentation fault (11)


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-08-19 22:42 UTC] felipe@php.net
-Status: Open +Status: Bogus
 [2011-08-19 22:42 UTC] felipe@php.net
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

This is a known behavior from PCRE library, it's not a PHP bug.

http://docs.php.net/manual/en/pcre.configuration.php
 [2013-06-01 13:26 UTC] masakielastic at gmail dot com
This report is a duplicate. See https://bugs.php.net/bug.php?id=36463
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Apr 26 19:01:29 2024 UTC