php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #72356 Regular Expression causes Apache/PHP to crash
Submitted: 2016-06-07 14:38 UTC Modified: 2016-06-26 04:22 UTC
From: fred at generation10 dot net Assigned: cmb (profile)
Status: No Feedback Package: Regexps related
PHP Version: 5.6.22 OS: Windows 10
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2016-06-07 14:38 UTC] fred at generation10 dot net
Description:
------------
We have a regular expression that removed nested comments from an HTML string. It was working OK in PHP 5.3 and 5.5 but crashes in PHP 5.6.20 and 5.6.22

The included test script is a very cut down version of string being processed. The number of characters seems to be important, removing some characters from the class names will make the script run but I can't figure the logic of it.

PHP crashes without outputting any errors, I only have the Windows Event Log output:

Faulting application name: httpd.exe, version: 2.4.12.0, time stamp: 0x550eaef9
Faulting module name: php5ts.dll, version: 5.6.22.0, time stamp: 0x57468b87
Exception code: 0xc00000fd
Fault offset: 0x0011ddd2
Faulting process id: 0x1600
Faulting application start time: 0x01d1c0c7b01411c2
Faulting application path: C:\Apache24\bin\httpd.exe
Faulting module path: C:\php-5.6.22\php5ts.dll
Report Id: 23060e48-35e8-41c0-96e7-f75628bdf8f9
Faulting package full name: 
Faulting package-relative application ID: 

Test script:
---------------
<?php
$html = <<<EOT
    <div>
            <p>Hello World</p>
            <!-- 
            <table class="123456789132456789123456789123456789123456789">
                    <tr class="">
                        <!--<td></td>-->
                        <!--<td></td>-->
                        <td class="123456789123456789123456789123456789123456789">FooBar</td>
                    </tr>
            </table>
            -->
    </div>
EOT;

do {
    $html = preg_replace("/<!--(?(?!<!--).)*-->/sU", '', $html, -1, $count);
} while ($count);

echo $html;

Expected result:
----------------
    <div>
        <p>Hello World</p>
        
    </div>

Actual result:
--------------
Site can't be reached error

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-06-07 16:23 UTC] cmb@php.net
-Status: Open +Status: Feedback
 [2016-06-07 16:23 UTC] cmb@php.net
Thank you for this bug report. To properly diagnose the problem, we
need a backtrace to see what is happening behind the scenes. To
find out how to generate a backtrace, please read
http://bugs.php.net/bugs-generating-backtrace.php for *NIX and
http://bugs.php.net/bugs-generating-backtrace-win32.php for Win32

Once you have generated a backtrace, please submit it to this bug
report and change the status back to "Open". Thank you for helping
us make PHP better.

I can't reproduce the issue on Windows 10 with the official
php-5.6.22-nts-Win32-VC11-x64 nor on <https://3v4l.org/s6jQ7>.
 [2016-06-15 00:23 UTC] cmb@php.net
-Assigned To: +Assigned To: cmb
 [2016-06-26 04:22 UTC] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Sun Nov 19 01:31:42 2017 UTC