------- You are receiving this mail because: -------
You are on the CC list for the bug.
http://bugs.exim.org/show_bug.cgi?id=1347
Summary: Deep recursion causing SegFault
Product: PCRE
Version: 8.30
Platform: x86-64
URL: http://qbnz.com/
OS/Version: Linux
Status: NEW
Severity: bug
Priority: high
Component: Code
AssignedTo: ph10@???
ReportedBy: BenBE@???
CC: pcre-dev@???
Created an attachment (id=620)
--> (
http://bugs.exim.org/attachment.cgi?id=620)
Sample interface script
For a website using Syntax Highlighting based on GeSHi 1.0.X there's a
reproduceable crash for certain inputs that causes a Segfault while the
highlighting is performed. To reproduce the following things are needed:
- The Source from
http://upaste.me/raw/172156204acbac74 (Code to be
Highlighted, save alongside example.php from attachment)
- A small GeSHi interface trying to highlight the above code (Place into
directory where geshi.php is)
- GeSHi 1.0.X branch (SVN trunk or latest release will do)
When running the above PHP script you get a plain stack overflow crash
reproduceably within milliseconds.
Unfortunately I couldn't extract the exact PCRE expression being matched when
the crash happens.
What I COULD locate roughly is this stack trace just before the recursion:
---
Breakpoint 1, php_pcre_replace_impl (pce=0x0,
subject=0x116ff80 " typedef enum JOBTYPE {\n JT_NOVICE = 0x0,\n
JT_SWORDMAN = 0x1,\n JT_MAGICIAN = 0x2,\n JT_ARCHER = 0x3,\n JT_ACOLYTE =
0x4,\n JT_MERCHANT = 0x5,\n JT_THIEF = 0x6,\n JT_KNIGHT = 0x7,\n
JT_PRIES"..., subject_len=-1, replace_val=0x7fffffffa884,
is_callable_replace=0, result_len=0x473b77 <preg_replace_impl.isra.9+775>,
limit=0, replace_count=0x7fffdfd9e910) at
/build/buildd/php5-5.4.6/ext/pcre/php_pcre.c:972
972 in /build/buildd/php5-5.4.6/ext/pcre/php_pcre.c
(gdb) bt
#0 php_pcre_replace_impl (pce=0x0,
subject=0x116ff80 " typedef enum JOBTYPE {\n JT_NOVICE = 0x0,\n
JT_SWORDMAN = 0x1,\n JT_MAGICIAN = 0x2,\n JT_ARCHER = 0x3,\n JT_ACOLYTE =
0x4,\n JT_MERCHANT = 0x5,\n JT_THIEF = 0x6,\n JT_KNIGHT = 0x7,\n
JT_PRIES"..., subject_len=-1, replace_val=0x7fffffffa884,
is_callable_replace=0, result_len=0x473b77 <preg_replace_impl.isra.9+775>,
limit=0, replace_count=0x7fffdfd9e910) at
/build/buildd/php5-5.4.6/ext/pcre/php_pcre.c:972
#1 0x00000000004735b3 in php_replace_in_subject (regex=0x7fffdfd68ff8,
replace=0x7fffdfd69328, subject=0x7ffff7f96b78, result_len=0x7fffffffa880,
limit=32767, is_callable_replace=-539557024,
replace_count=0x473b77 <preg_replace_impl.isra.9+775>) at
/build/buildd/php5-5.4.6/ext/pcre/php_pcre.c:1281
#2 0x0000000000473b77 in preg_replace_impl.isra.9 (ht=3,
return_value=0x7fffdfd68e60, is_callable_replace=0, is_filter=0) at
/build/buildd/php5-5.4.6/ext/pcre/php_pcre.c:1379
#3 0x0000000000760282 in zend_do_fcall_common_helper_SPEC
(execute_data=0x7ffff7f92768) at
/build/buildd/php5-5.4.6/Zend/zend_vm_execute.h:642
#4 0x0000000000719ac7 in execute (op_array=0x7fffdfda7bf8) at
/build/buildd/php5-5.4.6/Zend/zend_vm_execute.h:410
#5 0x00000000006b98fc in zend_execute_scripts (type=-134491440,
retval=0x300000008, file_count=32767) at
/build/buildd/php5-5.4.6/Zend/zend.c:1289
#6 0x0000000000658d13 in php_execute_script (primary_file=0x7fff00000001) at
/build/buildd/php5-5.4.6/main/main.c:2473
#7 0x00000000007628b3 in do_cli (argc=0, argv=0x7fffffffe538) at
/build/buildd/php5-5.4.6/sapi/cli/php_cli.c:988
#8 0x000000000042c460 in main (argc=32767, argv=0xdfe230) at
/build/buildd/php5-5.4.6/sapi/cli/php_cli.c:1364
(gdb) continue
Continuing.
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff6d996ab in match (
eptr=0x1132949 "TOMB = 0x235,\n JT_4_MYSTCASE = 0x236,\n
JT_4_M_SIT_NOVICE = 0x237,\n JT_4_OCTOPUS_LEG = 0x238,\n JT_4_F_NURSE =
0x239,\n JT_4_MAL_SOLDIER = 0x23a,\n JT_4_MAL_CAPTAIN = 0x23b,\n
JT_4_MAL_BUDIDA"...,
ecode=0x11b07c9 "}",
mstart=0x112ff97 "0x0,\n JT_SWORDMAN = 0x1,\n JT_MAGICIAN = 0x2,\n
JT_ARCHER = 0x3,\n JT_ACOLYTE = 0x4,\n JT_MERCHANT = 0x5,\n JT_THIEF =
0x6,\n JT_KNIGHT = 0x7,\n JT_PRIEST = 0x8,\n JT_WIZARD = 0x9,\n
JT_BLAC"..., offset_top=4, md=0x7fffffffa4d0, eptrb=0x0, rdepth=10674) at
pcre_exec.c:1044
1044 pcre_exec.c: File or directory not found.
---
For more information and assistance with debugging this issue feel free to
contact me.
--
Configure bugmail:
http://bugs.exim.org/userprefs.cgi?tab=email
