Crash using preg_replace_callback and global variable

Bug #44214

Submitted:

2008-02-22 15:01 UTC

Modified:

2008-03-08 13:12 UTC

Votes:	1
Avg. Score:	3.0 ± 0.0
Reproduced:	1 of 1 (100.0%)
Same Version:	0 (0.0%)
Same OS:	0 (0.0%)

From:

php at bouchery dot fr

Assigned:

Status:

Closed

Package:

Reproducible crash

PHP Version:

5.3.0-dev

OS:

Windows XP

Private report:

CVE-ID:

None

[2008-02-22 15:01 UTC] php at bouchery dot fr

Description:
------------
When assigning callback parameter of preg_replace_callback into a global variable, PHP CLI interpreter crash at the end of the script.
I generate this error with PHP v5.2.3.3, and I try the last 5.2.5.5, but the result is the same.

Reproduce code:
---------------
<?php
$string = 'aaa bbb ccc ddd eee ccc aaa bbb';

$array = array();

function myCallBack( $match ) {
    global $array;
    $array[] = $match;
    return 'xxx';
}

echo preg_replace_callback( '`a+`', 'myCallBack', $string);
?>

Expected result:
----------------
No crash at the end of the script.

Actual result:
--------------
Windows crash report with signature error.
---
AppName: php.exe  AppVer: 5.2.5.5  ModName: php5ts.dll
ModVer: 5.2.5.5  Offset: 0009a10a
--

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2008-03-03 15:27 UTC] php at bouchery dot fr

Same problem with nightly built "PHP 5.3.0-dev (cli) (built: Mar  3 2008 08:18:24)"

[2008-03-03 22:31 UTC] nlopess@php.net

uhm, nice.. on windows I get the following stack trace:

zend_hash_destroy(_hashtable * ht=0x01f10318)  Line 525 + 0x5 bytes
_zval_dtor_func(_zval_struct * zvalue=0x01f0e9b8)  Line 44
_zval_ptr_dtor(_zval_struct * * zval_ptr=0x01f0eac4)  Line 422 + 0xe bytes
zend_hash_destroy(_hashtable * ht=0x01f0e438)  Line 526 + 0x6 bytes
_zval_dtor_func(_zval_struct * zvalue=0x01f101a8)  Line 44
_zval_ptr_dtor(_zval_struct * * zval_ptr=0x01f10224)  Line 422 + 0xe bytes
zend_hash_apply_deleter(_hashtable * ht=0x01e1e888, bucket * p=0x01f10218)  Line 611 + 0x6 bytes
zend_hash_graceful_reverse_destroy(_hashtable * ht=0x01e1e888)  Line 647
shutdown_executor(void * * * tsrm_ls=0x002d2640)  Line 246 + 0x17 bytes
zend_deactivate(void * * * tsrm_ls=0x002d2640)  Line 882
php_request_shutdown(void * dummy=0x00000000)  Line 1497

I don't have time to look at this today, though. The problem is related with the global variable referencing and/or some reference counting bug.

[2008-03-08 13:12 UTC] nlopess@php.net

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.