#25754 [NEW]: preg_replace and preg_replace_callback are crash on long matches

[ilya at lebedev dot net]

From: ilya at lebedev dot net
Operating system: Win32
PHP version: 4CVS-2003-10-04 (stable)
PHP Bug Type: Reproducible crash
Bug description: preg_replace and preg_replace_callback are crash on long matches

Description:
------------
Regular expression from the J.Friedl's "Mastering regular expressions"
book that matches pair html tags:
#<tag([^>]*)>(((?!</?tag(?:[^>]*)>).)*)</tag>#si

When between <tag> and </tag> are more then 2100 bytes (symbols), Apache
crashes.

Same happens without "s" modifier, if string has no "newline" codes.

Reproduce code:
---------------
===
preg_replace("#<tag([^>]*)>(((?!</?tag(?:[^>]*)>).)*)</tag>#si","","<tag>
2200 symbols</tag>");
===
or
===
function callback (&$m) { return "";};
preg_replace_callback
("#<tag([^>]*)>(((?!</?tag(?:[^>]*)>).)*)</tag>#si","callback","<tag> 2200
symbols </tag>");
===

Expected result:
----------------
Match blocks bigger then 2100 symbols long.

Actual result:
--------------
With more then 2100 sybmols between tags Apache crashes.

--
Edit bug report at [url]http://bugs.php.net/?id=25754&edit=1[/url]
--
Try a CVS snapshot (php4): [url]http://bugs.php.net/fix.php?id=25754&r=trysnapshot4[/url]
Try a CVS snapshot (php5): [url]http://bugs.php.net/fix.php?id=25754&r=trysnapshot5[/url]
Fixed in CVS: [url]http://bugs.php.net/fix.php?id=25754&r=fixedcvs[/url]
Fixed in release: [url]http://bugs.php.net/fix.php?id=25754&r=alreadyfixed[/url]
Need backtrace: [url]http://bugs.php.net/fix.php?id=25754&r=needtrace[/url]
Try newer version: [url]http://bugs.php.net/fix.php?id=25754&r=oldversion[/url]
Not developer issue: [url]http://bugs.php.net/fix.php?id=25754&r=support[/url]
Expected behavior: [url]http://bugs.php.net/fix.php?id=25754&r=notwrong[/url]
Not enough info: [url]http://bugs.php.net/fix.php?id=25754&r=notenoughinfo[/url]
Submitted twice: [url]http://bugs.php.net/fix.php?id=25754&r=submittedtwice[/url]
register_globals: [url]http://bugs.php.net/fix.php?id=25754&r=globals[/url]
PHP 3 support discontinued: [url]http://bugs.php.net/fix.php?id=25754&r=php3[/url]
Daylight Savings: [url]http://bugs.php.net/fix.php?id=25754&r=dst[/url]
IIS Stability: [url]http://bugs.php.net/fix.php?id=25754&r=isapi[/url]
Install GNU Sed: [url]http://bugs.php.net/fix.php?id=25754&r=gnused[/url]
Floating point limitations: [url]http://bugs.php.net/fix.php?id=25754&r=float[/url]

[ferenczy]

From: ilya at lebedev dot net
Operating system: Win32
PHP version: 4CVS-2003-10-04 (stable)
PHP Bug Type: Reproducible crash
Bug description: preg_replace and preg_replace_callback are crash on long matches

Edit bug report at [url]http://bugs.php.net/?id=25754&edit=1[/url]

It's an Apache stack overflow issue. You probably need to increase Apache thread stack size, which is set on Windows to 1 MB only by default (8 MB on Linux).