Bug 481216 – =dev-lang/php-5.5.1 (with dev-libs/libpcre-8.33?) - segmentation fault in match() at pcre_exec.c:518

• Status: RESOLVED DUPLICATE of bug 528960
• Product: Gentoo Linux

[Description Alex Barker 2013-08-15 20:35:04 UTC]

AMD64 is causing a segfault for me in testing.  The error appears to be related to libpcre-8.33.  Please see attached backtrace.

Program received signal SIGSEGV, Segmentation fault.
0x00007fe110d56edd in match (eptr=0x2d9c691 "username\"", ecode=0x1ed28ba "X\fr", mstart=<error reading variable: Cannot access memory at address 0x7fffd4554d98>, offset_top=<error reading variable: Cannot access memory at address 0x7fffd4554d94>, 
    md=<error reading variable: Cannot access memory at address 0x7fffd4554d88>, eptrb=<error reading variable: Cannot access memory at address 0x7fffd4554d80>, rdepth=1) at pcre_exec.c:518
518     pcre_exec.c: No such file or directory.

Reproducible: Always

Steps to Reproduce:
Run the following.

<?php
// PHP 5.5.1 Segfault!
class Test {
    public function quote_column($column) {
                if (is_array($column)) {
                        list($column, $alias) = $column;
                }
               
                if (strpos($column, '"') !== FALSE) {
                        $column = preg_replace_callback('/"(.+?)"/', function($value) {
                                return $this->quote_column($value);
 
                        }, $column);
                }
 
                return $column;
    }
}
 
$t = new Test();
 
echo $t->quote_column('"Your Mom"');
?>
Actual Results:  
[Thu Aug 15 13:30:42 2013] [notice] child pid 27389 exit signal Segmentation fault (11)


Expected Results:  
Unquoted String: Your Mom

Segfaults both command line version and mod_php for Apache.

[Comment 1 Alex Barker 2013-08-15 20:39:09 UTC]

Created attachment 356118 [details]
FULL Stack Trace

This only seems to occur if the lambda function calls a recursive function, and does not appear to be related to $this or other object orientated lang constructs.  The following code will also segfault.

  GNU nano 2.3.2                                                                                 File: test.php                                                                                                                                                                        

<?php
    function quote_column($column) {
                if (is_array($column)) {
                        list($column, $alias) = $column;
                }

                if (strpos($column, '"') !== FALSE) {
                        $column = preg_replace_callback('/"(.+?)"/', function($value) {
                                return quote_column($value);

                        }, $column);
                }

                return $column;
    }

echo quote_column('"Your Mom"');

?>

[Comment 2 Alex Barker 2013-08-16 02:59:53 UTC]

Its not bailing out gracefully when it hits the recursion limit.  Doesn't matter what its set to, it always segfaults.  It should return something like it does in 5.3, you exceeded recursion limit xyz.

[Comment 3 Alex Barker 2013-08-23 17:40:36 UTC]

This continues to effects php 5.5.2.

[Comment 4 Ole Markus With (RETIRED) 2013-08-24 18:16:42 UTC]

I got segfault from both versions, but it is sort of expected. Recursion is one of the things php cannot handle gracefully [1]

If you got the recursion depth error, then you are probably using xdebug with that version.

[1] http://marc.info/?l=php-internals&m=115808767504972&w=2

[Comment 5 Michael Orlitzky 2016-07-14 15:57:51 UTC]

You got here first, but I'm going to mark this as a dupe of bug #528960 since that's assigned to base-system@ and this ultimately needs a workaround in libpcre.

*** This bug has been marked as a duplicate of bug 528960 ***