PHP CVS 30 RE THIS CAUSES A SEGFAULT CVS PHP SRC PHP 4 3 EXT PCRE CONFIG M4
Date: Thu, 10 Jul 2003 11:32:02 +0800

Subject: Re: this causes a segfault cvs: php-src(PHP_4_3) /ext/pcre config.m4
From: alan@no-spam (Alan Knowles)

> @@no-spam -420,7 +421,32 @@no-spam > size_offsets = num_subpats * 3;
> offsets = (int *)safe_emalloc(size_offsets, sizeof(int), 0);
> > - /* Allocate match sets array and initialize the values */
> + /*
> + * Build a mapping from subpattern numbers to their names. We will always > + * allocate the table, even though they may be no named subpatterns. This > + * avoids somewhat more complicated logic in the inner loops.
> + */
> + subpat_names = (char **)safe_emalloc(num_subpats, sizeof(char *), 0);
> + memset(subpat_names, 0, sizeof(char *) * num_subpats);
> + {
> + int name_cnt, name_size, ni = 0;
> + char *name_table;
> + unsigned short name_idx;
> +
> + pcre_fullinfo(re, extra, PCRE_INFO_NAMECOUNT, &name_cnt);
> + if (name_cnt > 0) {
> + pcre_fullinfo(re, extra, PCRE_INFO_NAMETABLE, &name_table);
> + pcre_fullinfo(re, extra, PCRE_INFO_NAMEENTRYSIZE, &name_size);
> +
> + while (ni++ < name_cnt) {
> + name_idx = 0xff * name_table[0] + name_table[1];
> + subpat_names[name_idx] = name_table + 2;

I'm getting name_idx = 23078, sizeof(subpat_names) = 4 here.

backing out the patch solves the problem
(sorry I've no idea what the code causing the problem is - it's part of a huge app...)

Regards Alan
> + name_table += name_size;
> + }
> + }
> + }
> +
> + /* Allocate match sets array and initialize the values. */
> if (global && subpats_order == PREG_PATTERN_ORDER) {
> match_sets = (zval **)safe_emalloc(num_subpats, sizeof(zval *), 0);
> for (i=0; i<num_subpats; i++) {


Date: Thu, 10 Jul 2003 19:11:26 +0300 (EEST)

Subject: Re: [PHP-DEV] Re: this causes a segfault cvs: php-src(PHP_4_3)
From: sniper@no-spam (Jani Taskinen)
Fixed in CVS now. :)
--Jani
On Thu, 10 Jul 2003, Alan Knowles wrote:

>
>> @@no-spam -420,7 +421,32 @@no-spam >> size_offsets = num_subpats * 3;
>> offsets = (int *)safe_emalloc(size_offsets, sizeof(int), 0);
>> >> - /* Allocate match sets array and initialize the values */
>> + /*
>> + * Build a mapping from subpattern numbers to their names. We will always >> + * allocate the table, even though they may be no named subpatterns. This >> + * avoids somewhat more complicated logic in the inner loops.
>> + */
>> + subpat_names = (char **)safe_emalloc(num_subpats, sizeof(char *), 0);
>> + memset(subpat_names, 0, sizeof(char *) * num_subpats);
>> + {
>> + int name_cnt, name_size, ni = 0;
>> + char *name_table;
>> + unsigned short name_idx;
>> +
>> + pcre_fullinfo(re, extra, PCRE_INFO_NAMECOUNT, &name_cnt);
>> + if (name_cnt > 0) {
>> + pcre_fullinfo(re, extra, PCRE_INFO_NAMETABLE, &name_table);
>> + pcre_fullinfo(re, extra, PCRE_INFO_NAMEENTRYSIZE, &name_size);
>> +
>> + while (ni++ < name_cnt) {
>> + name_idx = 0xff * name_table[0] + name_table[1];
>> + subpat_names[name_idx] = name_table + 2;
>
>I'm getting name_idx = 23078, sizeof(subpat_names) = 4 here.
>
>backing out the patch solves the problem >
>(sorry I've no idea what the code causing the problem is - it's part of > a huge app...)
>
>Regards >Alan >
>
>> + name_table += name_size;
>> + }
>> + }
>> + }
>> +
>> + /* Allocate match sets array and initialize the values. */
>> if (global && subpats_order == PREG_PATTERN_ORDER) {
>> match_sets = (zval **)safe_emalloc(num_subpats, sizeof(zval *), 0);
>> for (i=0; i<num_subpats; i++) {
>
>
>
>

-- https://www.paypal.com/xclick/business=sniper@no-spam

Date: Sun, 13 Jul 2003 09:28:41 +0800

Subject: Re: [PHP-DEV] Re: this causes a segfault cvs: php-src(PHP_4_3)
From: alan@no-spam (Alan Knowles)
it's a PHP_4_3 with apache2filter - clean checkout. eg. rm php-src;cvs co ....

Regards Alan
Jani Taskinen wrote:

>5.0.0b2-dev >
>int(1)
>int(1)
>array(1) {
> [0]=>
> string(3) "abc"
>}
>
><pre>
><?php >
>echo phpversion(), "<br>\n";
>
>var_dump(preg_match('/php/i','PHP is the web scripting language of choice.'));
>var_dump(preg_match('/abc/','fredabc',$matches)); >var_dump($matches); >
>show_source('pcre.php');
>
>?>
><pre>
>
>
> Aka. BULLSHIT.
>
> --Jani >
> p.s. Fix your build.
>
>
>On Sat, 12 Jul 2003, Alan Knowles wrote:
>
> >
>>Jani Taskinen wrote:
>> >>
>>> Fixed in CVS now. :)
>>> >>>
>>nice try:) -
>>something as simple as this still kills it..
>><? echo preg_match('/abc/','fredabc',$matches); ?>
>>
>>Regards >>Alan >>
>>
>> >>
>>> >>> --Jani >>> >>>
>>>On Thu, 10 Jul 2003, Alan Knowles wrote:
>>>
>>>
>>> >>>
>>>>>@@no-spam -420,7 +421,32 @@no-spam >>>>> size_offsets = num_subpats * 3;
>>>>> offsets = (int *)safe_emalloc(size_offsets, sizeof(int), 0);
>>>>>
>>>>>- /* Allocate match sets array and initialize the values */
>>>>>+ /*
>>>>>+ * Build a mapping from subpattern numbers to their names. We will always
>>>>>+ * allocate the table, even though they may be no named subpatterns. This
>>>>>+ * avoids somewhat more complicated logic in the inner loops.
>>>>>+ */
>>>>>+ subpat_names = (char **)safe_emalloc(num_subpats, sizeof(char *), 0);
>>>>>+ memset(subpat_names, 0, sizeof(char *) * num_subpats);
>>>>>+ {
>>>>>+ int name_cnt, name_size, ni = 0;
>>>>>+ char *name_table;
>>>>>+ unsigned short name_idx;
>>>>>+
>>>>>+ pcre_fullinfo(re, extra, PCRE_INFO_NAMECOUNT, &name_cnt);
>>>>>+ if (name_cnt > 0) {
>>>>>+ pcre_fullinfo(re, extra, PCRE_INFO_NAMETABLE, &name_table);
>>>>>+ pcre_fullinfo(re, extra, PCRE_INFO_NAMEENTRYSIZE, &name_size);
>>>>>+
>>>>>+ while (ni++ < name_cnt) {
>>>>>+ name_idx = 0xff * name_table[0] + name_table[1];
>>>>>+ subpat_names[name_idx] = name_table + 2;
>>>>> >>>>>
>>>>I'm getting name_idx = 23078, sizeof(subpat_names) = 4 here.
>>>>
>>>>backing out the patch solves the problem >>>>
>>>>(sorry I've no idea what the code causing the problem is - it's part of >>>>a huge app...)
>>>>
>>>>Regards >>>>Alan >>>>
>>>>
>>>>
>>>> >>>>
>>>>>+ name_table += name_size;
>>>>>+ }
>>>>>+ }
>>>>>+ }
>>>>>+
>>>>>+ /* Allocate match sets array and initialize the values. */
>>>>> if (global && subpats_order == PREG_PATTERN_ORDER) {
>>>>> match_sets = (zval **)safe_emalloc(num_subpats, sizeof(zval *), 0);
>>>>> for (i=0; i<num_subpats; i++) {
>>>>> >>>>>
>>>>
>>>>
>>>> >>>>
>> >>
>
> >