search

php / php-src

The PHP Interpreter
https://www.php.net
Other
38.23k stars 7.75k forks source link

PCRE JIT produces wrong result on ~8192-byte strings #9869

Open kohler opened 2 years ago

kohler commented 2 years ago

Description

A rather simple anchored pattern produces different results with and without the PCRE JIT when applied to a string just over 8192 characters. The JIT result is wrong.

3v4l.org link

The following code:

<?php

$t = <<<END
(49071,XXXXXXXXXX,XXXXXXXXXX,XXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,0,XXXX,XXXX2XX10X8XXXXXXXXX8XXX02XXXXXX9XXXXXX0XXXX3XXXX8X2XXXXXX7XXXXX,1605115416,XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXX,XXXXX(XXXXXXXXXXXX,XXXXXXX(XXXXX,XXXXXXXXXXXXXX,XXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXX,XXXX(XXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXX,XXXXXXXXXX,XXXXX(XXXXXXXXXXXXXX,XXXX(XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXX(XXXX(XXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXX,XXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXX,XXXX(XXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXX,XXXX(XXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXX,XXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXX,XXXXXXX(XXXXXX,XXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXX,XXXXXXXXXXXX,XXXXXXXX(XXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXX,XXXXXXXXXXXXXX(XXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXX,XXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXX,XXXXXXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXX,XXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
END;

$regex = '/\A\((?:[^\\\\\')]|\'(?:[^\'\\\\]|\\\\[\S\s])*?\')*/s';

// test without jit
ini_set("pcre.jit", 0);
echo "length: ", strlen($t), "\n";
echo "match length without pcre.jit: ";
$x = preg_match($regex, $t, $m);
echo ($x ? strlen($m[0]) : "none"), "\n";

// clear PCRE cache
$n = 0;
for ($i = 0; $i < 10000; ++$i) {
    $n += preg_match('/X{' . $i . '}/', $t);
}

// test with jit, should provide same answer
ini_set("pcre.jit", 1);
echo "match length with pcre.jit: ";
$x = preg_match($regex, $t, $m);
echo ($x ? strlen($m[0]) : "none"), "\n";

Resulted in this output:

length: 8220
match length without pcre.jit: 8219
match length with pcre.jit: none

But I expected this output instead:

length: 8220
match length without pcre.jit: 8219
match length with pcre.jit: 8219

PHP Version

PHP 8.0.12 and many others down to 7.3.30

Operating System

Mac OS X, Amazon Linux

cmb69 commented 2 years ago

I can reproduce this with PCRE 10.35 and 10.40 (latest release). It is most likely an issue in the PCRE2 JIT engine, so should be reported upstream if (still) reproducible there.

kohler commented 2 years ago

It was reproducible; this regex blows out the JIT stack. I reported it https://github.com/PCRE2Project/pcre2/issues/156

cmb69 commented 2 years ago

I reported it PCRE2Project/pcre2#156

Thank you! I suggest to keep this issue open, just in case there might be a solution which we want to backport to our bundled PCRE2.