php / php/php-src

PCRE JIT produces wrong result on ~8192-byte strings

Open
#9,869 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Extension: pcre Status: Needs Triage
Dominant language
C
Stars
40.4k
Forks
8.1k
Avg merge
2d 13h
Merged PRs (30d)
96

Description

Description

A rather simple anchored pattern produces different results with and without the PCRE JIT when applied to a string just over 8192 characters. The JIT result is wrong.

3v4l.org link

The following code:

<?php

$t = <<<END
(49071,XXXXXXXXXX,XXXXXXXXXX,XXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,0,XXXX,XXXX2XX10X8XXXXXXXXX8XXX02XXXXXX9XXXXXX0XXXX3XXXX8X2XXXXXX7XXXXX,1605115416,XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXX,XXXXX(XXXXXXXXXXXX,XXXXXXX(XXXXX,XXXXXXXXXXXXXX,XXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXX,XXXX(XXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXX,XXXXXXXXXX,XXXXX(XXXXXXXXXXXXXX,XXXX(XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXX(XXXX(XXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXX,XXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXX,XXXX(XXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXX,XXXX(XXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXX,XXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXX,XXXXXXX(XXXXXX,XXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXX,XXXXXXXXXXXX,XXXXXXXX(XXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXX,XXXXXXXXXXXXXX(XXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXX,XXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXX,XXXXXXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXX,XXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
END;


$regex = '/\A\((?:[^\\\\\')]|\'(?:[^\'\\\\]|\\\\[\S\s])*?\')*/s';

// test without jit
ini_set("pcre.jit", 0);
echo "length: ", strlen($t), "\n";
echo "match length without pcre.jit: ";
$x = preg_match($regex, $t, $m);
echo ($x ? strlen($m[0]) : "none"), "\n";

// clear PCRE cache
$n = 0;
for ($i = 0; $i < 10000; ++$i) {
    $n += preg_match('/X{' . $i . '}/', $t);
}

// test with jit, should provide same answer
ini_set("pcre.jit", 1);
echo "match length with pcre.jit: ";
$x = preg_match($regex, $t, $m);
echo ($x ? strlen($m[0]) : "none"), "\n";

Resulted in this output:

length: 8220
match length without pcre.jit: 8219
match length with pcre.jit: none

But I expected this output instead:

length: 8220
match length without pcre.jit: 8219
match length with pcre.jit: 8219
PHP Version

PHP 8.0.12 and many others down to 7.3.30

Operating System

Mac OS X, Amazon Linux

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the provided PHP reproducer and compare the two preg_match calls with pcre.jit disabled and enabled. Investigate the PCRE JIT path responsible for anchored patterns on strings just over 8192 characters; done means both modes return a match of length 8219.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend, performance
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.