PCRE JIT produces wrong result on ~8192-byte strings
Open
Nobody has claimed this yet.
Bug
Extension: pcre
Status: Needs Triage
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
A rather simple anchored pattern produces different results with and without the PCRE JIT when applied to a string just over 8192 characters. The JIT result is wrong.
The following code:
<?php
$t = <<<END
(49071,XXXXXXXXXX,XXXXXXXXXX,XXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,0,XXXX,XXXX2XX10X8XXXXXXXXX8XXX02XXXXXX9XXXXXX0XXXX3XXXX8X2XXXXXX7XXXXX,1605115416,XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXX,XXXXX(XXXXXXXXXXXX,XXXXXXX(XXXXX,XXXXXXXXXXXXXX,XXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXX,XXXX(XXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXX,XXXXXXXXXX,XXXXX(XXXXXXXXXXXXXX,XXXX(XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXX(XXXX(XXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXX,XXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXX,XXXX(XXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXX,XXXX(XXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXX,XXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXX,XXXXXXX(XXXXXX,XXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXX,XXXXXXXXXXXX,XXXXXXXX(XXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXX,XXXXXXXXXXXXXX(XXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXX,XXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXX,XXXXXXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXX,XXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
END;
$regex = '/\A\((?:[^\\\\\')]|\'(?:[^\'\\\\]|\\\\[\S\s])*?\')*/s';
// test without jit
ini_set("pcre.jit", 0);
echo "length: ", strlen($t), "\n";
echo "match length without pcre.jit: ";
$x = preg_match($regex, $t, $m);
echo ($x ? strlen($m[0]) : "none"), "\n";
// clear PCRE cache
$n = 0;
for ($i = 0; $i < 10000; ++$i) {
$n += preg_match('/X{' . $i . '}/', $t);
}
// test with jit, should provide same answer
ini_set("pcre.jit", 1);
echo "match length with pcre.jit: ";
$x = preg_match($regex, $t, $m);
echo ($x ? strlen($m[0]) : "none"), "\n";
Resulted in this output:
length: 8220
match length without pcre.jit: 8219
match length with pcre.jit: none
But I expected this output instead:
length: 8220
match length without pcre.jit: 8219
match length with pcre.jit: 8219
PHP Version
PHP 8.0.12 and many others down to 7.3.30
Operating System
Mac OS X, Amazon Linux
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the provided PHP reproducer and compare the two preg_match calls with pcre.jit disabled and enabled. Investigate the PCRE JIT path responsible for anchored patterns on strings just over 8192 characters; done means both modes return a match of length 8219.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend, performance
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100