From: oliver dot block at lycos dot de
Operating system: Unix
PHP version: 5.1.2
PHP Bug Type: PCRE related
Bug description: Malicious Memory Management(?)
Description:
------------
preg_replace_callback returns content that should not be in memory!
Reproduce code:
---------------
input:
1. "Tue, 11 Apr 2006 17:09:22 GMT"
2. "Tue, 11 Apr 2006 20:26:57 +0000 (GMT)"
3. ""
function check_date($s)
{
$muster = "/(Mon, |Tue, |Wed, |Thu, |Fri, |Sat, |Sun, )?(\d\d?) (.{3})
(\d\d\d\d) (\d\d:\d\d(:\d\d)?) (([+-](\d\d(\d\d)))|GMT)/";
$result = "";
$result = preg_replace_callback($muster, create_function('$match',
'$mon = array("Jan" => "01", "Feb" => "02", "Mar" =>
"03",
"Apr" => "04", "May" => "05", "Jun" =>
"06",
"Jul" => "07", "Aug" => "08", "Sep" =>
"09",
"Okt" => "10", "Nov" => "11", "Dez" =>
"12");
$mm = $mon[$match[3]];
return "{$match[2]}.{$mm}.{$match[4]}";
'),
$s);
return $result;
}
Expected result:
----------------
1. "11.04.2006"
2. "11.04.2006"
3. ""
Actual result:
--------------
1. "11.04.2006"
2. "11.04.2006 (GMT)"
3. ""
--
Edit bug report at http://bugs.php.net/?id=37113&edit=1
--
Try a CVS snapshot (PHP 4.4):
http://bugs.php.net/fix.php?id=37113&r=trysnapshot44
Try a CVS snapshot (PHP 5.1):
http://bugs.php.net/fix.php?id=37113&r=trysnapshot51
Try a CVS snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=37113&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=37113&r=fixedcvs
Fixed in release:
http://bugs.php.net/fix.php?id=37113&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=37113&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=37113&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=37113&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=37113&r=support
Expected behavior: http://bugs.php.net/fix.php?id=37113&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=37113&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=37113&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=37113&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=37113&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=37113&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=37113&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=37113&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=37113&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=37113&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=37113&r=mysqlcfg
