Hi,
when pcre.backtrack_limit is reached with preg_replace()
the subject
string gets truncated to a string of length zero.
Here is a simple example (yes I know you shouldn't write a regexp like
that but it is simplified from a real pattern a coworker used).
,----[ PHP5.3 ]
| m58s03:~# php -r '$s = str_repeat("a", 9999);echo strlen(preg_replace("/a(.?)b/", "$1", $s)),"\n";'
| 9999
| m58s03:~# php -r 'ini_set("pcre.backtrack_limit",10);$s = str_repeat("a", 9999);echo strlen(preg_replace("/a(.?)b/", "$1", $s)),"\n";'
| 0
| m58s03:~# php -r '$s = str_repeat("a", 99998);echo strlen(preg_replace("/a(.*?)b/", "$1", $s)),"\n";'
| 0
| m58s03:~# php -i|grep pcre
| pcre
| pcre.backtrack_limit => 100000 => 100000
| pcre.recursion_limit => 100000 => 100000
| m58s03:~# php -v
| PHP 5.3.0-dev (cli) (built: Jan 20 2008 20:59:20)
| Copyright (c) 1997-2008 The PHP Group
| Zend Engine v2.3.0, Copyright (c) 1998-2008 Zend Technologies
`----
The same happens with PHP 5.2.5. The pcre lib is the one shipped with
PHP.
KP
Hello
Em Qua, 2008-01-30 às 20:57 +0100, Karl Pflästerer escreveu:
Hi,
when pcre.backtrack_limit is reached withpreg_replace()
the subject
string gets truncated to a string of length zero.
I changed the phrase about the return value (3 weeks ago) in
pcre_replace(), it can be seen at http://docs.php.net/preg-replace, i
added "or NULL
if an error occurred."
<?php
ini_set("pcre.backtrack_limit",10);
$s = str_repeat("a", 9999);
var_dump(preg_replace("/a(.*?)b/", "$1", $s));
var_dump(preg_last_error()); // 2 = PREG_BACKTRACK_LIMIT_ERROR
Output:
NULL
int(2)
--
Regards,
Felipe Pena.