Preg_match_all makes children die

Question

I have a TinyMCE form that accepts copy / paste images. When you finish your comment, you will click "Post" and it will submit the form, the content will be parsed and displayed in a session on the screen.

I am trying to use preg_match_all to pull base64 encoded data from POSTed vars. Most of my templates work, but this causes Apache to crash.

<img src="data:image/(png|PNG|gif|GIF|jpg|JPG|jpeg|JPEG);base64,([a-zA-Z0-9+/=])* 

The crash is disabled, and the only hint I get from Apache / PHP is one line in the error.log file:

[error] the child died with a signal 11

I narrowed it down to this template in preg_match_all and the fact that I have * after the second group, which consists of a class definition designed to follow base64 characters until they are completed with a quote.

A sample image is available here (base64 encoded text file): https://cloud.highpoweredhelp.com/index.php/s/hnIaFmK9vTCOmcU

The only thing I can think of is that "*" is too greedy and consumes too much memory. But there are two problems:

• I increased memory_limit in php.ini from 128M to 256M with no result and
• File size is only 198K.

System: Apache v2.2.22 on Debian Wheezy 7.9 PHP Version: 5.6.16 compiled from source using the following configuration:

 ./configure --with-config-file-path=/etc/php5/apache2 \ --with-pear=/usr/share/php \ --with-bz2 \ --with-curl \ --with-gd \ --enable-calendar \ --enable-mbstring \ --enable-bcmath \ --enable-sockets \ --with-libxml-dir \ --with-mysqli \ --with-mysql \ --with-openssl \ --with-regex=php \ --with-readline \ --with-zlib \ --with-apxs2=/usr/bin/apxs2 \ --enable-soap \ --with-freetype-dir=/usr/include/freetype2/ \ --with-freetype \ --with-mcrypt=/usr/src/mcrypt-2.6.8 \ --with-jpeg-dir=/usr/lib/x86_64-linux-gnu/ \ --with-png-dir=/usr/lib/x86_64-linux-gnu/ 

Answer 1

You really intended ([a-zA-Z0-9+/=]*) instead of ([a-zA-Z0-9+/=])*

The last pattern will give you the final base64 sequence character, but it seems to cause segmentation errors pretty quickly. I managed to invoke a command line application with a relatively short line with this pattern:

 #this segfaulted for me, a shorter string did succeed $str='<img src="data:image/png;base64,'.str_repeat('0123456789',1000); if (preg_match('{<img src="data:image/(png|PNG|gif|GIF|jpg|JPG|jpeg|JPEG);base64,([a-zA-Z0-9+/=])*}', $str, $match)){ print "matched"; } 

The pattern ([a-zA-Z0-9+/=]*) will capture every character and not crash!