PCRE JIT produces wrong result on ~8192-byte strings

[kohler]

Description

A rather simple anchored pattern produces different results with and without the PCRE JIT when applied to a string just over 8192 characters. The JIT result is wrong.

3v4l.org link

The following code:

<?php

$t = <<<END
(49071,XXXXXXXXXX,XXXXXXXXXX,XXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,0,XXXX,XXXX2XX10X8XXXXXXXXX8XXX02XXXXXX9XXXXXX0XXXX3XXXX8X2XXXXXX7XXXXX,1605115416,XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXX,XXXXX(XXXXXXXXXXXX,XXXXXXX(XXXXX,XXXXXXXXXXXXXX,XXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXX,XXXX(XXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXX,XXXXXXXXXX,XXXXX(XXXXXXXXXXXXXX,XXXX(XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXX(XXXX(XXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXX,XXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXX,XXXX(XXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXX,XXXX(XXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXX,XXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXX,XXXXXXX(XXXXXX,XXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXX,XXXXXXXXXXXX,XXXXXXXX(XXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXX,XXXXXXXXXXXXXX(XXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXX,XXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXX,XXXXXXXXXXXXX,XXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXX,XXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXX,XXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX,XXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
END;


$regex = '/\A\((?:[^\\\\\')]|\'(?:[^\'\\\\]|\\\\[\S\s])*?\')*/s';

// test without jit
ini_set("pcre.jit", 0);
echo "length: ", strlen($t), "\n";
echo "match length without pcre.jit: ";
$x = preg_match($regex, $t, $m);
echo ($x ? strlen($m[0]) : "none"), "\n";

// clear PCRE cache
$n = 0;
for ($i = 0; $i < 10000; ++$i) {
    $n += preg_match('/X{' . $i . '}/', $t);
}

// test with jit, should provide same answer
ini_set("pcre.jit", 1);
echo "match length with pcre.jit: ";
$x = preg_match($regex, $t, $m);
echo ($x ? strlen($m[0]) : "none"), "\n";

Resulted in this output:

length: 8220
match length without pcre.jit: 8219
match length with pcre.jit: none

But I expected this output instead:

length: 8220
match length without pcre.jit: 8219
match length with pcre.jit: 8219

PHP Version

PHP 8.0.12 and many others down to 7.3.30

Operating System

Mac OS X, Amazon Linux

[cmb69]

I can reproduce this with PCRE 10.35 and 10.40 (latest release). It is most likely an issue in the PCRE2 JIT engine, so should be reported upstream if (still) reproducible there.

[kohler]

It was reproducible; this regex blows out the JIT stack. I reported it PCRE2Project/pcre2#156

[cmb69]

I reported it PCRE2Project/pcre2#156

Thank you! I suggest to keep this issue open, just in case there might be a solution which we want to backport to our bundled PCRE2.