Home » HTML » HTML_QuickForm » Bug #9977

[2007-01-30 11:30 UTC] ian at ithomas dot name

Description:
------------
In Renderer/Default.php line 248:
preg_replace("/([ \t\n\r]*)?<!-- BEGIN required -->(\s|\S)*<!-- END required -->([ \t\n\r]*)?/i", '', $html);

When the above line processes a variable of over 9k it causes php to segfault, presumably from a stack overflow.

Changing the line to

preg_replace("/([ \t\n\r]*)?<!-- BEGIN required -->.*<!-- END required -->([ \t\n\r]*)?/i", '', $html);

avoids the segfault and as far as I can see does not cause any problems. The error regex a few lines below uses .* too

Test script:
---------------
<?php
$html = "<tr>
<th><span<!-- BEGIN required --> class=\"required\"<!-- END required -->><table class=\"homemain\">

any text here, must total over about 9 kbytes";

echo preg_replace("/([ \t\n\r]*)?<!-- BEGIN required -->(\s|\S)*<!-- END required -->([ \t\n\r]*)?/i", '', $html);
?>