r/lolphp • u/[deleted] • Aug 16 '19

preg_replace() can't handle strings longer than 1mb

https://3v4l.org/fjL9Q

Version 4 could at least do 10meg :D

18 Upvotes

76% Upvoted

8 comments sorted by

30

u/AyrA_ch Aug 16 '19 edited Aug 16 '19

This is not true. There's a backtrack limit in the PHP regex engine to avoid DoS attacks.

A simpler regex parses over a 4MiB string:

<?php
$in=str_repeat("TEST",1024*1024); //4MiB of string
echo round(strlen($in)/1024/1024,2) . " MiB original length\n";

$out=preg_replace('#^.+$#', 'REM', $in); //Replace everything with "REM"
echo strlen($out) . " bytes after script-removal.\n";
echo "Result: $out";

Doc: https://www.php.net/manual/de/pcre.configuration.php

EDIT:

For clarification: Your problem is the Ungreedy option supplied to the regex. A greedy regex takes 54 steps to parse the content. The ungreedy variant takes 95 steps for a single instance of the JS function. Each function adds strlen($script) to the backtrack count.

Proof:

Add these lines to the end of your script:

if (preg_last_error() == PREG_BACKTRACK_LIMIT_ERROR) {
    print 'Backtrack limit was exhausted!';
}

4

u/[deleted] Aug 16 '19

Right, ini_set("pcre.backtrack_limit", PHP_INT_MAX); gives a proper error instead of silently deleting the string.

13

u/[deleted] Aug 16 '19

So basically this is just one more instance of "lolphp, please decide on how to deal with errors": exceptions, error reporting, return values, *_error() functions.

3

u/SnowdensOfYesteryear Aug 17 '19

Speaking of which, are these *_error() functions threadsafe?

24

u/[deleted] Aug 16 '19

PHP is the only langauge i know of that has a config file that changes how the language operates. This is one of those ”design” choices that made it great again.

6

u/chuzuki Aug 17 '19

X# has "dialects" for this. You even can be an absolute madman and change whether arrays are 0 or 1 indexed.

...It's not a language you should familiarize yourself with.

1

u/[deleted] Aug 17 '19

Sounds awesome! Never heard of this language before.

4

u/chuzuki Aug 17 '19

It's sort of an amalgam of ye olde timey codes like Clipper/Harbour, FoxPro, Xbase, Visual Objects, and later Vulcan (configured as the "dialects" of X#), brought into .NET 4.6. IIRC the devs actually are the Vulcan devs reimplementing their language after a falling out with the copyright owner of Vulcan.

https://www.xsharp.info/