WizKid

=================================================================
==29537== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6008002b4bc3 at pc 0x5ad49f1 bp 0x7fff44de4100 sp 0x7fff44de40f8
WRITE of size 1 at 0x6008002b4bc3 thread T0
    #0 0x5ad49f0 in HPHP::php_pcre_replace(HPHP::String const&, HPHP::String const&, HPHP::Variant const&, bool, int, int*) /home/emil/fbcode/hphp/runtime/base/preg.cpp:1073
    #1 0x5ad5620 in HPHP::php_replace_in_subject(HPHP::Variant const&, HPHP::Variant const&, HPHP::String, int, bool, int*) /home/emil/fbcode/hphp/runtime/base/preg.cpp:1163
    #2 0x5ad61b8 in HPHP::preg_replace_impl(HPHP::Variant const&, HPHP::Variant const&, HPHP::Variant const&, int, HPHP::Variant&, bool, bool) /home/emil/fbcode/hphp/runtime/base/preg.cpp:1238
    #3 0x54063f0 in HPHP::f_preg_replace(HPHP::Variant const&, HPHP::Variant const&, HPHP::Variant const&, int, HPHP::VRefParamValue const&) /home/emil/fbcode/hphp/runtime/ext/pcre/ext_pcre.cpp:69

WizKid

diff --git a/hphp/runtime/base/preg.cpp b/hphp/runtime/base/preg.cpp
index e9e637b..b64fbff 100644
--- a/hphp/runtime/base/preg.cpp
+++ b/hphp/runtime/base/preg.cpp
@@ -1064,6 +1064,12 @@ static Variant php_pcre_replace(const String& pattern, const String& subject,
                                     VMExecutionContext::InvokePseudoMain);
             eval_result = v;
 
+            // Make sure that we have enough space in result
+            if (eval_result.size() > alloc_len - result_len) {

WizKid

diff --git a/hphp/runtime/base/preg.cpp b/hphp/runtime/base/preg.cpp
index e9e637b..fcb0cbf 100644
--- a/hphp/runtime/base/preg.cpp
+++ b/hphp/runtime/base/preg.cpp
@@ -1064,6 +1064,12 @@ static Variant php_pcre_replace(const String& pattern, const String& subject,
                                     VMExecutionContext::InvokePseudoMain);
             eval_result = v;

+            // Make sure that we have enough space in result
+            if (eval_result.size() > alloc_len - result_len) {

WizKid

def removecomments(s):
    inCommentSingle = False
    inCommentMulti = False
    inString = False

    t = []
    l = len(s)

    i = 0
    fromIndex = 0