[FIX] RTE: Keep large inline images from exhausting PCRE

components/ILIAS/RTE/classes/class.ilRTE.php

@@ -28,6 +28,13 @@
  */
 class ilRTE
 {
+    /**
+     * Media-object images are stored as src="…" data-id="123".
+     * The value must not cross the closing quote. A greedy ".*" backtracks
+     * over large data-URI payloads and hits the PCRE backtrack limit.
+     */
+    private const MEDIA_OBJECT_SRC_PATTERN = '/src="[^"]*" data-id="([0-9]+)"/';
+
     protected ilGlobalTemplateInterface $tpl;
     protected ilCtrlInterface $ctrl;
     protected ilObjUser $user;
@@ -141,7 +148,7 @@ public static function _getRTEClassname(): string
     public static function _cleanupMediaObjectUsage(string $a_text, string $a_usage_type, int $a_usage_id): void
     {
         $mobs = ilObjMediaObject::_getMobsOfObject($a_usage_type, $a_usage_id);
-        while (preg_match('/src=".*" data-id="([0-9]+)"/', $a_text, $found)) {
+        while (preg_match(self::MEDIA_OBJECT_SRC_PATTERN, $a_text, $found)) {
             $a_text = str_replace($found[0], '', $a_text);
             $found_mob_id = (int) $found[1];
 
@@ -185,11 +192,16 @@ public static function _replaceMediaObjectImageSrc(
         }
 
         if ($a_direction === 0) {
-            $a_text = preg_replace(
-                '/src=".*" data-id="([0-9]+)"/',
-                'src="il_' . $nic . '_mob_\\1"',
+            $replaced = preg_replace_callback(
+                self::MEDIA_OBJECT_SRC_PATTERN,
+                static fn (array $match): string => 'src="il_' . $nic . '_mob_' . $match[1] . '"',
                 $a_text
             );
+            // A PCRE failure returns null. Keep the original text instead of
+            // violating the string return type.
+            if (is_string($replaced)) {
+                $a_text = $replaced;
+            }
         } else {
             $resulttext = $a_text;
             if (preg_match_all('/src="(il_[0-9]+_mob_([0-9]+))"/', $a_text, $matches)) {
@@ -221,7 +233,7 @@ public static function _getMediaObjects(string $a_text, int $a_direction = 0): a
 
         $mediaObjects = [];
         if ($a_direction === 0) {
-            $is_matching = preg_match_all('/src=".*" data-id="([0-9]+)"/', $a_text, $matches);
+            $is_matching = preg_match_all(self::MEDIA_OBJECT_SRC_PATTERN, $a_text, $matches);
         } else {
             $is_matching = preg_match_all('/src="il_[0-9]+_mob_([0-9]+)"/', $a_text, $matches);
         }

components/ILIAS/RTE/tests/ilRTEMediaObjectImageSrcTest.php

@@ -0,0 +1,64 @@
+<?php
+
+/**
+ * This file is part of ILIAS, a powerful learning management system
+ * published by ILIAS open source e-Learning e.V.
+ *
+ * ILIAS is licensed with the GPL-3.0,
+ * see https://www.gnu.org/licenses/gpl-3.0.en.html
+ * You should have received a copy of said license along with the
+ * source code, too.
+ *
+ * If this is not the case or you just want to try ILIAS, you'll find
+ * us at:
+ * https://www.ilias.de
+ * https://github.com/ILIAS-eLearning
+ *
+ *********************************************************************/
+
+declare(strict_types=1);
+
+use PHPUnit\Framework\TestCase;
+
+class ilRTEMediaObjectImageSrcTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        ini_set('pcre.jit', '0');
+        ini_set('pcre.backtrack_limit', '1000000');
+    }
+
+    public function testReplacesMediaObjectSourceWithoutTouchingOtherImages(): void
+    {
+        $html = '<p><img src="data:image/png;base64,AAAA"></p><img src="foo.jpg" data-id="42">';
+
+        $result = ilRTE::_replaceMediaObjectImageSrc($html, 0, '7');
+
+        $this->assertSame(
+            '<p><img src="data:image/png;base64,AAAA"></p><img src="il_7_mob_42">',
+            $result
+        );
+    }
+
+    public function testKeepsLargeInlineImageWhenBacktrackingIsDisabled(): void
+    {
+        $payload = str_repeat('A', 750 * 1024 * 4 / 3);
+        $html = '<p><img src="data:image/jpeg;base64,' . $payload . '" alt="drop"></p>';
+
+        $result = ilRTE::_replaceMediaObjectImageSrc($html, 0, '7');
+
+        $this->assertIsString($result);
+        $this->assertSame($html, $result);
+        $this->assertSame(PREG_NO_ERROR, preg_last_error());
+    }
+
+    public function testTreatsInstallationIdAsLiteralText(): void
+    {
+        $html = '<img src="foo.jpg" data-id="42">';
+
+        $result = ilRTE::_replaceMediaObjectImageSrc($html, 0, '1$2');
+
+        $this->assertSame('<img src="il_1$2_mob_42">', $result);
+    }
+}