Skip to content

Segmentation fault in ext/xmlreader/php_xmlreader.c:1282 #16292

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
YuanchengJiang opened this issue Oct 8, 2024 · 0 comments
Closed

Segmentation fault in ext/xmlreader/php_xmlreader.c:1282 #16292

YuanchengJiang opened this issue Oct 8, 2024 · 0 comments

Comments

@YuanchengJiang
Copy link

Description

The following code:

<?php
$character_data = new DOMCharacterData();
$fusion = $character_data;
$xmlstring = '<?xml version="1.0" encoding="UTF-8"?>
<books><book>new book</book></books>';
$reader = new XMLReader();
$reader->XML($xmlstring);
while ($reader->read()) {
if ($reader->localName == "book") {
$node = $reader->expand($fusion);
}
}

Resulted in this output:

/php-src/ext/xmlreader/php_xmlreader.c:1282:3: runtime error: member access within misaligned address 0x000000000001 for type 'zend_class_entry' (aka 'struct _zend_class_entry'), which requires 8 byte alignment
0x000000000001: note: pointer points here
<memory cannot be printed>
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/xmlreader/php_xmlreader.c:1282:3

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

nielsdos added a commit to nielsdos/php-src that referenced this issue Oct 8, 2024
…1282

3 issues:
1) RETURN_NULL() was used via the macro NODE_GET_OBJ(), but the function
   returns false on failure and cannot return null according to its
   stub.
2) The struct layout of the different implementors of libxml only
   guarantees overlap between the node pointer and the document
   reference, so accessing the std zend_object may not work.
3) DOC_GET_OBJ() wasn't using ZSTR_VAL().
nielsdos added a commit that referenced this issue Oct 8, 2024
* PHP-8.2:
  Fix GH-16292: Segmentation fault in ext/xmlreader/php_xmlreader.c:1282
nielsdos added a commit that referenced this issue Oct 8, 2024
* PHP-8.3:
  Fix GH-16292: Segmentation fault in ext/xmlreader/php_xmlreader.c:1282
nielsdos added a commit that referenced this issue Oct 8, 2024
* PHP-8.4:
  Fix GH-16292: Segmentation fault in ext/xmlreader/php_xmlreader.c:1282
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants