php / php/php-src

Memory leak in XMLWriter extension upon fatal error

Open
#14,044 3 comments 0 reactions 1 assignee View on GitHub

@ndossche is already working on this.

Since Apr 25, 2024.

Bug Extension: libxml Status: Verified
Dominant language
C
Stars
40.4k
Forks
8.1k
Avg merge
2d 13h
Merged PRs (30d)
96

Description

Description

The following code:

<?php
$xw = new XMLWriter();
$xw->openMemory();
$xw->startDocument(NULL, "UTF-8");
$xw->endDocument();
trait T {
    public $prop;
}
readonly class C {
    use T;
}
?>

Resulted in this output:

Fatal error: Readonly class C cannot use trait with a non-readonly property T::$prop in test.php on line 9

=================================================================
==3141115==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 80 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fbb5e69b in xmlNewTextWriter (/lib/x86_64-linux-gnu/libxml2.so.2+0x14769b) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

Indirect leak of 4096 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fbb007ac in xmlBufCreate (/lib/x86_64-linux-gnu/libxml2.so.2+0xe97ac) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)
    #2 0x55a778db8fa4 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /Zend/zend_vm_execute.h:1879:4
    #3 0x55a778b2e8f7 in execute_ex /Zend/zend_vm_execute.h:57125:7
    #4 0x55a778b2fcc2 in zend_execute /Zend/zend_vm_execute.h:62752:2
    #5 0x55a77897ba68 in zend_execute_script /Zend/zend.c:1888:3
    #6 0x55a7784e6366 in php_execute_script_ex /main/main.c:2507:13
    #7 0x55a7784e6c08 in php_execute_script /main/main.c:2547:9
    #8 0x55a7798a4483 in do_cli /sapi/cli/php_cli.c:966:5
    #9 0x55a7798a0a12 in main /sapi/cli/php_cli.c:1340:18
    #10 0x7f08fb696d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Indirect leak of 4096 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fba87d58 in xmlBufferCreate (/lib/x86_64-linux-gnu/libxml2.so.2+0x70d58) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)
    #2 0x55a778db8fa4 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /Zend/zend_vm_execute.h:1879:4
    #3 0x55a778b2e8f7 in execute_ex /Zend/zend_vm_execute.h:57125:7
    #4 0x55a778b2fcc2 in zend_execute /Zend/zend_vm_execute.h:62752:2
    #5 0x55a77897ba68 in zend_execute_script /Zend/zend.c:1888:3
    #6 0x55a7784e6366 in php_execute_script_ex /main/main.c:2507:13
    #7 0x55a7784e6c08 in php_execute_script /main/main.c:2547:9
    #8 0x55a7798a4483 in do_cli /sapi/cli/php_cli.c:966:5
    #9 0x55a7798a0a12 in main /sapi/cli/php_cli.c:1340:18
    #10 0x7f08fb696d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Indirect leak of 4001 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fbb006c2 in xmlBufCreateSize (/lib/x86_64-linux-gnu/libxml2.so.2+0xe96c2) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

Indirect leak of 176 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fba792de in xmlNewDoc (/lib/x86_64-linux-gnu/libxml2.so.2+0x622de) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

Indirect leak of 64 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fbb00753 in xmlBufCreate (/lib/x86_64-linux-gnu/libxml2.so.2+0xe9753) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)
    #2 0x55a778db8fa4 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /Zend/zend_vm_execute.h:1879:4
    #3 0x55a778b2e8f7 in execute_ex /Zend/zend_vm_execute.h:57125:7
    #4 0x55a778b2fcc2 in zend_execute /Zend/zend_vm_execute.h:62752:2
    #5 0x55a77897ba68 in zend_execute_script /Zend/zend.c:1888:3
    #6 0x55a7784e6366 in php_execute_script_ex /main/main.c:2507:13
    #7 0x55a7784e6c08 in php_execute_script /main/main.c:2547:9
    #8 0x55a7798a4483 in do_cli /sapi/cli/php_cli.c:966:5
    #9 0x55a7798a0a12 in main /sapi/cli/php_cli.c:1340:18
    #10 0x7f08fb696d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Indirect leak of 64 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fbb00635 in xmlBufCreateSize (/lib/x86_64-linux-gnu/libxml2.so.2+0xe9635) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

Indirect leak of 56 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fba9495b in xmlAllocOutputBufferInternal (/lib/x86_64-linux-gnu/libxml2.so.2+0x7d95b) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)
    #2 0x55a778db8fa4 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /Zend/zend_vm_execute.h:1879:4
    #3 0x55a778b2e8f7 in execute_ex /Zend/zend_vm_execute.h:57125:7
    #4 0x55a778b2fcc2 in zend_execute /Zend/zend_vm_execute.h:62752:2
    #5 0x55a77897ba68 in zend_execute_script /Zend/zend.c:1888:3
    #6 0x55a7784e6366 in php_execute_script_ex /main/main.c:2507:13
    #7 0x55a7784e6c08 in php_execute_script /main/main.c:2547:9
    #8 0x55a7798a4483 in do_cli /sapi/cli/php_cli.c:966:5
    #9 0x55a7798a0a12 in main /sapi/cli/php_cli.c:1340:18
    #10 0x7f08fb696d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Indirect leak of 48 byte(s) in 2 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fba8cff3 in xmlListCreate (/lib/x86_64-linux-gnu/libxml2.so.2+0x75ff3) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

Indirect leak of 48 byte(s) in 2 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fba8cfd3 in xmlListCreate (/lib/x86_64-linux-gnu/libxml2.so.2+0x75fd3) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

Indirect leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fba87d23 in xmlBufferCreate (/lib/x86_64-linux-gnu/libxml2.so.2+0x70d23) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)
    #2 0x55a778db8fa4 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /Zend/zend_vm_execute.h:1879:4
    #3 0x55a778b2e8f7 in execute_ex /Zend/zend_vm_execute.h:57125:7
    #4 0x55a778b2fcc2 in zend_execute /Zend/zend_vm_execute.h:62752:2
    #5 0x55a77897ba68 in zend_execute_script /Zend/zend.c:1888:3
    #6 0x55a7784e6366 in php_execute_script_ex /main/main.c:2507:13
    #7 0x55a7784e6c08 in php_execute_script /main/main.c:2547:9
    #8 0x55a7798a4483 in do_cli /sapi/cli/php_cli.c:966:5
    #9 0x55a7798a0a12 in main /sapi/cli/php_cli.c:1340:18
    #10 0x7f08fb696d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Indirect leak of 6 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fbafa7f2 in xmlStrdup (/lib/x86_64-linux-gnu/libxml2.so.2+0xe37f2) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

Indirect leak of 6 byte(s) in 2 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fbafa6e3 in xmlStrndup (/lib/x86_64-linux-gnu/libxml2.so.2+0xe36e3) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

SUMMARY: AddressSanitizer: 12773 byte(s) leaked in 16 allocation(s).
PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.