php / php/php-src

Memory leak in XMLWriter extension upon fatal error

未关闭
#14,044 3 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

@ndossche 已经在做这个了。

开始于 2024年4月25日。

Bug Extension: libxml Status: Verified
主要语言
C
星标
40.4k
派生
8.1k
平均合并
2 天 13 小时
30 天内合并 PR
96

描述

Description

The following code:

<?php
$xw = new XMLWriter();
$xw->openMemory();
$xw->startDocument(NULL, "UTF-8");
$xw->endDocument();
trait T {
    public $prop;
}
readonly class C {
    use T;
}
?>

Resulted in this output:

Fatal error: Readonly class C cannot use trait with a non-readonly property T::$prop in test.php on line 9

=================================================================
==3141115==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 80 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fbb5e69b in xmlNewTextWriter (/lib/x86_64-linux-gnu/libxml2.so.2+0x14769b) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

Indirect leak of 4096 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fbb007ac in xmlBufCreate (/lib/x86_64-linux-gnu/libxml2.so.2+0xe97ac) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)
    #2 0x55a778db8fa4 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /Zend/zend_vm_execute.h:1879:4
    #3 0x55a778b2e8f7 in execute_ex /Zend/zend_vm_execute.h:57125:7
    #4 0x55a778b2fcc2 in zend_execute /Zend/zend_vm_execute.h:62752:2
    #5 0x55a77897ba68 in zend_execute_script /Zend/zend.c:1888:3
    #6 0x55a7784e6366 in php_execute_script_ex /main/main.c:2507:13
    #7 0x55a7784e6c08 in php_execute_script /main/main.c:2547:9
    #8 0x55a7798a4483 in do_cli /sapi/cli/php_cli.c:966:5
    #9 0x55a7798a0a12 in main /sapi/cli/php_cli.c:1340:18
    #10 0x7f08fb696d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Indirect leak of 4096 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fba87d58 in xmlBufferCreate (/lib/x86_64-linux-gnu/libxml2.so.2+0x70d58) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)
    #2 0x55a778db8fa4 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /Zend/zend_vm_execute.h:1879:4
    #3 0x55a778b2e8f7 in execute_ex /Zend/zend_vm_execute.h:57125:7
    #4 0x55a778b2fcc2 in zend_execute /Zend/zend_vm_execute.h:62752:2
    #5 0x55a77897ba68 in zend_execute_script /Zend/zend.c:1888:3
    #6 0x55a7784e6366 in php_execute_script_ex /main/main.c:2507:13
    #7 0x55a7784e6c08 in php_execute_script /main/main.c:2547:9
    #8 0x55a7798a4483 in do_cli /sapi/cli/php_cli.c:966:5
    #9 0x55a7798a0a12 in main /sapi/cli/php_cli.c:1340:18
    #10 0x7f08fb696d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Indirect leak of 4001 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fbb006c2 in xmlBufCreateSize (/lib/x86_64-linux-gnu/libxml2.so.2+0xe96c2) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

Indirect leak of 176 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fba792de in xmlNewDoc (/lib/x86_64-linux-gnu/libxml2.so.2+0x622de) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

Indirect leak of 64 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fbb00753 in xmlBufCreate (/lib/x86_64-linux-gnu/libxml2.so.2+0xe9753) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)
    #2 0x55a778db8fa4 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /Zend/zend_vm_execute.h:1879:4
    #3 0x55a778b2e8f7 in execute_ex /Zend/zend_vm_execute.h:57125:7
    #4 0x55a778b2fcc2 in zend_execute /Zend/zend_vm_execute.h:62752:2
    #5 0x55a77897ba68 in zend_execute_script /Zend/zend.c:1888:3
    #6 0x55a7784e6366 in php_execute_script_ex /main/main.c:2507:13
    #7 0x55a7784e6c08 in php_execute_script /main/main.c:2547:9
    #8 0x55a7798a4483 in do_cli /sapi/cli/php_cli.c:966:5
    #9 0x55a7798a0a12 in main /sapi/cli/php_cli.c:1340:18
    #10 0x7f08fb696d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Indirect leak of 64 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fbb00635 in xmlBufCreateSize (/lib/x86_64-linux-gnu/libxml2.so.2+0xe9635) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

Indirect leak of 56 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fba9495b in xmlAllocOutputBufferInternal (/lib/x86_64-linux-gnu/libxml2.so.2+0x7d95b) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)
    #2 0x55a778db8fa4 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /Zend/zend_vm_execute.h:1879:4
    #3 0x55a778b2e8f7 in execute_ex /Zend/zend_vm_execute.h:57125:7
    #4 0x55a778b2fcc2 in zend_execute /Zend/zend_vm_execute.h:62752:2
    #5 0x55a77897ba68 in zend_execute_script /Zend/zend.c:1888:3
    #6 0x55a7784e6366 in php_execute_script_ex /main/main.c:2507:13
    #7 0x55a7784e6c08 in php_execute_script /main/main.c:2547:9
    #8 0x55a7798a4483 in do_cli /sapi/cli/php_cli.c:966:5
    #9 0x55a7798a0a12 in main /sapi/cli/php_cli.c:1340:18
    #10 0x7f08fb696d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Indirect leak of 48 byte(s) in 2 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fba8cff3 in xmlListCreate (/lib/x86_64-linux-gnu/libxml2.so.2+0x75ff3) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

Indirect leak of 48 byte(s) in 2 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fba8cfd3 in xmlListCreate (/lib/x86_64-linux-gnu/libxml2.so.2+0x75fd3) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

Indirect leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fba87d23 in xmlBufferCreate (/lib/x86_64-linux-gnu/libxml2.so.2+0x70d23) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)
    #2 0x55a778db8fa4 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER /Zend/zend_vm_execute.h:1879:4
    #3 0x55a778b2e8f7 in execute_ex /Zend/zend_vm_execute.h:57125:7
    #4 0x55a778b2fcc2 in zend_execute /Zend/zend_vm_execute.h:62752:2
    #5 0x55a77897ba68 in zend_execute_script /Zend/zend.c:1888:3
    #6 0x55a7784e6366 in php_execute_script_ex /main/main.c:2507:13
    #7 0x55a7784e6c08 in php_execute_script /main/main.c:2547:9
    #8 0x55a7798a4483 in do_cli /sapi/cli/php_cli.c:966:5
    #9 0x55a7798a0a12 in main /sapi/cli/php_cli.c:1340:18
    #10 0x7f08fb696d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

Indirect leak of 6 byte(s) in 1 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fbafa7f2 in xmlStrdup (/lib/x86_64-linux-gnu/libxml2.so.2+0xe37f2) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

Indirect leak of 6 byte(s) in 2 object(s) allocated from:
    #0 0x55a776888c0e in malloc (/usr/local/bin/php+0x1c88c0e) (BuildId: c0213df21908f588a04dfadca2142af951d35e31)
    #1 0x7f08fbafa6e3 in xmlStrndup (/lib/x86_64-linux-gnu/libxml2.so.2+0xe36e3) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

SUMMARY: AddressSanitizer: 12773 byte(s) leaked in 16 allocation(s).
PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

贡献指南

打开贡献指南

从这里开始

  1. 先读完整个 Issue,再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库,在一个分支上完成修改。
  4. 提交 Pull Request,并在描述里引用这个 Issue 编号。

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。