stack overflow in asan/dom?
Open
Nobody has claimed this yet.
Bug
Extension: dom
Status: Needs Triage
Status: Verified
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
The following code:
<?php
$xml = str_repeat('<a>', 400000) . 'x' . str_repeat('</a>', 400000);
$d=new DOMDocument(); $d->loadXML($xml, LIBXML_PARSEHUGE);
$c = $d->documentElement->cloneNode(true);
Resulted in this output:
#191 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#192 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#193 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#194 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#195 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#196 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#197 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#198 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#199 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#200 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#201 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#202 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#203 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#204 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#205 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#206 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#207 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#208 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#209 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#210 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#211 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#212 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#213 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#214 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#215 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#216 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#217 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#218 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#219 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#220 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#221 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#222 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#223 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#224 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#225 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#226 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#227 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#228 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#229 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#230 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#231 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#232 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#233 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#234 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#235 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#236 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#237 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#238 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#239 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#240 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#241 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#242 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#243 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#244 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#245 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#246 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#247 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
#248 0x7fc83e16234b (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
#249 0x7fc83e16168a (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
SUMMARY: AddressSanitizer: stack-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_stackdepot.cpp:54 in __sanitizer::StackDepotNode::hash(__sanitizer::StackTrace const&)
==45==ABORTING
USE_ZEND_ALLOC-0
PHP Version
8.6.0
Operating System
ubuntu 22.04
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the PHP 8.6.0 example using DOMDocument::loadXML(), LIBXML_PARSEHUGE, and cloneNode(true) under ASan with USE_ZEND_ALLOC-0. Trace the DOM cloning path and its interaction with libxml2; done means the reported deeply nested input no longer causes a stack overflow.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100