stack overflow in asan/dom?

Description

The following code:

<?php
$xml = str_repeat('<a>', 400000) . 'x' . str_repeat('</a>', 400000);
$d=new DOMDocument(); $d->loadXML($xml, LIBXML_PARSEHUGE);
$c = $d->documentElement->cloneNode(true);

Resulted in this output:

    #191 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #192 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #193 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #194 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #195 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #196 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #197 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #198 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #199 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #200 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #201 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #202 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #203 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #204 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #205 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #206 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #207 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #208 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #209 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #210 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #211 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #212 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #213 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #214 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #215 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #216 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #217 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #218 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #219 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #220 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #221 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #222 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #223 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #224 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #225 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #226 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #227 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #228 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #229 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #230 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #231 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #232 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #233 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #234 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #235 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #236 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #237 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #238 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #239 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #240 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #241 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #242 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #243 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #244 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #245 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #246 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #247 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)
    #248 0x7fc83e16234b  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7234b)
    #249 0x7fc83e16168a  (/lib/x86_64-linux-gnu/libxml2.so.2+0x7168a)

SUMMARY: AddressSanitizer: stack-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_stackdepot.cpp:54 in __sanitizer::StackDepotNode::hash(__sanitizer::StackTrace const&)
==45==ABORTING

USE_ZEND_ALLOC-0

PHP Version

8.6.0

Operating System

ubuntu 22.04

まず、ASan 上で USE_ZEND_ALLOC-0 を指定し、DOMDocument::loadXML()、LIBXML_PARSEHUGE、cloneNode(true) を使って PHP 8.6.0 の例を再現します。DOM のクローン処理の経路と libxml2 との相互作用を追跡します。報告されている深くネストされた入力でスタックオーバーフローが発生しなくなれば完了です。