Bug #72085 [NEW]: AddressSanitizer: SEGV on unknown address zif_xml_parse

From: fernando at null-life dot com Operating system: Linux PHP version: 5.6.20 Package: *XML functions Bug Type: Bug Bug description:AddressSanitizer: SEGV on unknown address zif_xml_parse Description: ------------ Run attached script test with ASAN Test script: --------------- <?php $var1=xml_parser_create_ns(); xml_set_element_handler($var1, new Exception(""), 4096); xml_parse($var1, str_repeat("<a>", 10)); Expected result: ---------------- No complains from asan Actual result: -------------- Warning: Invalid callback exception 'Exception' in /ramdisk/22/xmlparse.php:5 Stack trace: #0 {main}, no array or string given in /ramdisk/22/xmlparse.php on line 6 ASAN:SIGSEGV ================================================================= ==24991==ERROR: AddressSanitizer: SEGV on unknown address 0x00000005 (pc 0x094dd093 bp 0xb3f4a3e4 sp 0xbff2e810 T0) #0 0x94dd092 in zend_hash_index_find /home/fmunozs/phpgit/php56/Zend/zend_hash.c:942 #1 0x90e7c39 in xml_call_handler /home/fmunozs/phpgit/php56/ext/xml/xml.c:538 #2 0x90e7c39 in _xml_startElementHandler /home/fmunozs/phpgit/php56/ext/xml/xml.c:802 #3 0x90ffd67 in _start_element_handler_ns /home/fmunozs/phpgit/php56/ext/xml/compat.c:190 #4 0xb6f6e1a7 (/usr/lib/i386-linux-gnu/libxml2.so.2+0x3a1a7) #5 0xb6f785f0 (/usr/lib/i386-linux-gnu/libxml2.so.2+0x445f0) #6 0xb6f79f62 in xmlParseChunk (/usr/lib/i386-linux-gnu/libxml2.so.2+0x45f62) #7 0x9102a2b in php_XML_Parse /home/fmunozs/phpgit/php56/ext/xml/compat.c:605 #8 0x90dee1e in zif_xml_parse /home/fmunozs/phpgit/php56/ext/xml/xml.c:1454 #9 0x9a7c718 in zend_do_fcall_common_helper_SPEC /home/fmunozs/phpgit/php56/Zend/zend_vm_execute.h:558 #10 0x9640316 in execute_ex /home/fmunozs/phpgit/php56/Zend/zend_vm_execute.h:363 #11 0x9a6c9c8 in zend_execute /home/fmunozs/phpgit/php56/Zend/zend_vm_execute.h:388 #12 0x9470b59 in zend_execute_scripts /home/fmunozs/phpgit/php56/Zend/zend.c:1341 #13 0x91acc6b in php_execute_script /home/fmunozs/phpgit/php56/main/main.c:2613 #14 0x9a8648a in do_cli /home/fmunozs/phpgit/php56/sapi/cli/php_cli.c:994 #15 0x808a502 in main /home/fmunozs/phpgit/php56/sapi/cli/php_cli.c:1378 #16 0xb6d97645 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18645) #17 0x808aaba (/home/fmunozs/phpgit/php56/sapi/cli/php+0x808aaba) AddressSanitizer can not provide additional info. -- Edit bug report at https://bugs.php.net/bug.php?id=72085&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72085&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72085&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72085&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72085&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72085&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72085&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72085&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72085&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72085&r=support Expected behavior: https://bugs.php.net/fix.php?id=72085&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72085&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72085&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72085&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72085&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72085&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72085&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72085&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72085&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72085&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72085&r=mysqlcfg