[php-src] Issue #15192: Segmentation fault in dom extension (html5_serializer)
| From: | YuanchengJiang | Date: | Thu, 01 Aug 2024 09:05:35 +0000 |
| Subject: | [php-src] Issue #15192: Segmentation fault in dom extension (html5_serializer) | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-247416@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/15192
Author: YuanchengJiang
### Description
The following code:
```php
<?php
$dom = Dom\HTMLDocument::createFromString("<p>foo</p>");
$dom2 = clone $dom;
$element = $dom2->firstChild;
$dom = new DomDocument();
$random_var=$element;
var_dump('random_var:',$random_var);
```
Resulted in this output:
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==7824==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7fa1d42a17fd bp 0x7ffdc5e4e870 sp
0x7ffdc5e4e028 T0)
==7824==The signal is caused by a READ memory access.
==7824==Hint: this fault was caused by a dereference of a high value address (see register values
below). Disassemble the provided pc to learn which register was used.
#0 0x7fa1d42a17fd string/../sysdeps/x86_64/multiarch/strlen-avx2.S:74
#1 0x55a41aa1a2b9 in strlen (/php-src/sapi/cli/php+0x1c1a2b9) (BuildId:
77d842f0b50f3a0c666850c0803eb2de994affbc)
#2 0x55a41b2797c6 in smart_str_appends /php-src/Zend/zend_smart_str.h:177:34
#3 0x55a41b276bb4 in dom_inner_html_write_string /php-src/ext/dom/inner_html_mixin.c:40:2
#4 0x55a41b273599 in dom_html5_serialize_element_tag_name
/php-src/ext/dom/html5_serializer.c:159:3
#5 0x55a41b26e108 in dom_html5_serialize_element_start /php-src/ext/dom/html5_serializer.c:168:2
#6 0x55a41b26b37f in dom_html5_serialize_node /php-src/ext/dom/html5_serializer.c:291:5
#7 0x55a41b26adaa in dom_html5_serialize /php-src/ext/dom/html5_serializer.c:369:9
#8 0x55a41b275bf1 in dom_element_inner_html_read /php-src/ext/dom/inner_html_mixin.c:75:3
#9 0x55a41b342d5b in dom_get_debug_info_helper /php-src/ext/dom/php_dom.c:474:7
#10 0x55a41b2f404c in dom_get_debug_info /php-src/ext/dom/php_dom.c:495:9
#11 0x55a41db17e9f in zend_std_get_properties_for /php-src/Zend/zend_object_handlers.c:2245:10
#12 0x55a41db18829 in zend_get_properties_for /php-src/Zend/zend_object_handlers.c:2279:9
#13 0x55a41c6cd4ba in php_var_dump /php-src/ext/standard/var.c:164:11
#14 0x55a41c6d1183 in zif_var_dump /php-src/ext/standard/var.c:229:3
#15 0x55a41d5d2214 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER
/php-src/Zend/zend_vm_execute.h:1287:2
#16 0x55a41d15c3c7 in execute_ex /php-src/Zend/zend_vm_execute.h:58354:7
#17 0x55a41d15d8a2 in zend_execute /php-src/Zend/zend_vm_execute.h:64011:2
#18 0x55a41dc56928 in zend_execute_script /php-src/Zend/zend.c:1913:3
#19 0x55a41c82fac6 in php_execute_script_ex /php-src/main/main.c:2535:13
#20 0x55a41c830368 in php_execute_script /php-src/main/main.c:2575:9
#21 0x55a41dc647b1 in do_cli /php-src/sapi/cli/php_cli.c:956:5
#22 0x55a41dc60192 in main /php-src/sapi/cli/php_cli.c:1330:18
#23 0x7fa1d412dd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#24 0x7fa1d412de3f in __libc_start_main csu/../csu/libc-start.c:392:3
#25 0x55a41aa03244 in _start (/php-src/sapi/cli/php+0x1c03244) (BuildId:
77d842f0b50f3a0c666850c0803eb2de994affbc)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV string/../sysdeps/x86_64/multiarch/strlen-avx2.S:74
==7824==ABORTING
```
### PHP Version
PHP 8.4.0-dev
### Operating System
ubuntu 22.04