[php-src] Issue #24545: Heap corruption in DOMXPath PHP callbacks during XSLT transformation (malloc(): unaligned tcache chunk detected)

Issue: https://github.com/php/php-src/issues/24545 Author: frederikbosch ### Description In my [XSLT 2.0 Transpiler](https://github.com/genkgo/xsl) I received [the following error](https://github.com/genkgo/xsl/actions/runs/39777774519/job/119821693336#step:5:18) for this [test](https://github.com/genkgo/xsl/blob/master/test/Integration/Xsl/ForEachGroupTest.php#L195). ``` malloc(): unaligned tcache chunk detected /home/runner/work/_temp/80c2d2b3-ee98-42a0-a7cd-6e9bf948fe5e.sh: line 1: 2802 Aborted (core dumped) ./vendor/bin/phpunit -c phpunit.xml ``` I am also able to reproduce this locally, see below . ``` USE_ZEND_ALLOC=0 gdb --batch -ex run -ex "thread apply all bt full" --args php8.4 test.php This GDB supports auto-downloading debuginfo from the following URLs: <https://debuginfod.ubuntu.com> Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal] Debuginfod has been disabled. To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit. [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". malloc(): unaligned tcache chunk detected Program received signal SIGABRT, Aborted. __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44 warning: 44 ./nptl/pthread_kill.c: No such file or directory Thread 1 (Thread 0x7ffff7b14980 (LWP 164036) "php8.4"): #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44 tid = <optimized out> ret = 0 pd = <optimized out> old_mask = {__val = {0}} ret = <optimized out> pd = <optimized out> old_mask = <optimized out> ret = <optimized out> tid = <optimized out> ret = <optimized out> resultvar = <optimized out> resultvar = <optimized out> __arg3 = <optimized out> __arg2 = <optimized out> __arg1 = <optimized out> _a3 = <optimized out> _a2 = <optimized out> _a1 = <optimized out> __futex = <optimized out> resultvar = <optimized out> __arg3 = <optimized out> __arg2 = <optimized out> __arg1 = <optimized out> _a3 = <optimized out> _a2 = <optimized out> _a1 = <optimized out> __futex = <optimized out> __private = <optimized out> __oldval = <optimized out> #1 __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78 No locals. #2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 No locals. #3 0x00007ffff724527e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 ret = <optimized out> #4 0x00007ffff72288ff in __GI_abort () at ./stdlib/abort.c:79 save_stage = 1 act = {__sigaction_handler = {sa_handler = 0x20, sa_sigaction = 0x20}, sa_mask = {__val = {93824999400432, 140737488324160, 140737340169902, 1, 18446744073709550928, 0, 93825004684160, 140737488324208, 140737340169902, 140737488324208, 10129931861285325824, 93825005173216, 93825005105328, 64, 93825005105328, 64}}, sa_flags = 1859308544, sa_restorer = 0x7fffffff86d0} #5 0x00007ffff72297b6 in __libc_message_impl (fmt=fmt@entry=0x7ffff73cf8f0 "%s\n") at ../sysdeps/posix/libc_fatal.c:134 ap = {{gp_offset = 16, fp_offset = 32767, overflow_arg_area = 0x7fffffff87d0, reg_save_area = 0x7fffffff8760}} fd = 2 iov = {{iov_base = 0x7ffff73d2ed8, iov_len = 41}, {iov_base = 0x7ffff73cf8f2, iov_len = 1}, {iov_base = 0x5555561538b0, iov_len = 97}, {iov_base = 0x60, iov_len = 140737488324928}, {iov_base = 0x13, iov_len = 2}, {iov_base = 0x7fffffff8840, iov_len = 93824995244225}, {iov_base = 0x7fffffff87d0, iov_len = 140737340162741}} iovcnt = <optimized out> total = <optimized out> cp = <optimized out> #6 0x00007ffff72a90d5 in malloc_printerr (str=str@entry=0x7ffff73d2ed8 "malloc(): unaligned tcache chunk detected") at ./malloc/malloc.c:5775 No locals. #7 0x00007ffff72ada4c in tcache_get_n (ep=<optimized out>, tc_idx=<optimized out>) at ./malloc/malloc.c:3183 e = <optimized out> e = <optimized out> #8 tcache_get (tc_idx=<optimized out>) at ./malloc/malloc.c:3199 No locals. #9 __GI___libc_malloc (bytes=120) at ./malloc/malloc.c:3320 ar_ptr = <optimized out> victim = <optimized out> tbytes = <optimized out> tc_idx = <optimized out> __PRETTY_FUNCTION__ = "__libc_malloc" #10 0x00007ffff7d4261c in xmlNewText () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #11 0x00007ffff7d46ed1 in xmlStringLenGetNodeList () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #12 0x00007ffff7d49987 in xmlNodeSetContentLen () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #13 0x00007ffff3c5a949 in ?? () from /usr/lib/php/20240924/dom.so No symbol table info available. #14 0x00007ffff3c60751 in ?? () from /usr/lib/php/20240924/dom.so No symbol table info available. #15 0x0000555555916bfd in ?? () No symbol table info available. #16 0x000055555592b7e5 in execute_ex () No symbol table info available. #17 0x00005555558d60d2 in zend_call_function () No symbol table info available. #18 0x00007ffff3c77da8 in ?? () from /usr/lib/php/20240924/dom.so No symbol table info available. #19 0x00007ffff3c78e6a in php_dom_xpath_callbacks_call_php_ns () from /usr/lib/php/20240924/dom.so No symbol table info available. #20 0x00007ffff7da2a80 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #21 0x00007ffff7da2afd in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #22 0x00007ffff7da2c89 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #23 0x00007ffff7da2c39 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #24 0x00007ffff7da299a in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #25 0x00007ffff7da2afd in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #26 0x00007ffff7da2c89 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #27 0x00007ffff7da2c39 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #28 0x00007ffff7da299a in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #29 0x00007ffff7da2c89 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #30 0x00007ffff7da9b60 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #31 0x00007ffff7daa32d in xmlXPathEvalExpression () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #32 0x00007ffff3c7926f in ?? () from /usr/lib/php/20240924/dom.so No symbol table info available. #33 0x0000555555931a8a in execute_ex () No symbol table info available. #34 0x00005555558d60d2 in zend_call_function () No symbol table info available. #35 0x00005555558d64a2 in zend_call_known_function () No symbol table info available. #36 0x00007ffff3c77c8f in ?? () from /usr/lib/php/20240924/dom.so No symbol table info available. #37 0x00007ffff3c78e6a in php_dom_xpath_callbacks_call_php_ns () from /usr/lib/php/20240924/dom.so No symbol table info available. #38 0x00007ffff7da2a80 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #39 0x00007ffff7da2afd in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #40 0x00007ffff7da2afd in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #41 0x00007ffff7da2c89 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #42 0x00007ffff7da92da in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #43 0x00007ffff7da97be in xmlXPathCompiledEval () from /lib/x86_64-linux-gnu/libxml2.so.2 No symbol table info available. #44 0x00007ffff05f9629 in xsltForEach () from /lib/x86_64-linux-gnu/libxslt.so.1 No symbol table info available. #45 0x00007ffff05f51e9 in ?? () from /lib/x86_64-linux-gnu/libxslt.so.1 No symbol table info available. #46 0x00007ffff05f7ae2 in ?? () from /lib/x86_64-linux-gnu/libxslt.so.1 No symbol table info available. #47 0x00007ffff05f8388 in xsltProcessOneNode () from /lib/x86_64-linux-gnu/libxslt.so.1 No symbol table info available. #48 0x00007ffff05f86de in ?? () from /lib/x86_64-linux-gnu/libxslt.so.1 No symbol table info available. #49 0x00007ffff05f84a8 in xsltProcessOneNode () from /lib/x86_64-linux-gnu/libxslt.so.1 No symbol table info available. #50 0x00007ffff05f9f35 in ?? () from /lib/x86_64-linux-gnu/libxslt.so.1 No symbol table info available. #51 0x00007ffff06232e0 in ?? () from /usr/lib/php/20240924/xsl.so No symbol table info available. #52 0x00007ffff0623f3c in ?? () from /usr/lib/php/20240924/xsl.so No symbol table info available. #53 0x0000555555931a8a in execute_ex () No symbol table info available. #54 0x0000555555927ed1 in zend_execute () No symbol table info available. #55 0x0000555555996466 in zend_execute_script () No symbol table info available. #56 0x00005555558230e8 in php_execute_script_ex () No symbol table info available. #57 0x000055555599844f in ?? () No symbol table info available. #58 0x000055555568dab3 in ?? () No symbol table info available. #59 0x00007ffff722a1ca in __libc_start_call_main (main=main@entry=0x55555568d760, argc=argc@entry=2, argv=argv@entry=0x7fffffffda48) at ../sysdeps/nptl/libc_start_call_main.h:58 self = <optimized out> result = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140737488345672, -2839177362677667089, 2, 0, 93824997678456, 140737354125312, -2839177362688152849, -2839195751303189777}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x2, 0x7fffffffda40}, data = {prev = 0x0, cleanup = 0x0, canceltype = 2}}} not_first_call = <optimized out> #60 0x00007ffff722a28b in __libc_start_main_impl (main=0x55555568d760, argc=2, argv=0x7fffffffda48, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffda38) at ../csu/libc-start.c:360 No locals. #61 0x000055555568ec35 in _start () No symbol table info available. ``` I tried to create a standalone reproducer for this, but I did not succeed in doing so. Hopefully the above is enough. The crash occurs on PHP 8.4 and PHP 8.5, not PHP 8.3. ### PHP Version ```plain PHP 8.4.27 / 8.5.12 ``` ### Operating System _No response_