Segmentation fault (access null pointer) in ext/dom/parentnode/tree.c

Description

The following code:

<?php
$entity = new DOMEntity();
$fusion = $entity;
$dom = new DOMDocument;
$element = $dom->appendChild($dom->createElement('root'));
$str = str_repeat('X', 2**31 + 10);
try {
$element->append('x', $str);
} catch (ValueError $e) {
$element->prepend('x', $fusion);
}

Resulted in this output:

/php-src/ext/dom/parentnode/tree.c:245:12: runtime error: member access within null pointer of type 'xmlNode' (aka 'struct _xmlNode')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/dom/parentnode/tree.c:245

To reproduce:

-d "memory_limit=-1"

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

Minimal reproduction:

<?php
$dom = new DOMDocument;
$element = $dom->appendChild($dom->createElement('root'));
$str = str_repeat('X', 2**31 + 10);
try {
    $element->append('x', $str);
} catch (ValueError $e) {
    $element->prepend('x', new DOMEntity());
}

Very old bug, must've been here since the beginning that DOMParentNode was here.

Fix phpGH-16039: Segmentation fault (access null pointer) in ext/dom/…

Fix GH-16039: Segmentation fault (access null pointer) in ext/dom/par…

Merge branch 'PHP-8.2' into PHP-8.3

Merge branch 'PHP-8.3' into PHP-8.4

Merge branch 'PHP-8.4'

Navigation Menu

Repository navigation

Segmentation fault (access null pointer) in ext/dom/parentnode/tree.c #16039

Description

PHP Version

Operating System

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Segmentation fault (access null pointer) in ext/dom/parentnode/tree.c #16039

Description

Description

PHP Version

Operating System

Activity

DanielEScherzer commented on Sep 25, 2024

ndossche commented on Sep 25, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions