Repository navigation
Segmentation fault in RecursiveIteratorIterator->current() with a xml element input #16808
Description
Description
The following code:
<?php
$sx1 = new SimpleXMLElement("<root />");
$fusion = $sx1;
$test = new RecursiveIteratorIterator($fusion);
var_dump($test->current());Resulted in this output:
/php-src/main/spprintf.c:376:14: runtime error: member access within null pointer of type 'zend_string' (aka 'struct _zend_string')
To reproduce: JIT 1015
PHP Version
nightly
Operating System
ubuntu 22.04
Activity
ndossche commentedon Nov 15, 2024
It already goes wrong in non-JIT mode:
So the mixed type check for null isn't working properly apparently. But only for internal functions, userland functions seem fine... EDIT: actually on a release build it outputs "UNKNOWN:0" so that means an UNDEF value is produced somewhere and propagated...
ndossche commentedon Nov 15, 2024
This is not a JIT nor opcache issue, the SXE iterator returns UNDEF when invalid (which is right EDIT: hmm or not will need to check) but SPL does not handle this right. Either it should check for validity first or check if the return value is UNDEF.
ndossche commentedon Nov 15, 2024
Okay judging how the other code works: the issue is that SXE returns UNDEF but it should return NULL; that's how others do it too. So this is an SXE bug after all.
Fix phpGH-16808: Segmentation fault in RecursiveIteratorIterator->cur…
Fix GH-16808: Segmentation fault in RecursiveIteratorIterator->curren…
Merge branch 'PHP-8.2' into PHP-8.3
Merge branch 'PHP-8.3' into PHP-8.4
Merge branch 'PHP-8.4'