Skip to content

zend_string_init with NULL pointer in simplexml (UB) #19988

Closed
Closed
zend_string_init with NULL pointer in simplexml (UB)#19988
Assignees
ndossche
Labels
BugExtension: simplexmlExtension: xslStatus: Verified

Description

@YuanchengJiang
YuanchengJiang
opened on Sep 29, 2025

Description

The following code:

<?php
class AdvancedXMLElement extends SimpleXMLElement {
}
$sxe = simplexml_load_file(__DIR__ . '/53965/collection.xml', AdvancedXMLElement::class);
$processor = new XSLTProcessor;
$dom = new DOMDocument;
$dom->load(__DIR__ . '/53965/collection.xsl');
$processor->importStylesheet($dom);
$result = $processor->transformToDoc($sxe, AdvancedXMLElement::class);
$fusion = $result;
var_dump($fusion->getName());

Resulted in this output:

/home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.h:191:24: runtime error: null pointer passed as argument 2, which is declared to never be null
/usr/include/string.h:44:28: note: nonnull attribute specified here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.h:191:24 in

To reproduce:

./php-src/sapi/cli/php  ./test.php

Commit:

ee2da6d9e9745ec83b02b1e5c5a07e8dbd5f9f98

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This report is automatically generated by FlowFusion

PHP Version

nightly

Operating System

No response

Activity

  1. YuanchengJiang
    added
    Bug
    Status: Needs Triage
    on Sep 29, 2025
  2. ndossche
    self-assigned this
    on Sep 29, 2025
  3. ndossche
    added
    Status: Verified
    and removed
    Status: Needs Triage
    on Sep 29, 2025

  4. ndossche commented on Sep 29, 2025

    @ndossche
    ndossche
    on Sep 29, 2025
    Member

    Slightly reduced and easier:

    <?php
$sxe = simplexml_load_file(__DIR__ . '/ext/xsl/tests/53965/collection.xml');
$processor = new XSLTProcessor;
$dom = new DOMDocument;
$dom->load(__DIR__ . '/ext/xsl/tests/53965/collection.xsl');
$processor->importStylesheet($dom);
$result = $processor->transformToDoc($sxe, SimpleXMLElement::class);
var_dump($result->getName());

  5. ndossche commented on Sep 29, 2025

    @ndossche
    ndossche
    on Sep 29, 2025
    Member

    Not sure why this is NULL in the first place, I'll have to figure it out. If it is legit that this is NULL then the following patch would work:

    diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 78653cf7ef6..aa903668152 100644
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -1628,10 +1628,11 @@ PHP_METHOD(SimpleXMLElement, getName)
 	node = php_sxe_get_first_node_non_destructive(sxe, node);
 	if (node) {
 		namelen = xmlStrlen(node->name);
-		RETURN_STRINGL((char*)node->name, namelen);
-	} else {
-		RETURN_EMPTY_STRING();
+		if (namelen) {
+			RETURN_STRINGL((char*)node->name, namelen);
+		}
 	}
+	RETURN_EMPTY_STRING();
 }
 /* }}} */

  6. ndossche commented on Sep 29, 2025

    @ndossche
    ndossche
    on Sep 29, 2025
    Member

    It's also not a SEGV, this does not crash my system but it's UB.

  7. ndossche
    changed the title [-]SEGV zend_string.h unexpected null pointer[/-] [+]zend_string_init with NULL pointer in simplexml (UB)[/+] on Sep 29, 2025

  8. ndossche commented on Sep 29, 2025

    @ndossche
    ndossche
    on Sep 29, 2025
    Member

    It may also be worthwhile to use ZVAL_STRINGL_FAST as many tags tend to be one char.

  9. ndossche
    added
    Extension: simplexml
    Extension: xsl
    on Sep 29, 2025

  10. ndossche commented on Sep 29, 2025

    @ndossche
    ndossche
    on Sep 29, 2025
    Member

    The problem is that the SimpleXMLElement is a document... Normally this isn't possible, i.e. it's always the root of a document that is pointed at, but xsl allows you to bypass this apparently. You can see this when you try importing a document via simplexml_import_dom.
    A document indeed has no name.
    Changing this to use the root element is breaking, and I see now technical reason why the importing of document nodes should be disallowed, so I'll just fix getName() probably.

  11. ndossche
    linked a pull request that will close this issueFix GH-19988: zend_string_init with NULL pointer in simplexml (UB) #19990on Sep 29, 2025
  12. ndossche
    added 4 commits that reference this issue on Sep 29, 2025

    Fix phpGH-19988: zend_string_init with NULL pointer in simplexml (UB)

    b8b23bd

    Fix GH-19988: zend_string_init with NULL pointer in simplexml (UB)

    d94846c

    Merge branch 'PHP-8.3' into PHP-8.4

    1bda46e

    Merge branch 'PHP-8.4' into PHP-8.5

    c1a6627
  13. ndossche
    closed this as completedin d94846con Sep 29, 2025
  14. ndossche
    added a commit that references this issue on Sep 29, 2025

    Merge branch 'PHP-8.5'

    4db8993
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

BugExtension: simplexmlExtension: xslStatus: Verified

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions