XMLReader leak on RelaxNG schema failure

Description

The following code:

<?php
$v_2153 = '<?xml version="1.0" encoding="UTF-8"?>\n<chapter xmlns="http://docbook.org/ns/docbook" version="5.0">\n<title>Test Chapter</title>\n<para>\nThis is a paragraph in the test chapter. It is unremarkable in\nevery regard. This is a paragraph in the test chapter. It is\nunremarkable in every regard. This is a paragraph in the test\nchapter. It is unremarkable in every regard.\n</para>\n<paar>\n<emphasis role="bold">This</emphasis> paragraph contains\n<emphasis>some <emphasis>emphasized</emphasis> text</emphasis>\n1and a <superscript>super</superscript>script\nand a <subscript>sub</subscript>script.\n</para>\n<para>\nThis is a paragraph in the test chapter. It is unremarkable in\nevery regard. This is a paragraph in the test chapter. It is\nunremarkable in every regard. This is a paragraph in the test\nchapter. It is unremarkable in every regard.\n</para>\n</chapter>';
$v_2152 = new XMLReader();$v_2154 = $v_2152->xml($v_2153,);
$v_2155 = 'http://docs.oasis-open.org/docbook/rng/5.0/docbook.rng';
$v_2157 = $v_2152->read();
$v_2158 = @($v_2157);
$v_2159 = False;
$v_2160 = $v_2158 !== $v_2159;
$v_2156 = $v_2152->setRelaxNGSchema($v_2155,);

Resulted in this output:

Warning: XMLReader::read(): /home/w023dtc/treebugs/:1: parser error : Document is empty in /home/w023dtc/treebugs/e782977a913c64838daf.php.er on line 5

Warning: XMLReader::read(): <?xml version="1.0" encoding="UTF-8"?>\n<chapter xmlns="http://docbook.org/ns/do in /home/w023dtc/treebugs/e782977a913c64838daf.php.er on line 5

Warning: XMLReader::read():                                       ^ in /home/w023dtc/treebugs/e782977a913c64838daf.php.er on line 5

Warning: XMLReader::setRelaxNGSchema(): Schema contains errors in /home/w023dtc/treebugs/e782977a913c64838daf.php.er on line 9

=================================================================
==2057889==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 80 byte(s) in 1 object(s) allocated from:
    #0 0x6829ad in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6829ad)
    #1 0x14eff3d76eb2  (/lib/x86_64-linux-gnu/libxml2.so.2+0x136eb2)

Indirect leak of 131072 byte(s) in 1 object(s) allocated from:
    #0 0x682cc9 in realloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x682cc9)
    #1 0x14eff3d6c279  (/lib/x86_64-linux-gnu/libxml2.so.2+0x12c279)

Indirect leak of 51312 byte(s) in 1069 object(s) allocated from:
    #0 0x6829ad in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6829ad)
    #1 0x14eff3cb459b in xmlHashAddEntry3 (/lib/x86_64-linux-gnu/libxml2.so.2+0x7459b)

Indirect leak of 37978 byte(s) in 1703 object(s) allocated from:
    #0 0x6829ad in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6829ad)
    #1 0x14eff3d237c2 in xmlStrdup (/lib/x86_64-linux-gnu/libxml2.so.2+0xe37c2)

Indirect leak of 30720 byte(s) in 1 object(s) allocated from:
    #0 0x6829ad in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6829ad)
    #1 0x14eff3cb442f in xmlHashAddEntry3 (/lib/x86_64-linux-gnu/libxml2.so.2+0x7442f)

Indirect leak of 4256 byte(s) in 1 object(s) allocated from:
    #0 0x6829ad in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6829ad)
    #1 0x14eff3d244d9  (/lib/x86_64-linux-gnu/libxml2.so.2+0xe44d9)

Indirect leak of 2320 byte(s) in 1 object(s) allocated from:
    #0 0x6829ad in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6829ad)
    #1 0x14eff3d241b9  (/lib/x86_64-linux-gnu/libxml2.so.2+0xe41b9)

Indirect leak of 784 byte(s) in 7 object(s) allocated from:
    #0 0x6829ad in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6829ad)
    #1 0x14eff3d6c1e2  (/lib/x86_64-linux-gnu/libxml2.so.2+0x12c1e2)

Indirect leak of 224 byte(s) in 1 object(s) allocated from:
    #0 0x6829ad in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6829ad)
    #1 0x14eff3d240ac  (/lib/x86_64-linux-gnu/libxml2.so.2+0xe40ac)

Indirect leak of 104 byte(s) in 1 object(s) allocated from:
    #0 0x6829ad in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6829ad)
    #1 0x14eff3d23ef5  (/lib/x86_64-linux-gnu/libxml2.so.2+0xe3ef5)

Indirect leak of 64 byte(s) in 1 object(s) allocated from:
    #0 0x6829ad in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6829ad)
    #1 0x14eff3d76905  (/lib/x86_64-linux-gnu/libxml2.so.2+0x136905)

Indirect leak of 64 byte(s) in 2 object(s) allocated from:
    #0 0x6829ad in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6829ad)
    #1 0x14eff3cbc39a in xmlHashCreate (/lib/x86_64-linux-gnu/libxml2.so.2+0x7c39a)

SUMMARY: AddressSanitizer: 258978 byte(s) leaked in 2789 allocation(s).

PHP Version

nightly

Operating System

ubuntu 22.04

maybe related to or a duplicate of #14044?

Simplified reproducer:

<?php
$src = '<chapter xmlns="http://docbook.org/ns/docbook" version="5.0"/>';
$xml = new XMLReader();
$xml->xml($src);
$xml->read();
$xml->setRelaxNGSchema('http://docs.oasis-open.org/docbook/rng/5.0/docbook.rng');

Fix phpGH-20009: XMLReader leak on RelaxNG schema failure

@chongwick

@chongwick No, this is a PHP bug, a missing call to a libxml free API.

Merge branch 'PHP-8.3' into PHP-8.4

Merge branch 'PHP-8.4' into PHP-8.5

Merge branch 'PHP-8.5'

Fix GH-20009: XMLReader leak on RelaxNG schema failure

Navigation Menu

Repository navigation

XMLReader leak on RelaxNG schema failure #20009

Description

PHP Version

Operating System

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

XMLReader leak on RelaxNG schema failure #20009

Description

Description

PHP Version

Operating System

Activity

chongwick commented on Sep 30, 2025

ndossche commented on Sep 30, 2025

ndossche commented on Sep 30, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions