Skip to content

Memory leak in xml extension with zend allocator #14637

Closed as not planned
Closed as not planned
@YuanchengJiang

Description

@YuanchengJiang

Description

The following code:

<?php
function createParser(bool $huge) {
    $parser = xml_parser_create();
    xml_parser_set_option($parser, XML_OPTION_PARSE_HUGE, $huge);
    xml_set_element_handler($parser, function($parser, $data) {
    }, function($parser, $data) {
    });
    return $parser;
}
// Construct XML that is too large to parse without XML_OPTION_PARSE_HUGE
$long_text = str_repeat("A", 1000 * 1000 * 5 /* 5 MB */);
$long_xml_head = "<?xml version=\"1.0\"?><container><$long_text/><$long_text/><second>foo</second>";
$long_xml_tail = "</container>";
$parser = createParser(false);
$ret = xml_parse($parser, $long_xml_head, true);
echo "ret = $ret (", xml_error_string(xml_get_error_code($parser)), ")\n";
$parser = createParser(true);
$ret = xml_parse($parser, $long_xml_head, false);
$parser = createParser(true);
$ret = xml_parse_into_struct($parser, $long_xml_head . $long_xml_tail, $values, $index);
?>

Resulted in this output:

Fatal error: Allowed memory size of 20971520 bytes exhausted at /php-src/Zend/zend_string.h:176 (tried to allocate 5000032 bytes) in test.php on line 18

=================================================================
==4013058==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 5000001 byte(s) in 1 object(s) allocated from:
    #0 0x56408aa88c1e in malloc (/php-src/sapi/cli/php+0x1c88c1e) (BuildId: 5b92f8b1df62e3423fa6490d16c9978bd9086692)
    #1 0x7f149e2c97f2 in xmlStrdup (/lib/x86_64-linux-gnu/libxml2.so.2+0xe37f2) (BuildId: aebf8e42966c3ce475ff9d9d51a762831adcbb61)

SUMMARY: AddressSanitizer: 5000001 byte(s) leaked in 1 allocation(s).

To reproduce:

USE_ZEND_ALLOC=1 php -d "memory_limit=20M" ./test.php

PHP Version

nightly

Operating System

ubuntu 22.04

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions