Repository navigation
DOMXPath breaks when not initialized properly #16316
Description
Description
The following code:
<?php
class Demo extends DOMXPath {
public function __construct() {}
public function __debugInfo(): array {
return ['x' => 'y'];
}
}
var_dump( new Demo() );Resulted in this output:
Segmentation fault
But I expected this output instead:
object(Demo)#1 (1) {
["x"]=>
string(1) "y"
}
Valgrind
==23084== Invalid read of size 4
==23084== at 0x45A7BB: php_dom_create_object (php_dom.c:1680)
==23084== by 0x46976E: dom_xpath_document_read (xpath.c:181)
==23084== by 0x454DBD: dom_get_debug_info_helper (php_dom.c:518)
==23084== by 0x454E7E: dom_get_debug_info (php_dom.c:541)
==23084== by 0x97868C: zend_std_get_properties_for (zend_object_handlers.c:2384)
==23084== by 0x978826: zend_get_properties_for (zend_object_handlers.c:2433)
==23084== by 0x73D66D: php_var_dump (var.c:178)
==23084== by 0x73DC57: zif_var_dump (var.c:245)
==23084== by 0x88D15C: ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:1287)
==23084== by 0x909ACE: execute_ex (zend_vm_execute.h:58774)
==23084== by 0x90E410: zend_execute (zend_vm_execute.h:64206)
==23084== by 0x9A4E2B: zend_execute_script (zend.c:1928)
==23084== Address 0x8 is not stack'd, malloc'd or (recently) free'd
PHP Version
PHP 8.4 dev (f2fbb75)
Operating System
No response
Activity
DanielEScherzer commentedon Oct 9, 2024
Does not affect any released version per https://3v4l.org/3UmEU
cmb69 commentedon Oct 9, 2024
DomXPathmight need some is_initialized checks, or some other solution (ideally, the class would befinal, I think).cmb69 commentedon Oct 9, 2024
Oh, indeed. 1cb86b6 removed the
(!obj)check, and that is properly documented:php-src/UPGRADING.INTERNALS
Line 277 in f2fbb75
cc @nielsdos
ndossche commentedon Oct 9, 2024
This is unrelated to debugInfo, you can leave that out and it'll break too.
This is already wrong on 8.2 as it returns NULL for the document, which isn't allowed because the property isn't nullable.
This should throw an INVALID_STATE_ERR type of DOMException when not initialized properly.
[-]Seg fault when overriding DOMXPath::__debugInfo()[/-][+]DOMXPath breaks when not initialized properly[/+]Fix phpGH-16316: DOMXPath breaks when not initialized properly
Merge branch 'PHP-8.2' into PHP-8.3
Merge branch 'PHP-8.3' into PHP-8.4
Merge branch 'PHP-8.4'
Fix GH-16316: DOMXPath breaks when not initialized properly