Skip to content

Segfault with requesting nodeName on nameless doctype #17500

Description

@willaix

Description

The following code:

<?php

$html = "<div> <!DOCTYPE> <!DOCTYPE html> </div>";
$doc = new \DOMDocument();
$load_result = $doc->loadHTML($html);

foreach ($doc->childNodes as $childNode) {
    var_dump($childNode);
}

Resulted in this output:

Segmentation fault (core dumped)
(gdb) bt
#0  0x00007fb7a8eab0fd in __strlen_avx2 () from /lib64/libc.so.6
#1  0x00007fb794e1fff0 in dom_node_node_name_read () from /usr/lib64/php/modules/dom.so
#2  0x00007fb794e0d22a in dom_read_property () from /usr/lib64/php/modules/dom.so
#3  0x0000555feeb3f42c in ZEND_FETCH_OBJ_R_SPEC_CV_CONST_INLINE_HANDLER () at /usr/src/debug/php-8.3.15-1.el8.remi.x86_64/Zend/zend_vm_execute.h:41859
#4  ZEND_FETCH_OBJ_R_SPEC_CV_CONST_HANDLER () at /usr/src/debug/php-8.3.15-1.el8.remi.x86_64/Zend/zend_vm_execute.h:41888
#5  0x0000555feeb749c5 in execute_ex (ex=0x0) at /usr/src/debug/php-8.3.15-1.el8.remi.x86_64/Zend/zend_vm_execute.h:60841
#6  0x0000555feeb7dcf2 in zend_execute (op_array=0x7fb7a748d000, return_value=0x0) at /usr/src/debug/php-8.3.15-1.el8.remi.x86_64/Zend/zend_vm_execute.h:61634
#7  0x0000555feeb074c5 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /usr/src/debug/php-8.3.15-1.el8.remi.x86_64/Zend/zend.c:1895
#8  0x0000555feea9ba7a in php_execute_script (primary_file=<optimized out>) at /usr/src/debug/php-8.3.15-1.el8.remi.x86_64/main/main.c:2529
#9  0x0000555feebf6202 in do_cli (argc=5, argv=0x5560131a9800) at /usr/src/debug/php-8.3.15-1.el8.remi.x86_64/sapi/cli/php_cli.c:966
#10 0x0000555fee927fd7 in main (argc=5, argv=0x5560131a9800) at /usr/src/debug/php-8.3.15-1.el8.remi.x86_64/sapi/cli/php_cli.c:1341

There is no segmentation fault with PHP 8.2.

Note that a similar issue was fixed in PDO : #14712

PHP Version

PHP 8.3.15

Operating System

No response

Metadata

Metadata

Assignees

Type

No type

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions