undefined behavior zend_string.h

[chongwick]

Description

The following code:

<?php
$v_325483 = 42;
$v_325457 = Uri\Rfc3986\Uri::parse($v_325483,);
$v_325458 = var_dump($v_325457,);
$v_325459 = array();
$v_325460 = '�~_~P~X';
$v_325468 = 'https://�~_~P~X.com/�~_~P~X?�~_~P~X=�~_~P~X';
$v_325461 = null;
$v_325462 = Uri\WhatWg\Url::parse($v_325468,$v_325461,);
$v_325462 = Uri\WhatWg\Url::parse($v_325460,$v_325462,$v_325459,);
$v_325463 = var_dump($v_325462,);

Resulted in this output:

/home/w023dtc/nightly_php/php-src/Zend/zend_string.h:191:24: runtime error: null pointer passed as argument 2, which is declared to never be null
/usr/include/string.h:44:28: note: nonnull attribute specified here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/w023dtc/nightly_php/php-src/Zend/zend_string.h:191:24

But I expected this output instead:

PHP Version

nightly

Operating System

ubuntu 22.04

[devnexen]

Hi @chongwick can t reproduce this one, how do you call the script ?

[chongwick]

<?php
$v_325483 = 42;
$v_325457 = Uri\Rfc3986\Uri::parse($v_325483,);
$v_325458 = var_dump($v_325457,);
$v_325459 = array();
$v_325460 = '🐘';
$v_325468 = 'https://🐘.com/🐘?🐘=🐘';
$v_325461 = null;
$v_325462 = Uri\WhatWg\Url::parse($v_325468,$v_325461,);
$v_325462 = Uri\WhatWg\Url::parse($v_325460,$v_325462,$v_325459,);
$v_325463 = var_dump($v_325462,);
#$v_325464 = var_dump($v_325459,);
#$v_325465 = 'https://🐘.com/🐘?🐘=🐘';

#$v_325457 = Uri\Rfc3986\Uri::parse($v_325465,);
#$v_325467 = var_dump($v_325457,);
#$v_325471 = var_dump($v_325462,);
#$v_325472 = $v_325462->getAsciiHost();
#$v_325473 = var_dump($v_325472,);

#$v_325474 = $v_325462->getUnicodeHost();
#$v_325475 = var_dump($v_325474,);
#$v_325476 = $v_325462->toAsciiString();
#$v_325477 = var_dump($v_325476,);
#$v_325478 = $v_325462->toUnicodeString();
#$v_325479 = var_dump($v_325476,);

php script.php

Try this one, please. Copy/paste missed the elephant.

[devnexen]

null pointer passed as argument 2, which is declared to never be null
/usr/include/string.h:44:28: note: nonnull attribute specified here
    #0 0x571a4bcb2739 in zend_string_init /home/dcarlier/php-src/Zend/zend_string.h:191:2
    #1 0x571a4bcaf1f2 in php_uri_parser_whatwg_query_read /home/dcarlier/php-src/ext/uri/uri_parser_whatwg.c:458:3
    #2 0x571a4bc8b03b in uri_get_debug_properties /home/dcarlier/php-src/ext/uri/php_uri.c:92:6
    #3 0x571a4bc8f6af in zim_Uri_WhatWg_Url___debugInfo /home/dcarlier/php-src/ext/uri/php_uri.c:1008:2
    #4 0x571a4ce01784 in zend_call_function /home/dcarlier/php-src/Zend/zend_execute_API.c:1025:4
    #5 0x571a4ce0631a in zend_call_known_function /home/dcarlier/php-src/Zend/zend_execute_API.c:1106:23
    #6 0x571a4df2ed92 in zend_call_known_instance_method /home/dcarlier/php-src/Zend/zend_API.h:866:2
    #7 0x571a4def093b in zend_call_known_instance_method_with_0_params /home/dcarlier/php-src/Zend/zend_API.h:872:2
    #8 0x571a4def03cc in zend_std_get_debug_info /home/dcarlier/php-src/Zend/zend_object_handlers.c:208:2
    #9 0x571a4df2cb46 in zend_std_get_properties_for /home/dcarlier/php-src/Zend/zend_object_handlers.c:2506:10
    #10 0x571a4df2d686 in zend_get_properties_for /home/dcarlier/php-src/Zend/zend_object_handlers.c:2555:9
    #11 0x571a4bb8cc5c in php_var_dump /home/dcarlier/php-src/ext/standard/var.c:178:11
    #12 0x571a4bb906f2 in zif_var_dump /home/dcarlier/php-src/ext/standard/var.c:245:3
    #13 0x571a4d8bd0b1 in ZEND_DO_ICALL_SPEC_RETVAL_USED_TAILCALL_HANDLER /home/dcarlier/php-src/Zend/zend_vm_execute.h:56960:2
    #14 0x571a4ce6162e in execute_ex /home/dcarlier/php-src/Zend/zend_vm_execute.h:115722:12
    #15 0x571a4ce636ae in zend_execute /home/dcarlier/php-src/Zend/zend_vm_execute.h:121434:2
    #16 0x571a4e06e0bf in zend_execute_script /home/dcarlier/php-src/Zend/zend.c:1977:3
    #17 0x571a4c53db22 in php_execute_script_ex /home/dcarlier/php-src/main/main.c:2640:13
    #18 0x571a4c53ea08 in php_execute_script /home/dcarlier/php-src/main/main.c:2680:9
    #19 0x571a4e07f98e in do_cli /home/dcarlier/php-src/sapi/cli/php_cli.c:951:5
    #20 0x571a4e07b931 in main /home/dcarlier/php-src/sapi/cli/php_cli.c:1362:18
    #21 0x7b36b5a2a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #22 0x7b36b5a2a63a in __libc_start_main csu/../csu/libc-start.c:360:3
    #23 0x571a48407e54 in _start (/home/dcarlier/php-src/sapi/cli/php+0x3607e54) (BuildId: 9caab666a1b4bd905bb68148a97581a0a62b62ea)

[YuanchengJiang]

The following code:

<?php
class AdvancedXMLElement extends SimpleXMLElement {
}
$sxe = simplexml_load_file(__DIR__ . '/53965/collection.xml', AdvancedXMLElement::class);
$processor = new XSLTProcessor;
$dom = new DOMDocument;
$dom->load(__DIR__ . '/53965/collection.xsl');
$processor->importStylesheet($dom);
$result = $processor->transformToDoc($sxe, AdvancedXMLElement::class);
$fusion = $result;
var_dump($fusion->getName());

Resulted in this output:

/home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.h:191:24: runtime error: null pointer passed as argument 2, which is declared to never be null
/usr/include/string.h:44:28: note: nonnull attribute specified here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_string.h:191:24 in 

To reproduce:

./php-src/sapi/cli/php  ./test.php

Commit:

ee2da6d9e9745ec83b02b1e5c5a07e8dbd5f9f98

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This report is automatically generated by FlowFusion

[devnexen]

It is completely different that the cause above.

UBSAN_OPTIONS="print_stacktrace=1" sapi/cli/php test.php
...
/home/dcarlier/Contribs/php-src/Zend/zend_string.h:191:24: runtime error: null pointer passed as argument 2, which is declared to never be null
/usr/include/string.h:44:28: note: nonnull attribute specified here
    #0 0x5a022d51dde9 in zend_string_init /home/dcarlier/Contribs/php-src/Zend/zend_string.h:191:2
    #1 0x5a022d51d888 in zim_SimpleXMLElement_getName /home/dcarlier/Contribs/php-src/ext/simplexml/simplexml.c:1631:3
    #2 0x5a022facb7a8 in ZEND_DO_FCALL_SPEC_RETVAL_USED_TAILCALL_HANDLER /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:57691:4
    #3 0x5a022f26261e in execute_ex /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:115722:12
    #4 0x5a022f26469e in zend_execute /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:121434:2
    #5 0x5a023046f0af in zend_execute_script /home/dcarlier/Contribs/php-src/Zend/zend.c:1977:3
    #6 0x5a022e93eb12 in php_execute_script_ex /home/dcarlier/Contribs/php-src/main/main.c:2640:13
    #7 0x5a022e93f9f8 in php_execute_script /home/dcarlier/Contribs/php-src/main/main.c:2680:9
    #8 0x5a023048097e in do_cli /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:951:5
    #9 0x5a023047c921 in main /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:1362:18
    #10 0x7cd89762a577 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #11 0x7cd89762a63a in __libc_start_main csu/../csu/libc-start.c:360:3
    #12 0x5a022a807e54 in _start (/home/dcarlier/Contribs/php-src/sapi/cli/php+0x3607e54) (BuildId: c8540f1123681aa415414a0c5cf458ec48e8e19c)

Would you mind open a distinct issue please ?

[TimWolla]

Reduced and with proper variable names:

<?php
$parsed = Uri\WhatWg\Url::parse('https://example.com/path?query');
$parsed = Uri\WhatWg\Url::parse('relative',$parsed);
var_dump($parsed);

[TimWolla]

Filed upstream lexbor/lexbor#310, but depending on whether the maintainer is accepting the PR or not, we might need a fix in PHP.