member access within misaligned address zend_iterators.c:91

[chongwick]

Description

The following code:

<?php
ob_clean();
$hugetempl = array('length' => PHP_INT_MAX);
$huge = array();
for ($i = 0; $i < $hugetempl['length']; $i++) {
    $huge[] = new DOMDocument;
    $huge[$i]->loadXML('<foo>foo'. $i. '</foo>');
    $nodes = $huge[$i]->documentElement->childNodes;
    $iter = $nodes->getIterator();
    file_get_contents("/proc/self/maps") ^ PHP_INT_MAX;
    clone $iter;
    $stat = stat('/dev/urandom');
    $stat[0] = PHP_INT_MAX;
    while (true) {
        echo str_repeat('a', PHP_INT_MAX);
    }
}
?>

Resulted in this output:

/home/dan/php-8.3.9/Zend/zend_iterators.c:91:6: runtime error: member access within misaligned address 0x000000000009 for type 'struct zend_object_iterator', which requires 8 byte alignment

But I expected this output instead:

PHP Version

8.3.9

Operating System

No response

[DanielEScherzer]

With the latest version of PHP 8.3 (cd67c09):

root@05457a5cfa7f:/usr/src/php# php /var/www/html/test.php 

Notice: ob_clean(): Failed to delete buffer. No buffer to delete in /var/www/html/test.php on line 2

Warning: A non-numeric value encountered in /var/www/html/test.php on line 10

Fatal error: Uncaught Error: Trying to clone an uncloneable object of class InternalIterator in /var/www/html/test.php:11
Stack trace:
#0 {main}
  thrown in /var/www/html/test.php on line 11

[DanielEScherzer]

The uncloneable-ness is from #14741 merged into PHP 8.3 as 4c95cb3

[cmb69]

Thanks @DanielEScherzer!

@chongwick, please try again with PHP 8.3.12.

[nielsdos]

I can confirm this is a duplicate of GH-14741, not a new bug.