Memory Leak in XML

[chongwick]

Description

The following code:

<?php
$v_321852 = __DIR__;
$v_321853 = '*** Testing Invalid file types ***\n';
$v_321868 = xmlwriter_open_memory();
$v_321891 = xmlwriter_end_element($v_321868,);
$v_321857 = ' ';
$v_321886 = null;
$v_321887 = 'bar';
$v_321888 = '';
$v_321889 = '';
$v_321890 = xmlwriter_write_element_ns($v_321868,$v_321886,$v_321887,$v_321888,$v_321889,);
#$v_321859 = TRUE;
$v_321860 = FALSE;
$v_321861 = 1234;
$v_321862 = 0;
$v_321854 = array(0 => $v_321891,1 => $v_321857,2 => $v_321890,3 => $v_321859,4 => $v_321860,5 => $v_321861,6 => $v_321862,);
$v_321854 = array(0 => $v_321891,1 => $v_321857,2 => $v_321890,3 => $v_321859,4 => $v_321860,5 => $v_321861,6 => $v_321862,);
foreach ($v_321854 as $filename){
$v_321864 = $filename;
$v_321865 = filegroup($v_321864,);
$v_321867 = clearstatcache();
}
$v_321863 = $filename;

Resulted in this output:

=================================================================
==2634714==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 24 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6810bd)
    #1 0x154a8246fafc in xmlTextWriterStartElementNS (/lib/x86_64-linux-gnu/libxml2.so.2+0x14aafc)

Indirect leak of 6 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6810bd)
    #1 0x154a824086b3 in xmlStrndup (/lib/x86_64-linux-gnu/libxml2.so.2+0xe36b3)

Indirect leak of 1 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6810bd)
    #1 0x154a824087c2 in xmlStrdup (/lib/x86_64-linux-gnu/libxml2.so.2+0xe37c2)

SUMMARY: AddressSanitizer: 31 byte(s) leaked in 3 allocation(s).
Singularity> vim 9582a001b7b88579a109.php.er
Singularity> ~/nightly_php/php-src/sapi/cli/php 9582a001b7b88579a109.php.er

=================================================================
==2634854==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 24 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6810bd)
    #1 0x150e31b05afc in xmlTextWriterStartElementNS (/lib/x86_64-linux-gnu/libxml2.so.2+0x14aafc)

Indirect leak of 6 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6810bd)
    #1 0x150e31a9e6b3 in xmlStrndup (/lib/x86_64-linux-gnu/libxml2.so.2+0xe36b3)

Indirect leak of 1 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6810bd)
    #1 0x150e31a9e7c2 in xmlStrdup (/lib/x86_64-linux-gnu/libxml2.so.2+0xe37c2)

SUMMARY: AddressSanitizer: 31 byte(s) leaked in 3 allocation(s).

But I expected this output instead:

PHP Version

nightly

Operating System

20.04

[nielsdos]

Reduced to:

<?php
$xml = xmlwriter_open_memory();
xmlwriter_end_element($xml);
xmlwriter_write_element_ns($xml, null, 'bar', '', '');

Reproduces in 8.3 too. Need to figure out if this is a libxml bug or a PHP bug.

[nielsdos]

@chongwick You found a libxml bug, this reproduces without PHP.
I'll report it upstream.

libxml repro:

#include <libxml/xmlwriter.h>
#include <stdio.h>

int main() {
    xmlBufferPtr buf = xmlBufferCreate();
    xmlTextWriterPtr writer = xmlNewTextWriterMemory(buf, 0);

    xmlTextWriterStartDocument(writer, NULL, "UTF-8", NULL);

    xmlTextWriterEndElement(writer); // Comment this out to get rid of the leak

    xmlTextWriterWriteElementNS(writer, NULL, "foo", "", "");

    xmlFreeTextWriter(writer);

    puts(xmlBufferContent(buf));

    xmlBufferFree(buf);

    return 0;
}

Upstream link: https://gitlab.gnome.org/GNOME/libxml2/-/issues/978

[nielsdos]

I'll close this now as this is not a PHP bug and is being tracked in the libxml2 repo.