xmlTextWriterStartAttributeNS memory leak

[chongwick]

Description

The following code:

<?php
$v_136933 = xmlwriter_open_memory();
$v_136969 = True;
$v_136970 = xmlwriter_flush($v_136933,$v_136969,);
$v_136943 = 'ns1';
$v_136944 = 'child1';
$v_136945 = 'urn:ns1';
$v_136946 = xmlwriter_start_element_ns($v_136933,$v_136943,$v_136944,$v_136945,);
$v_136936 = '   ';
$v_136954 = 'att2';
$v_136941 = 'root';
$v_136942 = xmlwriter_start_element($v_136933,$v_136941,);
$v_136949 = 'urn:ns1';
$v_136947 = 'ns1';
$v_136934 = TRUE;
$v_136935 = xmlwriter_set_indent($v_136933,$v_136934,);
$v_136961 = '<>"\'&';
$v_136962 = xmlwriter_text($v_136933,$v_136961,);
$v_136957 = 'ns1';
$v_136958 = 'att2';
$v_136939 = 'UTF-8';
$v_136948 = 'att1';
$v_136955 = 'double" single\'';
$v_136956 = xmlwriter_write_attribute($v_136933,$v_136954,$v_136955,);
$v_136968 = xmlwriter_end_document($v_136933,);
$v_136937 = xmlwriter_set_indent_string($v_136933,$v_136936,);
$v_136967 = xmlwriter_end_element($v_136933,);
$v_136951 = 'a&b';
$v_136952 = xmlwriter_text($v_136933,$v_136951,);
$v_136959 = 'urn:ns1';
$v_136960 = xmlwriter_start_attribute_ns($v_136933,$v_136957,$v_136958,$v_136959,);

Resulted in this output:

=================================================================
==3222599==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 24 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6810bd)
    #1 0x148eced75366 in xmlTextWriterStartAttributeNS (/lib/x86_64-linux-gnu/libxml2.so.2+0x146366)

Indirect leak of 10 byte(s) in 1 object(s) allocated from:
    #0 0x6813d9 in realloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6813d9)
    #1 0x148eced12d22  (/lib/x86_64-linux-gnu/libxml2.so.2+0xe3d22)

Indirect leak of 8 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/w023dtc/nightly_php/php-src/sapi/cli/php+0x6810bd)
    #1 0x148eced127c2 in xmlStrdup (/lib/x86_64-linux-gnu/libxml2.so.2+0xe37c2)

SUMMARY: AddressSanitizer: 42 byte(s) leaked in 3 allocation(s).

PHP Version

nightly

Operating System

ubuntu 22.04

[nielsdos]

I haven't checked this (yet), but this is probably again a libxml2 bug as it feels very similar to #19704

[nielsdos]

Minimal reproducer in PHP:

<?php
$xml = xmlwriter_open_memory();
xmlwriter_end_element($xml);
xmlwriter_start_attribute_ns($xml,'ns1','att2','urn:ns1');

@chongwick However, similarly to the other issue, this is a not a PHP bug but a libxml2 bug as the following C code (adapted from GH-19704) demonstrates the issue without PHP:

#include <libxml/xmlwriter.h>
#include <stdio.h>

int main() {
    xmlBufferPtr buf = xmlBufferCreate();
    xmlTextWriterPtr writer = xmlNewTextWriterMemory(buf, 0);

    xmlTextWriterStartDocument(writer, NULL, "UTF-8", NULL);

    xmlTextWriterEndElement(writer); // Comment this out to get rid of the leak

    //xmlTextWriterWriteElementNS(writer, NULL, "foo", "", "");
    xmlTextWriterStartAttributeNS(writer, NULL, "foo", "");

    xmlFreeTextWriter(writer);

    puts(xmlBufferContent(buf));

    xmlBufferFree(buf);

    return 0;
}

I'll report this to the libxml2 maintainer as well.