Skip to content

Heap corruption in DOMXPath PHP callbacks during XSLT transformation (malloc(): unaligned tcache chunk detected) #24545

Open
#24570
Open
Heap corruption in DOMXPath PHP callbacks during XSLT transformation (malloc(): unaligned tcache chunk detected)#24545
#24570
Labels
BugExtension: domStatus: Verified

Description

@frederikbosch
frederikbosch
opened on Oct 22, 2026

Description

In my XSLT 2.0 Transpiler I received the following error for this test.

malloc(): unaligned tcache chunk detected
/home/runner/work/_temp/80c2d2b3-ee98-42a0-a7cd-6e9bf948fe5e.sh: line 1:  2802 Aborted                 (core dumped) ./vendor/bin/phpunit -c phpunit.xml

I am also able to reproduce this locally, see below .

USE_ZEND_ALLOC=0 gdb --batch     -ex run     -ex "thread apply all bt full"     --args php8.4 test.php

This GDB supports auto-downloading debuginfo from the following URLs:
  <https://debuginfod.ubuntu.com>
Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal]
Debuginfod has been disabled.
To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
malloc(): unaligned tcache chunk detected

Program received signal SIGABRT, Aborted.
__pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
warning: 44	./nptl/pthread_kill.c: No such file or directory

Thread 1 (Thread 0x7ffff7b14980 (LWP 164036) "php8.4"):
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
        tid = <optimized out>
        ret = 0
        pd = <optimized out>
        old_mask = {__val = {0}}
        ret = <optimized out>
        pd = <optimized out>
        old_mask = <optimized out>
        ret = <optimized out>
        tid = <optimized out>
        ret = <optimized out>
        resultvar = <optimized out>
        resultvar = <optimized out>
        __arg3 = <optimized out>
        __arg2 = <optimized out>
        __arg1 = <optimized out>
        _a3 = <optimized out>
        _a2 = <optimized out>
        _a1 = <optimized out>
        __futex = <optimized out>
        resultvar = <optimized out>
        __arg3 = <optimized out>
        __arg2 = <optimized out>
        __arg1 = <optimized out>
        _a3 = <optimized out>
        _a2 = <optimized out>
        _a1 = <optimized out>
        __futex = <optimized out>
        __private = <optimized out>
        __oldval = <optimized out>
#1  __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
No locals.
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
No locals.
#3  0x00007ffff724527e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
        ret = <optimized out>
#4  0x00007ffff72288ff in __GI_abort () at ./stdlib/abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x20, sa_sigaction = 0x20}, sa_mask = {__val = {93824999400432, 140737488324160, 140737340169902, 1, 18446744073709550928, 0, 93825004684160, 140737488324208, 140737340169902, 140737488324208, 10129931861285325824, 93825005173216, 93825005105328, 64, 93825005105328, 64}}, sa_flags = 1859308544, sa_restorer = 0x7fffffff86d0}
#5  0x00007ffff72297b6 in __libc_message_impl (fmt=fmt@entry=0x7ffff73cf8f0 "%s\n") at ../sysdeps/posix/libc_fatal.c:134
        ap = {{gp_offset = 16, fp_offset = 32767, overflow_arg_area = 0x7fffffff87d0, reg_save_area = 0x7fffffff8760}}
        fd = 2
        iov = {{iov_base = 0x7ffff73d2ed8, iov_len = 41}, {iov_base = 0x7ffff73cf8f2, iov_len = 1}, {iov_base = 0x5555561538b0, iov_len = 97}, {iov_base = 0x60, iov_len = 140737488324928}, {iov_base = 0x13, iov_len = 2}, {iov_base = 0x7fffffff8840, iov_len = 93824995244225}, {iov_base = 0x7fffffff87d0, iov_len = 140737340162741}}
        iovcnt = <optimized out>
        total = <optimized out>
        cp = <optimized out>
#6  0x00007ffff72a90d5 in malloc_printerr (str=str@entry=0x7ffff73d2ed8 "malloc(): unaligned tcache chunk detected") at ./malloc/malloc.c:5775
No locals.
#7  0x00007ffff72ada4c in tcache_get_n (ep=<optimized out>, tc_idx=<optimized out>) at ./malloc/malloc.c:3183
        e = <optimized out>
        e = <optimized out>
#8  tcache_get (tc_idx=<optimized out>) at ./malloc/malloc.c:3199
No locals.
#9  __GI___libc_malloc (bytes=120) at ./malloc/malloc.c:3320
        ar_ptr = <optimized out>
        victim = <optimized out>
        tbytes = <optimized out>
        tc_idx = <optimized out>
        __PRETTY_FUNCTION__ = "__libc_malloc"
#10 0x00007ffff7d4261c in xmlNewText () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#11 0x00007ffff7d46ed1 in xmlStringLenGetNodeList () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#12 0x00007ffff7d49987 in xmlNodeSetContentLen () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#13 0x00007ffff3c5a949 in ?? () from /usr/lib/php/20240924/dom.so
No symbol table info available.
#14 0x00007ffff3c60751 in ?? () from /usr/lib/php/20240924/dom.so
No symbol table info available.
#15 0x0000555555916bfd in ?? ()
No symbol table info available.
#16 0x000055555592b7e5 in execute_ex ()
No symbol table info available.
#17 0x00005555558d60d2 in zend_call_function ()
No symbol table info available.
#18 0x00007ffff3c77da8 in ?? () from /usr/lib/php/20240924/dom.so
No symbol table info available.
#19 0x00007ffff3c78e6a in php_dom_xpath_callbacks_call_php_ns () from /usr/lib/php/20240924/dom.so
No symbol table info available.
#20 0x00007ffff7da2a80 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#21 0x00007ffff7da2afd in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#22 0x00007ffff7da2c89 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#23 0x00007ffff7da2c39 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#24 0x00007ffff7da299a in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#25 0x00007ffff7da2afd in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#26 0x00007ffff7da2c89 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#27 0x00007ffff7da2c39 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#28 0x00007ffff7da299a in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#29 0x00007ffff7da2c89 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#30 0x00007ffff7da9b60 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#31 0x00007ffff7daa32d in xmlXPathEvalExpression () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#32 0x00007ffff3c7926f in ?? () from /usr/lib/php/20240924/dom.so
No symbol table info available.
#33 0x0000555555931a8a in execute_ex ()
No symbol table info available.
#34 0x00005555558d60d2 in zend_call_function ()
No symbol table info available.
#35 0x00005555558d64a2 in zend_call_known_function ()
No symbol table info available.
#36 0x00007ffff3c77c8f in ?? () from /usr/lib/php/20240924/dom.so
No symbol table info available.
#37 0x00007ffff3c78e6a in php_dom_xpath_callbacks_call_php_ns () from /usr/lib/php/20240924/dom.so
No symbol table info available.
#38 0x00007ffff7da2a80 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#39 0x00007ffff7da2afd in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#40 0x00007ffff7da2afd in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#41 0x00007ffff7da2c89 in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#42 0x00007ffff7da92da in ?? () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#43 0x00007ffff7da97be in xmlXPathCompiledEval () from /lib/x86_64-linux-gnu/libxml2.so.2
No symbol table info available.
#44 0x00007ffff05f9629 in xsltForEach () from /lib/x86_64-linux-gnu/libxslt.so.1
No symbol table info available.
#45 0x00007ffff05f51e9 in ?? () from /lib/x86_64-linux-gnu/libxslt.so.1
No symbol table info available.
#46 0x00007ffff05f7ae2 in ?? () from /lib/x86_64-linux-gnu/libxslt.so.1
No symbol table info available.
#47 0x00007ffff05f8388 in xsltProcessOneNode () from /lib/x86_64-linux-gnu/libxslt.so.1
No symbol table info available.
#48 0x00007ffff05f86de in ?? () from /lib/x86_64-linux-gnu/libxslt.so.1
No symbol table info available.
#49 0x00007ffff05f84a8 in xsltProcessOneNode () from /lib/x86_64-linux-gnu/libxslt.so.1
No symbol table info available.
#50 0x00007ffff05f9f35 in ?? () from /lib/x86_64-linux-gnu/libxslt.so.1
No symbol table info available.
#51 0x00007ffff06232e0 in ?? () from /usr/lib/php/20240924/xsl.so
No symbol table info available.
#52 0x00007ffff0623f3c in ?? () from /usr/lib/php/20240924/xsl.so
No symbol table info available.
#53 0x0000555555931a8a in execute_ex ()
No symbol table info available.
#54 0x0000555555927ed1 in zend_execute ()
No symbol table info available.
#55 0x0000555555996466 in zend_execute_script ()
No symbol table info available.
#56 0x00005555558230e8 in php_execute_script_ex ()
No symbol table info available.
#57 0x000055555599844f in ?? ()
No symbol table info available.
#58 0x000055555568dab3 in ?? ()
No symbol table info available.
#59 0x00007ffff722a1ca in __libc_start_call_main (main=main@entry=0x55555568d760, argc=argc@entry=2, argv=argv@entry=0x7fffffffda48) at ../sysdeps/nptl/libc_start_call_main.h:58
        self = <optimized out>
        result = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140737488345672, -2839177362677667089, 2, 0, 93824997678456, 140737354125312, -2839177362688152849, -2839195751303189777}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x2, 0x7fffffffda40}, data = {prev = 0x0, cleanup = 0x0, canceltype = 2}}}
        not_first_call = <optimized out>
#60 0x00007ffff722a28b in __libc_start_main_impl (main=0x55555568d760, argc=2, argv=0x7fffffffda48, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffda38) at ../csu/libc-start.c:360
No locals.
#61 0x000055555568ec35 in _start ()
No symbol table info available.

I tried to create a standalone reproducer for this, but I did not succeed in doing so. Hopefully the above is enough.

The crash occurs on PHP 8.4 and PHP 8.5, not PHP 8.3.

PHP Version

PHP 8.4.27 / 8.5.12

Operating System

No response

Activity

  1. frederikbosch
    added
    Bug
    Status: Needs Triage
    on Oct 22, 2026
  2. ndossche
    self-assigned this
    on Oct 22, 2026

  3. ndossche commented on Oct 22, 2026

    @ndossche
    ndossche
    on Oct 22, 2026
    Member

    This is actually the same as GH-22554, but that was only fixed on master.
    Actually we need a series of patches: 33a49bb (for the helper), f36660d (for the root cause fix), fcdc4fb (for the improvement)
    cc @devnexen why was the root cause bug only fixed on master?

  4. ndossche
    added
    Extension: dom
    Status: Verified
    and removed
    Status: Needs Triage
    on Oct 22, 2026
  5. ndossche
    removed their assignment
    on Oct 22, 2026

  6. devnexen commented on Oct 22, 2026

    @devnexen
    devnexen
    on Oct 22, 2026
    Member

    oh that was just a mistake it could have gone to 8.5. looking ...

  7. devnexen
    linked a pull request that will close this issueext/dom: fix use-after-free with XPath callback returning foreign-doc… #24570on Oct 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    BugExtension: domStatus: Verified

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions