Repository navigation
core dump triggered by setRelaxNGSchema #19741
Description
Description
The following code:
<?php
$v_137483 = new XMLReader();
$v_137484 = '<?xml version="1.0" encoding="UTF-8"?>\n<chapter xmlns="http://docbook.org/ns/docbook" version="5.0">\n<title>Test Chapter</title>\n<para>\nThis is a paragraph in the test chapter. It is unremarkable in\nevery regard. This is a paragraph in the test chapter. It is\nunremarkable in every regard. This is a paragraph in the test\nchapter. It is unremarkable in every regard.\n</para>\n<paar>\n<emphasis role="bold">This</emphasis> paragraph contains\n<emphasis>some <emphasis>emphasized</emphasis> text</emphasis>\n1and a <superscript>super</superscript>script\nand a <subscript>sub</subscript>script.\n</para>\n<para>\nThis is a paragraph in the test chapter. It is unremarkable in\nevery regard. This is a paragraph in the test chapter. It is\nunremarkable in every regard. This is a paragraph in the test\nchapter. It is unremarkable in every regard.\n</para>\n</chapter>';
$v_137485 = $v_137483->xml($v_137484,);
$v_137490 = get_resources();
$v_137491 = end($v_137490,);
$v_137492 = fclose($v_137491,);
$v_137487 = $v_137483->setRelaxNGSchema($v_137492,);Resulted in this output:
Aborted (core dumped)
PHP Version
nightly
Operating System
ubuntu 20.04
Activity
devnexen commentedon Sep 6, 2025
could it be a library version issue ? can t reproduce it.
ndossche commentedon Sep 6, 2025
Can't reproduce this either. Please share the libxml version used, the
1file, and the output from ASAN.chongwick commentedon Sep 6, 2025
libxml2-dev:
Installed: 2.9.13+dfsg-1ubuntu0.5
Candidate: 2.9.13+dfsg-1ubuntu0.5
Version table:
*** 2.9.13+dfsg-1ubuntu0.5 100
100 /var/lib/dpkg/status
There is no output from ASAN
chongwick commentedon Sep 6, 2025
I just noticed it only seems to reproduce when there is a directory named "1" . i.e. mkdir 1
ndossche commentedon Sep 6, 2025
I can't reproduce this with a directory
1and on libxml 2.13.The only thing I can think of is that it's basically #19742 (comment) because the
fcloseline closes the last resource which is likely STDERR andsetRelaxNGSchemacould write to STDERR.13 remaining items
chongwick commentedon Sep 7, 2025
Seems to be the same lseek assertion failure. This is being run on a remote server. I don't know if user permissions would be affecting this behavior at all.
ndossche commentedon Sep 7, 2025
I do have the
1directory. Actually, looking at the trace reveals this is thelseek(self->fd, 0, 1) == 0assertion from #17164, so unless I'm mistaken this is actually a duplicate. I don't understand why I don't get the assertion failure; and I don't understand how that assertion can fail either ...Can you please try to apply the following patch and rerun and share the output? This should at least give us some hint:
chongwick commentedon Sep 8, 2025
I"m not getting anything printed to stderr. Still just: Aborted (core dumped)
gdb output:
ndossche commentedon Sep 8, 2025
Hm, that might be related to the fclose call. What's the output if you use the patch on the reproducer of #17164 ?
chongwick commentedon Sep 8, 2025
ret=-1 | errno=22
ndossche commentedon Sep 8, 2025
Thanks for the info!
22 is EINVAL...
Man page for
lseeksays:But we seek from the current offset with an argument of 0, so I don't understand this. Is the current offsets already negative, but how can that be possible? In any case, this is a duplicate of #17164 given the stack trace and the fact it operates on a directory. So let's continue there.