Potential NULL pointer dereference in php_dom_create_fake_namespace_decl_node_ptr()
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 68/100
Research direction
Start in ext/dom/php_dom.c and inspect php_dom_create_fake_namespace_decl_node_ptr(), then trace how dom_object_namespace_node_clone_obj() and php_dom_create_fake_namespace_decl() handle its result. Check the xmlNewNs() allocation failure path and run the relevant DOM tests. Done means the failure is handled without dereferencing a NULL pointer and the callers handle creation failure safely.
Written by the indexing model from the issue text.
Description
Description
Hi, my static analyzer, Svace, has found a potential bug. Could you take a look and provide some feedback?
(File - /ext/dom/php_dom.c)
The function php_dom_create_fake_namespace_decl_node_ptr() dereferences the return value of xmlNewNs() without checking whether it is NULL.
xmlNsPtr curns = xmlNewNs(NULL, original->href, NULL);
if (original->prefix) {
curns->prefix = xmlStrdup(original->prefix);
}
<?php
Since xmlNewNs() may return NULL on allocation failure, a non-NULL original->prefix can cause a NULL pointer dereference when accessing curns->prefix.
Impact
This may lead to a crash of the PHP process, potentially resulting in a denial of service (DoS) when processing DOM namespace nodes.
The affected function is called from dom_object_namespace_node_clone_obj() and php_dom_create_fake_namespace_decl(), making the issue relevant to namespace node cloning and creation.
Proposed Solution
Check the return value of xmlNewNs() before dereferencing curns and handle allocation failures appropriately. Additionally, ensure that callers correctly handle a failure to create the fake namespace declaration node.
PHP Version
PHP 8.3.31
Operating System
No response
- Dominant language
- C
- Stars
- 41.8k
- Forks
- 8.5k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 145
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from php/php-src
-
ext/openssl: 8.2.31+/8.3.31+ fail to build against OpenSSL 1.0.2 (ASN1_STRING_get0_data in xp_ssl.c)Open
Difficulty 2/5 1-3 hours Newbie friendliness 79/100
Maintainers usually reply within 1 day
-
SNMP accepts malformed remote portsPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 Half a day Newbie friendliness 62/100
php/php-src#25137 · 1 comment ·
Maintainers usually reply within 1 day
-
Bug Status: Needs Triage
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
Maintainers usually reply within 1 day
-
quoted_printable_encode() produces lines longer than 76 characters for bytes 0xF5 to 0xFFPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Bug Status: Needs Triage
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
php/php-src#24196 · 1 comment ·
Maintainers usually reply within 1 day
Similar issues
-
Ship /Local/Applications, the Local domain's Applications folderPossibly taken @pkgdemon claimed this today. Openarea:base enhancement
Difficulty 1/5 Under an hour Newbie friendliness 94/100
nextbsd/nextbsd-userland#612 ·
Maintainers usually reply within 1 day
-
good first issue needs-triage
Difficulty 1/5 Under an hour Newbie friendliness 88/100
InauguralSystems/EigenScript#2347 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
colbymchenry/codegraph#3277 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
not for AI lovers
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
OSGeo/gdal#15515 · 1 comment ·
Maintainers usually reply within 1 day