ext/lexbor: Enable ASAN support in Lexbor#22826
Open
kocsismate wants to merge 6 commits into
Open
Conversation
ndossche
requested changes
Jul 20, 2026
ndossche
left a comment
Member
There was a problem hiding this comment.
This doesn't fully work, right?
For example in core/dobject.c in lexbor, it check for LEXBOR_HAVE_ADDRESS_SANITIZER but LEXBOR_HAVE_ADDRESS_SANITIZER is only defined in php_config.h...
I just tried this hypothesis by putting a syntax error under that define and PHP still compiled fine, so that indicates it indeed isn't being picked up there
Member
Author
|
Yeah, sorry for the premature PR, I also tested the change (after I opened the PR), and it indeed didn't work that way... But now we'll have a proof that it works: |
iluuu1994
reviewed
Jul 21, 2026
| CFLAGS="-fsanitize=undefined,address -fno-sanitize=function -DZEND_TRACK_ARENA_ALLOC" | ||
| LDFLAGS="-fsanitize=undefined,address -fno-sanitize=function" | ||
| CFLAGS="-fno-sanitize=function -DZEND_TRACK_ARENA_ALLOC" | ||
| LDFLAGS="-fno-sanitize=function" |
Member
Member
Author
There was a problem hiding this comment.
Oh, thanks for the info.. I didn't understand why not the --enable-*-sanitizer flags were used.
Member
Author
There was a problem hiding this comment.
Desperate times call for desperate measures: https://github.com/php/php-src/pull/22826/changes#diff-8f50e816adac6afb8f364de04db3ca061f2e64f92834d17dc0ceec2a0da9cc21R6
Member
Author
|
Finally, I can see the same failure what I saw locally: |
kocsismate
commented
Jul 22, 2026
| if (lxb_url_is_ipv4(parser, domain->data, end)) { | ||
| status = lxb_url_ipv4_parse(parser, domain->data, end, &ipv4); | ||
|
|
||
| (void) lexbor_str_destroy(domain, mraw, false); |
Member
Author
There was a problem hiding this comment.
The lexbor_str_destroy() call frees and subsequently poisons the domain string's memory region, but the character where parsing failed is added to the logs, causing a use-after-poison error during returing the error in fill_errors().
Since lexbor uses an arena allocator, skipping the explicit lexbor_str_destroy() call should not cause a memory leak (but correct me if I'm wrong) — the memory will be reclaimed at the end of the request.
kocsismate
added a commit
to kocsismate/lexbor
that referenced
this pull request
Jul 22, 2026
The lexbor_str_destroy() call frees and subsequently poisons the domain string's memory region, but the character where parsing failed is added to the logs (https://github.com/lexbor/lexbor/blob/21c907010afbace3df43e9cb42071d988428084a/source/lexbor/url/url.c#L3617), causing a use-after-poison error if the logs are consumed. Since lexbor uses an arena allocator, skipping the explicit lexbor_str_destroy() call should not cause a memory leak — the memory will be reclaimed when the arena itself is freed. Found in php/php-src#22826
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.