Out of memory error when passing non-existing filename to xmlwriter_open

Out of memory error when passing non-existing filename to xmlwriter_open_uri()

Bug #48202	Out of memory error when passing non-existing filename to xmlwriter_open_uri()
Submitted:	2009-05-09 12:40 UTC	Modified:	2009-06-22 17:59 UTC
From:	koenk82 at gmail dot com	Assigned:	rrichards (profile)
Status:	Not a bug	Package:	XML Writer
PHP Version:	5.*, 6CVS (2009-05-09)	OS:	*
Private report:	No	CVE-ID:	None

[2009-05-09 12:40 UTC] koenk82 at gmail dot com

Description:
------------
If you supply a non-existing file to xmlwriter_open_uri it produces an Out of memory error.

Reproduce code:
---------------
<?php 
var_dump(xmlwriter_open_uri('foo/bar.tmp'));
?>

Expected result:
----------------
Warning: xmlwriter_open_uri(%s): failed to open stream: No such file or directory in %s on line %d
bool(false)

Actual result:
--------------
Warning: xmlwriter_open_uri(/home/koen/Bureaublad/php5/foo/bar.tmp): failed to open stream: No such file or directory in /home/koen/Bureaublad/mytests/xmlwriter_open_uri_error_003.php on line 2

Warning: xmlwriter_open_uri(): xmlNewTextWriterFilename : out of memory! in /home/koen/Bureaublad/mytests/xmlwriter_open_uri_error_003.php on line 2
bool(false)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2009-05-09 13:04 UTC] pajoye@php.net

reproduced during the testfest 2009/utrecht, assigning to me.

[2009-05-25 16:53 UTC] pajoye@php.net

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

fixed in 5.2, 5.3 and HEAD

[2009-05-26 14:12 UTC] felipe@php.net

It's reproducible yet.

$ sapi/cli/php -r 'xmlwriter_open_uri("file:///a");'

Warning: xmlwriter_open_uri(/a): failed to open stream: Permission denied in Command line code on line 1

Warning: xmlwriter_open_uri(): xmlNewTextWriterFilename : out of memory! in Command line code on line 1

[2009-05-30 20:59 UTC] pajoye@php.net

I found the problem, it is a bug in libxml's xmlwriter. It does not check correctly the return value from the createfilename callback.

[2009-05-30 22:14 UTC] pajoye@php.net

Rob, can you take a look please?

Maybe change the error in xmlNewTextWriterFilename from:

    out = xmlOutputBufferCreateFilename(uri, NULL, compression);
    if (out == NULL) {
        xmlWriterErrMsg(NULL, XML_ERR_NO_MEMORY,
                        "xmlNewTextWriterFilename : out of memory!\n");
        return NULL;
    }

to

    out = xmlOutputBufferCreateFilename(uri, NULL, compression);
    if (out == NULL) {
        xmlWriterErrMsg(NULL, XML_EIO,
                        "xmlNewTextWriterFilename : cannot create file %s\n", uri);
        return NULL;
    }

[2009-06-22 17:59 UTC] rrichards@php.net

Sorry, but your problem does not imply a bug in PHP itself.  For a
list of more appropriate places to ask for help using PHP, please
visit http://www.php.net/support.php as this bug system is not the
appropriate forum for asking support questions.  Due to the volume
of reports we can not explain in detail here why your report is not
a bug.  The support channels will be able to provide an explanation
for you.

Thank you for your interest in PHP.

Error message was fixed in libxml2 source - will be in the 2.7.4 release