Re: [xml] xmlNodeDump looses data

[Daniel Veillard <veillard redhat com>]

On Fri, Feb 15, 2008 at 04:59:36PM +0100, Petr Pajas wrote:
> Hi Daniel, All,
> 
> one of the users of the Perl bindings reported a strange bug which I 
> was able to reduce to the attached very very simple "test.c" 
> program and a XML file "test2.xml". 
> 
> The program parses the XML file into a tree, and then dumps the root 
> element using xmlNodeDump.
> 
> In the result, a complete text content of a text node within an 
> element <linkage> is missing.
[...]

  Bill started to dig the problem earlier today and we came up
with a patch (commited to SVN in revision 3695)
  This is a bad combination of buffer limits and saving to a string
when using predefined entities in text. Patch is rather simple actually.

> The bug seems to me rather serious since it can have really bad 
> consequences for applications that use xmlNodeDump.

  Well apparently that function has been around at least since 2004 since
Bill already fixed a bug there a in Nov 2004. Surprizingly the bug seems
to have gonne unnoticed for years, apparently it's not that easy to trigger
but i will soon push a new release, maybe next week.

> Please let me know if you need more information.

  Nahh that was just fine, patch enclosed, thanks a lot,

Daniel

-- 
Red Hat Virtualization group http://redhat.com/virtualization/
Daniel Veillard      | virtualization library  http://libvirt.org/
veillard redhat com  | libxml GNOME XML XSLT toolkit  http://xmlsoft.org/
http://veillard.com/ | Rpmfind RPM search engine  http://rpmfind.net/

Index: xmlIO.c
===================================================================
--- xmlIO.c	(revision 3694)
+++ xmlIO.c	(working copy)
@@ -3315,6 +3315,16 @@
 	cons = len;
 	chunk = (out->buffer->size - out->buffer->use) - 1;
 
+        /*
+	 * make sure we have enough room to save first, if this is
+	 * not the case force a flush, but make sure we stay in the loop
+	 */
+	if (chunk < 40) {
+	    nbchars = 0;
+	    oldwritten = -1;
+	    goto flush;
+	}
+
 	/*
 	 * first handle encoding stuff.
 	 */
@@ -3360,6 +3370,7 @@
 	if ((nbchars < MINLEN) && (len <= 0))
 	    goto done;
 
+flush:
 	if (out->writecallback) {
 	    /*
 	     * second write the stuff to the I/O channel