Re: [xml] XML Schema crash in W3C test suite

[Daniel Veillard <veillard redhat com>]

On Thu, Feb 28, 2008 at 06:06:49PM +0100, Stefan Behnel wrote:
> Hi,
> 
> Daniel Veillard wrote:
> > On Thu, Feb 28, 2008 at 10:35:20AM +0100, Stefan Behnel wrote:
> >> For the following test, however, I get a crash:
> >>
> >> xmlschema2006-11-06/sunData/Notation/targetNS/targetNS00101m/targetNS00101m2_p.xml
> >>
> >> Valgrind gives me this:
> >>
> >> ==15628== Invalid free() / delete / delete[]
> >> ==15628==    at 0x402237F: free (vg_replace_malloc.c:233)
> >> ==15628==    by 0x4187985: xmlSchemaFreeValue (xmlschemastypes.c:1047)
> >> ==15628==    by 0x416A6CC: xmlSchemaFreeFacet (xmlschemas.c:3927)
> >> ==15628==    by 0x416A742: xmlSchemaFreeType (xmlschemas.c:3954)
> >> ==15628==    by 0x416A9A9: xmlSchemaComponentListFree (xmlschemas.c:4022)
> >> ==15628==    by 0x416AAAA: xmlSchemaBucketFree (xmlschemas.c:3504)
> >> ==15628==    by 0x410D7E8: xmlHashFree (hash.c:307)
> >> ==15628==    by 0x416AC49: xmlSchemaFree (xmlschemas.c:4119)
> >> ==15628==    by 0x804F853: main (xmllint.c:3534)
> >> ==15628==  Address 0x4389800 is 0 bytes inside a block of size 4 free'd
> >> ==15628==    at 0x402237F: free (vg_replace_malloc.c:233)
> >> ==15628==    by 0x4174BF8: xmlSchemaValidateNotation (xmlschemas.c:21820)
> >> ==15628==    by 0x417634B: xmlSchemaVCheckCVCSimpleType (xmlschemas.c:24469)
> >> ==15628==    by 0x417D606: xmlSchemaCheckFacet (xmlschemas.c:18599)
> >> ==15628==    by 0x417DC88: xmlSchemaFixupSimpleTypeStageTwo (xmlschemas.c:18756)
> >> ==15628==    by 0x4183E33: xmlSchemaFixupComponents (xmlschemas.c:20988)
> >> ==15628==    by 0x418694E: xmlSchemaParse (xmlschemas.c:21263)
> >> ==15628==    by 0x804F457: main (xmllint.c:3384)
> >>
> >   Can you provide the .xml and .xsd leading to the crash ?
> 
> Sure. The W3C test suite is here:
> 
> http://www.w3.org/XML/2004/xml-schema-test-suite/index.html
> 
> I attached the two test files.

  I wanted to look at it yesterday in the train, alas the test were not
standalone and depending on another file not included in the mail, so i could
not debug it, i hope i will find some time at some point later. Still there
is a good reason i ask people to try to provide and send standalone test cases
in the http://xmlsoft.org/bugs.html

Daniel

-- 
Red Hat Virtualization group http://redhat.com/virtualization/
Daniel Veillard      | virtualization library  http://libvirt.org/
veillard redhat com  | libxml GNOME XML XSLT toolkit  http://xmlsoft.org/
http://veillard.com/ | Rpmfind RPM search engine  http://rpmfind.net/