[xml] xmllint dumps core

[David Allen <mda idatar com>]

Hello,

Just testing out some suggestions and mucking around with things, I
might have found a bug in either xmllint or libxml2.  Here's the
contents of a test file called "t.xml" (which was a poorly made
example file):

<?xml version="1.0"?>
<!DOCTYPE a [
<!ELEMENT a    (b | c | d | e | f | g | #PCDATA)>
<!ELEMENT b    (#PCDATA)>
<!ELEMENT c    (#PCDATA)>
<!ELEMENT d    (#PCDATA)>
<!ELEMENT e    (#PCDATA)>
<!ELEMENT f    (#PCDATA)>
<!ELEMENT g    (#PCDATA)>
]>

<a>

</a>

I saved this into "t.xml"...now check this out:

[x mothra libxml]$ xmllint --valid t.xml 
t.xml:3: error: xmlParseElementChildrenContentDecl : Name or '('
expected
<!ELEMENT a    (b | c | d | e | f | g | #PCDATA)>
                                        ^
xmlFreeElementContent : type 1075724464
Segmentation fault (core dumped)
[x mothra libxml]$ ls -l core
-rw-------    1 x        x          262144 May  9 18:50 core

Some extra info...

[x mothra libxml]$ dpkg -S xmllint
libxml2: /usr/share/man/man1/xmllint.1.gz
libxml2: /usr/bin/xmllint
[x mothra libxml]$ dpkg -l libxml2 | grep libxml
ii  libxml2        2.3.8-0.1      GNOME XML library
[x mothra x]$ uname -a
Linux mothra 2.4.3 #2 SMP Sat Mar 31 14:07:24 UTC 2001 i686 unknown

A backtrace...

[x mothra x]$ gdb /usr/bin/xmllint core
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and
you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for
details.
This GDB was configured as "i686-pc-linux-gnu"...
(no debugging symbols found)...

warning: exec file is newer than core file.
Core was generated by `xmllint --valid t.xml'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libxml2.so.2...(no debugging symbols
found)...
done.
Loaded symbols for /usr/lib/libxml2.so.2
Reading symbols from /usr/lib/libz.so.1...(no debugging symbols
found)...done.
Loaded symbols for /usr/lib/libz.so.1
Reading symbols from /lib/libm.so.6...(no debugging symbols
found)...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...(no debugging symbols
found)...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...(no debugging symbols
found)...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x4014a22d in free () from /lib/libc.so.6
(gdb) backtrace
#0  0x4014a22d in free () from /lib/libc.so.6
#1  0x4005c152 in xmlFreeElementContent () from /usr/lib/libxml2.so.2
#2  0x4005c129 in xmlFreeElementContent () from /usr/lib/libxml2.so.2
#3  0x4005c129 in xmlFreeElementContent () from /usr/lib/libxml2.so.2
#4  0x4005c129 in xmlFreeElementContent () from /usr/lib/libxml2.so.2
#5  0x4005c129 in xmlFreeElementContent () from /usr/lib/libxml2.so.2
#6  0x4005c129 in xmlFreeElementContent () from /usr/lib/libxml2.so.2
#7  0x40046e91 in xmlParseElementChildrenContentDecl ()
   from /usr/lib/libxml2.so.2
#8  0x4004716e in xmlParseElementContentDecl () from
/usr/lib/libxml2.so.2
#9  0x4004760d in xmlParseElementDecl () from /usr/lib/libxml2.so.2
#10 0x40047841 in xmlParseMarkupDecl () from /usr/lib/libxml2.so.2
#11 0x4004995e in xmlParseDocTypeDecl () from /usr/lib/libxml2.so.2
#12 0x4004c72e in xmlParseDocument () from /usr/lib/libxml2.so.2
#13 0x4004f4d8 in xmlSAXParseFile () from /usr/lib/libxml2.so.2
#14 0x4004f572 in xmlParseFile () from /usr/lib/libxml2.so.2
#15 0x8049dec in xmlCreateFileParserCtxt ()
#16 0x804ad3f in xmlCreateFileParserCtxt ()
#17 0x400f62eb in __libc_start_main () from /lib/libc.so.6
(gdb) 

GZipped core file is available upon request.  I don't tend to appreciate it
when people send 200k files out on mailing lists, so I'm not doing it
here.  :)
-- 
David Allen
http://opop.nols.com/