[xml] stack corruption (2.5.4)

[Gary Pennington sun com]

I have an intermittent problem with stack corruption that appears to be
caused by libxml2. I'll describe the problem, any pointers are appreciated.

Environment:

Solaris

libxml2 2.5.4

I am building a document in memory. Since I want to be able to access
DTD information as I build my document, I do the following:

                info.ktx_doc = xmlNewDoc(BAD_CAST "1.0");
                xmlCreateIntSubset(info.ktx_doc, BAD_CAST "system",
                    BAD_CAST "-//Sun Microsystems Inc//DTD Resource "
                    "Management All//EN",
                    BAD_CAST dtd_location);
                /*
                 * This hack is required to force libxml to recognize the
                 * document structure without having to validate. This is
                 * achieved by forcing external DTD parsing.
                 */
                xmlFreeDtd(info.ktx_doc->extSubset);
                info.ktx_doc->extSubset =
                    xmlParseDTD(info.ktx_doc->intSubset->ExternalID,
                        info.ktx_doc->intSubset->SystemID);
                /*
                 * End of the hack to force external DTD parsing
                 */
                if ((info.ktx_node = xmlNewDocNode(info.ktx_doc, NULL,
                    BAD_CAST "system", NULL)) == NULL) {
                        pool_seterror(POE_DATASTORE);
                        return (PO_FAIL);
                }
                ...

The above created a new document, then an internal subset. The section which
is described as a "hack" basically tries to do enough work to ensure that
the data from my DTD is known to the application without having to do
a validation of the document. (I avoid calling xmlValidateDocument() at
this stage, since I know my document isn't valid and it will generate
error messages which I don't want to generate.). I do this so that calls
to xmlHasProp() will correctly pick up the appropriate DTD supplied
attributes.

After the above, I go ahead and build the rest of my document. Now, when
I call xmlValidateDocument() and then save the document (xmlSaveFormatFile)
I get a core dump and stack corruption on the next line after my function
returns. If I comment out the call to xmlValidateDocument(), no corruption
and no problems.

However, this problem is really intermittent. If I make other changes to my
application, e.g. adding tracing details, then the problem can return, but
only if I call xmlValidateDocument(). The constant factors are:

xmlValidateDocument() called: Sometimes I get a corrupt stack and SIGSEGV
xmlValidateDocument() NOT called: Never a problem.

Another colleague developing a separate application contacted me today and
he's experiencing the same intermittent problem, which makes more think
it's more likely the problem is in libxml2 than my application.

My questions are:

1. Is this a known problem in 2.5.4?
2. If so, will an upgrade to 2.5.7 fix it?
3. Is the "hack" I'm using above likely to be the cause of the problem?

As I said above, all suggestions gratefully received.

Gary

-- 
Gary Pennington
Solaris Kernel Development,
Sun Microsystems
Gary Pennington sun com