Re: [xml] stack corruption (2.5.4)

[Gary Pennington sun com]

Ok, we've got a reproducible test case and I have some information.

If we apply the patch you sent out, then the stack corruption problem
disappears but we get a core dump when the document is freed.

This problem is caused by the following line in the patch:

        ret->doc = NULL;

This will set the external subset of the document to have a null pointer.

In xmlUnlinkNode(), the following line causes the SIGSEGV:

    if (cur->type == XML_DTD_NODE) {
        xmlDocPtr doc;
        doc = cur->doc;
        if (doc->intSubset == (xmlDtdPtr) cur) <== SIGSEGV here.
            doc->intSubset = NULL;
         if (doc->extSubset == (xmlDtdPtr) cur)
        doc->extSubset = NULL;
    }

The problem is that the document has an external subset associated with it
but the external subset has had it's document reference removed.

My workaround is to take out the "ret->doc = NULL" line from the patch
that Daniel submitted. This allows the application to complete normally.

However, I can't honestly say that this is the definitively correct answer,
since I don't know why Daniel was setting this to NULL in his patch. It may
be that it should be set to NULL and a check added to xmlUnlinkNode() to
make sure that doc isn't NULL.

Is the above information enough to determine the correct answer?

Gary

On Wed, Apr 30, 2003 at 01:07:46PM +0100, Gary Pennington sun com wrote:
> Thanks for the information. I'll try and identify a reproducible test case
> and ensure that the patch fixes the problem.
>
> It may take some time.
>
> Gary
>
> On Wed, Apr 30, 2003 at 06:49:42AM -0400, Daniel Veillard wrote:
> > On Wed, Apr 30, 2003 at 12:47:40PM +0200, Petr Pajas wrote:
> > > Gary Pennington sun com writes:
> > >
> > > [snip]
> > > > I am building a document in memory. Since I want to be able to access
> > > > DTD information as I build my document, I do the following:
> > > [snip]
> > > >                 info.ktx_doc->extSubset =
> > > >                     xmlParseDTD(info.ktx_doc->intSubset->ExternalID,
> > > >                         info.ktx_doc->intSubset->SystemID);
> > > [snip]
> > > > My questions are:
> > > >
> > > > 1. Is this a known problem in 2.5.4?
> > > > 2. If so, will an upgrade to 2.5.7 fix it?
> > >
> > > A bug in xmlParseDTD fixed by Daniel few days ago is very likely the
> > > cause of the behavior you describe. Try upgrading from the CVS (or
> > > wait for 2.5.8; 2.5.7 still contains the bug).
> >
> >   Hum, right, I forgot about this, it's easy to check, the patch was
> > enclosed in my answer.
> >
> > Daniel
> >
> > -- 
> > Daniel Veillard      | Red Hat Network https://rhn.redhat.com/
> > veillard redhat com  | libxml GNOME XML XSLT toolkit  http://xmlsoft.org/
> > http://veillard.com/ | Rpmfind RPM search engine http://rpmfind.net/
> _______________________________________________
> xml mailing list, project page  http://xmlsoft.org/
> xml gnome org
> http://mail.gnome.org/mailman/listinfo/xml

-- 
Gary Pennington
Solaris Kernel Development,
Sun Microsystems
Gary Pennington sun com