[xml] unregister XPath namespace prefix crash (python bindings)

[Anthony Carrico <acarrico memebeam org>]

I'm using libxml2 version 2.5.11 (debian packages). I've narrowed my
bug down to small a bit of code that registers and removes an xpath
namespace prefix. Here is the test code:

$ cat test-xmlMalloc

#! /usr/bin/env python2.3
import libxml2

buffer = """<?xml version="1.0"?>
<foo xmlns:ds='http://www.w3.org/2000/09/xmldsig#'>
</foo>"""

libxml2.debugMemory(1)
doc = libxml2.parseMemory(buffer, len(buffer))
context = doc.xpathNewContext()
print context.xpathRegisterNs("dsig", "http://www.w3.org/2000/09/xmldsig#";)
print context.xpathRegisterNs("dsig", None)
context.xpathFreeContext()

Here is the output:

$ ./test-xmlMalloc
0
0
(nil) : Freed()
xmlMallocBreakpoint reached on block 0
Segmentation fault

That crash happens in "context.xpathFreeContext()".

I looked at the libxml2 source code a little bit. It seems like maybe
the code xmlHashUpdateEntry doesn't delete the hashtable entry if the
ns_uri is NULL, so I wonder if something like the following patch
would be appropriate. I haven't tested this patch yet; I wanted to
submit the problem with the wisdom of this list to see if I'm going in
the right direction.

bash-2.05b$ diff -u xpath.c ../../xpath.c
--- xpath.c     2003-07-31 10:47:38.000000000 -0400
+++ ../../xpath.c       2003-10-28 21:40:49.000000000 -0500
@@ -2929,8 +2929,11 @@
        ctxt->nsHash = xmlHashCreate(10);
     if (ctxt->nsHash == NULL)
        return(-1);
-    return(xmlHashUpdateEntry(ctxt->nsHash, prefix, (void *) xmlStrdup(ns_uri),
-                             (xmlHashDeallocator)xmlFree));
+    if (ns_uri == NULL)
+      return(xmlHashRemoveEntry(ctxt->nsHash, ns_uri, (xmlHashDeallocator)xmlFree));
+    else
+      return(xmlHashUpdateEntry(ctxt->nsHash, prefix, (void *) xmlStrdup(ns_uri),
+                                (xmlHashDeallocator)xmlFree));
 }

 /**

--
Anthony Carrico