Re: [xml] xmlNodeDumpOutputInternal segfault when usingt '/' as xpath expr

[Joel McConaughy <joel displayware com>]

Daniel Veillard wrote:

> On Mon, Jul 05, 2004 at 08:36:43AM -0700, Joel McConaughy wrote:
>  
>
> > I get the following segfault when using '/' as an xpath expression:
> >
> >   Program received signal SIGSEGV, Segmentation fault.
> >   [Switching to Thread 1024 (LWP 6946)]
> >   0x400d5cb8 in xmlNodeDumpOutputInternal (ctxt=0xbffff640, cur=0x804d438)
> >       at xmlsave.c:737
> >   737        if ((cur->ns != NULL) && (cur->ns->prefix != NULL)) {
> >
> > I have modified the xpath2.c sample to dump the results of an xpath 
> > expression using xmlNodeDumpOutput.  The problem can be reproduced by 
> >    
>
>  xpath2.c is used to modify the target nodes to change their value.
> if You do that on / you would modify the Document Root node. This won't
> work.
>
> [...]
>  
>
> > The only change I made to the sample was to replace update_xpath_nodes() 
> > with get_xpath_nodes().  The code is pretty simple and I can't see any 
> > problems however pilot error is always a possibility.  Help would be 
> > greatly appreciated.  Thanks.
> >    
>
>  there is no get_xpath_nodes() in xpath2.c . 
> Using "/" as an XPath expression is used all the time, especially in XSLT
> on top of libxml2. I don't see this being an xpath error. It likely to be
> an error handling the XML_DOCUMENT_NODE nore returned from the query.
> Never assume that a node is of a given type before processing it. Always
> test node->type first.
>
> Daniel
>
>  
Thanks for the quick response.  I'm not changing the doc in this code.  
I removed the update_xpath_nodes() function and replaced with the 
following which walks the xmlNodeSetPtr array and calls 
xmlNodeDumpOutput() for each element.  The node that causes the segfault 
is type=9, name=null.

static char *
get_xpath_nodes(xmlDocPtr doc, xmlNodeSetPtr nodes) {
   int size;
   int i;
   xmlOutputBufferPtr outbuf;
   char *s = calloc(1,1);
   assert(s);
  
   size = (nodes) ? nodes->nodeNr : 0;
   for(i = 0; i < size; i++) {
       assert(nodes->nodeTab[i]);
       outbuf = xmlAllocOutputBuffer(NULL);
       assert(outbuf);

       xmlNodeDumpOutput(outbuf, doc, nodes->nodeTab[i], 0, 0, NULL);
       xmlOutputBufferFlush(outbuf);

       s = realloc(s, strlen(s) + outbuf->buffer->use + 1);
       assert(s);
       strncat(s, outbuf->buffer->content, outbuf->buffer->use);

       xmlOutputBufferClose(outbuf);
   }

   return s;
}