Re: [xml] segfault and a possible fix in parser.c



On Sun, Oct 31, 2004 at 07:26:39PM +0100, Petr Pajas wrote:
Hi Daniel, All,

  Hi Petr,

I was hunting down why XML::LibXML Perl-binding fails to pass it's test-suit 
(with many segfaults) when linked to a recent release of libxml2 when I came 
to the following:

in xmlParseBalancedChunkMemoryRecover a new document and a parser context are 
temporarily created (and freed at the end of that routine). The parser ctxt 
has a dict, which is also used as the newDoc's dict at line parse.c:11196 
(CVS).

    newDoc->dict = ctxt->dict; 
    xmlDictReference(newDoc->dict);

Thus e.g. all element names of the parsed chunk are stored in this dictionary. 
But finally, both the parser ctxt and newDoc are destroyed and so is the 
dictionary. Thus, the resulting nodelist has invalid pointers in nodes' 
names. I guess, those two lines got there by mistake (we need the strings in 
the parsed chunk to exist even after the newDoc and ctxt are freed). At 
least, removing them fixes the segfaults :-) 

  Okay I see. This was done in an attempt to always use the document dictionary
when building a doc. I goofed for that particular API, and unfortunately it
seems not well tested by the regression tests :-\

  Are you using a document in that API ? If yes does it use a dictionnary
(i.e. doc->dict != NULL) ?

  Can you test the enclosed patch for the Perl bindings ?

Daniel

-- 
Daniel Veillard      | Red Hat Desktop team http://redhat.com/
veillard redhat com  | libxml GNOME XML XSLT toolkit  http://xmlsoft.org/
http://veillard.com/ | Rpmfind RPM search engine http://rpmfind.net/

Attachment: chunk.patch
Description: Text document



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]