[xml] xmlTextWriterWriteFormatElement problem

["James Eggleston" <james eggleston vega de>]

Hello, 

I've found a problem in our use of libxml2's streaming API. The call "xmlTextWriterWriteFormatElement" 
crashes when writing strings longer than 8191 bytes. It only happens on our dual - EM64T  SuSE Enterprise 9.0 
server... it seems fine on our single CPU 32 bit SLES machine (I tried using taskset to make the program 
stick to one CPU, but the program still crashed...). The default libxml2 is installed (2.6.7).

The following program reproduces the problem on my machine: 

==================xmlProblem.cpp===========
#include <libxml/encoding.h> 
#include <libxml/xmlwriter.h> 

int main() 
{ 
        xmlTextWriterPtr writer; 
        const char* xmlEncoding = "ISO-8859-1"; 

        writer = xmlNewTextWriterFilename("./test.xml", 0); 
        int rc = xmlTextWriterStartDocument(writer, NULL, xmlEncoding, NULL); 
        
        const int longStringLength(8192);  // 8192 causes a seg fault... 
        // const int longStringLength(8191); //  8191doesn't cause a problem!
        char* pLongString = new char[longStringLength]; 
        for (int i=0;i<longStringLength; i++) 
        { 
                pLongString[i] = 'a'; 
        } 
        pLongString[longStringLength-1] = 0; 

        // this will seg fault!! 
        rc = xmlTextWriterWriteFormatElement(writer, BAD_CAST "test", "%s", pLongString); 

        return 0;        
} 
=====end of xmlProblem.cpp===================

Compiling with "g++ xmlProblem.cpp -lxml2", and running causes a core dump...  the back trace is:

#0 0x0000002a95d2bd70 in strlen () from /lib64/tls/libc.so.6 
#1 0x0000002a95cffcdc in vfprintf () from /lib64/tls/libc.so.6 
#2 0x0000002a95d1f337 in vsnprintf () from /lib64/tls/libc.so.6 
#3 0x0000002a95735fc1 in xmlTextWriterVSprintf () from /usr/lib64/libxml2.so.2 
#4 0x0000002a95738e1e in xmlTextWriterWriteVFormatElement () from /usr/lib64/libxml2.so.2 
#5 0x0000002a95738ee3 in xmlTextWriterWriteFormatElement () from /usr/lib64/libxml2.so.2 
#6 0x000000000040096c in main () 

Does anyone have any ideas why this is and if anything can be done? 

Thanks,
James.


===========================================
James Eggleston

VEGA GmbH
Hilperstrasse, 20A
64295 Darmstadt
Germany

Tel: 0049 6151 82570
Tel (direct):  0049 6151 8257712
Fax: 0049 6151 8257799
===========================================
Notice of Confidentiality:
This transmission is intended for the named addressee only. 
It contains information which may be confidential and which
may also be privileged. Unless you are the named addressee
(or authorised to receive it for the addressee) you may not
copy or use it, or disclose it to anyone else. If you have
received this transmission in error please notify the sender
immediately.
===========================================