Re: [xml] Crash in xmlPushInput

On Fri, Jun 16, 2006 at 10:26:17AM -0700, Ryan Phillips wrote:
I am experiencing a crash within xmlPushInput in the 2.6.26 version of
libxml.  Using the reader1 example change the xmlReaderForFile options
to be:


I have attached the crashing XML file and a backtrace.

In a separate application with the same file and same libxml options the
library crashes in parser.c:3499 dereferencing a NULL pointer.

  You use XML_PARSE_RECOVER. This *MUST* be used *ONLY* in recovery operation
not as a normal option which could be used to force for example HTML in the
XML parser. This force going though code paths which are not normally 
used. I said in the past that if this option is abused I would remove it
it's that simple and there won't be any warning, if you rely on it as a default
option you are warned, I will do something against abuses, like stopping
processing if the option is used too frequently.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1208514336 (LWP 26163)]
0x00386e21 in xmlPushInput () from /usr/lib/
#0  0x00386e21 in xmlPushInput () from /usr/lib/
#1  0x0042452a in xmlParseCharData () from /usr/lib/
#2  0x00428f27 in xmlParseChunk () from /usr/lib/
#3  0x00432e9e in xmlRegExecPushString () from /usr/lib/
#4  0x00433a98 in xmlTextReaderRead () from /usr/lib/
#5  0x08048931 in streamFile (filename=0xbffd5c95 "crash.xml") at reader1.c:68
#6  0x080489f3 in main (argc=2, argv=0xbffab614) at reader1.c:93
#0  0x00386e21 in xmlPushInput () from /usr/lib/
The program is running.  Exit anyway? (y or n) 

  The crash does not happen if you remove the XML_PARSE_RECOVER option.
I will remove the crash in CVS, but I'm also thinking about ways to 
allow XML_PARSE_RECOVER only in exceptional cases.


Daniel Veillard      | Red Hat
veillard redhat com  | libxml GNOME XML XSLT toolkit | Rpmfind RPM search engine

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]