Re: [xml] an xpath segfault reproducible with xmllint

From: Petr Pajas <pajas ufal mff cuni cz>
To: veillard redhat com
Cc: xml gnome org
Subject: Re: [xml] an xpath segfault reproducible with xmllint
Date: Wed, 4 Apr 2007 15:00:23 +0200

On Wednesday 04 April 2007 14:50, Daniel Veillard wrote:

On Tue, Apr 03, 2007 at 06:04:54PM +0200, Petr Pajas wrote:

Hi Daniel, All,

I have experienced segfaults where just an error should be
issued. After playing with the xpath for a while, I have
narrowed it to the following test case:

xmllint --shell test.xml
/ > xpath *[ a=name(concat(""))]
XPath error : Invalid number of arguments
XPath error : Invalid type
xmlXPathEval: 3 object left on the stack
Object is empty (NULL)
/ > xpath *[ a=name(concat(""))]
XPath error : Invalid number of arguments
Segmentation fault (SIGSEGV)

Notes:
1) test.xml can by any XML file

2) you may need to repeat the xpath query two or more times
before it actually segfaults, but valgrind indicates a problem
already during the first run

3) with just *[name("")] I have to repeat 3 times before it
segfaults, but it does; valgrind shows a problem only on 1st
run, though

4) name("") alone is ok (invalid type error is reported)

5) I'm running libxml2-2.6.27, openSuSE 10.2


  I can't reproduce it with CVS head nor the default binary
installed on RHEL5 x86_64 nor i386, please provide more
informations about the crash because here it is really behaving
as it should:


valgrind output is below; it's not built with -g so this doesn't say 
that much. I'll try to install the -debuginfo packages or recompile 
and come back with a more detailed one later:

$ valgrind xmllint --shell test.xml
...
/ > xpath *[ a=name(concat(""))]
XPath error : Invalid number of arguments
XPath error : Invalid type
==16758== Invalid read of size 4
==16758==    at 0x414DE11: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C1AE: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)
==16758==  Address 0x43C03A8 is 0 bytes inside a block of size 40 
free'd
==16758==    at 0x402300A: free 
(in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==16758==    by 0x414DE31: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C74A: xmlXPathCompOpEvalPredicate 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415D6B8: xmlXPathNodeCollectAndTest 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415A2F8: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x4159FEA: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415BDCF: xmlXPathRunEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C16E: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)
==16758==
==16758== Invalid read of size 4
==16758==    at 0x414DE40: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C1AE: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)
==16758==  Address 0x43C03B0 is 8 bytes inside a block of size 40 
free'd
==16758==    at 0x402300A: free 
(in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==16758==    by 0x414DE31: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C74A: xmlXPathCompOpEvalPredicate 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415D6B8: xmlXPathNodeCollectAndTest 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415A2F8: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x4159FEA: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415BDCF: xmlXPathRunEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C16E: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)
==16758==
==16758== Invalid read of size 4
==16758==    at 0x414DE61: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C1AE: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)
==16758==  Address 0x43C03AC is 4 bytes inside a block of size 40 
free'd
==16758==    at 0x402300A: free 
(in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==16758==    by 0x414DE31: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C74A: xmlXPathCompOpEvalPredicate 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415D6B8: xmlXPathNodeCollectAndTest 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415A2F8: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x4159FEA: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415BDCF: xmlXPathRunEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C16E: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)
==16758==
==16758== Invalid read of size 4
==16758==    at 0x414D65B: xmlXPathFreeNodeSet 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414DE6F: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C1AE: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)
==16758==  Address 0x43C0408 is 8 bytes inside a block of size 12 
free'd
==16758==    at 0x402300A: free 
(in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==16758==    by 0x414D6A5: xmlXPathFreeNodeSet 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414DE6F: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C74A: xmlXPathCompOpEvalPredicate 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415D6B8: xmlXPathNodeCollectAndTest 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415A2F8: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x4159FEA: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415BDCF: xmlXPathRunEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C16E: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==
==16758== Invalid read of size 4
==16758==    at 0x414D662: xmlXPathFreeNodeSet 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414DE6F: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C1AE: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)
==16758==  Address 0x43C0400 is 0 bytes inside a block of size 12 
free'd
==16758==    at 0x402300A: free 
(in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==16758==    by 0x414D6A5: xmlXPathFreeNodeSet 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414DE6F: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C74A: xmlXPathCompOpEvalPredicate 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415D6B8: xmlXPathNodeCollectAndTest 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415A2F8: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x4159FEA: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415BDCF: xmlXPathRunEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C16E: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==
==16758== Invalid read of size 4
==16758==    at 0x414D668: xmlXPathFreeNodeSet 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414DE6F: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C1AE: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)
==16758==  Address 0x43C0408 is 8 bytes inside a block of size 12 
free'd
==16758==    at 0x402300A: free 
(in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==16758==    by 0x414D6A5: xmlXPathFreeNodeSet 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414DE6F: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C74A: xmlXPathCompOpEvalPredicate 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415D6B8: xmlXPathNodeCollectAndTest 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415A2F8: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x4159FEA: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415BDCF: xmlXPathRunEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C16E: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==
==16758== Invalid read of size 4
==16758==    at 0x414D677: xmlXPathFreeNodeSet 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414DE6F: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C1AE: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)
==16758==  Address 0x43C0440 is 0 bytes inside a block of size 40 
free'd
==16758==    at 0x402300A: free 
(in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==16758==    by 0x414D6A0: xmlXPathFreeNodeSet 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414DE6F: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C74A: xmlXPathCompOpEvalPredicate 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415D6B8: xmlXPathNodeCollectAndTest 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415A2F8: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x4159FEA: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415BDCF: xmlXPathRunEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C16E: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==
==16758== Invalid read of size 4
==16758==    at 0x414D673: xmlXPathFreeNodeSet 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414DE6F: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C1AE: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)
==16758==  Address 0x43C0400 is 0 bytes inside a block of size 12 
free'd
==16758==    at 0x402300A: free 
(in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==16758==    by 0x414D6A5: xmlXPathFreeNodeSet 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414DE6F: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C74A: xmlXPathCompOpEvalPredicate 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415D6B8: xmlXPathNodeCollectAndTest 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415A2F8: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x4159FEA: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415BDCF: xmlXPathRunEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C16E: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==
==16758== Invalid free() / delete / delete[]
==16758==    at 0x402300A: free 
(in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==16758==    by 0x414D6A0: xmlXPathFreeNodeSet 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414DE6F: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C1AE: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)
==16758==  Address 0x43C0440 is 0 bytes inside a block of size 40 
free'd
==16758==    at 0x402300A: free 
(in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==16758==    by 0x414D6A0: xmlXPathFreeNodeSet 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414DE6F: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C74A: xmlXPathCompOpEvalPredicate 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415D6B8: xmlXPathNodeCollectAndTest 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415A2F8: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x4159FEA: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415BDCF: xmlXPathRunEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C16E: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==
==16758== Invalid free() / delete / delete[]
==16758==    at 0x402300A: free 
(in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==16758==    by 0x414D6A5: xmlXPathFreeNodeSet 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414DE6F: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C1AE: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)
==16758==  Address 0x43C0400 is 0 bytes inside a block of size 12 
free'd
==16758==    at 0x402300A: free 
(in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==16758==    by 0x414D6A5: xmlXPathFreeNodeSet 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414DE6F: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C74A: xmlXPathCompOpEvalPredicate 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415D6B8: xmlXPathNodeCollectAndTest 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415A2F8: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x4159FEA: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415BDCF: xmlXPathRunEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C16E: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==
==16758== Invalid free() / delete / delete[]
==16758==    at 0x402300A: free 
(in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==16758==    by 0x414DE31: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C1AE: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)
==16758==  Address 0x43C03A8 is 0 bytes inside a block of size 40 
free'd
==16758==    at 0x402300A: free 
(in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==16758==    by 0x414DE31: xmlXPathFreeObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414E45B: xmlXPathReleaseObject 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C74A: xmlXPathCompOpEvalPredicate 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415D6B8: xmlXPathNodeCollectAndTest 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415A2F8: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x4159FEA: xmlXPathCompOpEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415BDCF: xmlXPathRunEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x415C16E: xmlXPathEval 
(in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x414B846: xmlShell (in /usr/lib/libxml2.so.2.6.27)
==16758==    by 0x804DB5C: parseAndPrintFile (in /usr/bin/xmllint)
==16758==    by 0x8050003: main (in /usr/bin/xmllint)

-- Petr

Follow-Ups:
- Re: [xml] an xpath segfault reproducible with xmllint
  - From: Daniel Veillard

References:
- [xml] an xpath segfault reproducible with xmllint
  - From: Petr Pajas
- Re: [xml] an xpath segfault reproducible with xmllint
  - From: Daniel Veillard

[Date Prev][Date Next] [Thread Prev][Thread Next] [Thread Index] [Date Index] [Author Index]