Re: [xml] an xpath segfault reproducible with xmllint

[Pavol Rusnak <prusnak suse cz>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Daniel Veillard wrote:
>   What is the stack like, and value for i and obj->nodeNr.
> As stated I tested with latest SVN version on 2 machines without seeing the
> problem myself.

(gdb) r --shell test.xml
Starting program: /usr/bin/xmllint --shell test.xml
/ > xpath *[ a=name(concat(""))]
XPath error : Invalid number of arguments
XPath error : Invalid type
xmlXPathEval: 3 object left on the stack

Program received signal SIGSEGV, Segmentation fault.
0x00002b9636a24d4b in xmlXPathFreeNodeSet (obj=0x6660f0) at xpath.c:4059
4059                if ((obj->nodeTab[i] != NULL) &&
(gdb) bt
#0  0x00002b9636a24d4b in xmlXPathFreeNodeSet (obj=0x6660f0) at xpath.c:4059
#1  0x00002b9636a2552e in xmlXPathFreeObject (obj=0x666170) at xpath.c:5344
#2  0x00002b9636a32c1d in xmlXPathEval (str=0x2b96369df5c0
"UH\211ïSH\201ïï", ctx=0x61b7c0)
    at xpath.c:14832
#3  0x00002b9636a233db in xmlShell (doc=<value optimized out>,
    filename=0x7fff749b23f9 "test.xml", input=<value optimized out>,
    output=<value optimized out>) at debugXML.c:2989
#4  0x0000000000406b42 in parseAndPrintFile (filename=0x7fff749b23f9
"test.xml", rectxt=0x0)
    at xmllint.c:2310
#5  0x0000000000408e13 in main (argc=3, argv=0x7fff749b09e8) at
xmllint.c:3499
#6  0x00002b9637165944 in __libc_start_main () from /lib64/libc.so.6
#7  0x00000000004044a9 in _start ()
(gdb) p i
$1 = 10
(gdb) p obj->nodeTab[i]
$2 = (xmlNodePtr) 0x60
(gdb) p obj->nodeNr
$3 = 6711616
(gdb)

File test.xml contains only "<aaa />"

- --
Best Regards / S pozdravom,

Pavol RUSNAK                                       SUSE LINUX, s.r.o
Package Maintainer                                Lihovarska 1060/12
PGP 0xA6917144                                     19000 Praha 9, CR
prusnak[at]suse.cz                                http://www.suse.cz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org

iD8DBQFGE7lTASE5C6aRcUQRAiBnAJ9JxFSdPFfsTPL0hYEqZyxVT/RnrwCfdp9t
XvaR4tDlBE1wNx79Toiaj78=
=RY/w
-----END PGP SIGNATURE-----