Re: [xml] XML Schema crash in W3C test suite

[Stefan Behnel <stefan_ml behnel de>]

Hi,

Daniel Veillard wrote:
> On Thu, Feb 28, 2008 at 10:35:20AM +0100, Stefan Behnel wrote:
> > For the following test, however, I get a crash:
> >
> > xmlschema2006-11-06/sunData/Notation/targetNS/targetNS00101m/targetNS00101m2_p.xml
> >
> > Valgrind gives me this:
> >
> > ==15628== Invalid free() / delete / delete[]
> > ==15628==    at 0x402237F: free (vg_replace_malloc.c:233)
> > ==15628==    by 0x4187985: xmlSchemaFreeValue (xmlschemastypes.c:1047)
> > ==15628==    by 0x416A6CC: xmlSchemaFreeFacet (xmlschemas.c:3927)
> > ==15628==    by 0x416A742: xmlSchemaFreeType (xmlschemas.c:3954)
> > ==15628==    by 0x416A9A9: xmlSchemaComponentListFree (xmlschemas.c:4022)
> > ==15628==    by 0x416AAAA: xmlSchemaBucketFree (xmlschemas.c:3504)
> > ==15628==    by 0x410D7E8: xmlHashFree (hash.c:307)
> > ==15628==    by 0x416AC49: xmlSchemaFree (xmlschemas.c:4119)
> > ==15628==    by 0x804F853: main (xmllint.c:3534)
> > ==15628==  Address 0x4389800 is 0 bytes inside a block of size 4 free'd
> > ==15628==    at 0x402237F: free (vg_replace_malloc.c:233)
> > ==15628==    by 0x4174BF8: xmlSchemaValidateNotation (xmlschemas.c:21820)
> > ==15628==    by 0x417634B: xmlSchemaVCheckCVCSimpleType (xmlschemas.c:24469)
> > ==15628==    by 0x417D606: xmlSchemaCheckFacet (xmlschemas.c:18599)
> > ==15628==    by 0x417DC88: xmlSchemaFixupSimpleTypeStageTwo (xmlschemas.c:18756)
> > ==15628==    by 0x4183E33: xmlSchemaFixupComponents (xmlschemas.c:20988)
> > ==15628==    by 0x418694E: xmlSchemaParse (xmlschemas.c:21263)
> > ==15628==    by 0x804F457: main (xmllint.c:3384)
>   Can you provide the .xml and .xsd leading to the crash ?

Sure. The W3C test suite is here:

http://www.w3.org/XML/2004/xml-schema-test-suite/index.html

I attached the two test files.

Stefan

<?xml version="1.0" encoding="UTF-8"?>

<!--
Ident: @(#)targetNS00101m2.xsd
   generated from: @(#)targetNS00101m.jmpp      1.3 02/11/15

-->

<xsd:schema
  xmlns:xsd="http://www.w3.org/2001/XMLSchema";
  xmlns:test="tck_test"
  xmlns="targetNS"
  targetNamespace="targetNS">

     <xsd:import namespace="tck_test" schemaLocation="targetNS00101m1.xsd"/>

     <xsd:complexType name="Picture">
          <xsd:attribute name="type">
               <xsd:simpleType>
                    <xsd:restriction base="xsd:NOTATION">
                         <xsd:enumeration value="test:png"/>
                    </xsd:restriction>
               </xsd:simpleType>
          </xsd:attribute>
     </xsd:complexType>

     <xsd:element name="a" type="xsd:string" />

</xsd:schema>

<?xml version="1.0" encoding="UTF-8"?>

<!--
Ident: @(#)targetNS00101m2_p.xml
   generated from: @(#)targetNS00101m.jmpp      1.3 02/11/15

-->


<test:a
    xmlns:test="targetNS"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
    xsi:schemaLocation="targetNS targetNS00101m2.xsd">abc</test:a>