|
Hi, I found a problem in libxml, but I’m not able to fix it. So please, could you look at it?
There is infinite recursion in xmlFARecurseDeterminism. It fails with versions 2.7.6 also 2.7.8, tested on Ubuntu 9. I tried to debug and send you part of call stack: #0 xmlFARecurseDeterminism (ctxt=0xd1a010, state=0xd19980, to=-2, atom=0x0) at xmlregexp.c:2600 #1 0x00007ffff7b06584 in xmlFARecurseDeterminism (ctxt=0xd1a010, state=0xd1a380, to=-2, atom=0x0) at xmlregexp.c:2621 #2 0x00007ffff7b06584 in xmlFARecurseDeterminism (ctxt=0xd1a010, state=0xd19980, to=-2, atom=0x0) at xmlregexp.c:2621 #3 0x00007ffff7b06584 in xmlFARecurseDeterminism (ctxt=0xd1a010, state=0xd1a380, to=-2, atom=0x0) at xmlregexp.c:2621 #4 0x00007ffff7b06584 in xmlFARecurseDeterminism (ctxt=0xd1a010, state=0xd17830, to=-2, atom=0x0) at xmlregexp.c:2621 #5 0x00007ffff7b06934 in xmlFAComputesDeterminism (ctxt=0xd1a010) at xmlregexp.c:2751 #6 0x00007ffff7b0c622 in xmlRegexpIsDeterminist__internal_alias (comp=0xd1ded0) at xmlregexp.c:5539 #7 0x00007ffff7b0185e in xmlRegEpxFromParse (ctxt=0xc73090) at xmlregexp.c:445 #8 0x00007ffff7b0da12 in xmlAutomataCompile__internal_alias (am=0xc73090) at xmlregexp.c:6296 #9 0x00007ffff7b2c056 in xmlSchemaBuildContentModel (type=0xbd49d0, ctxt=0x61f490) at xmlschemas.c:13140 #10 0x00007ffff7b3782b in xmlSchemaFixupComponents (pctxt=0x61f490, rootBucket=0x626a60) at xmlschemas.c:21213 #11 0x00007ffff7b37b2b in xmlSchemaParse__internal_alias (ctxt=0x61f490) at xmlschemas.c:21336 #12 0x000000000040ca12 in main (argc=3, argv=0x7fffffffe368) at xmllint.c:3578 As you can see 0xd19980 is called for xmlFARecurseDeterminism in cycle. I’m attaching used xsds. Crash can be reproduced by: xmllint --schema ./docx_xsd/wml.xsd On the other hand the following scipt doesn’t fail xmllint --schema ./docx_xsd/wml.xsd.ok It differs only in minoccurence of one element. Please, would you inform me, it the crash is fixed? With Best Regards, Pavel Madr |
Attachment:
docx_xsd.zip
Description: docx_xsd.zip