Re: [xml] Segmentation fault - xmlFARecurseDeterminism

[Daniel Veillard <veillard redhat com>]

On Thu, Nov 10, 2011 at 10:28:58AM +0000, Pavel Madr wrote:
> Hi,
>
> I found a problem in libxml, but I'm not able to fix it. So please, could you look at it?
> There is infinite recursion in xmlFARecurseDeterminism.
> It fails with versions 2.7.6 also 2.7.8, tested on Ubuntu 9.

  Yup, I was able to reproduce this,

> I'm attaching used xsds.
>
> Crash can be reproduced by:
> xmllint --schema ./docx_xsd/wml.xsd
>
> On the other hand the following scipt doesn't fail
> xmllint --schema ./docx_xsd/wml.xsd.ok
> It differs only in minoccurence of one element.

  I see,  minOccurs="0" led to an extra epsilon transition
and unfortunately the way that is done could lead to a loop

> Please, would you inform me, it the crash is fixed?

  Done, I commited the fix upstream:

  http://git.gnome.org/browse/libxml2/commit/?id=466fcdaa33258cf3633887222146b891d202cc6c

  it will be in 2.9.0-rc2, it would be nice if you could double check,

   thanks !

Daniel

-- 
Daniel Veillard      | libxml Gnome XML XSLT toolkit  http://xmlsoft.org/
daniel veillard com  | Rpmfind RPM search engine http://rpmfind.net/
http://veillard.com/ | virtualization library  http://libvirt.org/