[xml] memory leakage while saving file

[Ottavio Campana <ottavio videotec com>]

Hi, I think I found a bug in libxml-2: in my multi-threaded application 
I get a memory leakage when I save an xml file

Here's an example of the output I get from valgrind

==4275== 981,552 bytes in 1,014 blocks are definitely lost in loss 
record 44 of 44
==4275==    at 0x4C2779D: malloc (in 
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==4275==    by 0x4ED7EF1: xmlGetGlobalState (threads.c:584)
==4275==    by 0x4ED7634: __xmlIndentTreeOutput (globals.c:921)
==4275==    by 0x4F3D12C: xmlNodeListDumpOutput (xmlsave.c:722)
==4275==    by 0x4F3C95E: xmlNodeDumpOutputInternal (xmlsave.c:979)
==4275==    by 0x4F3D112: xmlNodeListDumpOutput (xmlsave.c:730)
==4275==    by 0x4F3C95E: xmlNodeDumpOutputInternal (xmlsave.c:979)
==4275==    by 0x4F3D112: xmlNodeListDumpOutput (xmlsave.c:730)
==4275==    by 0x4F3C95E: xmlNodeDumpOutputInternal (xmlsave.c:979)
==4275==    by 0x4F3D112: xmlNodeListDumpOutput (xmlsave.c:730)
==4275==    by 0x4F3C95E: xmlNodeDumpOutputInternal (xmlsave.c:979)
==4275==    by 0x4F3C4E1: xmlDocContentDumpOutput (xmlsave.c:1139)

In globals.c in case the calling thread is not the main thread, 
__xmlIndentTreeOutput does

return (&xmlGetGlobalState()->xmlIndentTreeOutput);

but as it can be seen in threads.c:584 every time it is called it 
mallocs memory for a xmlGlobalState.
This memory is never free'd, and this is the only reason why functions 
calling __xmlIndentTreeOutput get a valid pointer and do not give a 
segfault.

But, unfortunately, after returning from __xmlIndentTreeOutput, you 
don't have any way to free the malloc'd memory any more and you have a 
leakage.

Now, considering that I am a libxml-2.0 internals novice, I tried changing

int * __xmlIndentTreeOutput(void);

to

int __xmlIndentTreeOutput(void);

so that you just return the value and not a pointer. This solution break 
parserInternals.c:2157 because it breaks

xmlIndentTreeOutput = 1;

since it is not a valid lvalue any more. I know this is bad, but I need 
a quit fix for my application dying because of memory exhaustion.

I attach my patch,  please evaluate if it is a good strategy.

Ottavio Campana

PS: a similar problem seems to exist in __xmlLastError , 
__xmlSaveNoEmptyTags , __xmlTreeIndentString , __xmlBufferAllocScheme , 
__xmlDefaultBufferSize , __xmlOutputBufferCreateFilenameValue , 
__htmlDefaultSAXHandler and __xmlGenericError . And maybe in others.

Attachment: save_leak.patch
Description: Text Data