Re: [xml] Problem resolving relative URIs during catalog resolution, potential regression as of libxml2 2.9.2 (patch included)

  Hi Matthias,

 it took a while but I looked at this today, indeed that's a serious regression
however your patch needed a bit of work to avoid potential segfaults. Also
I found that condition in a couple of place in the code. Resulting fix is
commited to git head:

  thanks for the report !


On Thu, Nov 24, 2016 at 02:20:36PM +0000, Matthias Pigulla wrote:
Hello libxml2 developers,


./testURI --base file:///some/where file

Without patch: file:/some/file
With patch: file:///some/file

Full report:

I am using PHP to read a simple XML file and see a regression between
libxml 2.9.1 and 2.9.2, with the problem still present in 2.9.4.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN³
<html xmlns=3D"";>
<div>test &copy; </div>

I am running this on Debian and have installed the w3c-dtd-xhtml pacakge,
relying on system tooling to generate the catalog definitions in /etc/xml.
If it helps, I can post a tarball with all relevant files from /etc/xml
and /usr/share/xml/xhtml somewhere.

The resulting catalog will contain file:///etc/... references to other
files, eventually pointing to file:///usr/share/xml/somewhere... and
finally contain relative references like 'uri="xhtml1-strict.dtd"'.

Due to a glitch in xmlBuildURI, interpreting this relative URI with a base
of "file:///usr/share/xml/xhtml/schema/dtd/1.0/catalog.xml" ends up as
"file:/usr/share/xml/xhtml/schema/dtd/1.0/xhtml1-strict.dtd" with only a
single slash following the "file:".

Further down the road, this is interpreted as a file path and passed to
system calls, as can be seen in this strace output:

0x7fff7f56fda0) = -1 ENOENT (No such file or directory)
0x7fff7f56fd50) = -1 ENOENT (No such file or directory)

Immediately after, PHP fails with a PHP Notice: DOMDocument::loadXML():
failed to load external entity
"file:/usr/share/xml/xhtml/schema/dtd/1.0/xhtml1-strict.dtd" in Entity,
line ...

The patch solves the problem for me.

Relevant changes:
Also see

Please let me know if a test case for this is needed (would need
instructions how/where to write this).

Best regards

diff --git a/uri.c b/uri.c
index 2bd5720..6e09018 100644
--- a/uri.c
+++ b/uri.c
@@ -2024,7 +2024,7 @@ xmlBuildURI(const xmlChar *URI, const xmlChar *base) {
     if (bas->authority != NULL)
        res->authority = xmlMemStrdup(bas->authority);
-    else if (bas->server != NULL) {
+    else if ((bas->server != NULL) || (bas->port == -1)) {
        res->server = xmlMemStrdup(bas->server);
        if (bas->user != NULL)
            res->user = xmlMemStrdup(bas->user);

xml mailing list, project page
xml gnome org

Daniel Veillard      | Red Hat Developers Tools
veillard redhat com  | libxml Gnome XML XSLT toolkit | virtualization library

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]