After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 53391 - "xmlSAXParseFile" causes seg. faults if a SAX Handler is passed
"xmlSAXParseFile" causes seg. faults if a SAX Handler is passed
Product: libxml
Classification: Deprecated
Component: general
Other Linux
: Normal normal
: ---
Assigned To: Daniel Veillard
Daniel Veillard
Depends on:
Reported: 2001-04-19 21:46 UTC by Christian Glahn
Modified: 2009-08-15 18:40 UTC
See Also:
GNOME target: ---
GNOME version: ---

Description Christian Glahn 2001-04-19 21:46:34 UTC
The application compiles correctly, but crashes if a SAX Handler is passed
to the function "xmlSAXParseFile". If the default handler is used
(sax==NULL), the application works correctly. Otherwise the application
crashes in the first function that accesses "ctxt->user_data". 

  xmlSAXUserParseFile(testSAXHandler,0, filename);   /* ok */
  doc = xmlSAXParseFile(0, filename,0);              /* ok */
  doc = xmlSAXParseFile(testSAXHandler, filename,0); /*segmentation fault*/

I use libxml2 2.3.5
The code is still available in todays cvs snapshot (Apr, 19).

In file "parser.c":

(a) function "xmlSAXParseFile" will cause later segmentation faults if a
    SAX handler is passed. (tested)
(exactly the same code is in function "xmlSAXParseEntity")

similar problems could appear in 

(b) function  "xmlSAXParseMemory" (same code is in "xmlSAXParseDoc")
(c) function "xmlSAXUserParseMemory" 
(both not tested)

The function "xmlSAXUserParseFile" works correct.

fixing sugestions:
>    if (sax != NULL) {
>	if (ctxt->sax != NULL)
>	    xmlFree(ctxt->sax);
>        ctxt->sax = sax;
<       ctxt->userData = NULL; /* remove this line! */
>    }
comment: it the NULL assignment is removed the application returns 
correct results.

>    if (sax != NULL) {
>        ctxt->sax = sax;
<        ctxt->userData = NULL; /* remove this line!? */
>    }
comment: this code piece will cause the same effect as (a) 

(c) apps will seg fault if user_data == NULL is passed.
>    if (sax != NULL) {
>	oldsax = ctxt->sax;
>	ctxt->sax = sax;
>    }
<    ctxt->userData = user_data; /* replace this line with next line */
>    if ( user_data != NULL ) ctxt->user_data = user_data;

The last line is from  "xmlSAXUserParseFile"

Comment 1 Daniel Veillard 2001-04-26 09:31:03 UTC
Okay, this look sensible, I have done the changes suggested,

thanks for the report,

Comment 2 Daniel Veillard 2001-05-04 10:42:54 UTC
shipped in 2.3.8, I hope it's not the source of

Comment 3 Daniel Veillard 2001-05-04 16:04:28 UTC
Seems it's fine, closed !