[SVN-3023] segfault on update-report response without base revision

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: trunk
• Fix Version/s: 1.5.0
• Component/s: libsvn_ra_neon
• Assignee: Unassigned
• Reporter: Subversion Importer
• Created: 15/Nov/07 23:41
• Updated: 27/Oct/18 16:33
• Resolved: 10/Mar/09 15:22

Description

I'm working on a Subversion interface to MediaWiki, to support editing articles
in Emacs VC mode. One of my implementations generated update-report responses
with <S:open-file> elements without a base revision attribute:

<?xml version="1.0" encoding="utf-8" ?>
<S:update-report xmlns:S="svn:"
xmlns:V="http://subversion.tigris.org/xmlns/dav/" xmlns:D="DAV:">
  <S:target-revision rev="3"/>
  <S:open-directory>
    <D:checked-in><D:href>/svn/!svn/ver/3/</D:href></D:checked-in>
    <S:open-file name="test">
      <D:checked-in><D:href>/svn/!svn/ver/3/test</D:href></D:checked-in>
    </S:open-file>
  </S:open-directory>
</S:update-report>

This caused the Subversion client to segfault at libsvn_ra_neon/fetch.c:1594
(r27633):

 1591     case ELEM_open_file:
 1592       att = svn_xml_get_attr_value("rev", atts);
 1593       /* ### verify we got it. punt on error. */
 1594       base = SVN_STR_TO_REV(att);

ket% svn up
zsh: segmentation fault  svn up
ket% 

Jack

Original issue reported by jablko