Uploaded image for project: 'XalanC'
  1. XalanC
  2. XALANC-463

Transforming an XML DOM document encapsulated within an XercesDOMWrapperParsedSource object triggers an invalid heap pointer exception if XSL opens other XML document with 'document()' function.

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: 1.9
    • Fix Version/s: CurrentCVS
    • Component/s: XalanC
    • Labels:
      None
    • Environment:
      Xerces 2.6 (9/30/2004)
      Xalan 1.9 (12/22/2004)
      Os: Windows 2000 Advanced Server
      Compiler: Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 13.10.3077 for 80x86
      Linker: Microsoft (R) Incremental Linker Version 7.10.3077

      Description

      Transforming an XML DOM document encapsulated within an XercesDOMWrapperParsedSource object triggers an invalid heap pointer exception if XSL opens other XML document with 'document()' function.

      The XML is parsed and stored in an XercesDOMWrapperParsedSource object.
      The XSL style-sheet opens with the function 'document()' an other XML document.
      The transformation itself goes ok. When the destructors are called, an 'delete' is deleting memory in a wrong heap.

      The behaviour does not occur with Xalan 1.8
      The behaviour does not occur when the XSL style-sheet does not open an other XML document.
      The behaviour does not occur when the XML is not stored in an XercesDOMWrapperParsedSource object.

      source-code:
      =================

      #include <xalanc/Include/PlatformDefinitions.hpp>

      #if defined(XALAN_CLASSIC_IOSTREAMS)
      #include <iostream.h>
      #else
      #include <iostream>
      #endif

      #include <xercesc/util/PlatformUtils.hpp>
      #include <xercesc/parsers/XercesDOMParser.hpp>
      #include <xercesc/dom/DOMDocument.hpp>

      #include <xalanc/XalanTransformer/XalanTransformer.hpp>
      #include <xalanc/XalanTransformer/XercesDOMWrapperParsedSource.hpp>
      #include <xalanc/XalanTransformer/XalanParsedSource.hpp>

      #include <xalanc/XercesParserLiaison/XercesParserLiaison.hpp>
      #include <xalanc/XercesParserLiaison/XercesDOMSupport.hpp>

      int
      main(
      int argc,
      char* argv[])
      {
      XALAN_USING_STD(cerr)
      XALAN_USING_STD(cout)
      XALAN_USING_STD(endl)

      if (argc < 3 || argc > 3)

      { cerr << "Usage: XalanTransform XMLFileName XSLFileName " << endl; return -1; }

      int theResult = -1;

      try
      {
      XALAN_USING_XERCES(XMLPlatformUtils)
      XALAN_USING_XERCES(XercesDOMParser)
      XALAN_USING_XERCES(DOMDocument)

      XALAN_USING_XALAN(XalanTransformer)
      XALAN_USING_XALAN(XercesParserLiaison)
      XALAN_USING_XALAN(XercesDOMSupport)
      XALAN_USING_XALAN(XercesDOMWrapperParsedSource)

      XALAN_USING_XALAN(XalanParsedSource)
      XALAN_USING_XALAN(XalanParsedSourceHelper)

      // Call the static initializer for Xerces.
      XMLPlatformUtils::Initialize();

      // Initialize Xalan.
      XalanTransformer::initialize();

      {
      DOMDocument* parsedXml = NULL;
      XercesDOMParser parser;
      parser.parse(argv[1]);

      parsedXml = parser.getDocument();

      XercesDOMSupport theDOMSupport;
      XercesParserLiaison theLiaison(theDOMSupport);
      XercesDOMWrapperParsedSource theSource(parsedXml, theLiaison, theDOMSupport);

      // Create a XalanTransformer.
      XalanTransformer theXalanTransformer;

      // Do the transform.
      theResult = theXalanTransformer.transform(theSource, argv[2], cout);

      if(theResult != 0)

      { cerr << "Error: " << theXalanTransformer.getLastError() << endl; }

      }

      // Terminate Xalan...
      XalanTransformer::terminate();

      // Terminate Xerces...
      XMLPlatformUtils::Terminate();

      // Clean up the ICU, if it's integrated...
      XalanTransformer::ICUCleanUp();
      }
      catch(...)

      { cerr << "An unknown error occurred!" << endl; }

      return theResult;
      }

      XSL-file:
      ===========

      <?xml version="1.0" ?>
      <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
      <xsl:output method="xml" version="1.0"/>

      <xsl:template match="/">
      <xsl:variable name="org_doc"><xsl:value-of select="./questionnaire/current_response_doc"/></xsl:variable>
      <xsl:variable name="org" select="document($org_doc)"></xsl:variable>
      <xsl:variable name="upd" select="/"></xsl:variable>
      <xsl:variable name="upd_q_ids" select="$upd//question/@id"/>

      <xsl:element name="questionnaire">
      <xsl:attribute name="id"><xsl:value-of select="$upd/questionnaire/@id"/></xsl:attribute>
      <xsl:attribute name="questionnaire_session_id"><xsl:value-of select="$upd/questionnaire/@questionnaire_session_id"/></xsl:attribute>

      <respondent-tracking>
      <xsl:copy-of select="$org/questionnaire/respondent-tracking//posting"/>
      <xsl:copy-of select="$upd/questionnaire/posting"/>
      </respondent-tracking>

      <responses>
      <respondent_id><xsl:value-of select="$upd/questionnaire/responses/respondent_id"/></respondent_id>

      <xsl:copy-of select="$org//question[not(@id = $upd_q_ids)]"/>
      <xsl:copy-of select="$upd//question"/>
      </responses>

      </xsl:element>

      </xsl:template>

      </xsl:stylesheet>

      XML-file parsed in program:
      =============================

      <?xml version="1.0" encoding="UTF-8"?>
      <questionnaire id="1" questionnaire_session_id="1">
      <current_response_doc>response_org.xml</current_response_doc>
      <respondent-tracking>
      </respondent-tracking>
      <responses>
      <respondent_id>

      {aa-bcd-23-0}</respondent_id>
      <question id="{q-aa-4}">
      <answer id="{q-aa-4_a-1}">
      <text/>
      </answer>
      </question>
      </responses>
      </questionnaire>


      XML-file opened in XSL-sheet with 'document()' function
      ==========================================================
      <?xml version="1.0" encoding="UTF-8"?>
      <questionnaire id="1" questionnaire_session_id="1">
      <respondent-tracking>
      </respondent-tracking>
      <responses>
      <respondent_id>{aa-bcd-23-0}

      </respondent_id>
      <question id="

      {q-aa-5}

      ">
      <answer id="

      {q-aa-5_a-4}

      ">
      <text/>
      </answer>
      </question>
      </responses>
      </questionnaire>

      Call stack:
      ================
      > msvcr71d.dll!operator delete(void * pUserData=0x006a5d80) Line 52 + 0x51 C++
      xerces-c_2_6D.dll!120b1d10()
      Xalan-C_1_9D.dll!xalanc_1_9::XercesParserLiaison::reset() Line 140 + 0x28 C++
      Xalan-C_1_9D.dll!xalanc_1_9::XercesParserLiaison::~XercesParserLiaison() Line 116 C++
      Xalan-C_1_9D.dll!xalanc_1_9::XercesDOMParsedSourceHelper::~XercesDOMParsedSourceHelper() Line 60 + 0xb C++
      Xalan-C_1_9D.dll!xalanc_1_9::XercesDOMParsedSourceHelper::`vector deleting destructor'() + 0x57 C++
      Xalan-C_1_9D.dll!xalanc_1_9::XalanMemMgrAutoPtr<xalanc_1_9::XalanParsedSourceHelper,1>::MemMgrAutoPtrData::deallocate() Line 83 + 0x14 C++
      Xalan-C_1_9D.dll!xalanc_1_9::XalanMemMgrAutoPtr<xalanc_1_9::XalanParsedSourceHelper,1>::~XalanMemMgrAutoPtr<xalanc_1_9::XalanParsedSourceHelper,1>() Line 146 C++
      Xalan-C_1_9D.dll!xalanc_1_9::XalanTransformer::doTransform(const xalanc_1_9::XalanParsedSource & theParsedXML=

      {...}, const xalanc_1_9::XalanCompiledStylesheet * theCompiledStylesheet=0x0066ac38, const xalanc_1_9::XSLTInputSource * theStylesheetSource=0x00000000, const xalanc_1_9::XSLTResultTarget & theResultTarget={...}

      ) Line 1307 + 0x93 C++
      Xalan-C_1_9D.dll!xalanc_1_9::XalanTransformer::transform(const xalanc_1_9::XalanParsedSource & theParsedXML=

      {...}, const xalanc_1_9::XalanCompiledStylesheet * theCompiledStylesheet=0x0066ac38, const xalanc_1_9::XSLTResultTarget & theResultTarget={...}

      ) Line 188 C++
      Xalan19Transform.exe!main(int argc=3, char * * argv=0x003a6890) Line 104 + 0x5b C++
      Xalan19Transform.exe!mainCRTStartup() Line 398 + 0x11 C
      KERNEL32.DLL!7c59893d()

        Attachments

        1. patch.txt
          0.6 kB
          David N Bertoni
        2. Xalan19Transform.zip
          9 kB
          Rene van Hoek

          Activity

            People

            • Assignee:
              dbertoni David N Bertoni
              Reporter:
              rene_van_hoek Rene van Hoek
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: