[XALANC-463] Transforming an XML DOM document encapsulated within an XercesDOMWrapperParsedSource object triggers an invalid heap pointer exception if XSL opens other XML document with 'document()' function.

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.9
• Fix Version/s: CurrentCVS
• Component/s: XalanC
• Environment: Xerces 2.6 (9/30/2004); Xalan 1.9 (12/22/2004); Os: Windows 2000 Advanced Server; Compiler: Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 13.10.3077 for 80x86; Linker: Microsoft (R) Incremental Linker Version 7.10.3077
• Assignee: David N Bertoni
• Reporter: Rene van Hoek
• Created: 09/Mar/05 19:08
• Updated: 12/Aug/05 00:44
• Resolved: 10/Mar/05 06:54

Description

Transforming an XML DOM document encapsulated within an XercesDOMWrapperParsedSource object triggers an invalid heap pointer exception if XSL opens other XML document with 'document()' function.

The XML is parsed and stored in an XercesDOMWrapperParsedSource object.
The XSL style-sheet opens with the function 'document()' an other XML document.
The transformation itself goes ok. When the destructors are called, an 'delete' is deleting memory in a wrong heap.

The behaviour does not occur with Xalan 1.8
The behaviour does not occur when the XSL style-sheet does not open an other XML document.
The behaviour does not occur when the XML is not stored in an XercesDOMWrapperParsedSource object.

source-code:
=================

#include <xalanc/Include/PlatformDefinitions.hpp>

#if defined(XALAN_CLASSIC_IOSTREAMS)
#include <iostream.h>
#else
#include <iostream>
#endif

#include <xercesc/util/PlatformUtils.hpp>
#include <xercesc/parsers/XercesDOMParser.hpp>
#include <xercesc/dom/DOMDocument.hpp>

#include <xalanc/XalanTransformer/XalanTransformer.hpp>
#include <xalanc/XalanTransformer/XercesDOMWrapperParsedSource.hpp>
#include <xalanc/XalanTransformer/XalanParsedSource.hpp>

#include <xalanc/XercesParserLiaison/XercesParserLiaison.hpp>
#include <xalanc/XercesParserLiaison/XercesDOMSupport.hpp>

int
main(
int argc,
char* argv[])
{
XALAN_USING_STD(cerr)
XALAN_USING_STD(cout)
XALAN_USING_STD(endl)

if (argc < 3 || argc > 3)

{ cerr << "Usage: XalanTransform XMLFileName XSLFileName " << endl; return -1; }

int theResult = -1;

try
{
XALAN_USING_XERCES(XMLPlatformUtils)
XALAN_USING_XERCES(XercesDOMParser)
XALAN_USING_XERCES(DOMDocument)

XALAN_USING_XALAN(XalanTransformer)
XALAN_USING_XALAN(XercesParserLiaison)
XALAN_USING_XALAN(XercesDOMSupport)
XALAN_USING_XALAN(XercesDOMWrapperParsedSource)

XALAN_USING_XALAN(XalanParsedSource)
XALAN_USING_XALAN(XalanParsedSourceHelper)

// Call the static initializer for Xerces.
XMLPlatformUtils::Initialize();

// Initialize Xalan.
XalanTransformer::initialize();

{
DOMDocument* parsedXml = NULL;
XercesDOMParser parser;
parser.parse(argv[1]);

parsedXml = parser.getDocument();

XercesDOMSupport theDOMSupport;
XercesParserLiaison theLiaison(theDOMSupport);
XercesDOMWrapperParsedSource theSource(parsedXml, theLiaison, theDOMSupport);

// Create a XalanTransformer.
XalanTransformer theXalanTransformer;

// Do the transform.
theResult = theXalanTransformer.transform(theSource, argv[2], cout);

if(theResult != 0)

{ cerr << "Error: " << theXalanTransformer.getLastError() << endl; }

}

// Terminate Xalan...
XalanTransformer::terminate();

// Terminate Xerces...
XMLPlatformUtils::Terminate();

// Clean up the ICU, if it's integrated...
XalanTransformer::ICUCleanUp();
}
catch(...)

{ cerr << "An unknown error occurred!" << endl; }

return theResult;
}

XSL-file:
===========

<?xml version="1.0" ?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
<xsl:output method="xml" version="1.0"/>

<xsl:template match="/">
<xsl:variable name="org_doc"><xsl:value-of select="./questionnaire/current_response_doc"/></xsl:variable>
<xsl:variable name="org" select="document($org_doc)"></xsl:variable>
<xsl:variable name="upd" select="/"></xsl:variable>
<xsl:variable name="upd_q_ids" select="$upd//question/@id"/>

<xsl:element name="questionnaire">
<xsl:attribute name="id"><xsl:value-of select="$upd/questionnaire/@id"/></xsl:attribute>
<xsl:attribute name="questionnaire_session_id"><xsl:value-of select="$upd/questionnaire/@questionnaire_session_id"/></xsl:attribute>

<respondent-tracking>
<xsl:copy-of select="$org/questionnaire/respondent-tracking//posting"/>
<xsl:copy-of select="$upd/questionnaire/posting"/>
</respondent-tracking>

<responses>
<respondent_id><xsl:value-of select="$upd/questionnaire/responses/respondent_id"/></respondent_id>

<xsl:copy-of select="$org//question[not(@id = $upd_q_ids)]"/>
<xsl:copy-of select="$upd//question"/>
</responses>

</xsl:element>

</xsl:template>

</xsl:stylesheet>

XML-file parsed in program:
=============================

<?xml version="1.0" encoding="UTF-8"?>
<questionnaire id="1" questionnaire_session_id="1">
<current_response_doc>response_org.xml</current_response_doc>
<respondent-tracking>
</respondent-tracking>
<responses>
<respondent_id>

{aa-bcd-23-0}</respondent_id>
<question id="{q-aa-4}">
<answer id="{q-aa-4_a-1}">
<text/>
</answer>
</question>
</responses>
</questionnaire>


XML-file opened in XSL-sheet with 'document()' function
==========================================================
<?xml version="1.0" encoding="UTF-8"?>
<questionnaire id="1" questionnaire_session_id="1">
<respondent-tracking>
</respondent-tracking>
<responses>
<respondent_id>{aa-bcd-23-0}

</respondent_id>
<question id="

{q-aa-5}

">
<answer id="

{q-aa-5_a-4}

">
<text/>
</answer>
</question>
</responses>
</questionnaire>

Call stack:
================
> msvcr71d.dll!operator delete(void * pUserData=0x006a5d80) Line 52 + 0x51 C++
xerces-c_2_6D.dll!120b1d10()
Xalan-C_1_9D.dll!xalanc_1_9::XercesParserLiaison::reset() Line 140 + 0x28 C++
Xalan-C_1_9D.dll!xalanc_1_9::XercesParserLiaison::~XercesParserLiaison() Line 116 C++
Xalan-C_1_9D.dll!xalanc_1_9::XercesDOMParsedSourceHelper::~XercesDOMParsedSourceHelper() Line 60 + 0xb C++
Xalan-C_1_9D.dll!xalanc_1_9::XercesDOMParsedSourceHelper::`vector deleting destructor'() + 0x57 C++
Xalan-C_1_9D.dll!xalanc_1_9::XalanMemMgrAutoPtr<xalanc_1_9::XalanParsedSourceHelper,1>::MemMgrAutoPtrData::deallocate() Line 83 + 0x14 C++
Xalan-C_1_9D.dll!xalanc_1_9::XalanMemMgrAutoPtr<xalanc_1_9::XalanParsedSourceHelper,1>::~XalanMemMgrAutoPtr<xalanc_1_9::XalanParsedSourceHelper,1>() Line 146 C++
Xalan-C_1_9D.dll!xalanc_1_9::XalanTransformer::doTransform(const xalanc_1_9::XalanParsedSource & theParsedXML=

{...}, const xalanc_1_9::XalanCompiledStylesheet * theCompiledStylesheet=0x0066ac38, const xalanc_1_9::XSLTInputSource * theStylesheetSource=0x00000000, const xalanc_1_9::XSLTResultTarget & theResultTarget={...}

) Line 1307 + 0x93 C++
Xalan-C_1_9D.dll!xalanc_1_9::XalanTransformer::transform(const xalanc_1_9::XalanParsedSource & theParsedXML=

{...}, const xalanc_1_9::XalanCompiledStylesheet * theCompiledStylesheet=0x0066ac38, const xalanc_1_9::XSLTResultTarget & theResultTarget={...}

) Line 188 C++
Xalan19Transform.exe!main(int argc=3, char * * argv=0x003a6890) Line 104 + 0x5b C++
Xalan19Transform.exe!mainCRTStartup() Line 398 + 0x11 C
KERNEL32.DLL!7c59893d()