[XERCESC-1470] segmentation fault in xerces 2.6.0 on this file for unknown reason

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 2.6.0
• Component/s: SAX/SAX2
• Environment: Debian 3.1 with patch for issues 1282 and 1421
• Assignee: Unassigned
• Reporter: Jay Berkenbilt
• Created: 04/Aug/05 08:17
• Updated: 22/Sep/05 01:55
• Resolved: 04/Aug/05 22:12

Description

Running SAX2Print on this file:

<t:a xmlns:t="T" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="T bug.xsd">
<t:b><i><e/></i></t:b>
<t:b><e a=""/></t:b>
</t:a>

with this schema:

<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:t="T" targetNamespace="T" elementFormDefault="qualified">
<xs:element name="a" type="t:A"/>
<xs:complexType name="B">
<xs:sequence>
<xs:any processContents="lax"/>
</xs:sequence>
</xs:complexType>
<xs:complexType name="A">
<xs:sequence>
<xs:element name="b" type="t:B" maxOccurs="2"/>
</xs:sequence>
</xs:complexType>
</xs:schema>

results in a segmentation fault with this stack trace:

#0 0x4017bce0 in xercesc_2_6::RefHashTableOf<xercesc_2_6::DTDAttDef>::findBucketElem () from /usr/lib/libxerces-c.so.26
#1 0x4017b9c1 in xercesc_2_6::RefHashTableOf<xercesc_2_6::DTDAttDef>::get ()
from /usr/lib/libxerces-c.so.26
#2 0x4017d028 in xercesc_2_6::DTDElementDecl::getAttDef ()
from /usr/lib/libxerces-c.so.26
#3 0x4019a212 in xercesc_2_6::IGXMLScanner::buildAttList ()
from /usr/lib/libxerces-c.so.26
#4 0x401a6da8 in xercesc_2_6::IGXMLScanner::scanStartTagNS ()
from /usr/lib/libxerces-c.so.26
#5 0x401a3332 in xercesc_2_6::IGXMLScanner::scanContent ()
from /usr/lib/libxerces-c.so.26
#6 0x401a1ee1 in xercesc_2_6::IGXMLScanner::scanDocument ()
from /usr/lib/libxerces-c.so.26
#7 0x40247150 in xercesc_2_6::XMLScanner::scanDocument ()
from /usr/lib/libxerces-c.so.26
#8 0x402471d9 in xercesc_2_6::XMLScanner::scanDocument ()
from /usr/lib/libxerces-c.so.26
#9 0x401cc66c in xercesc_2_6::SAX2XMLReaderImpl::parse ()
from /usr/lib/libxerces-c.so.26
#10 0x0804cc6c in main ()

I'm sorry that I don't have full debug information, but hopefully this will give a clue as to where this may be crashing. I have spent a few minutes trying to track it down, but have not been successful up to this point. I can try testing this problem with the current subversion HEAD, but I need to be able to maintain binary compatibility with 2.6.0, so a small patch would be most welcome. It's worth noting that no errors are reported when running this in 2.3.0. We do not have an installation of 2.4.0 or 2.5.0 to test with. Thanks.

Issue Links

• is duplicated by: XERCESC-1504 Access violation during parsing with schema validation turned on if a needed schema is missing.