[XERCESC-1919] Access violation in AbstractDOMParser::docComment()

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.0
• Fix Version/s: 3.1.1, 3.2.0
• Component/s: Non-Validating Parser
• Environment: Windows 7; Visual C++ 2008; Static manually built version of Xerces 3.1.0
• Assignee: Boris Kolpackov
• Reporter: Dmitriy V'jukov
• Created: 16/Apr/10 14:20
• Updated: 18/Apr/10 15:48
• Resolved: 18/Apr/10 15:48

Description

I parse an XML document with the following code:
XercesDOMParser parser;
parser.setCreateEntityReferenceNodes(false);
parser.setLoadExternalDTD(false);
parser.setLoadSchema(false);
parser.setSkipDTDValidation(true);
parser.setExitOnFirstFatalError(false);
MemBufInputSource source ((XMLByte const*)decoded.begin(), decoded.size(), L"");
parser.parse(source);

Parser crashes in:
void AbstractDOMParser::docComment(const XMLCh* const comment)
{
if (fCreateCommentNodes)

{ DOMComment *dcom = fDocument->createComment(comment); castToParentImpl (fCurrentParent)->appendChildFast (dcom); // <----- fCurrentParent == 0 fCurrentNode = dcom; }

}
with fCurrentParent == 0.

Current position of parser is line 233, column 17, i.e. straight after "<!-- Scripts -->"

Here is the XML document:

[attached as 'crash.xml']