6791 2009-04-08 14:04:13 +0000 Crash on generic XML file 2009-04-10 09:26:26 +0000 1 1 1 Unclassified Amaya XML unspecified PC Linux RESOLVED FIXED P2 normal --- 1 magnus.henoch+w3bugzilla carcone carcone emilien.kia fred.wang Irene.Vatton vincent.quint carcone oldest_to_newest 24622 0 681 magnus.henoch+w3bugzilla 2009-04-08 14:04:13 +0000 Created attachment 681 File that crashes Amaya I just compiled Amaya from CVS, and tried to open the attached XML file. This results in a segfault, with the following backtrace: #0 0xb71cd18a in strcmp () from /lib/libc.so.6 #1 0x08173cd4 in EndOfAttributeName (xmlName=0xa867328 "a|a") at ../../amaya/Xml2thot.c:3182 #2 0x08174b29 in Hndl_ElementStart (userData=0x0, name=0xa8894cf "b", attlist=0xa888a90) at ../../amaya/Xml2thot.c:4446 #3 0xb7f96aaa in ?? () from /usr/lib/libxmlparse.so.0 #4 0xb7f97fe9 in ?? () from /usr/lib/libxmlparse.so.0 #5 0xb7f94012 in XML_Parse () from /usr/lib/libxmlparse.so.0 #6 0x0816fb4e in XmlParse (infile=0xa880bb0, charset=UNDEFINED_CHARSET, xmlDec=0xbfffadeb, xmlDoctype=0xbfffadea) at ../../amaya/Xml2thot.c:5924 #7 0x08175760 in StartXmlParser (doc=1, fileName=0xa881c90 "/home/magnus/.amaya/1/foo.xml", documentName=0x9d61298 "foo.xml", documentDirectory=0x9d62260 "/home/magnus/.amaya/1", pathURL=0xa881640 "/tmp/foo.xml", withDec=false, withDoctype=false, useMath=false, externalDoc=false) at ../../amaya/Xml2thot.c:6087 #8 0x081480bf in LoadDocument (doc=1, pathname=0xa881640 "/tmp/foo.xml", form_data=0x0, initial_url=0x9d59550 "/tmp/foo.xml", method=8, tempfile=0xa881968 "", documentname=0x9d61298 "foo.xml", http_headers=0x0, history=false, inNewWindow=0xbfffbb77, realdocname=0x0) at ../../amaya/init.c:3878 #9 0x0814842c in GetAmayaDoc_callback (newdoc=1, status=0, urlName=0x9d61c10 "/tmp/foo.xml", outputfile=0x9d618e8 "", proxyName=0x0, http_headers=0x0, context=0x9d5aef8) at ../../amaya/init.c:4811 #10 0x081496c9 in GetAmayaDoc (urlname=0xbfffc668 "/tmp/foo.xml", form_data=0x0, doc=0, baseDoc=0, method=8, history=false, cbf=0, ctx_cbf=0x0) at ../../amaya/init.c:5323 #11 0x08149bd0 in CallbackDialogue (ref=37310, typedata=1, data=0x1 <Address 0x1 out of bounds>) at ../../amaya/init.c:5602 #12 0x0814bbee in OpenNewDocFromArgv (url=0x99c4998 "/tmp/foo.xml") at ../../amaya/init.c:7222 #13 0x0814e033 in InitAmaya (event=0xbfffce24) at ../../amaya/init.c:7130 #14 0x082f6678 in CallAction (notifyEvent=0xbfffce24, event=TteInit, pre=false, type=0, element=0x0, schStruct=0x0, attr=false) at ../../thotlib/dialogue/callback.c:174 #15 0x082f691b in CallEventType (notifyEvent=0xbfffce24, pre=false) at ../../thotlib/dialogue/callback.c:335 #16 0x083066fd in TtaMainLoop () at ../../thotlib/dialogue/interface.c:174 #17 0x080d959c in amaya_main (argc=2, argv=0x99c2610) at EDITORAPP.c:1667 #18 0x082a289b in AmayaApp::OnIdle (this=0x996f658, event=@0xbfffef38) at ../../thotlib/base/AmayaApp.cpp:463 #19 0xb744aaf1 in wxAppConsole::HandleEvent(wxEvtHandler*, void (wxEvtHandler::*)(wxEvent&), wxEvent&) const () from /usr/lib/libwx_baseu-2.8.so.0 #20 0xb74e9d2a in wxEvtHandler::ProcessEventIfMatches(wxEventTableEntryBase const&, wxEvtHandler*, wxEvent&) () from /usr/lib/libwx_baseu-2.8.so.0 #21 0xb74eaf44 in wxEventHashTable::HandleEvent(wxEvent&, wxEvtHandler*) () from /usr/lib/libwx_baseu-2.8.so.0 #22 0xb74eb04b in wxEvtHandler::ProcessEvent(wxEvent&) () from /usr/lib/libwx_baseu-2.8.so.0 #23 0xb77bd8d2 in wxAppBase::ProcessIdle() () from /usr/lib/libwx_gtk2u_core-2.8.so.0 #24 0xb770c8f3 in ?? () from /usr/lib/libwx_gtk2u_core-2.8.so.0 #25 0xb68e6a71 in ?? () from /usr/lib/libglib-2.0.so.0 #26 0xb68e89a8 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0 #27 0xb68ec063 in ?? () from /usr/lib/libglib-2.0.so.0 #28 0xb68ec582 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0 #29 0xb6ce2239 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0 #30 0xb77264f5 in wxEventLoop::Run() () from /usr/lib/libwx_gtk2u_core-2.8.so.0 #31 0xb77bd6be in wxAppBase::MainLoop() () from /usr/lib/libwx_gtk2u_core-2.8.so.0 #32 0xb77bd291 in wxAppBase::OnRun() () from /usr/lib/libwx_gtk2u_core-2.8.so.0 #33 0xb74846ba in wxEntry(int&, wchar_t**) () from /usr/lib/libwx_baseu-2.8.so.0 #34 0xb74848b7 in wxEntry(int&, char**) () from /usr/lib/libwx_baseu-2.8.so.0 #35 0x082a462b in main (argc=6357089, argv=0xa534670) at ../../thotlib/base/AmayaApp.cpp:51 24623 1 682 magnus.henoch+w3bugzilla 2009-04-08 14:07:28 +0000 Created attachment 682 Don't pass NULL to strcmp This patch makes Amaya load the file. Not sure if this is the right change; should UriName really be NULL here? 24643 2 Irene.Vatton 2009-04-10 09:26:26 +0000 (In reply to comment #0) > Created an attachment (id=681) [details] > File that crashes Amaya The main problem is that a prefix is used but it's not defined. Amaya won't crash when parsing that kind of document. 681 2009-04-08 14:04:13 +0000 2009-04-08 14:04:13 +0000 File that crashes Amaya foo.xml application/xml 79 magnus.henoch+w3bugzilla PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPGE6YSB4bWxuczphPSJhIj4K ICA8eiBhOmE9ImEiLz4KPC9hOmE+Cg== 682 2009-04-08 14:07:28 +0000 2009-04-08 14:07:28 +0000 Don't pass NULL to strcmp Xml2thot.c.patch text/plain 1175 magnus.henoch+w3bugzilla SW5kZXg6IGFtYXlhL1htbDJ0aG90LmMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQpSQ1MgZmlsZTogL3NvdXJjZXMvcHVi bGljL0FtYXlhL2FtYXlhL1htbDJ0aG90LmMsdgpyZXRyaWV2aW5nIHJldmlzaW9uIDEuNDc3CmRp ZmYgLWMgLXIxLjQ3NyBYbWwydGhvdC5jCi0tLSBhbWF5YS9YbWwydGhvdC5jCTcgQXByIDIwMDkg MTI6Mjc6MzggLTAwMDAJMS40NzcKKysrIGFtYXlhL1htbDJ0aG90LmMJOCBBcHIgMjAwOSAxNDox MDo1MiAtMDAwMApAQCAtMjgyLDcgKzI4MiwxMiBAQAogCiAgIHdoaWxlICghZm91bmQgJiYgQ3Vy cmVudFBhcnNlckN0eHQgIT0gTlVMTCkKICAgICB7Ci0gICAgICBpZiAoIXN0cmNtcCAoQ3VycmVu dFBhcnNlckN0eHQtPlVyaU5hbWUsIFRlbXBsYXRlX1VSSSkpCisgICAgICBpZiAoIUN1cnJlbnRQ YXJzZXJDdHh0LT5VcmlOYW1lKQorICAgICAgICB7CisgICAgICAgICAgLyogSWYgVXJpTmFtZSBp cyBOVUxMLCBub25lIG9mIHRoZSBiZWxvdyBjYXNlcyBjb3VsZCBtYXRjaC4KKyAgICAgICAgICAg ICBQcmV2ZW50IGEgc2VnZmF1bHQgYnkgbm90IGNvbXBhcmluZy4gKi8KKyAgICAgICAgfQorICAg ICAgZWxzZSBpZiAoIXN0cmNtcCAoQ3VycmVudFBhcnNlckN0eHQtPlVyaU5hbWUsIFRlbXBsYXRl X1VSSSkpCiAgICAgICAgIHsKICAgICAgICAgICAvKiBUZW1wbGF0ZXMgKi8KICAgICAgICAgICBp ZiAoIXN0cmNtcCAoKGNoYXIgKil1cmlOYW1lLCBUZW1wbGF0ZV9VUkkpIHx8CkBAIC0zMTc5LDcg KzMxODQsNyBAQAogICAgICAgICAgIGF0dHJOYW1lID0gKGNoYXIgKilUdGFTdHJkdXAgKChjaGFy ICopcHRyKTsKICAgICAgICAgICBpZiAoVW5rbm93bk5TKQogICAgICAgICAgICAgQ3VycmVudFBh cnNlckN0eHQgPSBOVUxMOwotICAgICAgICAgIGlmIChDdXJyZW50UGFyc2VyQ3R4dCAmJgorICAg ICAgICAgIGlmIChDdXJyZW50UGFyc2VyQ3R4dCAmJiBDdXJyZW50UGFyc2VyQ3R4dC0+VXJpTmFt ZSAmJgogICAgICAgICAgICAgICBzdHJjbXAgKChjaGFyICopbnNVUkksIChjaGFyICopQ3VycmVu dFBhcnNlckN0eHQtPlVyaU5hbWUpICYmCiAgICAgICAgICAgICAgIENoYW5nZVhtbFBhcnNlckNv bnRleHRCeVVyaSAobnNVUkkpKQogICAgICAgICAgICAgewo=