[Expat-bugs] [ expat-Bugs-707464 ] expat 1.95.6 raises "Access violation" on WinXP

[SourceForge.net]

Bugs item #707464, was opened at 2003-03-21 14:38
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110127&aid=707464&group_id=10127

Category: www.libexpat.org
Group: Platform Specific
Status: Open
Resolution: None
Priority: 5
Submitted By: Dragos Onac (dragos_o)
Assigned to: Fred L. Drake, Jr. (fdrake)
>Summary: expat 1.95.6 raises "Access violation" on WinXP

Initial Comment:
Running the "elements.c" example on a specific XML file 
causes the Access Violation message do be displayed, 
when the code is compiled without debug info. 

The "Acces violation" issue could also be reproduced  
using the dll from the win32 package.

I don't know how useful this is, but when 
running the "elements.c" example by compiling all the 
files with the NuMega Bounds Checker, the following 
erorr message is shown at line line 1511 of file 
xmlparse.c:
     "Expresion uses dangling pointer"
The line is:
   bufferEnd = buffer + (bufferEnd - bufferPtr) + keep;

(parser->m_bufferEnd-parser->m_bufferPtr)+keep 
equals 2048

Stack trace:
    main()->XML_Parse()->XML_GetBuffer()

Input file is attached.


----------------------------------------------------------------------

>Comment By: Dragos Onac (dragos_o)
Date: 2003-03-21 16:51

Message:
Logged In: YES 
user_id=270981

The file was something like

<?xml version='1.0'?>
<!DOCTYPE test [
<!ELEMENT test (#PCDATA) >

<!ENTITY cc "&bb;" >
<!ENTITY bb "&bb1;" >
<!ENTITY bb1 "&bb2;" >
<!ENTITY bb2 "&bb3;" >
<!ENTITY bb3 "&bb4;" >
<!ENTITY bb4 "test" >
]>
<test>&cc;</test>
Where every entity had about 60 references to the other one 
(bb1 for exemple had 60*&bb2;).
The test was intended to see how much time is needed for a 
file with a large amount of references. 
Seems that i've found the source of the problem... When 
switching the project preferences, the input file was not 
passed as argument and of course that a fopen() returned 
NULL and the associated fread() failed, causing AV
Sorry for the false alarm :(


----------------------------------------------------------------------

Comment By: Karl Waclawek (kwaclaw)
Date: 2003-03-21 16:33

Message:
Logged In: YES 
user_id=290026

I could not reproduce this.
How exactly did you trigger the AV?
What file did you use?

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110127&aid=707464&group_id=10127