[ python-Bugs-1296433 ] expat crash python

[SourceForge.net]

Bugs item #1296433, was opened at 2005-09-20 07:10
Message generated for change (Settings changed) made by bcannon
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1296433&group_id=5470

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: XML
Group: Python 2.4
>Status: Closed
>Resolution: Fixed
Priority: 6
Submitted By: Mike Rozhnov (rozhnov)
Assigned to: Brett Cannon (bcannon)
Summary: expat crash python

Initial Comment:
This simple script crash python.
Parsing of commented xml string work good.
(i.e. raised exception not crash python)
Buffer overflow during convertion to unicode?

Tested on Win XP and linux with kernel 2.4 with same
results.

----------------------------------------------------------------------

Comment By: Fred L. Drake, Jr. (fdrake)
Date: 2006-07-01 09:33

Message:
Logged In: YES 
user_id=3066

This is now fixed in the Expat CVS with lib/xmlparse.c
revisions 1.154 and 1.155.  I've merged these into the Expat
bundled with Python in revision 47191 (on the trunk), and
moved the crasher test into the tests for xml.parsers.expat.

I don't know when the next Expat release will go out yet,
but this will keep us from being dependent on that schedule.

----------------------------------------------------------------------

Comment By: Brett Cannon (bcannon)
Date: 2006-06-30 11:06

Message:
Logged In: YES 
user_id=357491

The fault is with Expat and not us.  I have submitted a bug
report with a possible patch at
http://sourceforge.net/tracker/index.php?func=detail&aid=1515266&group_id=10127&atid=110127
 .  I don't know what their turn-around time will be with
this so I will email python-dev to see how long people want
to wait on the Expat developers before we just push our own
patch for this.

----------------------------------------------------------------------

Comment By: Brett Cannon (bcannon)
Date: 2006-06-29 18:33

Message:
Logged In: YES 
user_id=357491

Still seems to be failing even with the Expat 2.0 upgrade in
HEAD.

----------------------------------------------------------------------

Comment By: Neal Norwitz (nnorwitz)
Date: 2005-11-12 12:53

Message:
Logged In: YES 
user_id=33168

I had recently upgraded to expat 1.95.8, so I was hopeful. 
But it still crashed for me on linux.  

I did get a better stack trace which allowed me to come up
with a patch that solves the problem and passes all the
tests.  The patch seems a bit odd and I think there might be
another problem going on here.  It would be great if someone
more familiar with xmlparse could take a look at the patch
and figure out if it's right or not.

----------------------------------------------------------------------

Comment By: Fredrik Lundh (effbot)
Date: 2005-11-12 03:05

Message:
Logged In: YES 
user_id=38376

Works for me under 2.3.2 (with expat 1.95.6) and 2.4.1 (with
expat 1.95.8).

Try upgrading your expat and see if the problem goes away.

----------------------------------------------------------------------

Comment By: Neal Norwitz (nnorwitz)
Date: 2005-09-22 14:54

Message:
Logged In: YES 
user_id=33168

I can reproduce on Linux with current CVS and expat
1.95.5-2.  Note the size of the data only needs to be
greater than 1024.

xml = "<?xml version='1.0' encoding='iso8859'?><s>%s</s>" %
('a' * 1025)

I am not certain this problem is specific to Python.  It
might be down in expat only.  Need to investigate further.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=1296433&group_id=5470