Bug #93496 for XML-LibXML: memory crash when validating XML against XSD

Mon Mar 03 17:05:21 2014 jeremystuartmarshall [...] gmail.com - Ticket created

Subject:	memory crash when validating XML against XSD
Date:	Tue, 4 Mar 2014 09:05:05 +1100
To:	bug-XML-LibXML [...] rt.cpan.org
From:	Jeremy Marshall <jeremystuartmarshall [...] gmail.com>

I have a bugwhich causes a memory fault when I try to validate a SOAP response against its XSD I fixed it with this commenting out part of the DESTROY handler for XML::LibXML::Element to sub DESTROY { my ($self) = @_; $self->__destroy_tiecache; #$self->SUPER::DESTROY; } I suspect this may cause other problems though This is going wrong on Debian using the deb package for wheezy and jessie. I also pulled the latest off CPAN perl version This is perl 5, version 14, subversion 2 (v5.14.2) built for x86_64-linux-gnu-thread-multi (with 88 registered patches, see perl -V for more detail) Copyright 1987-2011, Larry Wall Perl may be copied only under the terms of either the Artistic License or the GNU General Public License, which may be found in the Perl 5 source kit. Complete documentation for Perl, including FAQ lists, should be found on this system using "man perl" or "perldoc perl". If you have access to the Internet, point your browser at http://www.perl.org/, the Perl Home Page. uname -a Linux devtestcivm02 3.2.0-4-amd64 #1 SMP Debian 3.2.54-2 x86_64 GNU/Linux LibXML version perl -MXML::LibXML -e "print XML::LibXML->VERSION" 2.0108

Message body is not shown because sender requested not to inline it.

Tue Mar 04 03:07:23 2014 SHLOMIF [...] cpan.org - Correspondence added

Hi, thanks for the report, I'll try to look into it in the future. Regards, -- Shlomi Fish On Mon Mar 03 17:05:21 2014, jeremystuartmarshall@gmail.com wrote: Show quoted text

> I have a bugwhich causes a memory fault when I try to validate a SOAP > response against its XSD > > I fixed it with this commenting out part of the DESTROY handler for > XML::LibXML::Element > > to > > sub DESTROY > { > my ($self) = @_; > $self->__destroy_tiecache; > #$self->SUPER::DESTROY; > } > > I suspect this may cause other problems though This is going wrong on > Debian using the deb package for wheezy and jessie. I also pulled the > latest off CPAN > > > perl version > > This is perl 5, version 14, subversion 2 (v5.14.2) built for > x86_64-linux-gnu-thread-multi > > (with 88 registered patches, see perl -V for more detail) > > > Copyright 1987-2011, Larry Wall > > > Perl may be copied only under the terms of either the Artistic License or > the > > GNU General Public License, which may be found in the Perl 5 source kit. > > > Complete documentation for Perl, including FAQ lists, should be found on > > this system using "man perl" or "perldoc perl". If you have access to the > > Internet, point your browser at http://www.perl.org/, the Perl Home Page. > > uname -a > > Linux devtestcivm02 3.2.0-4-amd64 #1 SMP Debian 3.2.54-2 x86_64 GNU/Linux > > > LibXML version > > perl -MXML::LibXML -e "print XML::LibXML->VERSION" > > 2.0108

Tue Mar 04 03:07:24 2014 The RT System itself - Status changed from 'new' to 'open'

Tue Mar 04 15:29:04 2014 NWELLNHOF [...] cpan.org - Correspondence added

The validate method in XML::LibXML::Schema only works with whole documents (XML::LibXML::Document). libxml2 also provides xmlSchemaValidateOneElement but there are no bindings for this function in XML::LibXML. Nevertheless, the crash shouldn't happen. XML::LibXML's typemap needs more thorough type checking and should produce a comprehensible error message.

Tue Mar 04 17:03:13 2014 jeremystuartmarshall [...] gmail.com - Correspondence added

Subject:	Re: [rt.cpan.org #93496] memory crash when validating XML against XSD
Date:	Wed, 5 Mar 2014 09:03:03 +1100
To:	bug-XML-LibXML [...] rt.cpan.org
From:	Jeremy Marshall <jeremystuartmarshall [...] gmail.com>

I saw your message on SO about that. We are upgrading from LibXML 1.66 and it works there but a meaningful error is better if that is the way it is. We tried patching the code and building the deb package with the DESTROY commented out but it failed the test phase Thanks for the help On Wed, Mar 5, 2014 at 7:29 AM, Nick Wellnhofer via RT < bug-XML-LibXML@rt.cpan.org> wrote: Show quoted text

> <URL: https://rt.cpan.org/Ticket/Display.html?id=93496 > > > The validate method in XML::LibXML::Schema only works with whole documents > (XML::LibXML::Document). libxml2 also provides xmlSchemaValidateOneElement > but there are no bindings for this function in XML::LibXML. > > Nevertheless, the crash shouldn't happen. XML::LibXML's typemap needs more > thorough type checking and should produce a comprehensible error message. >

Fri Mar 07 12:43:47 2014 NWELLNHOF [...] cpan.org - Correspondence added

On Tue Mar 04 17:03:13 2014, jeremystuartmarshall@gmail.com wrote: Show quoted text

> I saw your message on SO about that. We are upgrading from LibXML 1.66 and > it works there but a meaningful error is better if that is the way it is.

It's possible that other versions of XML::LibXML don't crash and they might even produce a correct result but that's sheer luck. $schema->validate was never supposed to work with element nodes, only with documents. Show quoted text

> We tried patching the code and building the deb package with the DESTROY > commented out but it failed the test phase

If you mess with the DESTROY method, you'll only create a memory leak. The attached patch should fix this issue allowing to pass elements as well as documents to $schema->validate. Note that with the patch you have to pass the 'shiporder' to $schema->validate.

Subject:

rt93496.diff

diff -r 8367a85013f9 LibXML.xs --- a/LibXML.xs Wed Feb 26 13:46:32 2014 +0200 +++ b/LibXML.xs Fri Mar 07 18:42:59 2014 +0100 @@ -7472,18 +7472,18 @@ int -validate( self, doc ) +validate( self, node ) xmlSchemaPtr self - xmlDocPtr doc + xmlNodePtr node PREINIT: xmlSchemaValidCtxtPtr vctxt = NULL; PREINIT_SAVED_ERROR CODE: INIT_ERROR_HANDLER; - if (doc) { - PmmClearPSVI(doc); - PmmInvalidatePSVI(doc); + if (node->type == XML_DOCUMENT_NODE) { + PmmClearPSVI((xmlDocPtr)node); + PmmInvalidatePSVI((xmlDocPtr)node); } vctxt = xmlSchemaNewValidCtxt( self ); if ( vctxt == NULL ) { @@ -7498,7 +7498,13 @@ (xmlSchemaValidityWarningFunc)LibXML_error_handler_ctx, saved_error ); - RETVAL = xmlSchemaValidateDoc( vctxt, doc ); + if (node->type == XML_DOCUMENT_NODE) { + RETVAL = xmlSchemaValidateDoc(vctxt, (xmlDocPtr)node); + } + else { + RETVAL = xmlSchemaValidateOneElement(vctxt, node); + } + xmlSchemaFreeValidCtxt( vctxt ); CLEANUP_ERROR_HANDLER;

Thu Mar 13 14:13:56 2014 SHLOMIF [...] cpan.org - Correspondence added

On Fri Mar 07 12:43:47 2014, NWELLNHOF wrote: Show quoted text

> On Tue Mar 04 17:03:13 2014, jeremystuartmarshall@gmail.com wrote:

> > I saw your message on SO about that. We are upgrading from LibXML > > 1.66 and > > it works there but a meaningful error is better if that is the way it > > is.

> > It's possible that other versions of XML::LibXML don't crash and they > might even produce a correct result but that's sheer luck. $schema-

> >validate was never supposed to work with element nodes, only with

> documents. >

> > We tried patching the code and building the deb package with the > > DESTROY > > commented out but it failed the test phase

> > If you mess with the DESTROY method, you'll only create a memory leak. > The attached patch should fix this issue allowing to pass elements as > well as documents to $schema->validate. Note that with the patch you > have to pass the 'shiporder' to $schema->validate.

Thanks for the report and thanks Nick for the bug fix. Merged into the repository and it is going to be on CPAN soon. Marking as RESOLVED. Regards, -- Shlomi Fish

Thu Mar 13 14:13:57 2014 SHLOMIF [...] cpan.org - Status changed from 'open' to 'resolved'