In Expat 2.0.0, in expat.c:doConvert() there is a 'for'
loop for the XML_TOK_DATA_CHARS case. There is
unfortunately no check in that loop whether the parser
was stopped during that call because of an error.
This was discovered in Python
(Lib/test/crashers/xml_parsers.py) because pyexpat,
upon error where there is no error return code like
with characterDataHandlers, sets all handlers to 0,
sets parsingStatus to XML_FINISHED, and sets errorCode.
This leads to a segfault if the 'for' loop goes around
again because parser->m_characterDataHandler is set to 0.
A simple check if the parser is stopped fixes the
problem. I have attached a simple patch that just
breaks out of the loop and lets execution fall through
to the bottom of the 'switch' statement. I don't know
if returning errorCode directly would be better or if
checking for XML_SUSPENDED is also desirable.
Fred L. Drake, Jr.
None
Test Required
Public
|
Date: 2009-01-17 16:09 Comment for Fred: |
|
Date: 2008-05-24 23:50
|
|
Date: 2006-11-25 17:41
|
|
Date: 2006-07-10 19:02 Logged In: YES |
|
Date: 2006-07-06 17:19 Logged In: YES |
|
Date: 2006-07-06 17:03 Logged In: YES |
|
Date: 2006-07-06 12:56 Logged In: YES |
|
Date: 2006-07-06 05:15 Logged In: YES |
|
Date: 2006-07-06 03:23 Logged In: YES |
|
Date: 2006-07-06 02:55 Logged In: YES |
|
Date: 2006-07-06 02:38 Logged In: YES |
|
Date: 2006-07-05 13:26 Logged In: YES |
|
Date: 2006-07-05 13:14 Logged In: YES |
|
Date: 2006-07-04 13:37 Logged In: YES |
|
Date: 2006-07-01 15:32 Logged In: YES |
|
Date: 2006-07-01 15:02 Logged In: YES |
|
Date: 2006-07-01 04:00 Logged In: YES |
|
Date: 2006-06-30 18:40 Logged In: YES |
| Filename | Description | Download |
|---|---|---|
| localCharDataHandlerPatch.diff | Patch that preserves default handler logic | Download |
| expat_check_status.diff | Add check for stopped parser in 'for' loop in doConvert() | Download |
| Field | Old Value | Date | By |
|---|---|---|---|
| File Added | 184081: localCharDataHandlerPatch.diff | 2006-07-06 17:19 | kwaclaw |
| priority | 6 | 2006-07-06 05:15 | fdrake |
| summary | missing check of stopped parser in doContext() 'for' loop | 2006-07-05 13:26 | kwaclaw |
| resolution_id | None | 2006-07-05 13:14 | kwaclaw |
| resolution_id | Accepted | 2006-07-04 13:37 | kwaclaw |
| status_id | Closed | 2006-07-04 13:37 | kwaclaw |
| close_date | 2006-07-01 15:02 | 2006-07-04 13:37 | kwaclaw |
| close_date | - | 2006-07-01 15:02 | fdrake |
| status_id | Open | 2006-07-01 15:02 | fdrake |
| artifact_group_id | None | 2006-07-01 04:00 | fdrake |
| resolution_id | None | 2006-07-01 04:00 | fdrake |
| assigned_to | nobody | 2006-06-30 18:40 | fdrake |
| priority | 5 | 2006-06-30 18:40 | fdrake |
| File Added | 183470: expat_check_status.diff | 2006-06-30 18:04 | bcannon |
Copyright © 2010 Geeknet, Inc. All rights reserved. Terms of Use