crash in 2.2.1 and hangs in 2.3.2

[Ritesh]

Hello,

I have been using 2.2.1 in my app and recently while parsing a 2MB xml file, TinyXML crashed. The problem is that the file is an invalid xml i.e. it has one node which does not end.

I know I should not send such data but it is what I get from another app.

Anyway, The crash comes in TiXMLBase::SkipWhiteSpace() function.

The XML is file is around 500KB in zip. If somebody wants to debug it then I will be glad to help him out.

Considering that this bug has been fixed in 2.3.2, I downloaded it and compiled it. Now in my app I have function like:

doc->Parse ( xml );

Now with 2.3.2, I was getting ::Parse() linkage error i.e. could not find a function with 3 arguments. I started investigating it and found if I change the following code:

    virtual const char* Parse(    const char* p,
                                TiXmlParsingData* data,
                                TiXmlEncoding encoding /*= TIXML_ENCODING_UNKNOWN */ ) = 0;

in TinyXMLBase definition in tinyxml.h to

    virtual const char* Parse(    const char* p,
                                TiXmlParsingData* data,
                                TiXmlEncoding encoding = TIXML_ENCODING_UNKNOWN ) = 0;

I can compile it correctly.

But the problem is that now whenever I call:

doc->Parse ( xml );

It just hangs there.

Even if xml is something like

char xml[] = "<xml v="4.0"><e_i></e_i><s_v>3.23.54</s_v><m_i></m_i><a_r>1</a_r><i_i>0</i_i>1<f_i c="1"><f><n>version()</n><t></t><m>7</m><d></d><ty>varchar</ty></f></f_i><r_i c="1"><r><c l="7">3.23.54</c></r></r_i></xml>"

Dont know what is the problem?

Can somebody provide a solution?

[Ritesh]

Update:

After more debugging - I found out that it is giving an ASSERT failure in:

TiXMLBase::SkipWhiteSpace()

in the following part:

        if ( isspace( *p ) || *p == '\n' || *p =='\r' )        // Still using old rules for white space.
            ++p;
        else
            break;

The assert is generated from the library function of isspace(). Now check the input I found out that the character to be tested was -92.

This data was sent by the external app which I send to TiXMLData to parse. So actually its a problem with isspace. Maybe before sending it to isspace you might do an error checking.

[mck9]

The ctype.h functions (isspace(), isdigit(), toupper(), etc. ) take ints for parameters and then treat them as unsigned chars -- leading to undefined behavior if the int passed is not representable as an unsigned char.  (EOF is negative but it is a special case).

Consequently the ints passed to these functions, except for EOF, should always be cast to unsigned char, unless it is already known by other means that they are in range.  Remember that plain char may be either signed or unsigned, depending on the implementation, so even plain char should be cast to unsigned char to be on the safe side.

I suggest that the tinyxml team scan the code for ctype.h functions and make sure that the appropriate casts are in place.

[Lee Thomason]

Could you post, to bugs, an XML file that causes the problem? I'll fix it in the next version.

thanks,
lee