Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 197043 - dev-libs/expat: lib/xmlparse.c:doContent() doesn't check if the parser was stopped
Summary: dev-libs/expat: lib/xmlparse.c:doContent() doesn't check if the parser was st...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: New packages (show other bugs)
Hardware: AMD64 Linux
: High normal (vote)
Assignee: Freedesktop bugs
URL: http://sourceforge.net/tracker/index....
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-10-25 14:54 UTC by Santiago Gala
Modified: 2008-07-26 20:20 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
expat-2.0.1-check_stopped_parser.patch (expat-2.0.1-check_stopped_parser.patch,421 bytes, patch)
2007-10-29 22:40 UTC, Ali Polatel (RETIRED)
Details | Diff
expat-2.0.1-check_stopped_parser.patch (expat-2.0.1-check_stopped_parser.patch,412 bytes, patch)
2008-01-08 13:22 UTC, Ali Polatel (RETIRED)
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Santiago Gala 2007-10-25 14:54:16 UTC
python 2.5.1-* dumps core at test_pyexpat.py

-> 

$ python /usr/lib64/python2.5/test/test_pyexpat.py 
OK.
OK.
OK.
OK.
OK.
OK.
OK.
OK.
OK.
OK.
OK.
OK.
PI:
        'xml-stylesheet' 'href="stylesheet.css"'
Comment:
        ' comment data '
Notation declared: ('notation', None, 'notation.jpeg', None)
Unparsed entity decl:
        ('unparsed_entity', None, 'entity.file', None, 'notation')
Start element:
        'root' {'attr1': 'value1', 'attr2': 'value2\xe1\xbd\x80'}
NS decl:
        'myns' 'http://www.python.org/namespace'
Start element:
        'http://www.python.org/namespace!subelement' {}
Character data:
        'Contents of subelements'
End element:
        'http://www.python.org/namespace!subelement'
End of NS decl:
        'myns'
Start element:
        'sub2' {}
Start of CDATA section
Character data:
        'contents of CDATA section'
End of CDATA section
End element:
        'sub2'
External entity ref: (None, 'entity.file', None)
End element:
        'root'
PI:
        u'xml-stylesheet' u'href="stylesheet.css"'
Comment:
        u' comment data '
Notation declared: (u'notation', None, u'notation.jpeg', None)
Unparsed entity decl:
        (u'unparsed_entity', None, u'entity.file', None, u'notation')
Start element:
        u'root' {u'attr1': u'value1', u'attr2': u'value2\u1f40'}
NS decl:
        u'myns' u'http://www.python.org/namespace'
Start element:
        u'http://www.python.org/namespace!subelement' {}
Character data:
        u'Contents of subelements'
End element:
        u'http://www.python.org/namespace!subelement'
End of NS decl:
        u'myns'
Start element:
        u'sub2' {}
Start of CDATA section
Character data:
        u'contents of CDATA section'
End of CDATA section
End element:
        u'sub2'
External entity ref: (None, u'entity.file', None)
End element:
        u'root'
PI:
        u'xml-stylesheet' u'href="stylesheet.css"'
Comment:
        u' comment data '
Notation declared: (u'notation', None, u'notation.jpeg', None)
Unparsed entity decl:
        (u'unparsed_entity', None, u'entity.file', None, u'notation')
Start element:
        u'root' {u'attr1': u'value1', u'attr2': u'value2\u1f40'}
NS decl:
        u'myns' u'http://www.python.org/namespace'
Start element:
        u'http://www.python.org/namespace!subelement' {}
Character data:
        u'Contents of subelements'
End element:
        u'http://www.python.org/namespace!subelement'
End of NS decl:
        u'myns'
Start element:
        u'sub2' {}
Start of CDATA section
Character data:
        u'contents of CDATA section'
End of CDATA section
End element:
        u'sub2'
External entity ref: (None, u'entity.file', None)
End element:
        u'root'

Testing constructor for proper handling of namespace_separator values:
Legal values tested o.k.
Caught expected TypeError:
ParserCreate() argument 2 must be string or None, not int
Caught expected ValueError:
namespace_separator must be at most one character, omitted, or None
Segmentation fault


Reproducible: Always

Steps to Reproduce:
1. run python 2.5 tests
2. wait for the segfault
3. enjoy

Actual Results:  
segmentation fault

Expected Results:  
test either passes or fails

I tried to debug it with gdb, but couldn't find any way to make it emit a meaningful trace.
Comment 1 Jakub Moc (RETIRED) gentoo-dev 2007-10-25 15:09:25 UTC
emerge --info please.
Comment 2 Santiago Gala 2007-10-25 15:15:10 UTC
$ emerge --info
Portage 2.1.3.9 (default-linux/amd64/2007.0/desktop, gcc-4.2.2, glibc-2.5-r4, 2.6.23-hrt3 x86_64)
=================================================================
System uname: 2.6.23-hrt3 x86_64 Intel(R) Core(TM)2 CPU T7200 @ 2.00GHz
Timestamp of tree: Thu, 25 Oct 2007 04:30:09 +0000
app-shells/bash:     3.2_p17
dev-java/java-config: 1.3.7, 2.1.2-r1
dev-lang/python:     2.4.4-r6, 2.5.1-r3
dev-python/pycrypto: 2.0.1-r6
sys-apps/baselayout: 1.12.9-r2
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.23
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=nocona -O2 -pipe -ftree-vectorize"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/config /var/bind"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/splash /etc/terminfo /etc/texmf/web2c /etc/udev/rules.d"
CXXFLAGS="-march=nocona -O2 -pipe -ftree-vectorize"
DISTDIR="/usr/portage/distfiles"
FEATURES="distlocks metadata-transfer parallel-fetch sandbox sfperms strict unmerge-orphans userfetch"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo"
LANG="es_ES.UTF-8"
LDFLAGS="-Wl,-O1"
LINGUAS="es es_ES en"
MAKEOPTS=""
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/portage/local/layman/voip /usr/portage/local/layman/sunrise /usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X aac acl acpi aiglx alsa amd64 apache2 arts avahi avi bash-completion berkdb bitmap-fonts bluetooth bonjour cairo cdr cli cracklib crypt cups curl dbus dlloader dri dvd dvdr dvdread eds emboss encode esd evdev evo fam firefox fortran galago gdbm gif gnome gpm gstreamer gtk gtk2 hal iconv icu iproute2 ipv6 isdnlog java jpeg kde kdehiddenvisibility kerberos lcms ldap libg++ libnotify logrotate lucene mad midi mikmod mmx mono mouse mp3 mpeg mudflap ncurses nls nptl nptlonly nsplugin obex ogg opengl openmp oss pam pcre pdf pdflib perl png ppds pppd python qt3 qt3support qt4 quicktime readline reflection sdl session spell spl sse sse2 ssl svg tcpd theora threads tiff truetype truetype-fonts type1-fonts udev unicode v4l v4l2 vorbis xinerama xml xorg xrandr xv xvid zlib" ALSA_CARDS="hda-intel" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" DVB_CARDS="usb-wt220u" ELIBC="glibc" INPUT_DEVICES="synaptics mouse evdev keyboard" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="es es_ES en" USERLAND="GNU" VIDEO_CARDS="vesa i810 intel"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 3 Santiago Gala 2007-10-26 10:33:39 UTC
reopening as it seems to be needed after I attached --info...
Comment 4 Jakub Moc (RETIRED) gentoo-dev 2007-10-26 10:36:46 UTC
Try w/o -ftree-vectorize please, it's known to be broken.
Comment 5 Santiago Gala 2007-10-26 10:40:59 UTC
I did several times, same failure
Comment 6 Santiago Gala 2007-10-26 12:59:04 UTC
As an extra data point, python-2.4.4-r6 (last in emerge) passes all tests after being emerged recently with the same expat. I was prompted to report after last roundof python upgrades because I noticed that the segfault does not appear in 2.4.4-r6, but it does in all the 2.5* ebuilds I tried.
Comment 7 Santiago Gala 2007-10-26 13:35:52 UTC
more (interesting) data points:

$ diff -u /usr/lib64/python2.*/test/test_pyexpat.py 
--- /usr/lib64/python2.4/test/test_pyexpat.py   2007-10-25 11:27:28.000000000 +0200
+++ /usr/lib64/python2.5/test/test_pyexpat.py   2007-10-26 14:58:38.000000000 +0200
@@ -365,3 +365,24 @@
   <c/>
  </b>
 </a>''', 1)
+
+
+def test_parse_only_xml_data():
+    # http://python.org/sf/1296433
+    #
+    xml = "<?xml version='1.0' encoding='iso8859'?><s>%s</s>" % ('a' * 1025)
+    # this one doesn't crash
+    #xml = "<?xml version='1.0'?><s>%s</s>" % ('a' * 10000)
+
+    def handler(text):
+        raise Exception
+
+    parser = expat.ParserCreate()
+    parser.CharacterDataHandler = handler
+
+    try:
+        parser.Parse(xml)
+    except:
+        pass
+
+test_parse_only_xml_data()


python2.5 does not crash with 2.4 version, python2.4 crashes with 2.5 version of the test file.

http://bugs.python.org/issue1296433 <- quoted in the diff. See last two comments

I bet we are not using python's bundled expat in 2.5 (and have not patched our expat)
Comment 8 Santiago Gala 2007-10-29 21:44:20 UTC
Any progress on this one?

Just to mention that the reason it is not noticed in "plain" ebuilds is that it is one of the skipped tests due to portage interference, or so it says in the ebuild.

Comment 9 Ali Polatel (RETIRED) gentoo-dev 2007-10-29 22:40:05 UTC
Created attachment 134662 [details, diff]
expat-2.0.1-check_stopped_parser.patch

(In reply to comment #7)
[...]
> I bet we are not using python's bundled expat in 2.5 (and have not patched our
> expat)
> 
Yes,and the bug[1] is about expat.
In expat.c:doContext() the for loop in case XML_TOK_DATA_CHARS doesn't
check whether the parser was stopped during that call because of an error.
Upstream has fixed the issue in CVS[2], the attached patch fixes it for
expat-2.0.1.

[1]: http://sourceforge.net/tracker/index.php?func=detail&aid=1515266&group_id=10127&atid=110127
[2]: http://expat.cvs.sourceforge.net/expat/expat/lib/xmlparse.c?r1=1.153&r2=1.154
Comment 10 Ali Polatel (RETIRED) gentoo-dev 2007-10-29 22:47:44 UTC
Reassigning bug to freedesktop herd because this is a bug about expat.
About my previous comment the function is lib/xmlparse.c:doContent().
Comment 11 Santiago Gala 2008-01-08 10:40:13 UTC
Note that we are dumping core with the test case on python bug http://bugs.python.org/issue1296433

$ python /tmp/crash.py 
Before parsing
Violación de segmento

"Violación de segmento" is the stupid L10N message coming from libc for a SEGV. This means that we (our expat/our python) are showing the bug still
Comment 12 Ali Polatel (RETIRED) gentoo-dev 2008-01-08 13:22:27 UTC
Created attachment 140470 [details, diff]
expat-2.0.1-check_stopped_parser.patch

Updated patch which fixes that issue as well.
Comment 13 Ali Polatel (RETIRED) gentoo-dev 2008-07-26 12:49:51 UTC
ping
Comment 14 Arun Raghavan (RETIRED) gentoo-dev 2008-07-26 20:20:37 UTC
Fixed committed as 2.0.1-r1.