blunderer / libroxml Goto Github PK

What steps will reproduce the problem?
1. compile the poc.c program below. The program creates a node whose content is 
an empty string then it deletes it. 
2. execute - the program crashes on a double-free

What is the expected output? What do you see instead?

No output is expected - the program shall run flawlessly. The issue only arise 
when the not-that-empty node is deleted - this can happen when one calls 
roxml_del_node on the node itself or on one of its parent, or when the user 
calls roxml_close() to release the XML document.

Output with v2.2.0:

*** glibc detected *** ./poc: double free or corruption (fasttop): 
0x000000000169b010 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x75b46)[0x7f9fbfe02b46]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x6c)[0x7f9fbfe0787c]
/usr/lib/libroxml.so.0(roxml_free_node+0x68)[0x7f9fc01191b8]
./poc[0x40068b]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd)[0x7f9fbfdabead]
./poc[0x400599]
======= Memory map: ========
00400000-00401000 r-xp 00000000 08:01 6429172                            
/home/edt/bugs/roxml_add_node/poc
00600000-00601000 rw-p 00000000 08:01 6429172                            
/home/edt/bugs/roxml_add_node/poc
0169b000-016bc000 rw-p 00000000 00:00 0                                  [heap]
7f9fb8000000-7f9fb8021000 rw-p 00000000 00:00 0 
7f9fb8021000-7f9fbc000000 ---p 00000000 00:00 0 
7f9fbfb77000-7f9fbfb8c000 r-xp 00000000 08:01 3408073                    
/lib/x86_64-linux-gnu/libgcc_s.so.1
7f9fbfb8c000-7f9fbfd8c000 ---p 00015000 08:01 3408073                    
/lib/x86_64-linux-gnu/libgcc_s.so.1
7f9fbfd8c000-7f9fbfd8d000 rw-p 00015000 08:01 3408073                    
/lib/x86_64-linux-gnu/libgcc_s.so.1
7f9fbfd8d000-7f9fbff0a000 r-xp 00000000 08:01 3407902                    
/lib/x86_64-linux-gnu/libc-2.13.so
7f9fbff0a000-7f9fc010a000 ---p 0017d000 08:01 3407902                    
/lib/x86_64-linux-gnu/libc-2.13.so
7f9fc010a000-7f9fc010e000 r--p 0017d000 08:01 3407902                    
/lib/x86_64-linux-gnu/libc-2.13.so
7f9fc010e000-7f9fc010f000 rw-p 00181000 08:01 3407902                    
/lib/x86_64-linux-gnu/libc-2.13.so
7f9fc010f000-7f9fc0114000 rw-p 00000000 00:00 0 
7f9fc0114000-7f9fc0120000 r-xp 00000000 08:01 3670469                    
/usr/lib/libroxml.so.0
7f9fc0120000-7f9fc0320000 ---p 0000c000 08:01 3670469                    
/usr/lib/libroxml.so.0
7f9fc0320000-7f9fc0321000 rw-p 0000c000 08:01 3670469                    
/usr/lib/libroxml.so.0
7f9fc0321000-7f9fc0341000 r-xp 00000000 08:01 3408116                    
/lib/x86_64-linux-gnu/ld-2.13.so
7f9fc0518000-7f9fc051b000 rw-p 00000000 00:00 0 
7f9fc053e000-7f9fc0540000 rw-p 00000000 00:00 0 
7f9fc0540000-7f9fc0541000 r--p 0001f000 08:01 3408116                    
/lib/x86_64-linux-gnu/ld-2.13.so
7f9fc0541000-7f9fc0542000 rw-p 00020000 08:01 3408116                    
/lib/x86_64-linux-gnu/ld-2.13.so
7f9fc0542000-7f9fc0543000 rw-p 00000000 00:00 0 
7fff5ccb9000-7fff5ccda000 rw-p 00000000 00:00 0                          [stack]
7fff5cd3e000-7fff5cd3f000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  
[vsyscall]
Abandon

The backtrace says

Program received signal SIGABRT, Aborted.
0x00007ffff787b475 in *__GI_raise (sig=<optimized out>) at 
../nptl/sysdeps/unix/sysv/linux/raise.c:64
64  ../nptl/sysdeps/unix/sysv/linux/raise.c: Aucun fichier ou dossier de ce type.
(gdb) bt
#0  0x00007ffff787b475 in *__GI_raise (sig=<optimized out>) at 
../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff787e6f0 in *__GI_abort () at abort.c:92
#2  0x00007ffff78b52fb in __libc_message (do_abort=<optimized out>, 
fmt=<optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#3  0x00007ffff78beb46 in malloc_printerr (action=3, str=0x7ffff79956e0 "double 
free or corruption (fasttop)", ptr=<optimized out>) at malloc.c:6283
#4  0x00007ffff78c387c in *__GI___libc_free (mem=<optimized out>) at 
malloc.c:3738
#5  0x00007ffff7bd51b8 in roxml_free_node (n=0x601030) at 
src/roxml-internal.c:108
#6  0x000000000040068b in main () at poc.c:6

The poc.c program
---------8<---------------------------------------------
#include <roxml.h>

int main()
{
    node_t *root = roxml_add_node(NULL, 0, 
        ROXML_ELM_NODE, "root", "");
    roxml_del_node(root);
    return 0;
}
---------8<---------------------------------------------

Firstly this may be similar to issue #15 which is reported closed, however it 
is occurring on v 2.2.0. I've attached a test snippet that shows the issue. 
Change the #define XML to see the difference:

make install fails reports errors when doxygen is not installed, as seen in the 
output below (seen on Ubuntu 11.04).

sronsse@ADCSEAL121:~/personal/libroxml$ sudo make install
  DOXYGEN
make: [doxy] Error 127 (ignored)
cp: cannot create regular file `docs/html/': Is a directory
make: [doxy] Error 1 (ignored)
cp: cannot create regular file `docs/html/': Is a directory
make: [doxy] Error 1 (ignored)
  MAN
make: [doxy] Error 127 (ignored)
rm: cannot remove `docs/man/man3/*_inc_.3': No such file or directory
make: [doxy] Error 1 (ignored)
  INSTALL DIRS
  INSTALL FILES
sronsse@ADCSEAL121:~/personal/libroxml$

In roxml.h, for example, there are two code examples (in comments) that refer 
to ROXML_ALL_NODES.  These don't compile as is, because the actual define is 
ROXML_ALL_NODE.  (Although the plural makes more sense.)
I also see the problem at the documentation of the functions via 
http://www.libroxml.net/public-api.html (which I suppose is derived from the .h 
file).

What version of the product are you using? On what operating system?
2.2.2.  Windows XP.

Please provide any additional information below.

The libroxml can't parse the following:

<CLISH_MODULE xmlns="http://clish.sourceforge.net/XMLSchema" 
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
 xsi:schemaLocation="http://clish.sourceforge.net/XMLSchema
                     http://clish.sourceforge.net/XMLSchema/clish.xsd">

It fails to parse xmlns:xsi. When libroxml parser find xmlns and next colon it 
set STATE_INSIDE_ARG_BEG but the arg doesn't really begin yet. It's still a 
attribute name.

See the patch in attach.

What steps will reproduce the problem?
2. Compile the program provided in the archive. This program displays nodes and 
attributes found in two files: types-invalid.xml and types-valid.xml.
3. Execute the ./reader program

What is the expected output? What do you see instead?
The output from types-invalid.xml shows some errors (a missing element and a 
borked attribute) while the output from types-valid.xml shows no error. The 
only difference between these two files is line 54:

--- types-invalid.xml   2012-05-15 11:50:51.610646358 +0200
+++ types-valid.xml 2012-05-15 12:04:12.098629931 +0200
@@ -51,7 +51,7 @@
        help="A.B.C.D[/mask] or any"/>
    <!--=======================================================-->
    <PTYPE name="PORT_MASK_ANY"
-       pattern='^(([0-9]+(/0x[0-9a-f]+)?)|(any))$'
+       pattern="^(([0-9]+(/0x[0-9a-f]+)?)|(any))$"
        help="Port[/mask]" />
    <!--=======================================================-->
    <PTYPE name="SEQ"

Single quotes on the definition of pattern has been replaced by double quotes. 
It seems that the parser fails to correctly process single-quoted attributes 
(as per http://www.w3.org/TR/2008/REC-xml-20081126/#sec-common-syn rule [10], 
both single and double quotes are valid to define an attribute value). 

See the patch that adds .gitignore file.

What steps will reproduce the problem?
1. Given the XML file
<?xml version="1.0"?>
<root>
  <node>
    <name>first</name>
    <data>1</data>
  </node>
  <node>
    <name>second</name>
    <data>2</data>
  </node>
</root>

2. And the query
roxml file.xml '//node[name!=first]/data'

3. We get the following answer: 
ans[0]: 1

What is the expected output? What do you see instead?
We shall get:
ans[0]: 2

What version of the product are you using? On what operating system?
trunk/r249

Please provide any additional information below.
There are two sites where strings are compared while evaluating an XPATH 
condition:
 * in roxml_validate_predicate()
 * in roxml_validate_axes()
In both sites, when the function to operate is ROXML_FUNC_STRCOMP, we only 
consider the result of strcmp(sarg1,sarg2) without considering the operator 
that has been choosen by the user. Thus, these operations:

 * XX!=string
 * XX<=string
 * XX>=string
 * XX<string
 * XX>string

Are all equivalent to XX=string. 

The proposed patch introduces roxml_string_cmp() which is built on the model of 
roxml_double_cmp() (used to compare numbers). The new function is used instead 
of strcmp() when we're comparing two strings in the context of an XPATH 
condition validation.

Eg xml:

<?xml version="1.0"?>
<test>
   Hello world
</test>


the xpath query /test/text() will fail (return 0 nodes)
but:
?xml/test/text() DOES work

Content from attributes still has quotes.

Eg:
<note attr="test">
</note>

calling roxml_get_attr(node, "attr") to get attribute then
roxml_get_content() on the result will return 

"test" instead of just

test

Run roxml executable with the attached input.

Command line: roxml config.xml /

XML recommendations says: "XML documents SHOULD begin with an XML declaration 
(something like <?xml version="1.0" encoding="UTF-8"?>) which specifies the 
version of XML being used".

So the declaration is strongly recommended but not mandatory. The libroxml 
doesn't parse XML files without XML declaration.

What steps will reproduce the problem?
The problem occurs when creating a xml file from scratch.

1. Create a first node with standard header
pTmpND = roxml_add_node( NULL, 0, ROXML_PI_NODE, "xml","version=\"1.0\" 
encoding=\"UTF-8\"" );

2.Then create the "real" root node
roxml_add_node( pTmpND, 0, ROXML_ELM_NODE, "myRoot", NULL );

3.Commit
roxml_commit_changes( pTmpND, "myPath", NULL, 1 );

The file content should look like this:
<?xml version="1.0" encoding="UTF-8"?>
<myRoot/>

4.Now reload
pTmpND = roxml_load_doc( "myPath" );

The root node should be "myRoot", because the header line isn't considered as 
the root node of an xml document.

5.Add a final child node and commit
roxml_add_node( pTmpND, 0, ROXML_ELM_NODE, "bla" );
roxml_commit_changes( pTmpND, "myPath", NULL, 1 );

What is the expected output? What do you see instead?
Normaly, the file should look like this:
<?xml version="1.0" encoding="UTF-8"?>
<myRoot>
<bla/>
</myroot>

But the header is now corrupted, sometimes the hole file

What version of the product are you using? On what operating system?
Using official git trunk on linux 2.6....

Additional question:
********************
Is it possible to provide a function which adds a standard header on an 
existing root node? It's a bit confusing that, when creating, the standard 
header line is considered as the root node and when loading, the root is the 
document root. Or do I miss something?
But by the way, this is a really cool project which helps me a lot. Thank you.

We should create a function node_t* roxml_goto(char * path) that returns a
node at the end of the path.

int i=0;
if(*buf){
int pos=*offset+lvl;
/////////////////////////////
if(pos<0)
    return;
/////////////////////////////
....
....
....

What steps will reproduce the problem?
1. Allocate a node_t with a string of data longer than 512 bytes 
(ROXML_LONG_LEN)
2. Serialize the node_t to an XML string
3. The realloc() will allocate too little additional, yet the sprintf will 
still write the whole string, clobbering memory.

What is the expected output? What do you see instead?


What version of the product are you using? On what operating system?
SVN Trunk

Please provide any additional information below.

Patch attached which fixes this issue. There is another realloc() in the 
write_space method above this one, but as it only writes 1 char at a time it is 
not affected.

What steps will reproduce the problem?
1. run roxml_get_content on a ROXML_ATTR_NODE such as <node attr="val">
2. the returned value contains the quotes!

What is the expected output? What do you see instead?
-----------------------------------------------------
value shall not be returned with their quotes.

What version of the product are you using? On what operating system?
trunk

Please provide any additional information below.
------------------------------------------------
Seeing your unit tests, I understand the cause of this: you're not following 
the XML specification: XML mandates the use of quotes around attribute values.

the spec is at: http://www.w3.org/TR/REC-xml/#sec-common-syn
specifically, the syntax rule for an attribute value is :

[10] AttValue ::= '"' ([^<&"] | Reference)* '"'
               |  "'" ([^<&'] | Reference)* "'"

the double or simple quotes are explicit.

So you could have a mode where you allow the parser to recognize attribute 
values without quotes, but this shall not be the default.

this is an important bug.

What is your opinion on how to solve that?

Regards

What steps will reproduce the problem?
1. read documentation about roxml_commit_changes
2. see params description:  (node_t *n, char *dest, char **buffer, int human) 
3. profit!

What is the expected output? What do you see instead?
I expect a description of each parameter:
n: the root node to dump
dest: ??? where the tree will be stored - if so, where is the buffer len to 
prevent buffer overflows?
buffer: ??? memory where the tree is written? allocated by the lib?
human: introduce newlines and indentatin so that an user can read the file

What version of the product are you using? On what operating system?
svn trunk, no OS required

Please provide any additional information below.
If that's already planned, just proceed.

I intend to use your library instead of xml2 because it exactly fits my needs 
(node creation would be a plus), and I may contribute to it. But I need more 
documentation.

Thanks

What steps will reproduce the problem?
1. find the type of an XML element
2. call roxml_get_type() on this node
3. we get ROXML_STD_NODE

What is the expected output? What do you see instead?

the ROXML_STD_NODE shall be named ROXML_ELM_NODE or something like that.

What version of the product are you using? On what operating system?

SVN trunk

Please provide any additional information below.

In "classic" XML syntax, a standard node is an XML Element.
Using ROXML_ELM_NODE (or ROXML_ELEMENT_NODE) would be more consistent with the 
other defines ROXML_ATTR_NODE, ROXML_TXT_NODE, etc.

That could be done by adding an alias to the existing define (and possibly 
declare it deprecated) or by renaming the define (that would break the API)

I'm currently porting a libxml based program to your lib, thanks for it.

roxml_load_xxx does not return a pointer to the root element. It also contains 
information about (I suppose) processing instructions. That's not quite easy.

I found the following function useful, you can add it to the lib if you like it 
(for the moment it's included in my main source).

If you know a way to return the root instead of the first element, that's even 
better.
---------------------
node_t * roxml_get_root_elem(node_t *doc)
    {
    node_t *    child;
    int         i;
    int         n;

    //the only child of a document is named "?xml"
    doc = roxml_get_chld(doc, NULL, 0);

    //look inside the ?xml element.
    n = roxml_get_chld_nb(doc);

    for(i=0; i!=n; i++)
        {
        child = roxml_get_chld(doc, NULL, i);
        if(roxml_get_type(child)==ROXML_ELM_NODE)
            {
            return child;
            }
        }

    return NULL;
    }

Do you plan to add node creation routines to the public API?

we're glad to have a roxml_add_node, but there is no roxml_create_element, 
roxml_set_attribute, roxml_create_text, etc...

is it planned?

regards

I think I use the lib in right way, but when the loop ended, the memory has 
used about 90MB .
I add some debug info into roxml_create_node ,roxml_close_node 
,roxml_free_node. I find roxml_create_node is called 6 times, but 
roxml_close_node and roxml_free_node are just called 5 times. I have not 
loctated the missing free() code.

I am using 2.2.1 version on VC6.0.

test code as follow:

#include <stdio.h>
#include "inc/roxml.h"
char* xmlbuff = "<root>hghg</root>";
int main(void)
{

    node_t *root = NULL;
    int i;

    for (i = 0; i < 1000000; i++)
    {

        root = roxml_load_buf(xmlbuff);
        roxml_release(RELEASE_ALL);
        roxml_close(root);
    }
    printf("end!");
    getch();
    return 0;
}

What steps will reproduce the problem?
1. download libroxml-2.0.1
2. create msvc project
3. import libroxml files
4. build
5. .....
6. do not profit :(

What is the expected output? What do you see instead?
I expected correct compilation.
I get lots of variables defined in the middle of instruction blocks. msvc 
really dislikes that.

What version of the product are you using? On what operating system?
2.0.1

Please provide any additional information below.
That's a portability issue; gcc is too nice (I had the same problems with a 
project of mine)

Please apply the following patch to fix compilation on msvc.

What steps will reproduce the problem?
1.
create an internal root with "roxml_add_node" without calling 
"roxml_commit_changes"
2.
run any search with "roxml_xpath", e.g. "*"
3.

What is the expected output? What do you see instead?
NULL or nodetable

What version of the product are you using? On what operating system?
libroxml 2.1.2, Linux 2.6.24

Please provide any additional information below.

What steps will reproduce the problem?
1. run roxml test.xml /ul

What is the expected output? What do you see instead?

expected output is 

ans[0]:li
...
ans[0]:li (21 times)  

but I get 

ans[0]:li
...
ans[0]:li (15 times)  
ans[0]:div 

What version of the product are you using? On what operating system?

latest version (2.12) on fedora core 16 & android 2.3.1 (same results on both 
systems). 

Please provide any additional information below.

no additional info. 

when NULL is passed to roxml_get_contents, the buffer is filled with "" but the 
*size param is not set to zero and NULL is returned. That's weird.

Option 1: do not store anything in the buffer and return NULL

Option 2: store "" in the buffer, set size to zero and return buffer instead of 
NULL

what do you think?

(PS: do you prefer tickets so that you can update your source, or a patch that 
fixes everything I find at once?)

Makefile uses
&>/dev/null
It's a bashism.
Some other shells (like dash) don't understand it and send process to the 
background.

See the patch in the attachment.

> What steps will reproduce the problem?
1. create an xml file that contains

<?xml version="1.0">
<root>
  <tag>
    <px>1</px>
    <fx>2</fx>
    <ax>3</ax>
    <ox>4</ox>
    <lx>5</lx>
    <xx>6</xx>
  </tag>
</root>

2. Build the roxml tool
3. Issue the following commands:

~$ roxml simple.xml '//tag[px=1]/px' ; roxml simple.xml '//tag[fx=2]/fx' ; 
roxml simple.xml '//tag[ax=3]/ax' ; roxml simple.xml '//tag[ox=4]/ox' ; roxml 
simple.xml '//tag[lx=5]/lx' ;  roxml simple.xml '//tag[xx=6]/xx'

> What is the expected output? What do you see instead?

We should get: 
Ans[0] = 1
Ans[0] = 2
Ans[0] = 3
Ans[0] = 4
Ans[0] = 5
Ans[0] = 6

But we get only: 
Ans[0] = 6

The first 5 command prints nothing although all of them are valid. 

> What version of the product are you using? On what operating system?
libroxml 2.1.1 on Linux 3.0

> Please provide any additional information below.

The problem is due to the parser, and specifically to how ctx->shorten_cond is 
used in the _func_xpath_xxx functions for xxx == { position, first, 
condition_and, condition_or, last }. 

When a opening bracket [ is found outside a quoted text, shorten_cond is set to 
one. This is used by _func_xpath_default to fetch the full condition (up to ]), 
which is then processed once we found the ending bracket ]. 

But when the very first character found after the opening [ is one of "pfoal" 
(the first char of the related XPATH function name), shorten_cond is set to 0 
unconditionnally, even if the rest of the string do not match the XPATH 
function name. In this case, the function returns 0, so we end up calling 
_func_xpath_default() - but then, ctx->shorten_cond is no longer set to != 0 
and we do not process the condition correctly. 

My own fix was to modify the few lines where ctx->shorten_cond was set to 0 in 
the aforementionnned functions, and to conditionnaly do this operation when cur 
was not 0 (meaning that we found the function name). See the attached patch for 
further information.

What steps will reproduce the problem?
1. Build libroxml on msvc, winxp
2. build...
3. .....
4. do not profit again

What is the expected output? What do you see instead?
Clean compilation. I get these warnings:

%ROOT%\libroxml-2.0.1\src\roxml-internal.c(458) : warning C4244: '=' : 
conversion from 'double' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(460) : warning C4244: '=' : 
conversion from 'int' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(462) : warning C4244: '=' : 
conversion from 'int' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(468) : warning C4244: '=' : 
conversion from 'int' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(470) : warning C4244: '=' : 
conversion from 'int' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(472) : warning C4244: '=' : 
conversion from 'int' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(475) : warning C4244: '=' : 
conversion from 'double' to 'int', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(476) : warning C4244: 'function' : 
conversion from 'int' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(484) : warning C4244: '=' : 
conversion from 'int' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(486) : warning C4244: '=' : 
conversion from 'int' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(489) : warning C4244: '=' : 
conversion from 'double' to 'int', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(490) : warning C4244: 'function' : 
conversion from 'int' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(498) : warning C4244: '=' : 
conversion from 'double' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(500) : warning C4244: '=' : 
conversion from 'double' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(502) : warning C4244: '=' : 
conversion from 'double' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(742) : warning C4244: '=' : 
conversion from 'double' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(744) : warning C4244: '=' : 
conversion from 'double' to 'float', possible loss of data
%ROOT%\libroxml-2.0.1\src\roxml-internal.c(746) : warning C4244: '=' : 
conversion from 'double' to 'float', possible loss of data


What version of the product are you using? On what operating system?
2.0.1 on wixp with patch from issue 5

Please provide any additional information below.
Can you fix your mind with that point? My suggestion is to declare as double 
and cast as appropriate.

Regards and thanks for your lib.

What steps will reproduce the problem?
1. Open a xml file created via "svn info --xml" on windows
2. Try to get the file's nodes

What is the expected output? What do you see instead?

See example.c in the attached file


What version of the product are you using? On what operating system?

2.2.0 on windows

Please provide any additional information below.

First of all, English is not my native language.

The attached file contains a file named example.c, who reads example.xml
(a file created via "svn info --xml" on windows), but the nodes are read 
incorretly. The same code works on linux with the same file example.xml.
I corrected the error modificating the mode to open the file in 
roxml_load_doc(). 
I changed "r" to "rb". With this modification the code works both windows and 
linux. The original xml file that gave me problems is attached (original.xml).

What steps will reproduce the problem?
1. In a memory limited environment (<64Ko) opening will file fail.
2. By reducing INTERNAL_BUF_SIZE openning a buffer is possible.
3. In a memory limited environment (<64Ko) xpath will file fail.

What is the expected output? What do you see instead?
Context of functions include array that are too big (buffer), it leads to stack 
overflow.
It would be better to malloc and free these buffer instead. (memory will be 
taken in the heap and not in the stack)

What version of the product are you using? On what operating system?
libroxml 2.1.2 on µC/OS 2.86

Please provide any additional information below.

What steps will reproduce the problem?
1. The proof of concept belows outines the issue. 
2. compile the programme : gcc -o poc poc.c -l roxml
3. execute it - its segfaults

What is the expected output? What do you see instead?

The program shall output "root", but it crashes instead. 

The problem comes from the fact that roxml_validate_axes() is called 
to validate the parent of the root node - and this parent is NULL. 

The backtrace: 

Program received signal SIGSEGV, Segmentation fault.
roxml_validate_axes (root=0x601010, candidat=0x0, ans=0x7fffffffe1a0, 
nb=0x7fffffffe210, max=0x7fffffffe1ac, xn=0x601a90, req_id=16) at 
src/roxml-internal.c:890
890             if(xn->abs) {
(gdb) bt
#0  roxml_validate_axes (root=0x601010, candidat=0x0, ans=0x7fffffffe1a0, 
nb=0x7fffffffe210, max=0x7fffffffe1ac, xn=0x601a90, req_id=16) at 
src/roxml-internal.c:890
#1  0x00007ffff7bd8380 in roxml_check_node (xp=<optimized out>, root=0x601010, 
context=0x601010, ans=0x7fffffffe1a0, nb=0x7fffffffe210, max=0x7fffffffe1ac, 
ignore=0, req_id=16) at src/roxml-internal.c:1034
#2  0x00007ffff7bd832c in roxml_check_node (xp=0x601ac0, root=0x601010, 
context=0x601010, ans=0x7fffffffe1a0, nb=0x7fffffffe210, max=0x7fffffffe1ac, 
ignore=0, req_id=16) at src/roxml-internal.c:1025
#3  0x00007ffff7bd75e0 in roxml_exec_xpath (root=0x601010, n=0x601010, 
xpath=0x601450, index=1, count=0x7fffffffe210) at src/roxml-internal.c:1564
#4  0x00007ffff7bd47e4 in roxml_xpath (n=0x601010, path=<optimized out>, 
nb_ans=0x7fffffffe254) at src/roxml.c:704
#5  0x00000000004007fe in main () at poc.c:23


The poc.c program
--------------8<----------------------------------------
#include <roxml.h>

char xml[] =
    "<?xml version=\"1.0\">\n"
    "<root>\n"
    " <node>\n"
    "  <test_node>value</test_node>\n"
    " </node>\n"
    "</root>\n";

void show_node(node_t *n)
{
    printf("%s\n", roxml_get_name(n, NULL, 0));
    roxml_release(RELEASE_LAST);
}

int main()
{
    int i, count;

    node_t *root = roxml_load_buf(xml);
    if (root) {
        node_t **ans = roxml_xpath(root, "//parent::", &count);
        for (i=0; i<count; ++i) {
            show_node(ans[i]);
        }
        roxml_release(ans);
    }
    roxml_close(root);
}

--------------8<----------------------------------------

documentation is required to explain the following:

\param size:

if size is NULL, then the real size of the output is not returned.

What steps will reproduce the problem?

1. Compile this function and call it:
static void ShowLibRoxmlBug()
{
    char    strTmp[]    = "<?xml version='1.0' encoding='UTF-8'?><MyRoot><MyNode/></MyRoot>";
    node_t* rootNode    = NULL;
    node_t* newNode     = NULL;
    char*   newBuffer   = NULL;
    int     lenNewBuffer    = 0;

    rootNode = roxml_load_buf(strTmp);
    newNode = roxml_add_node(rootNode, 1, ROXML_ELM_NODE, "NewNode", "Whatever");
    lenNewBuffer = roxml_commit_changes(rootNode, NULL, &newBuffer, 0);
    roxml_close(rootNode);
}


What is the expected output? 
Because the position parameter's value is 1, newBuffer should contain:
 "<NewNode>Whatever</NewNode><?xml version='1.0' encoding='UTF-8'?><MyRoot><MyNode/></MyRoot>"

What do you see instead?
"<?xml version='1.0' 
encoding='UTF-8'?><MyRoot><MyNode/></MyRoot><NewNode>Whatever</NewNode>"

This is of course a silly example, but it's just for simplicity; I first 
encountered the problem deeper inside a node hierarchy.

What version of the product are you using? 
Unsure.  roxml.h has:
\date 23 Dec 2008

On what operating system?
Windows XP.

Please provide any additional information below.
The problem occurs in roxml_parent_node(), here:
    if (n->type & ROXML_ATTR_NODE) {
        nb = roxml_get_attr_nb(n->prnt);
    } else {
        nb = roxml_get_nodes_nb(n->prnt,
                    ROXML_PI_NODE | ROXML_CMT_NODE | ROXML_TXT_NODE | ROXML_ELM_NODE |
                    ROXML_DOCTYPE_NODE);
    }

    if (position > nb) {
        return roxml_append_node(parent, n);
    }

n->prnt is 0, so roxml_get_nodes_nb returns -1 and nb is -1, which is always 
less than "position."  Therefore the new node is just appended, ignoring 
"position."  The following code happens one line later, which is too late:

    n->prnt = parent;

I "fixed" the problem (perhaps incorrectly) one level higher, in 
roxml_add_node():

    } else {
            new_node->prnt = parent; // XXX added this line 
        roxml_parent_node(parent, new_node, position);
    }
    return new_node;

but perhaps it needs to be fixed more generally, inside roxml_parent_node()?

Problem with the quotes within comments.

For example the string like:

<!-- - "
-->

It breaks the the next tag parsing.

See the patch in attach that probably fix the problem.

What is the expected output? What do you see instead?
roxml_get_chld should return all chld node: elm nodes, txt nodes, pi nodes and 
comment nodes.
Actually text node are not returned using this function...

What version of the product are you using? On what operating system?

svn-trunk

Please provide any additional information below.

line 1087 in src/roxml-internal.c is quite suspect 
(http://code.google.com/p/libroxml/source/browse/trunk/src/roxml-internal.c#1087
). 

I suppose it should be 

*len += ROXML_LONG_LEN;

What steps will reproduce the problem?
1. load xml file with roxml_load_doc()
2. close the document straight after with roxml_close()
3. run it through valgrind

What is the expected output? What do you see instead?

==11967== 280 (20 direct, 260 indirect) bytes in 1 blocks are definitely lost 
in loss record 14 of 14
==11967==    at 0x4024F12: calloc (vg_replace_malloc.c:467)
==11967==    by 0x8050829: roxml_append_parser_item (roxml-parse-engine.c:34)
==11967==    by 0x804C957: roxml_load (roxml-internal.c:143)
==11967==    by 0x8054135: roxml_load_doc (roxml.c:470)
==11967==    by 0x804BB9C: main (pjsipcpp.cpp:22)


What version of the product are you using? On what operating system?

Ubuntu 10.10 with libroxml 2.0.2

Please provide any additional information below.

There seems to be other memory leaks when calling get_content and the xpath 
functions.

What steps will reproduce the problem?
1.
In memory limited environment (<64Ko) "roxml_xpath" never return when the 
malloc of "roxml_parser_prepare" fail


What is the expected output? What do you see instead?
Empty result

What version of the product are you using? On what operating system?
libroxml 2.1.2 on µC/OS 2.86

Please provide any additional information below.

What steps will reproduce the problem?
1.
create a xml document with xml declaration and on root element.
save it with roxml_commit_changes(...human=0) (do it using tmp-file and 
renaming to source file)
clean memory with roxml_close
reload it with roxml_load_doc
2.
add a new child element to root.
save it like above

What is the expected output? What do you see instead?
Normaly, no newlines should be added between childs. (see attached file)

What version of the product are you using? On what operating system?
working on trunk

Please provide any additional information below.
The file gets even bigger (when human=1) every time you reload it and adding 
childs.

I do love working with this lightweight library. I have an embedded project for 
which any code I use needs to be statically-linked. 

To strictly follow the LGPL, the user always has to be able to replace the 
library with his own binary-compatible version and have the software run, which 
means dynamically-linking the library. 

Is there any chance you would consider dual-licensing? 

What steps will reproduce the problem?
1. wget http://code.google.com/p/libroxml/issues/list
2. roxml list html
3. i see application fucked up!


What is the expected output? What do you see instead?

I expected to see error output, but I see roxml fucked up:
roxml(87386) malloc: *** error for object 0x1001144e0: pointer being freed
was not allocated

It not good! Should not fuck with malloc!!


What version of the product are you using? On what operating system?

I use svn version on MacOSX (friend customed version).


Please provide any additional information below.

What steps will reproduce the problem?
1. create an XML file which contains a processing instruction in the document 
body, for example <?xml version="1.0"?><root><?check me?></root>
2. roxml -q thfile.xml "//processing-instruction()"

* What is the expected output? What do you see instead?

The line above shall display the top-level processing instructions, i.e. 

check me

Hovever, it does not display that, because processing instructions are 
incorrectly marked as ROXML_ELM_NODE instead of ROXML_PI_NODE. This is due to a 
test in _func_load_close_pi() where the first caracter after <? is supposed to 
be a space character : this is almost never the case. 

* What version of the product are you using? On what operating system?

Linux riemann 2.6.35-28-generic #49-Ubuntu SMP Tue Mar 1 14:39:03 UTC 2011 
x86_64 GNU/Linux

libroxml v2.0.3

* Please provide any additional information below.

Removing the test outlined above is necessary but it's not enough, as there are 
places where the node name "?xml" is tested (if the test is removed, character 
'?' is no more included in the node name, and the node type is ored with 
ROXML_PI_NODE instead of ROXML_ELM_NODE). Since "?xlm" is no longer an opening 
element, the roxml_get_root() functions is modified accordingly to process 
root-chld->sibl instead of root->chld->chld. 

The attached patch (created with quilt) solves this issue. 

From my comprehension of the XPATH language, 

//processing-instruction()

shall not return the <?xml ...?> processing instruction, as it's outside //, so 
the patch is correct in this respect. 

If doxygen isn't available, then man pages / html docs won't get created,
so don't try to install them.

What steps will reproduce the problem?
1. export O=build
2. make
3. make install

What is the expected output? What do you see instead?
The construction of libroxml shall built a dynamic library and a link. When the 
library is build with option O != '.', the link which is created points to the 
wrong file. 

$> ls -l build/*.so
total 180
lrwxrwxrwx 1 edt edt    19 Jan 17 11:22 libroxml.so -> build/libroxml.so.0

The link should be
lrwxrwxrwx 1 edt edt    19 Jan 17 11:22 libroxml.so -> libroxml.so.0

What version of the product are you using? On what operating system?
svn trunk.

Please provide any additional information below.
The attached patch correct this problem. It simply extracts the basename of the 
link target, as both the link and the dynamic library are to be stored in the 
same directory. 

What steps will reproduce the problem?
1. Call this function:

static void ShowGetNodePositionBug()
{
    char    strTmp[]    = "<?xml version='1.0' encoding='UTF-8'?><Root><Node1/><Node2/><Node3/></Root>";
    node_t* rootNode    = NULL;
    node_t**    targetNodes = NULL;
    int     numTargetNodes  = 0;
    int     position    = 0;

    rootNode = roxml_load_buf(strTmp);
    if (rootNode)
    {
    targetNodes = roxml_xpath(rootNode, "Root/Node3", &numTargetNodes);
    if (targetNodes)
    {
        position = roxml_get_node_position(targetNodes[0]);
        fprintf(stderr, "position of Node3: %d\n", position);
    }
    roxml_close(rootNode);
    }
}


What is the expected output? 
position of Node3: 3

What do you see instead?
position of Node3: 1

What version of the product are you using? On what operating system?
2.2.2.  Windows XP.


Please provide any additional information below.

What steps will reproduce the problem?
1. load a document
2. commit the document to a non existing location (a file in a non-existing 
directory)
3. profit

What is the expected output? What do you see instead?

The roxml_commit_changes() should fail gracefully instead of crashing on a 
sigsegv.

Please use labels and text to provide additional information.

The problem lies in the fact that when the file is opened the resulting FILE* 
instance is not checked. The proper fix if to return 0 when fout is NULL. 

I don't know is it really a bug...
But if i use ">" within attribute value (with quotes) it probably closes the 
tag.
For example:

<COMMAND ... help="Something with > symbol" ptype="SUBCOMMAND">

The ptype attribute value is empty.

I think it's not good to use ">" within value definition. The &gt; must be used 
but expat and tinyxml XML parsers can parse this situation.

>What steps will reproduce the problem?
1.given a xml string :
  <item>print(&quot;hello&quot;)</item>

2. write some code to get the cdata:
        ...
        node_t *txtnode = roxml_get_txt(elem, 0);
        roxml_get_content(txtnode, buf, len, size);
        ...
3. look at the result

>What is the expected output? What do you see instead?
expected output is:
 print("hello")
seen instead:
 print(&quot;hello&quot;)

>What version of the product are you using? On what operating system?
version 2.2.1

>Please provide any additional information below.
Maybe I missed a right API function to take care of getting CDATA, 
however I seeked and tried some times, hope you guys give me some tips.

by the way the software is really good for my embedded platform. Thank you all.

Please add *.patch to .gitignore