ppisar
commented
10 months ago The failing test can be reduced to:
$ cat /tmp/test.t
use XML::LibXML;
sub handler {
return join(",",@_);
}
my $parser = XML::LibXML->new({
expand_entities => 1,
ext_ent_handler => \&handler,
});
my $doc = $parser->parse_string(<<'EOF');
<?xml version="1.0"?>
<!DOCTYPE foo [
<!ENTITY b SYSTEM "file:///does-not-exist">
]>
<root>&b;</root>
EOFThe output looks like a random string is parsed because the exact invalid bytes changes with each run:
$ perl -Iblib/{lib,arch} /tmp/test.t
Entity: line 1: parser error : PCDATA invalid Char value 23
g�+�U
^
Entity: line 1: parser error : Input is not proper UTF-8, indicate encoding !
Bytes: 0x94 0x2B 0xDD 0x55
g�+�U
^
Entity: line 1: parser error : Char 0x0 out of allowed range
g�+�U
^
Entity: line 1: parser error : PCDATA invalid Char value 0
g�+�U
^
Entity: line 1: parser error : Char 0x0 out of allowed range
g�+�U
^
Entity: line 1: parser error : PCDATA invalid Char value 0
g�+�U
^
Entity: line 1: parser error : PCDATA invalid Char value 5
g�+�U
^
:5: parser error : Entity 'b' failed to parse
<root>&b;</root>
^Valgrind reveals memory errors:
$ valgrind -- perl -Iblib/{lib,arch} /tmp/test.t
==10869== Memcheck, a memory error detector
==10869== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==10869== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info
==10869== Command: perl -Iblib/lib -Iblib/arch /tmp/test.t
==10869==
==10869== Invalid read of size 8
==10869== at 0x484F2FE: memmove (vg_replace_strmem.c:1410)
==10869== by 0x5F20916: UnknownInlinedFun (string_fortified.h:29)
==10869== by 0x5F20916: xmlMemRead (xmlIO.c:2845)
==10869== by 0x5F28006: xmlParserInputBufferGrow (xmlIO.c:3213)
==10869== by 0x5EFAE2C: xmlParserGrow (parserInternals.c:537)
==10869== by 0x5F052B4: xmlDetectEncoding (parserInternals.c:1296)
==10869== by 0x5EFDD28: xmlParseExternalEntityPrivate.lto_priv.0 (parser.c:12725)
==10869== by 0x5EF2063: xmlParseReference (parser.c:7369)
==10869== by 0x5EFDA87: xmlParseContentInternal (parser.c:10268)
==10869== by 0x5EFF297: xmlParseElement (parser.c:10330)
==10869== by 0x5EFFEFF: xmlParseDocument (parser.c:11111)
==10869== by 0x5E48CBF: XS_XML__LibXML__parse_string.lto_priv.0 (LibXML.xs:1755)
==10869== by 0x49A05A9: Perl_pp_entersub (pp_hot.c:5555)
==10869== Address 0x6184420 is 0 bytes inside a block of size 25 free'd
==10869== at 0x4845B2C: free (vg_replace_malloc.c:985)
==10869== by 0x49A61DD: Perl_sv_clear (sv.c:6919)
==10869== by 0x49A3DC1: Perl_sv_free2 (sv.c:7244)
==10869== by 0x49D084E: UnknownInlinedFun (sv_inline.h:715)
==10869== by 0x49D084E: Perl_free_tmps (scope.c:255)
==10869== by 0x5E4634C: LibXML_load_external_entity (LibXML.xs:879)
==10869== by 0x5F276A6: UnknownInlinedFun (xmlIO.c:3977)
==10869== by 0x5F276A6: xmlLoadExternalEntity (xmlIO.c:3965)
==10869== by 0x5EF9FA7: xmlCreateEntityParserCtxtInternal (parser.c:13635)
==10869== by 0x5EFDC58: xmlParseExternalEntityPrivate.lto_priv.0 (parser.c:12681)
==10869== by 0x5EF2063: xmlParseReference (parser.c:7369)
==10869== by 0x5EFDA87: xmlParseContentInternal (parser.c:10268)
==10869== by 0x5EFF297: xmlParseElement (parser.c:10330)
==10869== by 0x5EFFEFF: xmlParseDocument (parser.c:11111)
==10869== Block was alloc'd at
==10869== at 0x484280F: malloc (vg_replace_malloc.c:442)
==10869== by 0x496BD62: Perl_safesysmalloc (util.c:161)
==10869== by 0x499EF8F: Perl_sv_grow (sv.c:1376)
==10869== by 0x49AA63A: Perl_sv_setsv_flags (sv.c:4646)
==10869== by 0x499A17E: Perl_leave_adjust_stacks (pp_hot.c:5149)
==10869== by 0x499ED8A: Perl_pp_leavesub (pp_hot.c:5225)
==10869== by 0x49915D7: Perl_runops_standard (run.c:41)
==10869== by 0x48D75B9: Perl_call_sv (perl.c:3150)
==10869== by 0x5E4601C: LibXML_load_external_entity (LibXML.xs:856)
==10869== by 0x5F276A6: UnknownInlinedFun (xmlIO.c:3977)
==10869== by 0x5F276A6: xmlLoadExternalEntity (xmlIO.c:3965)
==10869== by 0x5EF9FA7: xmlCreateEntityParserCtxtInternal (parser.c:13635)
==10869== by 0x5EFDC58: xmlParseExternalEntityPrivate.lto_priv.0 (parser.c:12681)
==10869==
==10869== Invalid read of size 2
==10869== at 0x484F350: memmove (vg_replace_strmem.c:1410)
==10869== by 0x5F20916: UnknownInlinedFun (string_fortified.h:29)
==10869== by 0x5F20916: xmlMemRead (xmlIO.c:2845)
==10869== by 0x5F28006: xmlParserInputBufferGrow (xmlIO.c:3213)
==10869== by 0x5EFAE2C: xmlParserGrow (parserInternals.c:537)
==10869== by 0x5F052B4: xmlDetectEncoding (parserInternals.c:1296)
==10869== by 0x5EFDD28: xmlParseExternalEntityPrivate.lto_priv.0 (parser.c:12725)
==10869== by 0x5EF2063: xmlParseReference (parser.c:7369)
==10869== by 0x5EFDA87: xmlParseContentInternal (parser.c:10268)
==10869== by 0x5EFF297: xmlParseElement (parser.c:10330)
==10869== by 0x5EFFEFF: xmlParseDocument (parser.c:11111)
==10869== by 0x5E48CBF: XS_XML__LibXML__parse_string.lto_priv.0 (LibXML.xs:1755)
==10869== by 0x49A05A9: Perl_pp_entersub (pp_hot.c:5555)
==10869== Address 0x6184430 is 16 bytes inside a block of size 25 free'd
==10869== at 0x4845B2C: free (vg_replace_malloc.c:985)
==10869== by 0x49A61DD: Perl_sv_clear (sv.c:6919)
==10869== by 0x49A3DC1: Perl_sv_free2 (sv.c:7244)
==10869== by 0x49D084E: UnknownInlinedFun (sv_inline.h:715)
==10869== by 0x49D084E: Perl_free_tmps (scope.c:255)
==10869== by 0x5E4634C: LibXML_load_external_entity (LibXML.xs:879)
==10869== by 0x5F276A6: UnknownInlinedFun (xmlIO.c:3977)
==10869== by 0x5F276A6: xmlLoadExternalEntity (xmlIO.c:3965)
==10869== by 0x5EF9FA7: xmlCreateEntityParserCtxtInternal (parser.c:13635)
==10869== by 0x5EFDC58: xmlParseExternalEntityPrivate.lto_priv.0 (parser.c:12681)
==10869== by 0x5EF2063: xmlParseReference (parser.c:7369)
==10869== by 0x5EFDA87: xmlParseContentInternal (parser.c:10268)
==10869== by 0x5EFF297: xmlParseElement (parser.c:10330)
==10869== by 0x5EFFEFF: xmlParseDocument (parser.c:11111)
==10869== Block was alloc'd at
==10869== at 0x484280F: malloc (vg_replace_malloc.c:442)
==10869== by 0x496BD62: Perl_safesysmalloc (util.c:161)
==10869== by 0x499EF8F: Perl_sv_grow (sv.c:1376)
==10869== by 0x49AA63A: Perl_sv_setsv_flags (sv.c:4646)
==10869== by 0x499A17E: Perl_leave_adjust_stacks (pp_hot.c:5149)
==10869== by 0x499ED8A: Perl_pp_leavesub (pp_hot.c:5225)
==10869== by 0x49915D7: Perl_runops_standard (run.c:41)
==10869== by 0x48D75B9: Perl_call_sv (perl.c:3150)
==10869== by 0x5E4601C: LibXML_load_external_entity (LibXML.xs:856)
==10869== by 0x5F276A6: UnknownInlinedFun (xmlIO.c:3977)
==10869== by 0x5F276A6: xmlLoadExternalEntity (xmlIO.c:3965)
==10869== by 0x5EF9FA7: xmlCreateEntityParserCtxtInternal (parser.c:13635)
==10869== by 0x5EFDC58: xmlParseExternalEntityPrivate.lto_priv.0 (parser.c:12681)
==10869==
==10869== Invalid read of size 2
==10869== at 0x484F35F: memmove (vg_replace_strmem.c:1410)
==10869== by 0x5F20916: UnknownInlinedFun (string_fortified.h:29)
==10869== by 0x5F20916: xmlMemRead (xmlIO.c:2845)
==10869== by 0x5F28006: xmlParserInputBufferGrow (xmlIO.c:3213)
==10869== by 0x5EFAE2C: xmlParserGrow (parserInternals.c:537)
==10869== by 0x5F052B4: xmlDetectEncoding (parserInternals.c:1296)
==10869== by 0x5EFDD28: xmlParseExternalEntityPrivate.lto_priv.0 (parser.c:12725)
==10869== by 0x5EF2063: xmlParseReference (parser.c:7369)
==10869== by 0x5EFDA87: xmlParseContentInternal (parser.c:10268)
==10869== by 0x5EFF297: xmlParseElement (parser.c:10330)
==10869== by 0x5EFFEFF: xmlParseDocument (parser.c:11111)
==10869== by 0x5E48CBF: XS_XML__LibXML__parse_string.lto_priv.0 (LibXML.xs:1755)
==10869== by 0x49A05A9: Perl_pp_entersub (pp_hot.c:5555)
==10869== Address 0x6184434 is 20 bytes inside a block of size 25 free'd
==10869== at 0x4845B2C: free (vg_replace_malloc.c:985)
==10869== by 0x49A61DD: Perl_sv_clear (sv.c:6919)
==10869== by 0x49A3DC1: Perl_sv_free2 (sv.c:7244)
==10869== by 0x49D084E: UnknownInlinedFun (sv_inline.h:715)
==10869== by 0x49D084E: Perl_free_tmps (scope.c:255)
==10869== by 0x5E4634C: LibXML_load_external_entity (LibXML.xs:879)
==10869== by 0x5F276A6: UnknownInlinedFun (xmlIO.c:3977)
==10869== by 0x5F276A6: xmlLoadExternalEntity (xmlIO.c:3965)
==10869== by 0x5EF9FA7: xmlCreateEntityParserCtxtInternal (parser.c:13635)
==10869== by 0x5EFDC58: xmlParseExternalEntityPrivate.lto_priv.0 (parser.c:12681)
==10869== by 0x5EF2063: xmlParseReference (parser.c:7369)
==10869== by 0x5EFDA87: xmlParseContentInternal (parser.c:10268)
==10869== by 0x5EFF297: xmlParseElement (parser.c:10330)
==10869== by 0x5EFFEFF: xmlParseDocument (parser.c:11111)
==10869== Block was alloc'd at
==10869== at 0x484280F: malloc (vg_replace_malloc.c:442)
==10869== by 0x496BD62: Perl_safesysmalloc (util.c:161)
==10869== by 0x499EF8F: Perl_sv_grow (sv.c:1376)
==10869== by 0x49AA63A: Perl_sv_setsv_flags (sv.c:4646)
==10869== by 0x499A17E: Perl_leave_adjust_stacks (pp_hot.c:5149)
==10869== by 0x499ED8A: Perl_pp_leavesub (pp_hot.c:5225)
==10869== by 0x49915D7: Perl_runops_standard (run.c:41)
==10869== by 0x48D75B9: Perl_call_sv (perl.c:3150)
==10869== by 0x5E4601C: LibXML_load_external_entity (LibXML.xs:856)
==10869== by 0x5F276A6: UnknownInlinedFun (xmlIO.c:3977)
==10869== by 0x5F276A6: xmlLoadExternalEntity (xmlIO.c:3965)
==10869== by 0x5EF9FA7: xmlCreateEntityParserCtxtInternal (parser.c:13635)
==10869== by 0x5EFDC58: xmlParseExternalEntityPrivate.lto_priv.0 (parser.c:12681)
==10869==
==10869== Invalid read of size 1
==10869== at 0x484F380: memmove (vg_replace_strmem.c:1410)
==10869== by 0x5F20916: UnknownInlinedFun (string_fortified.h:29)
==10869== by 0x5F20916: xmlMemRead (xmlIO.c:2845)
==10869== by 0x5F28006: xmlParserInputBufferGrow (xmlIO.c:3213)
==10869== by 0x5EFAE2C: xmlParserGrow (parserInternals.c:537)
==10869== by 0x5F052B4: xmlDetectEncoding (parserInternals.c:1296)
==10869== by 0x5EFDD28: xmlParseExternalEntityPrivate.lto_priv.0 (parser.c:12725)
==10869== by 0x5EF2063: xmlParseReference (parser.c:7369)
==10869== by 0x5EFDA87: xmlParseContentInternal (parser.c:10268)
==10869== by 0x5EFF297: xmlParseElement (parser.c:10330)
==10869== by 0x5EFFEFF: xmlParseDocument (parser.c:11111)
==10869== by 0x5E48CBF: XS_XML__LibXML__parse_string.lto_priv.0 (LibXML.xs:1755)
==10869== by 0x49A05A9: Perl_pp_entersub (pp_hot.c:5555)
==10869== Address 0x6184436 is 22 bytes inside a block of size 25 free'd
==10869== at 0x4845B2C: free (vg_replace_malloc.c:985)
==10869== by 0x49A61DD: Perl_sv_clear (sv.c:6919)
==10869== by 0x49A3DC1: Perl_sv_free2 (sv.c:7244)
==10869== by 0x49D084E: UnknownInlinedFun (sv_inline.h:715)
==10869== by 0x49D084E: Perl_free_tmps (scope.c:255)
==10869== by 0x5E4634C: LibXML_load_external_entity (LibXML.xs:879)
==10869== by 0x5F276A6: UnknownInlinedFun (xmlIO.c:3977)
==10869== by 0x5F276A6: xmlLoadExternalEntity (xmlIO.c:3965)
==10869== by 0x5EF9FA7: xmlCreateEntityParserCtxtInternal (parser.c:13635)
==10869== by 0x5EFDC58: xmlParseExternalEntityPrivate.lto_priv.0 (parser.c:12681)
==10869== by 0x5EF2063: xmlParseReference (parser.c:7369)
==10869== by 0x5EFDA87: xmlParseContentInternal (parser.c:10268)
==10869== by 0x5EFF297: xmlParseElement (parser.c:10330)
==10869== by 0x5EFFEFF: xmlParseDocument (parser.c:11111)
==10869== Block was alloc'd at
==10869== at 0x484280F: malloc (vg_replace_malloc.c:442)
==10869== by 0x496BD62: Perl_safesysmalloc (util.c:161)
==10869== by 0x499EF8F: Perl_sv_grow (sv.c:1376)
==10869== by 0x49AA63A: Perl_sv_setsv_flags (sv.c:4646)
==10869== by 0x499A17E: Perl_leave_adjust_stacks (pp_hot.c:5149)
==10869== by 0x499ED8A: Perl_pp_leavesub (pp_hot.c:5225)
==10869== by 0x49915D7: Perl_runops_standard (run.c:41)
==10869== by 0x48D75B9: Perl_call_sv (perl.c:3150)
==10869== by 0x5E4601C: LibXML_load_external_entity (LibXML.xs:856)
==10869== by 0x5F276A6: UnknownInlinedFun (xmlIO.c:3977)
==10869== by 0x5F276A6: xmlLoadExternalEntity (xmlIO.c:3965)
==10869== by 0x5EF9FA7: xmlCreateEntityParserCtxtInternal (parser.c:13635)
==10869== by 0x5EFDC58: xmlParseExternalEntityPrivate.lto_priv.0 (parser.c:12681)
==10869==
==10869==
==10869== HEAP SUMMARY:
==10869== in use at exit: 4,507,710 bytes in 16,971 blocks
==10869== total heap usage: 53,270 allocs, 36,299 frees, 10,078,767 bytes allocated
==10869==
==10869== LEAK SUMMARY:
==10869== definitely lost: 24,148 bytes in 35 blocks
==10869== indirectly lost: 56,412 bytes in 27 blocks
==10869== possibly lost: 4,408,443 bytes in 16,872 blocks
==10869== still reachable: 18,707 bytes in 37 blocks
==10869== of which reachable via heuristic:
==10869== newarray : 15,008 bytes in 465 blocks
==10869== suppressed: 0 bytes in 0 blocks
==10869== Rerun with --leak-check=full to see details of leaked memory
==10869==
==10869== For lists of detected and suppressed errors, rerun with: -s
==10869== ERROR SUMMARY: 6 errors from 4 contexts (suppressed: 0 from 0)
nwellnhof
dilyanpalauzov
kloczek
Here is build result:
And test suite: