Memory leak in xmlXPathEvalExpression()

View: New views
6 Messages — Rating Filter:   Alert me  

Memory leak in xmlXPathEvalExpression()

by Ralf Junker :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

The following psydo-code (is actually Pascal code; I do not have a C memory checker available) produces a 5-12 byte memory leak (unable to tell the exact number of bytes):

  xmlInitParser;

  Doc := htmlParseDoc('<html></html>', nil);
  XPathCtx := xmlXPathNewContext(Doc);
  XPathObj := xmlXPathEvalExpression('//a[@href=http://hello.com]', XPathCtx);

  xmlXPathFreeObject(XPathObj);
  xmlXPathFreeContext(XPathCtx);
  xmlFreeDoc(Doc);

  xmlCleanupParser;

Here is the stack trace:
 
  40FF18 [malloc][3730]
  4CB592 [xmlstrndup][53920]
  4AFC84 [xmlXPathParseNCName][35626]
  4B3555 [xmlXPathIsNodeType][37103]
  4B39A7 [xmlXPathIsNodeType][37218]
  4B3ADF [xmlXPathIsNodeType][37253]
  4B1BCA [xmlXPathIsNodeType][36461]
  4B1D1C [xmlXPathIsNodeType][36493]
  4B1F60 [xmlXPathIsNodeType][36533]
  4B1FD2 [xmlXPathIsNodeType][36558]
  4B21EE [xmlXPathIsNodeType][36599]

Ralf  

_______________________________________________
xml mailing list, project page  http://xmlsoft.org/
xml@...
http://mail.gnome.org/mailman/listinfo/xml

[PATCH] Memory leak in xmlXPathEvalExpression()

by Martin (gzlist) :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

A patch and some tests for this issue are attached.

On 10/10/2009, Ralf Junker <ralfjunker@...> wrote:
> The following psydo-code (is actually Pascal code; I do not have a C memory
> checker available) produces a 5-12 byte memory leak (unable to tell the
> exact number of bytes):

Okay, I got a few of these a while back but missed this one.

>   XPathObj := xmlXPathEvalExpression('//a[@href=http://hello.com]',
> XPathCtx);

This is the only line in your example that matters, it's comes from
trying to parse certain kinds of invalid xpath expressions. In case
it's not clear, the URL needs string quoting in order for the
expression to work as intended.

The basic problem is that xmlXPathCompStep and other functions used
for parsing location paths don't return a success indicator, and not
every call checks to see if there was an error afterwards, so the
parser tries to plow on for a bit before realising there was a
problem.

Really the xpath parsing could do with some fuzz testing to see if
there are any more of these lurking around.

Martin


_______________________________________________
xml mailing list, project page  http://xmlsoft.org/
xml@...
http://mail.gnome.org/mailman/listinfo/xml

Avoid-leaking-strings.patch (2K) Download Attachment

Parent Message unknown Re: [PATCH] Memory leak in xmlXPathEvalExpression()

by Ralf Junker :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

At 17:30 11.10.2009, Martin (gzlist) wrote:

>A patch and some tests for this issue are attached.

Applied, tested - all leaks gone. I also ported the Python tests from your patch and no memory leaks there either. Excellent!

I think the patch should be commited go GIT. I am sure either you or Daniel will take care of this, no?

Many thanks for the quick reply and fix,

Ralf

_______________________________________________
xml mailing list, project page  http://xmlsoft.org/
xml@...
http://mail.gnome.org/mailman/listinfo/xml

Re: [PATCH] Memory leak in xmlXPathEvalExpression()

by Daniel Veillard :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Sun, Oct 11, 2009 at 04:30:12PM +0100, Martin (gzlist) wrote:

> A patch and some tests for this issue are attached.
>
> On 10/10/2009, Ralf Junker <ralfjunker@...> wrote:
> > The following psydo-code (is actually Pascal code; I do not have a C memory
> > checker available) produces a 5-12 byte memory leak (unable to tell the
> > exact number of bytes):
>
> Okay, I got a few of these a while back but missed this one.
>
> >   XPathObj := xmlXPathEvalExpression('//a[@href=http://hello.com]',
> > XPathCtx);
>
> This is the only line in your example that matters, it's comes from
> trying to parse certain kinds of invalid xpath expressions. In case
> it's not clear, the URL needs string quoting in order for the
> expression to work as intended.
>
> The basic problem is that xmlXPathCompStep and other functions used
> for parsing location paths don't return a success indicator, and not
> every call checks to see if there was an error afterwards, so the
> parser tries to plow on for a bit before realising there was a
> problem.

  Yeah, it was a long time ago :)

Thanks for the patch applied, I just had to fix the expected error mesages
set in the python test

> Really the xpath parsing could do with some fuzz testing to see if
> there are any more of these lurking around.

  Well yes that would be a good idea,

Daniel

--
Daniel Veillard      | libxml Gnome XML XSLT toolkit  http://xmlsoft.org/
daniel@...  | Rpmfind RPM search engine http://rpmfind.net/
http://veillard.com/ | virtualization library  http://libvirt.org/
_______________________________________________
xml mailing list, project page  http://xmlsoft.org/
xml@...
http://mail.gnome.org/mailman/listinfo/xml

Re: [PATCH] Memory leak in xmlXPathEvalExpression()

by Martin (gzlist) :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On 12/10/2009, Daniel Veillard <veillard@...> wrote:
>
> Thanks for the patch applied, I just had to fix the expected error mesages
> set in the python test

Gah, thanks for catching that. I have now finally got the libxml2
python bindings built (not the libxslt ones though) after fiddling
with Igor's scripts a bit. Those leak tests aren't doing what they
really should be yet, but I'll get to that later.

Please do say how you want patch submissions to work in git country,
it's an alien beast to me so I'm not sure how to make your life as a
maintainer easier.

Martin
_______________________________________________
xml mailing list, project page  http://xmlsoft.org/
xml@...
http://mail.gnome.org/mailman/listinfo/xml

Re: [PATCH] Memory leak in xmlXPathEvalExpression()

by Daniel Veillard :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Tue, Oct 13, 2009 at 12:57:05PM +0100, Martin (gzlist) wrote:

> On 12/10/2009, Daniel Veillard <veillard@...> wrote:
> >
> > Thanks for the patch applied, I just had to fix the expected error mesages
> > set in the python test
>
> Gah, thanks for catching that. I have now finally got the libxml2
> python bindings built (not the libxslt ones though) after fiddling
> with Igor's scripts a bit. Those leak tests aren't doing what they
> really should be yet, but I'll get to that later.
>
> Please do say how you want patch submissions to work in git country,
> it's an alien beast to me so I'm not sure how to make your life as a
> maintainer easier.

  Usual contextual diffs are just fine. I'm not yet fully converted to
the new GIT religion, I'm just a distant or forced follower :-)
Attachements to mails sent on the list are just fine, i.e. no problem
with your previous patch !

Daniel

--
Daniel Veillard      | libxml Gnome XML XSLT toolkit  http://xmlsoft.org/
daniel@...  | Rpmfind RPM search engine http://rpmfind.net/
http://veillard.com/ | virtualization library  http://libvirt.org/
_______________________________________________
xml mailing list, project page  http://xmlsoft.org/
xml@...
http://mail.gnome.org/mailman/listinfo/xml