DO NOT REPLY [Bug 4173] New: - Crash when reusing Schema validator and the XML contains a DOCTYPE

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=4173>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=4173

Crash when reusing Schema validator and the XML contains a DOCTYPE

           Summary: Crash when reusing Schema validator and the XML contains
                    a DOCTYPE
           Product: Xerces-C++
           Version: 1.5.1
          Platform: PC
        OS/Version: Windows NT/2K
            Status: NEW
          Severity: Critical
          Priority: Other
         Component: Validating Parser (Schema) (Xerces 1.5 or up only)
        AssignedTo: xerces-c-dev@xml.apache.org
        ReportedBy: alby@exceloncorp.com


I need to validate an XML file against a fixed XMLSchema, so I preload it by 
parsing a standard document:

XMLByte* doc="<root xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" 
xsi:noNamespaceSchemaLocation=\"myschema.xsd\"/>";
MemBufInputSource inputSource(doc, strlen(doc), "", false);
SAXParser sp;
sp.setDoValidation(true);
sp.setDoNamespaces(true);
sp.setDoSchema(true);
sp.parse(inputSource);

At this point I parse the real XML file, reusing the validator

sp.parse(inputSource2, true);

Now, if the new document starts with a DOCTYPE declaration, like in

<?xml version="1.0"?>
<!DOCTYPE root SYSTEM "myschema.dtd">

Xerces crashes, essentially because DTDScanner::scanDocTypeDecl invokes 
getElemDecl(fEmptyNamespaceId, 0, bbRootName.getRawBuffer()...) while 
SchemaGrammar::getElemDecl only uses the second parameter, that is NULL

inline XMLElementDecl* SchemaGrammar::getElemDecl (const   unsigned int  uriId
                                              , const XMLCh* const    baseName
                                              , const XMLCh* const    qName
                                              , unsigned int          scope )
{
    return fElemDeclPool->getByKey(baseName, uriId, scope);
}

One possible way to fix this would be to change SchemaGrammar::getElemDecl to 
pick baseName if not NULL, otherwise use qName; is this acceptable?

Thanks,

Alberto

---------------------------------------------------------------------
To unsubscribe, e-mail: xerces-c-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xerces-c-dev-help@xml.apache.org