core

[Miroslaw Dobrzanski-Neumann <mn...@mosaic-ag.com>]

Hi,
the following code sample produces segmentation fault:

(gdb) run
Starting program: /edidev_data/mnedev70/object/Xerces/a.out 

Program received signal SIGSEGV, Segmentation fault.
0x40078bb2 in DOM_Node::getOwnerDocument () from /edidev_data/mnedev70/object/Xerces/lib/libxerces-c1_3.so
(gdb) where
#0  0x40078bb2 in DOM_Node::getOwnerDocument () from /edidev_data/mnedev70/object/Xerces/lib/libxerces-c1_3.so
#1  0x40088cc7 in DocumentImpl::createTreeWalker () from /edidev_data/mnedev70/object/Xerces/lib/libxerces-c1_3.so
#2  0x4007699e in DOM_Document::createTreeWalker () from /edidev_data/mnedev70/object/Xerces/lib/libxerces-c1_3.so
#3  0x8048a41 in main ()
#4  0x401cba5e in __libc_start_main () at ../sysdeps/generic/libc-start.c:93

running under SuSE Linux 6.4
I used released xerces 1.3.0 (built from sources)

#include <util/PlatformUtils.hpp>
#include <dom/DOM_Document.hpp>
#include <stddef.h>

int main(int argc, char* argv[])
{
	XMLPlatformUtils::Initialize();
	DOM_Document doc = DOM_Document::createDocument();

	DOM_Element root    = doc.getDocumentElement();
	DOM_TreeWalker iter = doc.createTreeWalker(root, DOM_NodeFilter::SHOW_ELEMENT, NULL, false);
}


this is silly example but still dangerous in more complex context
=> DOM_Node::getOwnerDocument() over NULL pointer
-- 
Miroslaw Dobrzanski-Neumann

MOSAIC SOFTWARE AG
Base Development and Research Section
Tel +49-2225-882-291
Fax +49-2225-882-201
E-mail: mne@mosaic-ag.com