<?xml version="1.0" encoding="UTF-8" ?>

<bugzilla version="5.2"
          urlbase="https://bugzilla.altlinux.org/"
          
          maintainer="jenya@basealt.ru"
>

    <bug>
          <bug_id>1211</bug_id>
          
          <creation_ts>2002-08-20 20:27:13 +0400</creation_ts>
          <short_desc>sigsegv in xmlStrcat and xmlStrcat</short_desc>
          <delta_ts>2003-08-25 15:18:33 +0400</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>4</classification_id>
          <classification>Development</classification>
          <product>Sisyphus</product>
          <component>libxml2</component>
          <version>unstable</version>
          <rep_platform>all</rep_platform>
          <op_sys>Linux</op_sys>
          <bug_status>CLOSED</bug_status>
          <resolution>NOTABUG</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P4</priority>
          <bug_severity>critical</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Alexey Voinov">voins</reporter>
          <assigned_to name="Mikhail Zabaluev">mhz</assigned_to>
          <cc>maks1ms</cc>
          
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1157</commentid>
    <comment_count>0</comment_count>
    <who name="Alexey Voinov">voins</who>
    <bug_when>2002-08-20 20:27:13 +0400</bug_when>
    <thetext>Вот такой маленький пример:
#include &amp;lt;stdio.h&amp;gt;
#include &amp;lt;libxml/parser.h&amp;gt;

int main(void)
{
        xmlChar *aaa = (xmlChar*)\&amp;quot;aaa\&amp;quot;;
        xmlChar *bbb = (xmlChar*)\&amp;quot;bbb\&amp;quot;;
        xmlChar *ccc = xmlStrcat(aaa, bbb);
        printf(\&amp;quot;%s\\n\&amp;quot;, (const char*)ccc);
        return 0;
}

Заканчивается Segmentation Fault.

$ catchsegv ./a.out
*** Segmentation fault
Register dump:

 EAX: 08000000   EBX: 2acd86f8   ECX: 00000001   EDX: 08048504
 ESI: 00000007   EDI: 00020000   EBP: 7ffff458   ESP: 7ffff430

 EIP: 2ac25655   EFLAGS: 00210206

 CS: 0023   DS: 002b   ES: 002b   FS: 0000   GS: 0000   SS: 002b

 Trap: 0000000e   Error: 00000004   OldMask: 00000000
 ESP/signal: 7ffff430   CR2: 08000000

Backtrace:
/lib/libc.so.6(__libc_realloc+0x1c5)[0x2ac25655]
/lib/libc.so.6[0x2ac23e81]
/lib/libc.so.6(__libc_realloc+0x31)[0x2ac254c1]
/usr/lib/libxml2.so.2(xmlStrncat+0x67)[0x2aaf99e7]
/usr/lib/libxml2.so.2(xmlStrcat+0x53)[0x2aaf9a93]
./a.out[0x8048498]
/lib/libc.so.6(__libc_start_main+0x93)[0x2abc26e7]
./a.out(xmlStrcat+0x35)[0x80483d1]
---

---

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>4044</commentid>
    <comment_count>1</comment_count>
    <who name="Mikhail Zabaluev">mhz</who>
    <bug_when>2002-08-21 09:41:53 +0400</bug_when>
    <thetext>The first argument of xmlStrcat is supposed to be either a string buffer allocated with the library\&apos;s allocation functions, or NULL. The buffer may be subjected to reallocation in the routine, and it\&apos;s handed to realloc() by default. The sample uses statically allocated string literals.
</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>7409</commentid>
    <comment_count>2</comment_count>
    <who name="Mikhail Zabaluev">mhz</who>
    <bug_when>2002-08-21 09:41:53 +0400</bug_when>
    <thetext>The first argument of xmlStrcat is supposed to be either a string buffer allocated with the library\&apos;s allocation functions, or NULL. The buffer may be subjected to reallocation in the routine, and it\&apos;s handed to realloc() by default. The sample uses statically allocated string literals.
</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>