Hello,

Disclaimer:
I'm experiencing a bug in Caudium that makes Parser.HTML to crash.
Sorry, i wasn't able to reproduce it with a standalone Pike program due
to my lack of full understanding of entities handling in Parser.HTML.
There may be a bug in Caudium in this area i'd be happy to solve, but
even in this case i guess Pike shouldn't crash.


Story:
An RXML entity whose return string ends with an XML entity, called with
the :none encoding, placed in a tag attibute makes Parser.HTML to crash.

For example, if "&myscope.myentity:none;" returns " " the following
would crash:
<a href='mailto:&myscope.myentity:none;'>foo</a>
It won't if "&myscope.myentity:none;" returns "&nbsp; ".


Here's gdb output (Pike 7.6.112):

----8<----8<----8<----8<----
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000004
[Switching to process 24147 thread 0x2303]
scan_forward (feed=0x2a1cbb8, c=0, destp=0xf0080b38, d_p=0xf0080b3c,
look_for=0x133d21c, num_look_for=2) at
/sw/src/fink.build/pike7.6-7.6.112-10/Pike-v7.6.112/src/modules/Parser/h
tml.c:1736
        in
/sw/src/fink.build/pike7.6-7.6.112-10/Pike-v7.6.112/src/modules/Parser/h
tml.c
(gdb) bt
#0  scan_forward (feed=0x2a1cbb8, c=0, destp=0xf0080b38, d_p=0xf0080b3c,
look_for=0x133d21c, num_look_for=2) at
/sw/src/fink.build/pike7.6-7.6.112-10/Pike-v7.6.112/src/modules/Parser/h
tml.c:1736
#1  0x013349dc in scan_forward_arg (this=0x2af6790, feed=0x2, c=0,
destp=0xf0080b38, d_p=0xf0080b3c, what=SCAN_ARG_ENT_BREAK, finished=1,
quote=0xf0080b50) at
/sw/src/fink.build/pike7.6-7.6.112-10/Pike-v7.6.112/src/modules/Parser/h
tml.c:2051
#2  0x0133a448 in try_feed (finished=44157880) at
/sw/src/fink.build/pike7.6-7.6.112-10/Pike-v7.6.112/src/modules/Parser/h
tml.c:3537
#3  0x0133b278 in html_finish (args=-267908296) at
/sw/src/fink.build/pike7.6-7.6.112-10/Pike-v7.6.112/src/modules/Parser/h
tml.c:3936
#4  0x000168e4 in low_mega_apply (type=4027059000, args=-267908296,
arg1=0x0, arg2=0xf0080b38) at
/sw/src/fink.build/pike7.6-7.6.112-10/Pike-v7.6.112/src/apply_low.h:214
#5  0x0001888c in jump_opcode_F_CALL_OTHER (arg1=-267908292) at
/home/peter/hack/Pike/7.6-distmaker/src/interpret_functions.h:1957
#6  0x0358583c in ?? ()
#7  0x00019738 in o_catch (pc=0x358a3d4) at
/sw/src/fink.build/pike7.6-7.6.112-10/Pike-v7.6.112/src/interpret.c:2051
#8  0x00019814 in jump_opcode_F_CATCH () at
/home/peter/hack/Pike/7.6-distmaker/src/interpret_functions.h:1239
#9  0x0358a3c8 in ?? ()
#10 0x00019738 in o_catch (pc=0x297dfdc) at
/sw/src/fink.build/pike7.6-7.6.112-10/Pike-v7.6.112/src/interpret.c:2051
#11 0x00019814 in jump_opcode_F_CATCH () at
/home/peter/hack/Pike/7.6-distmaker/src/interpret_functions.h:1239
#12 0x0297dfd0 in ?? ()
#13 0x00019738 in o_catch (pc=0x286a5d0) at
/sw/src/fink.build/pike7.6-7.6.112-10/Pike-v7.6.112/src/interpret.c:2051
#14 0x00019814 in jump_opcode_F_CATCH () at
/home/peter/hack/Pike/7.6-distmaker/src/interpret_functions.h:1239
#15 0x0286a5c4 in ?? ()
#16 0x0001708c in mega_apply (type=44157880, args=0, arg1=0xf0080b38,
arg2=0x133d21c) at
/sw/src/fink.build/pike7.6-7.6.112-10/Pike-v7.6.112/src/interpret.c:2006
#17 0x000d7c18 in new_thread_func (data=0xbfffe3d8) at
/sw/src/fink.build/pike7.6-7.6.112-10/Pike-v7.6.112/src/threads.c:868
#18 0x9002bd08 in _pthread_body ()
---->8---->8---->8---->8----

Thank you,

-- 
Bertrand LUPART

http://bertrand.gotpike.org/

Reply via email to