96764 - Invalid XML (SVG) crashes mozilla

Status: RESOLVED FIXED

(Core :: XPCOM, defect)

Description

[Ulrich Drepper]

I'll append shortly a file which has a typo and because of this crashes mozilla.
 The offending line is

      <svg:rect id="backg" x="10" y="10" width="400" height="300">

Note that there is a slash (/) missing before the closing angle bracket.  If the
slash is added all is fine (well, mozilla doesn't crash at least),

If this is a generic XML parser bug please change the component.

Comment 1

[Ulrich Drepper]

Attachment: SHTML file with SVG and typo

Comment 2

[Bradley Baetz (:bbaetz)]

Are you using an SVG build? This (when saved locally; the attached file has a
mimetype of text/ml) brings up an xml parser error page on 0.9.3, but crashes on
the SVG branch.

What build are you using? Is it the standard trunk?

I'll test on a nightly tomorrow, but the stack trace points to parser, so moving
there.

Comment 3

[Ulrich Drepper]

> Are you using an SVG build?

Yes, but from the trunk.  I'm not using the SVG branch.

> This (when saved locally; the attached file has a
> mimetype of text/ml) brings up an xml parser error page on 0.9.3

Well, I'm building moz daily myself.  All works well normally.  This is the only
crash I came across in a long time.  And just to be sure, I saved the attachment
to disk with a filename ending in .xml, used file:///... to load it and moz crashed.

Comment 4

[harishd]

Bradley: Could you please attach the stack? Thanx

Comment 5

[Ulrich Drepper]

I'm not sure sure this is the same problem.  But I stumbled across it by looking
at anothe prroblem.  Please see the attached patch.

Comment 6

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

The attachment is attachment 47128 [details] [diff] [review].

Comment 7

[Ulrich Drepper]

Attachment: Fix for buffer overrun.

Comment 8

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

The patch is clearly right, r=dbaron.

Comment 9

[Ulrich Drepper]

Just tried the original test file and the patch fixes it.

Comment 10

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

There's a similar problem on line 1064.

Comment 11

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: patch for all three

Comment 12

[Bradley Baetz (:bbaetz)]

r=bbaetz

Why didn't this cause problems before now?

Moving to XPCOM for dougt's amusement.

Comment 13

[Brendan Eich [:brendan]]

sr=[e-mail] -- we should look for similar problems in code that was
converted from char to PRUnichar.  Anyone know of any other such code?

/be

Comment 14

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: patch revised according to nit Brendan pointed out in email (array_ rather than _array)

Comment 15

[tor]

a=tor on behalf of drivers

Comment 16

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Fix checked in to trunk 2001-08-26 14:21 PDT.  Leaving open since we may want
this on the branch as well.

Comment 17

[Asa Dotzler [:asa]]

please rewsolve this since it has been checked in on the trunk. If some one
wants it checked into another branch then do so when it is checked into the
trunk or create a new bug for the branch checkin. Thanks.

Comment 18

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

OK.

Comment 19

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Checked in to branch.