libxslt broken? (Re: ERRORS: libxcb.spec OK: xcb-proto.spec)

[Paweł Sikora]

On Friday 03 November 2006 18:58, Jakub Bogusz wrote:
> On Fri, Nov 03, 2006 at 05:28:32PM +0000, PLD th-i686 builder wrote:
> [...]
>
> > /usr/bin/xsltproc --stringparam mode source \
> > 	            --stringparam base-path /usr/share/xcb/ \
> > 	            --stringparam extension-path /usr/share/xcb/ \
> > 	            -o xproto.c ./c-client.xsl xproto.xml
> > make[1]: *** [xproto.c] Segmentation fault
> > make[1]: Leaving directory
> > `/home/users/builder/rpm/BUILD/libxcb-0.9.93/src' make: ***
> > [all-recursive] Error 1
> > error: Bad exit status from /var/tmp/rpm-tmp.80655 (%build)
>
> It crashes inside libxslt.

(gdb) bt
#0  0x00002b71716a42a5 in free () from /lib64/libc.so.6
#1  0x00002b7170eb96ab in xsltFreeKeyTable (keyt=0x74fa40) at keys.c:154
#2  0x00002b7170eb973f in xsltFreeKeyTableList (keyt=0x0) at keys.c:177
#3  0x00002b7170eba9da in xsltFreeDocumentKeys (idoc=0x8045b0) at keys.c:852

Breakpoint 1, xsltFreeKeyTableList (keyt=0x74fa40) at keys.c:174
174         while (keyt != NULL) {

(gdb) p *keyt
$2 = {
  next = 0x0,
  name = 0xb1 <Address 0xb1 out of bounds>,
  nameURI = 0x8045b0 "",
  keys = 0x7510f0
}

one item in list with crappy data.
freeing keyt->name crashes.