[lxml-dev] Possible 'freeing null pointer' problem with 'document()' function

[Sidnei da Silva]

Hi there,

Just a heads up in case anyone is facing similar issues.

I have written a Apache output filter using lxml and it has been
working fine so far, but after some changes to a xsl file it started
crashing Apache. I've tracked down the issue to two variable
definitions that were using the 'document()' function to include a
external xml file.

	<xsl:variable name="geographic_vocabularies"
		select="document('../vocabularies/geographic_vocabularies.xml')"/>
	<xsl:variable name="workspace_vocabularies"
		select="document('../vocabularies/workspace_vocabularies.xml')"/>

I wrote a script that performs the same transformation outside of
Apache, and surprisingly it works just fine. The only difference being
that the script resolves to a file in the filesystem, and the filter
in Apache uses urlopen().

I'm testing this on Windows, and when the crash happens and I select
debug the current line is in free() and the previous item in the stack
is etree.pyd, but I couldn't get a debug build going to see where
exactly in etree.pyd.

This happens with both lxml 1.2.1 and 1.3.3, using libxml2 2.6.28 and
libxslt 1.1.19.

Any clues appreciated...

-- 
Sidnei da Silva
Enfold Systems                http://enfoldsystems.com
Fax +1 832 201 8856     Office +1 713 942 2377 Ext 214