[lxml-dev] Possible 'freeing null pointer' problem with 'document()' function

[Stefan Behnel]

Hi Sidnei,

Sidnei da Silva wrote:
> Just a heads up in case anyone is facing similar issues.
> 
> I have written a Apache output filter using lxml and it has been
> working fine so far, but after some changes to a xsl file it started
> crashing Apache. I've tracked down the issue to two variable
> definitions that were using the 'document()' function to include a
> external xml file.
> 
> 	<xsl:variable name="geographic_vocabularies"
> 		select="document('../vocabularies/geographic_vocabularies.xml')"/>
> 	<xsl:variable name="workspace_vocabularies"
> 		select="document('../vocabularies/workspace_vocabularies.xml')"/>
> 
> I wrote a script that performs the same transformation outside of
> Apache, and surprisingly it works just fine. The only difference being
> that the script resolves to a file in the filesystem, and the filter
> in Apache uses urlopen().
> 
> I'm testing this on Windows, and when the crash happens and I select
> debug the current line is in free() and the previous item in the stack
> is etree.pyd, but I couldn't get a debug build going to see where
> exactly in etree.pyd.
> 
> This happens with both lxml 1.2.1 and 1.3.3, using libxml2 2.6.28 and
> libxslt 1.1.19.
> 
> Any clues appreciated...

Hmmm, I need more detail here. Any chance you could send me a working (i.e.
crashing) example of acceptable size so that I could run it through valgrind?

Stefan