Обсуждение: Calling xlst_process with certain arguments causes server crash

Hello,

It looks like calling xlst_process as follows causes a crash:

select xslt_process('<root xml_tb_version=3D"2.0" type=3D"struct" >
<ttm type=3D"int32" >60</ttm>
<delta type=3D"double" >0.75</delta>
<ttm2 type=3D"int32" >30</ttm2>
<delta2 type=3D"double" >0.75</delta2>
<expMonthNum type=3D"int32" >1</expMonthNum>
<assetComb type=3D"cell" >
               <item type=3D"char" >calendar spread</item>
</assetComb>
</root>','<?xml version=3D"1.0" encoding=3D"UTF-8"?>
<xsl:stylesheet xmlns:xsl=3D"http://www.w3.org/1999/XSL/Transform" version=
=3D"1.0">
  <xsl:output method=3D"xml" indent=3D"yes"/>
  <xsl:template match=3D"//root/*">
    <elem type=3D"{@type}" name=3D"{name()}">
      <xsl:value-of select=3D"."/>
      <xsl:attribute name=3D"href">
          result.asp?value=3D<xsl:value-of select=3D"."/>
      </xsl:attribute>
    </elem>
  </xsl:template>
</xsl:stylesheet>','')

After the crash pglog contains the following records:





Peter Gagarinov | Head of Modelling and Analytics

Allied Testing

Hello,

It looks like calling xlst_process as follows causes a crash:

select xslt_process('<root xml_tb_version=3D"2.0" type=3D"struct" >
<ttm type=3D"int32" >60</ttm>
<delta type=3D"double" >0.75</delta>
<ttm2 type=3D"int32" >30</ttm2>
<delta2 type=3D"double" >0.75</delta2>
<expMonthNum type=3D"int32" >1</expMonthNum>
<assetComb type=3D"cell" >
               <item type=3D"char" >calendar spread</item>
</assetComb>
</root>','<?xml version=3D"1.0" encoding=3D"UTF-8"?>
<xsl:stylesheet xmlns:xsl=3D"http://www.w3.org/1999/XSL/Transform" version=
=3D"1.0">
  <xsl:output method=3D"xml" indent=3D"yes"/>

  <xsl:template match=3D"//root/*">
    <elem type=3D"{@type}" name=3D"{name()}">
      <xsl:value-of select=3D"."/>
      <xsl:attribute name=3D"href">
          result.asp?value=3D<xsl:value-of select=3D"."/>
      </xsl:attribute>
    </elem>
  </xsl:template>

</xsl:stylesheet>','')

After the crash pglog contains the following records:

2012-06-04 16:32:40.927 MSDLOG:  server process (PID 4512) was terminated b=
y exception 0xC0000005
2012-06-04 16:32:40.927 MSDHINT:  See C include file "ntstatus.h" for a des=
cription of the hexadecimal value.
2012-06-04 16:32:40.927 MSDLOG:  terminating any other active server proces=
ses

Could you please help to figure out how it can be fixed?

Thanks,
Peter


Peter Gagarinov | Head of Modelling and Analytics

Allied Testing

<pgagarinov@alliedtesting.com> writes:
> It looks like calling xlst_process as follows causes a crash:

Hm, apparently xsltApplyStylesheet returns a NULL in this example,
and we're passing that on to xsltSaveResultToString which is not
expecting any such thing.  I presume we need another error check
here, but what should the error say exactly?  Can we get any info
more detailed than "failed to apply stylesheet"?

            regards, tom lane

I wrote:
> Hm, apparently xsltApplyStylesheet returns a NULL in this example,
> and we're passing that on to xsltSaveResultToString which is not
> expecting any such thing.  I presume we need another error check
> here, but what should the error say exactly?  Can we get any info
> more detailed than "failed to apply stylesheet"?

Apparently not -- or at least, if libxslt provides any easy way to
extract error reports, it's not evident from the pretty-awful
documentation.  I've committed a fix that just reports "failed to apply
stylesheet".

            regards, tom lane

Hello Tom,

Here is another example that causes a crash, probably for the same reason b=
ut better be safe than sorry:

select xslt_process('<root xml_tb_version=3D"2.0" type=3D"struct" >
<ttm type=3D"int32" >60</ttm>
<delta type=3D"double" >0.75</delta>
<ttm2 type=3D"int32" >30</ttm2>
<delta2 type=3D"double" >0.75</delta2>
<expMonthNum type=3D"int32" >1</expMonthNum>
<assetComb type=3D"cell" >
    <item type=3D"char" >calendar spread</item>
</assetComb>
</root>',
'<?xml version=3D"1.0" encoding=3D"UTF-8"?>
<xsl:stylesheet xmlns:xsl=3D"http://www.w3.org/1999/XSL/Transform" version=
=3D"1.0">
<xsl:output method=3D"xml" indent=3D"yes"/>
<xsl:template match=3D"root">
        <xsl:for-each select=3D"*">
        <xsl:if test=3D"item">
        <elem type=3D"{@type}" name=3D"{global-name()}">
        <xsl:value-of select=3D"./item"/>
        </elem>
        <xsl:text>
</xsl:text>=09=09
        </xsl:if>
        <xsl:if test=3D"not(item)">
        <elem type=3D"{@type}" name=3D"{name()}">
        <xsl:value-of select=3D"."/>
        </elem>
        <xsl:text>
</xsl:text>=09=09
        </xsl:if>=20=20=20=20=20=20=20=20
        </xsl:for-each>
</xsl:template>
</xsl:stylesheet>','')

A correct error report for this case would be something like "function glob=
al-name is unknown" (I've just replaced a correct "name" function with "glo=
bal-name") but of course "failed to apply stylesheet" is still better than =
a crash :)

Thanks,
Peter


Peter Gagarinov | Head of Modelling and Analytics

Allied Testing


-----Original Message-----
From: Tom Lane [mailto:tgl@sss.pgh.pa.us]=20
Sent: Tuesday, June 05, 2012 4:16 AM
To: Peter Gagarinov
Cc: pgsql-bugs@postgresql.org
Subject: Re: [BUGS] Calling xlst_process with certain arguments causes serv=
er crash=20

I wrote:
> Hm, apparently xsltApplyStylesheet returns a NULL in this example, and=20
> we're passing that on to xsltSaveResultToString which is not expecting=20
> any such thing.  I presume we need another error check here, but what=20
> should the error say exactly?  Can we get any info more detailed than=20
> "failed to apply stylesheet"?

Apparently not -- or at least, if libxslt provides any easy way to extract =
error reports, it's not evident from the pretty-awful documentation.  I've =
committed a fix that just reports "failed to apply stylesheet".

            regards, tom lane