Bug 1184025

Description of problem:
When trying to parse an XML, there's some invalid address being used in strncpm().

Version-Release number of selected component (if applicable):
both following packages have the same problem:
 libxml2-2.7.6-14.el6.x86_64
 libxml2-2.7.6-17.el6_6.1.x86_64
*But* this happens after an upgrade to latest packages and libxml2 was not part of the upgrade!  But I'm assigning this to libxml2 as I don't know where else to track it (see the backtrace below).

How reproducible:
100%

 Steps to Reproduce:
1.

$ cat >test.c <<EOF
#include <stdio.h>
#include <stdlib.h>
#include <libxml/parser.h>

int
main(int argc, char **argv)
{
    int ret = EXIT_FAILURE;
    xmlDocPtr doc = NULL;
    xmlParserCtxtPtr ctx = xmlNewParserCtxt();

    if (!ctx || !ctx->sax)
        goto cleanup;

    if(argc != 2)
        goto cleanup;

    doc = xmlCtxtReadFile(ctx, argv[1], NULL,
                          XML_PARSE_NONET | XML_PARSE_NOWARNING);

    if (!doc)
        goto cleanup;

    ret = EXIT_SUCCESS;
 cleanup:
    if (doc)
        xmlFreeDoc(doc);
    if (ctx)
        xmlFreeParserCtxt(ctx);
    return ret;
}
EOF

2.
$ cat >dummy.xml <<EOF
<dummy/>
EOF

3.
$ gcc -pedantic -pedantic-errors -Wall -Werror $(pkg-config --libs --cflags libxml-2.0) test.c -ggdb -o test

4.
$ ./test dummy.xml

Actual results:
Segmentation fault (core dumped)

Expected results:
Doesn't crash and returns 0 (as it does on RHEL7 for example).

Additional info:
This is an isolation of a problem that libvirt daemon cannot start.  It fails when qemu driver tries to parse a default network's XML.

Here's a full bt:

$ gdb --args ./test dummy.xml
GNU gdb (GDB) Red Hat Enterprise Linux (7.2-75.el6)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /root/test...done.
(gdb) r
Starting program: /root/test dummy.xml

Program received signal SIGSEGV, Segmentation fault.
__strncmp_ssse3 () at ../sysdeps/x86_64/strcmp.S:214
214		movlpd	(%rsi), %xmm2
(gdb) bt full
#0  __strncmp_ssse3 () at ../sysdeps/x86_64/strcmp.S:214
No locals.
#1  0x000000343545e885 in __xmlParserInputBufferCreateFilename (URI=<value optimized out>, 
    enc=XML_CHAR_ENCODING_NONE) at xmlIO.c:2525
        cptr = 0x700001c4f <Address 0x700001c4f out of bounds>
        buff4 = "<dum"
        ret = 0x602700
        i = <value optimized out>
        context = 0x6025f0
#2  0x000000343543380d in xmlNewInputFromFile__internal_alias (ctxt=0x601010, filename=0x7fffffffe8a7 "dummy.xml")
    at parserInternals.c:1549
        buf = <value optimized out>
        inputStream = <value optimized out>
        directory = 0x0
        URI = 0x0
#3  0x000000343544bebb in xmlCtxtReadFile__internal_alias (ctxt=0x601010, filename=0x7fffffffe8a7 "dummy.xml", 
    encoding=0x0, options=<value optimized out>) at parser.c:15220
        stream = <value optimized out>
#4  0x0000000000400769 in main (argc=2, argv=0x7fffffffe648) at test.c:18
        ret = 1
        doc = 0x0
        ctx = 0x601010