Created attachment 658909 [details]
Demonstration Tcl script

Description of problem:

tDOM includes its own block-allocator which is enabled by default, but only
works correctly on 32-bit architectures.  The tDOM-0.8.2/unix/CONFIG file says:

  # --enable-tdomalloc
  # Default: on
  # With this option on, a special memory allocator is used, which is
  # optimized for low memory allocation overhead. This allocator works
  # only on 32-bit plattforms. If you build for a 64-bit OS, you _must_
  # disable this.

The EPEL package does not disable it.


Version-Release number of selected component (if applicable): 0.8.2-6


How reproducible:

The attached Tcl script parses a small piece of XML into a DOM-tree, selects two
nodes and deletes them.  Because of the use of tDOM's block-allocator the nodes
overlap in memory and the deletion of the first node corrupts the second one,
leading to a seg-fault during the deletion of the second node.


Steps to Reproduce:
1. Run the attached Tcl script.
2.
3.


Actual results:

Here is the output of the script:

  [jsowden.openbet:~/tmp/tdomtest] $ ./tdomtest.tcl
  <root>
      <child>
	  <attr1>one</attr1>
	  <attr2>two</attr2>
	  <attr3>three</attr3>
	  <attr4>four</attr4>
	  <attr5>five</attr5>
	  <attr6>six</attr6>
	  <attr7>seven</attr7>
	  <attr8>eight</attr8>
      </child>
  </root>

  AZL: 0: domNode0x10f8878
  AZL: 1: domNode0x1104cac - domDoc0x10da0c0
  AZL: 1: domNode0x1104ce4 - domDoc0x10da0c0
  AZL: 2: domNode0x1104ce4 -
  AZL: 3
  AZL: 0: domNode0x10f88c8
  AZL: 1: domNode0x1104ce4 -
  Segmentation fault (core dumped)

The two nodes to be deleted are domNode0x1104cac and domNode0x1104ce4.  The
names of the nodes correspond to their locations in memory.  Given that
sizeof (domNode) == 80 but 0x1104ce4 - 0x1104cac == 56, it is clear that they
must overlap.


Expected results:

After this patch had been applied to the spec-file:

--- SPECS/tdom.spec~    2012-12-06 17:30:32.559448879 +0000
+++ SPECS/tdom.spec     2012-12-06 17:30:35.031448564 +0000
@@ -35,7 +35,11 @@


 %build
+%ifarch %ix86
 %configure --enable-threads
+%else
+%configure --enable-threads --disable-tdomalloc
+%endif
 make %{?_smp_mflags}

 %install

and the package had been rebuilt and reinstalled, the following output from the
script was observed:

  [jsowden.openbet:~/tmp/tdomtest] $ ./tdomtest.tcl
  <root>
      <child>
	  <attr1>one</attr1>
	  <attr2>two</attr2>
	  <attr3>three</attr3>
	  <attr4>four</attr4>
	  <attr5>five</attr5>
	  <attr6>six</attr6>
	  <attr7>seven</attr7>
	  <attr8>eight</attr8>
      </child>
  </root>

  AZL: 0: domNode0x1a67780
  AZL: 1: domNode0x1a677e0 - domDoc0x1a820c0
  AZL: 1: domNode0x1a8eca0 - domDoc0x1a820c0
  AZL: 2: domNode0x1a8eca0 - domDoc0x1a820c0
  AZL: 3
  AZL: 0: domNode0x1a8ec40
  AZL: 1: domNode0x1a8eca0 - domDoc0x1a820c0
  AZL: 3

The two deleted nodes are no longer overlapping and the script runs to
completion.

Additional info:

The particular code in tDOM which causes this crash is tDOM-0.8.2/generic/dom.c,
ll. 2583ff.:

    TDomThreaded (
        if (shared) {
            if (doc->deletedNodes) {
                doc->deletedNodes->nextDeleted = node;
            } else {
                doc->deletedNodes = node;
            }
            node->nodeFlags |= IS_DELETED;
            node->nextDeleted = NULL;
        }
    )

node->nextDeleted is near the end of the structure and overlaps the
ownerDocument field of the following node.  Therefore, when NULL is assigned to
it, the ownerDocument field is also overwritten, leading to a subsequent null-
pointer-dereference.