[Bug 43377] valgrind shows an invalid read in dlls/msxml3/tests/domdoc.c

[wine-bugs at winehq.org]

https://bugs.winehq.org/show_bug.cgi?id=43377

André H. <nerv at dawncrow.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |nerv at dawncrow.de

--- Comment #1 from André H. <nerv at dawncrow.de> ---
This one seems highly related to the test crash on wine64, which happens in
test_get_ownerDocument at the end at IXMLDOMDocument2_Release(doc_owner)
which can be traced down to:

static void free_properties(domdoc_properties* properties)
{
    if (properties)
    {
        if (properties->schemaCache)
            IXMLDOMSchemaCollection2_Release(properties->schemaCache);
... crash ...

because properties is 0x8b400 I get:
wine: Unhandled page fault on read access to 0x0008b410 at address 0x8b410
(thread 002a), starting debugger...

That's because the exact same properties are already used and freed somewhere
else, which should not happen, because there is copy_properties(), but I found
a  candidate:

static HRESULT attach_xmldoc(domdoc *This, xmlDocPtr xml )
{
    release_namespaces(This);

    if(This->node.node)
    {
        priv_from_xmlDocPtr(get_doc(This))->properties = NULL;
        if (xmldoc_release(get_doc(This)) != 0)
            priv_from_xmlDocPtr(get_doc(This))->properties =
                copy_properties(This->properties);
    }

    This->node.node = (xmlNodePtr) xml;

    if(This->node.node)
    {
        xmldoc_add_ref(get_doc(This));
        priv_from_xmlDocPtr(get_doc(This))->properties = This->properties;

changing this to
        priv_from_xmlDocPtr(get_doc(This))->properties =
copy_properties(This->properties);
works fine here, I'll send a patch

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.