fixed a serious memory problen when walking the namespace axis showing up

* xpath.c include/libxml/xpath.h: fixed a serious memory problen
  when walking the namespace axis showing up in
  libxst/tests/general/bug-12
* xmlmemory.c: added the possibility to trace a given block
  defined by its address
Daniel

ChangeLog

+Mon Jul 30 12:58:39 EDT 2001 Daniel Veillard <Daniel.Veillard@imag.fr>
+
+	* xpath.c include/libxml/xpath.h: fixed a serious memory problen
+	  when walking the namespace axis showing up in
+	  libxst/tests/general/bug-12
+	* xmlmemory.c: added the possibility to trace a given block
+	  defined by its address
+
 Sun Jul 29 07:18:53 EDT 2001 Daniel Veillard <Daniel.Veillard@imag.fr>
 
 	* parser.c: don't override existing encoding specified before

include/libxml/xpath.h

@@ -235,6 +235,10 @@ struct _xmlXPathContext {
     /* function lookup function and data */
     void *funcLookupFunc;		/* function lookup func */
     void *funcLookupData;		/* function lookup data */
+
+    /* temporary namespace lists kept for walking the namespace axis */
+    xmlNsPtr *tmpNsList;		/* Array of namespaces */
+    int tmpNsNr;			/* number of namespace in scope */
 };
 
 /*

xmlmemory.c

@@ -95,6 +95,7 @@ static unsigned long  debugMemSize = 0;
 static unsigned long  debugMaxMemSize = 0;
 static int block=0;
 int xmlMemStopAtBlock = 0;
+void *xmlMemTraceBlockAt = NULL;
 int xmlMemInitialized = 0;
 #ifdef MEM_LIST
 static MEMHDR *memlist = NULL;
@@ -140,6 +141,7 @@ void *
 xmlMallocLoc(size_t size, const char * file, int line)
 {
     MEMHDR *p;
+    void *ret;
     
     if (!xmlMemInitialized) xmlInitMemory();
 #ifdef DEBUG_MEMORY
@@ -176,9 +178,17 @@ xmlMallocLoc(size_t size, const char * file, int line)
     
     if (xmlMemStopAtBlock == block) xmlMallocBreakpoint();
 
+    ret = HDR_2_CLIENT(p);
+
+    if (xmlMemTraceBlockAt == ret) {
+	xmlGenericError(xmlGenericErrorContext,
+			"%p : Malloc(%d) Ok\n", xmlMemTraceBlockAt, size);
+	xmlMallocBreakpoint();
+    }
+
     TEST_POINT
 
-    return(HDR_2_CLIENT(p));
+    return(ret);
 }
 
 /**
@@ -233,6 +243,12 @@ xmlReallocLoc(void *ptr,size_t size, const char * file, int line)
     if (!p) {
 	 goto error;
     }
+    if (xmlMemTraceBlockAt == ptr) {
+	xmlGenericError(xmlGenericErrorContext,
+			"%p : Realloced(%d -> %d) Ok\n",
+			xmlMemTraceBlockAt, p->mh_size, size);
+	xmlMallocBreakpoint();
+    }
     p->mh_tag = MEMTAG;
     p->mh_number = number;
     p->mh_type = REALLOC_TYPE;
@@ -280,14 +296,26 @@ xmlMemFree(void *ptr)
     MEMHDR *p;
     char *target;
 
+    if (ptr == (void *) -1) {
+	xmlGenericError(xmlGenericErrorContext,
+	    "trying to free pointer from freed area\n");
+        goto error;
+    }
+
+    if (xmlMemTraceBlockAt == ptr) {
+	xmlGenericError(xmlGenericErrorContext,
+			"%p : Freed()\n", xmlMemTraceBlockAt);
+	xmlMallocBreakpoint();
+    }
+
     TEST_POINT
 
     target = (char *) ptr;
 
     p = CLIENT_2_HDR(ptr);
     if (p->mh_tag != MEMTAG) {
-       Mem_Tag_Err(p);
-       goto error;
+        Mem_Tag_Err(p);
+        goto error;
     }
     p->mh_tag = ~MEMTAG;
     debugMemSize -= p->mh_size;
@@ -305,6 +333,7 @@ xmlMemFree(void *ptr)
 error:    
     xmlGenericError(xmlGenericErrorContext,
 	    "xmlFree(%lX) error\n", (unsigned long) ptr);
+    xmlMallocBreakpoint();
     return;
 }
 
@@ -355,6 +384,12 @@ xmlMemStrdupLoc(const char *str, const char *file, int line)
     
     TEST_POINT
 
+    if (xmlMemTraceBlockAt == s) {
+	xmlGenericError(xmlGenericErrorContext,
+			"%p : Strdup() Ok\n", xmlMemTraceBlockAt);
+	xmlMallocBreakpoint();
+    }
+
     return(s);
 
 error:
@@ -504,6 +539,7 @@ xmlMemDisplay(FILE *fp)
 #ifdef MEM_LIST
     MEMHDR *p;
     int     idx;
+    int     nb = 0;
 #if defined(HAVE_LOCALTIME) && defined(HAVE_STRFTIME)
     time_t currentTime;
     char buf[500];
@@ -532,7 +568,12 @@ xmlMemDisplay(FILE *fp)
 	  if (p->mh_file != NULL) fprintf(fp,"%s(%d)", p->mh_file, p->mh_line);
         if (p->mh_tag != MEMTAG)
 	      fprintf(fp,"  INVALID");
-	xmlMemContentShow(fp, p);
+        nb++;
+	if (nb < 100)
+	    xmlMemContentShow(fp, p);
+	else
+	    fprintf(fp," skip");
+
         fprintf(fp,"\n");
         p = p->mh_next;
     }
@@ -655,6 +696,12 @@ xmlInitMemory(void)
          sscanf(breakpoint, "%d", &xmlMemStopAtBlock);
      }
 #endif     
+#ifdef HAVE_STDLIB_H
+     breakpoint = getenv("XML_MEM_TRACE");
+     if (breakpoint != NULL) {
+         sscanf(breakpoint, "%p", &xmlMemTraceBlockAt);
+     }
+#endif     
     
 #ifdef DEBUG_MEMORY
      xmlGenericError(xmlGenericErrorContext,

xpath.c

@@ -5043,16 +5043,23 @@ xmlXPathNextPrecedingInternal(xmlXPathParserContextPtr ctxt,
  */
 xmlNodePtr
 xmlXPathNextNamespace(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
+    xmlNodePtr ret;
+
     if (ctxt->context->node->type != XML_ELEMENT_NODE) return(NULL);
-    if ((cur == NULL) || (ctxt->context->namespaces == NULL)) {
-        if (ctxt->context->namespaces != NULL)
-	    xmlFree(ctxt->context->namespaces);
-	ctxt->context->namespaces = 
+    if ((cur == NULL) || (ctxt->context->tmpNsList == NULL)) {
+        if (ctxt->context->tmpNsList != NULL)
+	    xmlFree(ctxt->context->tmpNsList);
+	ctxt->context->tmpNsList = 
 	    xmlGetNsList(ctxt->context->doc, ctxt->context->node);
-	if (ctxt->context->namespaces == NULL) return(NULL);
-	ctxt->context->nsNr = 0;
+	if (ctxt->context->tmpNsList == NULL) return(NULL);
+	ctxt->context->tmpNsNr = 0;
+    }
+    ret = (xmlNodePtr)ctxt->context->tmpNsList[ctxt->context->tmpNsNr++];
+    if (ret == NULL) {
+	xmlFree(ctxt->context->tmpNsList);
+	ctxt->context->tmpNsList = NULL;
     }
-    return((xmlNodePtr)ctxt->context->namespaces[ctxt->context->nsNr++]);
+    return(ret);
 }
 
 /**