Segmentation fault during XSLT transformation

[ojundt]

What problems are you experiencing?
Nokogiri crashes with a segmentation fault during a XSLT transformation.

What's the output from nokogiri -v?

# Nokogiri (1.8.5)
    ---
    warnings: []
    nokogiri: 1.8.5
    ruby:
      version: 2.5.1
      platform: x86_64-darwin17
      description: ruby 2.5.1p57 (2018-03-29 revision 63029) [x86_64-darwin17]
      engine: ruby
    libxml:
      binding: extension
      source: packaged
      libxml2_path: "/Users/foobar/.rvm/gems/ruby-2.5.1/gems/nokogiri-1.8.5/ports/x86_64-apple-darwin17.4.0/libxml2/2.9.8"
      libxslt_path: "/Users/foobar/.rvm/gems/ruby-2.5.1/gems/nokogiri-1.8.5/ports/x86_64-apple-darwin17.4.0/libxslt/1.1.32"
      libxml2_patches:
      - 0001-Revert-Do-not-URI-escape-in-server-side-includes.patch
      - 0002-Fix-nullptr-deref-with-XPath-logic-ops.patch
      - 0003-Fix-infinite-loop-in-LZMA-decompression.patch
      libxslt_patches: []
      compiled: 2.9.8
      loaded: 2.9.8

Can you provide a self-contained script that reproduces what you're seeing?
Yes, see example.zip for a simple ruby script and example XSL and XML file.

[flavorjones]

Thanks for reporting this. I'll take a look as soon as I have some free time.

[ojundt]

Thanks @flavorjones. In the meantime I've been able to narrow it down to the presence of xs:decimal calls in the XSL which are XPath 2.0 features. If I remove those, Nokogiri no longer crashes.

[flavorjones]

Ah, that's great information. libxml2 does not support XPath 2.0 queries. It's curious to me that it's _crashing_, though, and I will see if there's anything we can do in Nokogiri to prevent that.

…

On Thu, Oct 11, 2018 at 4:52 AM Oliver Jundt ***@***.***> wrote: Thanks @flavorjones <https://github.com/flavorjones>. In the meantime I've been able to narrow it down to the presence of xs:decimal calls in the XSL which are XPath 2.0 features. If I remove those, Nokogiri no longer crashes. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1802 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAgD1qtZBGQnN_R7nWu4IaOtDKtEUh1ks5ujwbRgaJpZM4XU3zG> .

[flavorjones]

@ojundt Are you able to provide a smaller repro script? If not maybe it's no biggie, but the test I have based on this data is large as a result.

[flavorjones]

just pushed branch 1802-xpath2-causes-segfault-in-transform which still needs a test before it gets merged.

[flavorjones]

@ojundt Never mind - I've got it shortened down to a very small size now. Thanks again for the repro!

[flavorjones]

See PR #1860 to address this issue.