xmllint crashed with SIGSEGV in ____strtol_l_internal()

[Tais P. Hansen]

Running "xmllint --pretty" with/without input crashes. Possibly a cmdline parameter parse problem, as --pretty should take a numeric argument.

ProblemType: Crash
DistroRelease: Ubuntu 11.10
Package: libxml2-utils 2.7.8.dfsg-4ubuntu0.1
ProcVersionSignature: Ubuntu 3.0.0-15.26-generic 3.0.13
Uname: Linux 3.0.0-15-generic x86_64
ApportVersion: 1.23-0ubuntu4
Architecture: amd64
Date: Mon Jan 30 11:31:08 2012
ExecutablePath: /usr/bin/xmllint
InstallationMedia: Kubuntu 11.04 "Natty Narwhal" - Release amd64 (20110427)
ProcCmdline: xmllint --pretty
ProcEnviron:
 SHELL=/bin/bash
 PATH=(custom, user)
 LANG=en_US.UTF-8
 LANGUAGE=en_US:en
SegvAnalysis:
 Segfault happened at: 0x7fe5a5f809f4 <____strtol_l_internal+68>: movzbl (%rbx),%eax
 PC (0x7fe5a5f809f4) ok
 source "(%rbx)" (0x00000000) not located in a known VMA region (needed readable region)!
 destination "%eax" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: libxml2
StacktraceTop:
 ____strtol_l_internal (nptr=0x0, endptr=0x0, base=10, group=<optimized out>, loc=0x7fe5a62dc6a0) at ../stdlib/strtol_l.c:298
 atoi (__nptr=<optimized out>) at /usr/include/stdlib.h:286
 main (argc=2, argv=0x7fff7f294e38) at ../../xmllint.c:3351
Title: xmllint crashed with SIGSEGV in ____strtol_l_internal()
UpgradeStatus: Upgraded to oneiric on 2011-10-14 (107 days ago)
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare

[Apport retracing service (apport)]

StacktraceTop:
 ____strtol_l_internal (nptr=0x0, endptr=0x0, base=10, group=<optimized out>, loc=0x7fe5a62dc6a0) at ../stdlib/strtol_l.c:298
 atoi (__nptr=<optimized out>) at /usr/include/stdlib.h:286
 main (argc=2, argv=0x7fff7f294e38) at ../../xmllint.c:3351

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Chris West (faux)]

        else if ((!strcmp(argv[i], "-pretty")) ||
                 (!strcmp(argv[i], "--pretty"))) {
             i++;
#ifdef LIBXML_OUTPUT_ENABLED
             format = atoi(argv[i]);

i > argc. Boom!

[Tim Galeckas (tim-n)]

I have included a patch.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "Check for NULL into atoi" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]