RE: Tidy inline stack bug

I think this bug has existed for a while.  See:

http://lists.w3.org/Archives/Public/html-tidy/1999JulSep/0078.html

(Andy's description rang a bell, so I had to check...)

Randy

> -----Original Message-----
> From: html-tidy-request@w3.org [mailto:html-tidy-request@w3.org]On
> Behalf Of Andy Quick
> Sent: Monday, March 13, 2000 7:04 PM
> To: html-tidy@w3.org
> Subject: Tidy inline stack bug
> 
> 
> I got a bug report with Java tidy that applies to C tidy
> as well.  I spent some time arriving at a small test
> case that shows the problem, but it's a little beyond
> me right now as to how to fix it.
> 
> It appears that tidy tries to return a node from an
> empty inline stack.  C tidy doesn't actually GPF, it
> just reads unallocated memory.  Java tidy throws an
> exception when accessing a 0-sized vector.
> 
> If you put the lines marked with * into the function
> InsertedToken in istack.c, you will see the message
> "0-size istack" printed as tidy parses the example
> (illegal) HTML file below.
> 
> Regards,
> 
> Andy Quick
> ---- from InsertedToken(Lexer *lexer) ----
>     node = NewNode();
>     node->type = StartTag;
>     node->implicit = yes;
>     node->start = lexer->txtstart;
>     node->end = lexer->txtstart;
>     istack = lexer->insert;
> *   if (lexer->istacksize == 0)
> *       tidy_out(lexer->errout, "0-size istack!\n");
>     node->element = wstrdup(istack->element);
>     node->tag = istack->tag;
>     node->attributes = DupAttrs(istack->attributes);
> 
> 
> ---- HTML test case -----
> <HTML>
> <HEAD>
> <TITLE></TITLE>
> </HEAD>
> <BODY>
> 
> <DL>
> <EM>
> <DD>blah</DD>
> </EM>
> </DL>
> 
> </BODY>
> </HTML>

Received on Tuesday, 14 March 2000 15:27:32 UTC