[xmlsec] memory corruption detected by libxml2 memory debugs

[Tomas Sieger]

Hi all,
  I wonder whether someone is also experiencing this kind of problem:
when I  enable libxml2 memory debugs (using --with-mem-debug option
to configure), make xmlSec against such libxml2 and run e.g. the
default sign1 xmlSec example:

   ./sign1 sign1-tmpl.xml rsakey.pem

libxml2 reports memory problems (see the end of this mail). However,
the example works well. I wonder if this is a real problem.
I'm using:
- libxml2 2.6.16
- openssl 0.9.7d (built as a shared lib)
- xmlSec 1.2.6 with dynamic crypto module loading:
   xmlsec1-config --cflags:
     -DXMLSEC_LIBXML_260=1
     -D__XMLSEC_FUNCTION__=__FUNCTION__
     -DXMLSEC_NO_XSLT=1
     -DXMLSEC_NO_XKMS=1
     -I/opt/soft/xmlsec1-1.2.6/include/xmlsec1
     -I/opt/soft/libxml2-2.6.16/include/libxml2
     -DXMLSEC_CRYPTO_DYNAMIC_LOADING=1
     -DXMLSEC_CRYPTO=\"openssl\"
on intel linux, Fedora Core 3 (gcc 3.4.2, glibc 2.3.3).

I've tracked down the "xmlMemFree" problem:

#0  xmlMallocBreakpoint () at xmlmemory.c:145
#1  0xf6f03b05 in xmlMemFree__internal_alias (ptr=0xf6f848cb) at 
xmlmemory.c:459
#2  0xf6fc100c in xmlSecCryptoDLFree (ptr=0x1a) at ../../src/dl.c:316
#3  0xf6fb8dad in xmlsec_lt_dlexit () at ../../src/xmlsec-ltdl.c:1418
#4  0xf6fc10e8 in xmlSecCryptoDLShutdown () at ../../src/dl.c:374
#5  0xf6fdedf0 in xmlSecShutdown () at ../../src/xmlsec.c:113
#6  0x08048d9f in main (argc=3, argv=0xfef8eeb4) at sign1.c:107

best regards
  Tomas

----- sign1 example error output -----

Memory tag error occurs :0x8ea9650
          bye
       11:59:58 AM

       MEMORY ALLOCATED : 726, MAX was 30088
BLOCK  NUMBER   SIZE  TYPE
0          21     16 malloc()  in none(0)
1          20     16 malloc()  in none(0)
2          19    256 malloc()  in none(0) pointer to #18 at index 0
3          18     16 malloc()  in none(0)
4          17     20 malloc()  in none(0) pointer to #16 at index 0
5          16      5 strdup()  in none(0) "HTML"
6          15     20 malloc()  in none(0) pointer to #14 at index 0
7          14      9 strdup()  in none(0) "US-ASCII"
8          13     20 malloc()  in none(0) pointer to #12 at index 0
9          12      6 strdup()  in none(0) "ASCII"
10         11     20 malloc()  in none(0) pointer to #10 at index 0
11         10     11 strdup()  in none(0) "ISO-8859-1"
12          9     20 malloc()  in none(0) pointer to #8 at index 0
13          8      7 strdup()  in none(0) "UTF-16"
14          7     20 malloc()  in none(0) pointer to #6 at index 0
15          6      9 strdup()  in none(0) "UTF-16BE"
16          5     20 malloc()  in none(0) pointer to #4 at index 0
17          4      9 strdup()  in none(0) "UTF-16LE"
18          3     20 malloc()  in none(0) pointer to #2 at index 0
19          2      6 strdup()  in none(0) "UTF-8"
20          1    200 malloc()  in none(0) pointer to #3 at index 0
xmlMemFree(8EA9670) error
xmlMallocBreakpoint reached on block 0
Memory tag error occurs :0x8ea9628
          bye
       11:59:58 AM

       MEMORY ALLOCATED : 726, MAX was 30088
BLOCK  NUMBER   SIZE  TYPE
0          21     16 malloc()  in none(0)
1          20     16 malloc()  in none(0)
2          19    256 malloc()  in none(0) pointer to #18 at index 0
3          18     16 malloc()  in none(0)
4          17     20 malloc()  in none(0) pointer to #16 at index 0
5          16      5 strdup()  in none(0) "HTML"
6          15     20 malloc()  in none(0) pointer to #14 at index 0
7          14      9 strdup()  in none(0) "US-ASCII"
8          13     20 malloc()  in none(0) pointer to #12 at index 0
9          12      6 strdup()  in none(0) "ASCII"
10         11     20 malloc()  in none(0) pointer to #10 at index 0
11         10     11 strdup()  in none(0) "ISO-8859-1"
12          9     20 malloc()  in none(0) pointer to #8 at index 0
13          8      7 strdup()  in none(0) "UTF-16"
14          7     20 malloc()  in none(0) pointer to #6 at index 0
15          6      9 strdup()  in none(0) "UTF-16BE"
16          5     20 malloc()  in none(0) pointer to #4 at index 0
17          4      9 strdup()  in none(0) "UTF-16LE"
18          3     20 malloc()  in none(0) pointer to #2 at index 0
19          2      6 strdup()  in none(0) "UTF-8"
20          1    200 malloc()  in none(0) pointer to #3 at index 0
xmlMemFree(8EA9648) error
xmlMallocBreakpoint reached on block 0

------ end of output -----