(this transcript originally posted to sablotron ml at address http://archive.gingerall.cz/archives/sablot/msg00252.html .
they suggested me to post on php bugtracking too. An attached script was posted and it's available at the above address. This mail was transcripted here only for possible future reference. please contact me if you need more data)
 
----------------------------

hi all... i'm using

- apache 1.3.23
- php 4.1.1
- expat 1.95.2
- Sablotron 0.82
- Linux Mandrake 8.0

i'm tring to parse the xml/xsl files i provide as attachment. parsing them with
sabcmd give me the correct output. Parsing it through apache lead to a brute
connection closed that smells a lot of segfault. So i tried to track down the
problem. I compiled php as cgi executable and tried to parse the php from gdb.
this is the result


(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/local/bin/php -f slashdot.php
 
 
Program received signal SIGSEGV, Segmentation fault.
0x400d7765 in Situation::generateMessage (this=0x3e73746e, type=538976288, code=538976288, arg1=@0x20202020,
    arg2=@0x20202020, theMessage=@0x20202020) at situa.cpp:279
279         if (messenger && !(flags & SAB_NO_ERROR_REPORTING))
(gdb)

good... stack corruption

(gdb) bt
#0  0x400d7765 in Situation::generateMessage (this=0x3e73746e, type=538976288, code=538976288,
    arg1=@0x20202020, arg2=@0x20202020, theMessage=@0x20202020) at situa.cpp:279
#1  0x656d6d6f in ?? ()
Cannot access memory at address 0x632f3c35
(gdb)

please note that 0x656d6d6f is "emmo" which really seems "cOMMEnt" reversed. Also 0x632f3c35
is "c/<5" which is "5</c" from reversed "<comments>105</comments>". arg1 and arg2 are filled
with spaces. as my file is (however, it crashes even without trailing spaces)

If you need more data contact me.

a few debug:

(gdb) break *0x400d7cb8
Breakpoint 2 at 0x400d7cb8: file situa.cpp, line 350.
(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y
 
Starting program: /usr/local/bin/php -f /usr/local/apache/htdocs/slashdot.php
Breakpoint 2 at 0x400d7cb8
Breakpoint 2 at 0x400d7cb8: file situa.cpp, line 350.
 
 
Breakpoint 2, Situation::message (this=0x81bc890, type=MT_LOG, code=L_START, arg1=@0xbfffdd10,
    arg2=@0xbfffdd20) at situa.cpp:350
350         if (code == E2_SDOM)
(gdb) cont
Continuing.
 
Breakpoint 2, Situation::message (this=0x81bc890, type=MT_LOG, code=L1_PARSING, arg1=@0x81b3b88,
    arg2=@0xbfffda70) at situa.cpp:350
350         if (code == E2_SDOM)
(gdb) n
357             if (type == MT_ERROR)
(gdb)
361         Str temp;
(gdb)
362         if (type == MT_ERROR)
(gdb)
364         generateMessage(type, code, arg1, arg2, temp);
(gdb)
 
Program received signal SIGSEGV, Segmentation fault.
0x400d7765 in Situation::generateMessage (this=0x3e73746e, type=538976288, code=538976288, arg1=@0x20202020,
    arg2=@0x20202020, theMessage=@0x20202020) at situa.cpp:279
279         if (messenger && !(flags & SAB_NO_ERROR_REPORTING))
(gdb)



---------------


(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /usr/local/bin/php -f /usr/local/apache/htdocs/slashdot.php
Breakpoint 2 at 0x400d7cb8
Breakpoint 2 at 0x400d7cb8: file situa.cpp, line 350.


ciao
Breakpoint 2, Situation::message (this=0x81bc890, type=MT_LOG, code=L_START, arg1=@0xbfffdd10,
    arg2=@0xbfffdd20) at situa.cpp:350
350         if (code == E2_SDOM)
(gdb) cont
Continuing.

Breakpoint 2, Situation::message (this=0x81bc890, type=MT_LOG, code=L1_PARSING, arg1=@0x81b3b88,
    arg2=@0xbfffda70) at situa.cpp:350
350         if (code == E2_SDOM)
(gdb) n
357             if (type == MT_ERROR)
(gdb)
361         Str temp;
(gdb)
362         if (type == MT_ERROR)
(gdb)
364         generateMessage(type, code, arg1, arg2, temp);
(gdb) s
Situation::generateMessage (this=0x81bc890, type=MT_LOG, code=L1_PARSING, arg1=@0x81b3b88, arg2=@0xbfffda70,
    theMessage=@0xbfffd9a0) at situa.cpp:227
227         PList<DStr*> out;
(gdb) n
228         void *messengerUD = NULL;
(gdb)
230         if (proc)
(gdb)
229         MessageHandler *messenger = NULL;
(gdb)
230         if (proc)
(gdb)
231             messenger = proc -> getMessageHandler(&messengerUD);
(gdb)
232         if (messenger)
(gdb)
234             out.append(new DStr("msgtype:"));
(gdb)
235             switch(type)
(gdb)
720         assert((ndx < nItems) && (ndx >= 0));
(gdb)
719     {
(gdb)
720         assert((ndx < nItems) && (ndx >= 0));
(gdb)
719     {
(gdb)
239             case MT_LOG: *(out[0]) += "log"; break;
(gdb)
242         if (type != MT_LOG)
(gdb)
247         if (messenger)
(gdb)
248             out.append(new DStr("module:Sablotron"));
(gdb)
249         if (!info.currFile.isEmpty())
(gdb)
254         if (info.currLine && type != MT_LOG)
(gdb)
259         if (info.currV && type != MT_LOG)
(gdb)
269         SabMsg *p = GetMessage(code);
(gdb)
271         if (p -> text[0])
(gdb) print p
$1 = (SabMsg *) 0x40110dd0
(gdb) print arg1
$2 = (Str &) @0x81b3b88: {
  text_ = 0x81b2b98 "<?xml version=\"1.0\"?>\n<backslash xmlns:/backslash=\"http://slashdot.org/backslash.dtd\";>\n<story>\n<title>Free Stripped-Down 3D Studio Max</title>\n<url>http://slashdot.org/article.pl?sid=00/07/30/2056209<"..., byteLength_ = 2022, _vptr. = 0x40111d80}
(gdb) print arg2
$3 = (Str &) @0xbfffda70: {text_ = 0x81b19b8 "", byteLength_ = 0, _vptr. = 0x40111d80}
(gdb) n
273             DStr msgText = messenger ? (char*)"msg:" : (char*)"";
(gdb)
274             sprintf(buf,p -> text,(char*)(Str&)arg1,(char*)(Str&)arg2);
(gdb)
275             msgText += buf;
(gdb)
276             out.append(new DStr(msgText));
(gdb)
279         if (messenger && !(flags & SAB_NO_ERROR_REPORTING))
(gdb)
 
Program received signal SIGSEGV, Segmentation fault.
0x400d7765 in Situation::generateMessage (this=0x3e73746e, type=538976288, code=538976288, arg1=@0x20202020,
    arg2=@0x20202020, theMessage=@0x20202020) at situa.cpp:279
279         if (messenger && !(flags & SAB_NO_ERROR_REPORTING))
(gdb)