PM67646: MAP HANG OR CRASH ON AIX 64 BIT WHEN USING XML XERCES TYPE TREE THAT DOES NOT MATCH REFERENCED XML SCHEMA

APAR status

• Closed as program error.

Error description

• Memory corruption issue occurs when using XML Xerces type tree
  with a syntax item that does not match the XML data or the
  referenced XML Schema.  The hang is a result of sigsegv
  delivered in AIX malloc subsystem.
  
  Stack trace when malloc crashes:
  newop.operator new(unsigned long)(??) at 0x9000000004fffe0
  allocate__Q2_9xml4c_5_617MemoryManagerImplFUl() at
  0x90000000618e870
  __nw__Q2_9xml4c_5_67XMemoryFUlPQ2_9xml4c_5_613MemoryManager() at
  0x900000006137464
  xml4c_5_6::DstxXMLScanner::scanStartTagNS(bool&)(this =
  0x000000011076fcd8, gotData = true), line 2666 in
  "DstxXmlscanner.cpp"
  unnamed block in xml4c_5_6::DstxXMLScanner::scanContent()(this =
  0x000000011076fcd8), line 1105 in "DstxXmlscanner.cpp"
  xml4c_5_6::DstxXMLScanner::scanContent()(this =
  0x000000011076fcd8), line 1105 in "DstxXmlscanner.cpp"
  xml4c_5_6::DstxXMLScanner::scanDocument(const
  xml4c_5_6::InputSource&)(this = 0x000000011076fcd8, src =
  &(...)), line 326 in "DstxXmlscanner.cpp"
  DstxSAXParser.parse(const xml4c_5_6::InputSource&)(this =
  0x000000011076e6b8, source = &(...)), line 569 in
  "DstxSAXParser.cpp"
  unnamed block in
  xml4c_5_6::DstxXMLDocHandlerHelper::parse(tagExitParamStruct*,xm
  l4c_5_6::DstxXMLReaderClient*,xml4c_5_6::DstxXMLType*)(this =
  0x000000011076dd70, pExitParam = 0x0fffffffffff7c10, client =
  0x00000001106b77c0, pRootObject = 0x000000011076dd90), line 819
  in "DstxXmlDocHandlerHelper.cpp"
  xml4c_5_6::DstxXMLDocHandlerHelper::parse(tagExitParamStruct*,xm
  l4c_5_6::DstxXMLReaderClient*,xml4c_5_6::DstxXMLType*)(this =
  0x000000011076dd70, pExitParam = 0x0fffffffffff7c10, client =
  0x00000001106b77c0, pRootObject = 0x000000011076dd90), line 819
  in "DstxXmlDocHandlerHelper.cpp"
  

Local fix

• WTXCQ - WTX00040990
  EJ / EJ
  Circumvention: Set the correct encoding in the type tree.
  

Problem summary

• Users Affected:
  WebSphere Transformation Extender customers using Xerces XML
  type tree with mismatch in item syntax
  
  Problem Description:
  Crash when XML parser type tree does not match schema. And one
  of differences is a schema text element is a syntax type tree
  element.
  
  Platforms Affected:
  All
  

Problem conclusion

• Changed code to insure that syntax element does not exceed
  delimiter buffer. This will occur if type tree does not exactly
  match schema.
  
  Delivered in:
  8.3.0.5, 8.4.0.4
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE DESIG

• Fixed component ID

  5724M4008

Applicable component levels

• R820 PSY

     UP

• R830 PSY

     UP

• R840 PSY

     UP