[BUG] bind crash in statschannel.c

[JINMEI Tatuya / 神明達哉]

At Tue, 5 Jan 2010 10:00:34 +0100,
Marinescu Paul dan <pauldan.marinescu at epfl.ch> wrote:

> bind (9.6.1-P2) dies when one tries to retrieve statistics via HTTP
> from the statistcs-channel feature if an underlying call to libxml
> fails (returns a NULL pointer) at statschannel.c:720 - writer =
> xmlNewTextWriterDoc(&doc, 0);

It's clearly wrong that we do assertion failure when an libxml routine
fails (we've noticed that and have a patch, but it's not yet ready to
be merged), but in reality libxml routines normally should not fail in
a way we are using it.  The only realistic cause is memory allocation
failure within libxml, but if this happened named should have
complained about memory shortage in other places, too.  Did you see
such warnings/errors in your log?

BTW, if we trust the information in the stack trace what happened
doesn't make sense:

> #3  0x0805b5ed in assertion_failed (file=0x81e5954 "statschannel.c", line=721, type=isc_assertiontype_insist, 
>     cond=0x81e59d0 "xmlrc >= 0") at ./main.c:161

Even though this indicates "xmlrc >= 0" was false,

> #4  0x08075e45 in generatexml (server=0xb7a2b018, buflen=0xbfd2be8c, buf=0xbfd2be90) at statschannel.c:721
> 	boottime = "2009-12-16T19:01:48Z"
> 	nowstr = "2009-12-16T19:02:00Z"
> 	now = {seconds = 1260990120, nanoseconds = 623889000}
> 	writer = (xmlTextWriterPtr) 0x0
> 	doc = <value optimized out>
> 	xmlrc = 0

xmlrc is actually 0.

It's also odd that writer is NULL (it may be the reason for the error
in xmlTextWriterStartDocument(), but it still doesn't explain why
xmlrc is 0).

---
JINMEI, Tatuya
Internet Systems Consortium, Inc.