Fix undefined behavior validating XSD substitution groups
authorMark Shroyer <code@markshroyer.com>
Thu, 26 Sep 2013 06:01:21 +0000 (02:01 -0400)
committerThe Qt Project <gerrit-noreply@qt-project.org>
Wed, 2 Oct 2013 19:53:46 +0000 (21:53 +0200)
commit3c63cedb5d3defd831eb2d8bfdeb883121737ef3
tree84e2ff50c2ad26ca7ed188484cb21cb2f666cf80
parent11b150d935ebdd422e3d3edb698f2e08c45e2229
Fix undefined behavior validating XSD substitution groups

A bug in XSD substitution group validation would result in an invalid
cast of SchemaType::Ptr to XsdComplexType::Ptr, in which case evaluating
complexType->prohibitedSubstitutions() exhibited undefined behavior.  In
practice this caused validation against XSD schemas containing
substitution groups to fail on some machines, where ORing the checkSet
mask against out of bounds memory could cause the function

XsdSchemaHelper::substitutionGroupOkTransitive()

to return a false negative.

Minus the bug fix, the regression test added in this commit failed on
(at least) Linux ARM when compiled with the Linaro toolchain 2013.01 g++
4.7, with flags -marm -mcpu=cortex-a8 -O2.  However, it did not fail on
a Linux amd64 machine prior to the bug fix.

Change-Id: Idd060a941a3bc0620f1fcc903375e43022bdcbdc
Reviewed-by: Lars Knoll <lars.knoll@digia.com>
src/xmlpatterns/schema/qxsdschemahelper.cpp
tests/auto/xmlpatternsvalidator/files/substitution-group-invalid.xml [new file with mode: 0644]
tests/auto/xmlpatternsvalidator/files/substitution-group-valid.xml [new file with mode: 0644]
tests/auto/xmlpatternsvalidator/files/substitution-group.xsd [new file with mode: 0644]
tests/auto/xmlpatternsvalidator/tst_xmlpatternsvalidator.cpp