bug#7172: emacs 23.2; xml.el: xml-parse-file hangs when DOCTYPE element names contain _ (underscore)

bug#7172: emacs 23.2; xml.el: xml-parse-file hangs when DOCTYPE element names contain _ (underscore)

[Jose Marino]

In a DOCTYPE construction, whenever there's an ELEMENT name with an 
underscore in its name, function xml-parse-file makes emacs become 
unresponsive and use 100% cpu. Emacs recovers nicely with C-g but no 
error is printed.

To reproduce this behavior I set up these two simple xml files:

------------ output --------------
$ cat example-good.xml
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE EXAMPLE [
    <!ELEMENT EXAMPLE EMPTY>
]>
<EXAMPLE>
</EXAMPLE>

$ cat example-bad.xml
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE EXAMPLE [
    <!ELEMENT EXAM_PLE EMPTY>
]>
<EXAM_PLE>
</EXAM_PLE>
------------ output --------------

Then from emacs I run:
(xml-parse-file "example-good.xml")
Which as expected produces:
((EXAMPLE nil "
"))

But when I do the same for the other file:
(xml-parse-file "example-bad.xml")
No output is produced and emacs becomes unresponsive.

Attaching strace to the running emacs process prints:
brk(0x267b000)                          = 0x267b000
brk(0x269d000)                          = 0x269d000
brk(0x2637000)                          = 0x2637000
brk(0x2659000)                          = 0x2659000
brk(0x267b000)                          = 0x267b000
brk(0x269d000)                          = 0x269d000
brk(0x2637000)                          = 0x2637000
brk(0x2659000)                          = 0x2659000
brk(0x267b000)                          = 0x267b000
brk(0x269d000)                          = 0x269d000
brk(0x2637000)                          = 0x2637000
brk(0x2659000)                          = 0x2659000

These messages repeat over and over.

I should mention that this behavior seems to be triggered by the 
underscore in the DOCTYPE ELEMENT name, and is not affected by the 
underscore in the actual element's name. Thus, this file also triggers 
the bug:
$ cat example-bad2.xml
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE EXAMPLE [
    <!ELEMENT EXAM_PLE EMPTY>
]>
<EXAMPLE>
</EXAMPLE>

bug#7172: emacs 23.2; xml.el: xml-parse-file hangs when DOCTYPE element names contain _ (underscore)

[Glenn Morris]

Jose Marino wrote:

> Attaching strace to the running emacs process prints:
> brk(0x267b000)                          = 0x267b000

A much more useful thing to do in such cases is to
M-x toggle-debug-on-quit
beforehand, then interrupt Emacs with C-g when it hangs. Resulting backtrace:

Debugger entered--Lisp error: (quit)
  looking-at("<!ATTLIST[ 	\n\r]*\\([[:alpha:]:_][-[:digit:].[:alpha:]:_]*\\)[ 	\n\r]*\\(\\(?:[ 	\n\r]*[[:alpha:]:_][-[:digit:].[:alpha:]:_]*[ 	\n\r]*\\(?:CDATA\\|\\(?:ID\\|IDREF\\|IDREFS\\|ENTITY\\|ENTITIES\\|NMTOKEN\\|NMTOKENS\\)\\|\\(?:NOTATION[ 	\n\r]([ 	\n\r]*[[:alpha:]:_][-[:digit:].[:alpha:]:_]*\\(?:[ 	\n\r]*|[ 	\n\r]*[[:alpha:]:_][-[:digit:].[:alpha:]:_]*\\)*[ 	\n\r]*)\\)\\|\\(?:\\(?:NOTATION[ 	\n\r]([ 	\n\r]*[[:alpha:]:_][-[:digit:].[:alpha:]:_]*\\(?:[ 	\n\r]*|[ 	\n\r]*[[:alpha:]:_][-[:digit:].[:alpha:]:_]*\\)*[ 	\n\r]*)\\)\\|\\(?:([ 	\n\r]*[-[:digit:].[:alpha:]:_]+\\(?:[ 	\n\r]*|[ 	\n\r]*[-[:digit:].[:alpha:]:_]+\\)*[ 	\n\r])\\)\\)\\)[ 	\n\r]*\\(?:#REQUIRED\\|#IMPLIED\\|\\(?:#FIXED[ 	\n\r]\\)*\\(?:\"\\(?:[^&\"]\\|\\(?:&[[:alpha:]:_][-[:digit:].[:alpha:]:_]*;\\|\\(?:&#[0-9]+;\\|&#x[0-9a-fA-F]+;\\)\\)\\)*\"\\|'\\(?:[^&']\\|\\(?:&[[:alpha:]:_][-[:digit:].[:alpha:]:_]*;\\|\\(?:&#[0-9]+;\\|&#x[0-9a-fA-F]+;\\)\\)\\)*'\\)\\)\\)\\)*[ 	\n\r]*>")
  xml-parse-dtd(nil)
  xml-parse-tag(nil nil)
  xml-parse-tag(nil nil)
  xml-parse-region(1 116 #<buffer  *temp*> nil nil)
  xml-parse-file("example-bad.xml")


That certainly is a regexp.

bug#7172: emacs 23.2; xml.el: xml-parse-file hangs when DOCTYPE element names contain _ (underscore)

[Chong Yidong]

Jose Marino <marinoj@astro.ufl.edu> writes:

> In a DOCTYPE construction, whenever there's an ELEMENT name with an
> underscore in its name, function xml-parse-file makes emacs become
> unresponsive and use 100% cpu. Emacs recovers nicely with C-g but no
> error is printed.
>
> $ cat example-bad.xml
> <?xml version="1.0" encoding="utf-8"?>
> <!DOCTYPE EXAMPLE [
>    <!ELEMENT EXAM_PLE EMPTY>
> ]>
> <EXAM_PLE>
> </EXAM_PLE>

This is fixed in trunk.  Thanks for the bug report.