From: Lee Fyock <lee.fyock@...>
Date: 2007-12-06T05:00:00+09:00
Subject: Tidy segfault on Linux

Hi--

I'm using the Ruby tidy gem to clean some user-input HTML. It works
splendidly on my Mac development machine, but seg faults on a CentOS
linux box.

I've tracked through the code, and the crash occurs in Tidybuf.rb's
to_s function. The "struct.bp" method returns a non-nil value (that
indicates a zero size), but the struct.size is some huge number which
varies run-to-run.

I've googled a ton, and there are a lot of people who have hit
segfaults using Ruby and tidy. Some of the issue seem to have been a
namespace conflict between Graphics/ImageMagick and Tidy, but we've
fixed that (by renaming tidy's GetToken function and recompiling), and
are still hitting a seg fault.

More detail:

Using a fresh Rails 1.2.5 app, I've stepped in console thru the parts
of Tidyobj.rb's clean method, like so:

require 'tidy'
tidy = Tidyobj.new
@doc = Tidylib.create
@outbuf = Tidybuf.new
str = 'hi there!'
rc = -1
rc = Tidylib.parse_string(@doc, str)
rc = Tidylib.clean_and_repair(@doc) if rc >= 0
rc = (Tidylib.opt_parse_value(@doc, :force_output, true) == 1 ? rc :
-1) if rc > 1
rc = Tidylib.save_buffer(@doc, @outbuf.struct) if rc >= 0

At this point:
>> @outbuf.struct.size
=> 154846656
>> @outbuf.struct.bp
=> #<DL::PtrData:0x0x949aa38 ptr=0x0x29c4d0 size=0 free=0x(nil)>

Then:
>> @outbuf.to_s
/usr/lib/ruby/site_ruby/1.8/tidy/tidybuf.rb:39: [BUG] Segmentation
fault
ruby 1.8.4 (2005-12-24) [i386-linux]
Aborted (core dumped)

The shorter way to reproduce this is:
>> tidy=Tidyobj.new
>> tidy.clean 'hi'
/usr/lib/ruby/site_ruby/1.8/tidy/tidybuf.rb:39: [BUG] Segmentation
fault
ruby 1.8.4 (2005-12-24) [i386-linux]
Aborted (core dumped)

If anyone has a clue, please help!

Thanks,
Lee