HTML Tidy segfault on TidyBufFree

Question

I'm using Tidy to clean up lots of HTML. The function I'm using is:

std::string cleanHTML (std::string htmlcontent)
{

char* outputstr;
TidyBuffer output ={0};
uint buflen =0;

TidyBuffer errbuf;
int rc = -1;
Bool ok;
TidyDoc tdoc = tidyCreate();                     // Initialize "document"

tidyBufInit( &errbuf );

ok = tidyOptSetBool( tdoc, TidyXhtmlOut, yes );  // Convert to XHTML
if ( ok )
  rc = tidySetErrorBuffer( tdoc, &errbuf );      // Capture diagnostics
if ( rc >= 0 )
  rc = tidyParseString( tdoc, htmlcontent.c_str() );           // Parse the input
if ( rc >= 0 )
  rc = tidySaveBuffer (tdoc,&output );               // Tidy it up!


uint yy= output.size;
outputstr = (char*)malloc(yy+10);
uint xx=yy+10;
rc = tidySaveString (tdoc,outputstr,&xx);
std::string cleanedhtml (outputstr);

tidyBufFree(&output);
tidyBufFree(&errbuf);
tidyRelease(tdoc);

return cleanedhtml;

}

The program seems to segfault on tidyBufFree (&output) on a certain call (I don't think there is anything obviously distinctive about the call) having used gdb. There also seems to be a memory leak coming from this function.

Can anyone help?

EDIT:

I've used Valgrind as recommended and the output is below (can someone explain what it means?).

==7860== Process terminating with default action of signal 11 (SIGSEGV)
==7860==  Access not within mapped region at address 0x0
==7860==    at 0x428B00: tidyBufFree (in /home/sergerold/qt5_episode_analyser/a.out)
==7860==    by 0x405EC6: cleanHTML(std::string) (in    /home/sergerold/qt5_episode_analyser/a.out)
==7860==    by 0x4048A3: get_tvseries(std::string) (in /home/sergerold/qt5_episode_analyser/a.out)
==7860==    by 0x403DE2: main (in /home/sergerold/qt5_episode_analyser/a.out)
==7860==  If you believe this happened as a result of a stack
==7860==  overflow in your program's main thread (unlikely but
==7860==  possible), you can try to increase the size of the
==7860==  main thread stack using the --main-stacksize= flag.
==7860==  The main thread stack size used in this run was 8388608.
==7860== 
==7860== HEAP SUMMARY:
==7860==     in use at exit: 2,285,594 bytes in 3,638 blocks
==7860==   total heap usage: 102,543 allocs, 98,905 frees, 137,801,931 bytes allocated
==7860== 
==7860== LEAK SUMMARY:
==7860==    definitely lost: 0 bytes in 0 blocks
==7860==    indirectly lost: 0 bytes in 0 blocks
==7860==      possibly lost: 1,303,686 bytes in 114 blocks
==7860==    still reachable: 981,908 bytes in 3,524 blocks
==7860==         suppressed: 0 bytes in 0 blocks
==7860== Rerun with --leak-check=full to see details of leaked memory
==7860== 
==7860== For counts of detected and suppressed errors, rerun with: -v
==7860== Use --track-origins=yes to see where uninitialised values come from
==7860== ERROR SUMMARY: 113 errors from 17 contexts (suppressed: 0 from 0)
Segmentation fault

SOLVED:

The segmentation fault was caused by tidyBufFree (&output) when &output was empty causing a dereferencing of a null pointer.

Answer 1

Your code seems a lot like this example but with few important differences.

Note in the example the author is not calling tidyBufInit( &errbuf ); this may be your memory leak. To be on the safe side use a tool for memory debugging for instance valgrind. As for the segfault - it seems what you do do free output is correct(at least according to the example) so my guess is that a stack corruption may be causing the problem. Again valgrind may help you find it.

Answer 2

The segmentation fault was caused by tidyBufFree (&output) when &output was empty causing a dereferencing of a null pointer. – user3083672