原作者已確認,Bug ID: 524
http://www.msweet.org/bugs.php?L+Z3
API文檔對該函數的描述如下:
/*
* 'mxmlSaveString()' - Save an XML node tree to a string.
*
* This function returns the total number of bytes that would be
* required for the string but only copies (bufsize - 1) characters
* into the specified buffer.
*/
int /* O - Size of string */
mxmlSaveString(mxml_node_t *node, /* I - Node to write */
char *buffer, /* I - String buffer */
int bufsize, /* I - Size of string buffer */
mxml_save_cb_t cb) /* I - Whitespace callback or MXML_NO_CALLBACK */
{
int col; /* Final column */
char *ptr[2]; /* Pointers for putc_cb */
_mxml_global_t *global = _mxml_global();
/* Global data */
/*
* Write the node...
*/
ptr[0] = buffer;
ptr[1] = buffer + bufsize;
if ((col = mxml_write_node(node, ptr, cb, 0, mxml_string_putc, global)) < 0)
return (-1);
if (col > 0)
mxml_string_putc('\n', ptr);
/*
* Nul-terminate the buffer...
*/
if (ptr[0] >= ptr[1])
buffer[bufsize - 1] = '\0';
else
ptr[0][0] = '\0';
/*
* Return the number of characters...
*/
return (ptr[0] - buffer);
}
但是,如果像下面這樣調用(這樣調用的目的是統計節點中的字符數,並不是真正的想去存字符),就會導致段錯誤:
`
FILE *fp = fopen("test.xml", "r");
mxml_node_t *top = mxmlLoadFile(NULL,fp,NULL);
int num = mxmlSaveString(top,NULL,0,NULL);
這是由於,源碼中下面這一句
buffer[bufsize - 1] = ‘\0’;
入參buffer被寫入,但是由於我們傳入的是NULL,所以掛了。