Fix: libcib: Full-CIB replace op no longer segfaults with cib_xpath

Previously, a CIB replace operation targeting the full CIB would fail
with a segmentation fault if the cib_xpath flag were set (or if --xpath
were used with cibadmin). Presumably this is because
process_replace_xpath() was freeing the CIB, leaving no reference to it,
and possibly dereferencing more nodes in the document as it continued
processing any remaining XPath search results.

Now, a full CIB replacement with XPath succeeds if the replacement CIB
is well-formed and is of a newer version, and it appears to fail sanely
otherwise.

Signed-off-by: Reid Wahl <nrwahl@protonmail.com>

Author: nrwahl2

lib/cib/cib_ops.c

@@ -828,11 +828,11 @@ replace_cib(xmlNode *request, xmlNode *input, xmlNode **cib)
 
 static int
 process_replace_xpath(const char *op, int options, const char *xpath,
-                      xmlNode *input, xmlNode *cib)
+                      xmlNode *request, xmlNode *input, xmlNode **cib)
 {
     int num_results = 0;
     int rc = pcmk_rc_ok;
-    xmlXPathObject *xpath_obj = pcmk__xpath_search(cib->doc, xpath);
+    xmlXPathObject *xpath_obj = pcmk__xpath_search((*cib)->doc, xpath);
 
     num_results = pcmk__xpath_num_results(xpath_obj);
     if (num_results == 0) {
@@ -855,6 +855,11 @@ process_replace_xpath(const char *op, int options, const char *xpath,
         pcmk__debug("Processing %s op for %s with %s", op, xpath, path);
         free(path);
 
+        if (match == *cib) {
+            rc = replace_cib(request, input, cib);
+            break;
+        }
+
         parent = match->parent;
 
         pcmk__xml_free(match);
@@ -912,7 +917,7 @@ cib__process_replace(const char *op, int options, const char *section,
                      xmlNode **answer)
 {
     if (pcmk__is_set(options, cib_xpath)) {
-        return process_replace_xpath(op, options, section, input, *cib);
+        return process_replace_xpath(op, options, section, req, input, cib);
     }
 
     return process_replace_section(section, req, input, cib);