Bug#779807: osmosis: XML parser messes up data

[Jochen Topf]

Package: osmosis
Version: 0.43.1-2
Severity: important

Dear Maintainer,

there is a critical problem in the way Osmosis is packaged in Debian.

To reproduce:
Download XML for this node: http://www.openstreetmap.org/node/3382756758
Run
    osmosis --rx 3382756758.osm --wx -

The funny character in the name:en tag will be doubled. This does not
happen with stock Osmosis, but only with the Debian version.

It seems this is due to a faulty XML parser library. The Xerces lib is
missing in /etc/osmosis/plexus.conf. If I understand correctly this means
Java will fall back to its own XML implementation which is buggy.

If you add a line 

load /usr/share/java/xercesImpl.jar

to the file the error will not happen any more.

This is a rather critical problem, because it will lead to data corruption
whenever some Unicode characters are used in OSM files.

-- System Information:
Debian Release: 8.0
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages osmosis depends on:
ii  default-jre-headless [java6-runtime-headless]    2:1.7-52
ii  libbatik-java                                    1.7+dfsg-4
ii  libcommons-codec-java                            1.9-1
ii  libcommons-compress-java                         1.9-1
ii  libcommons-dbcp-java                             1.4-5
ii  libcommons-pool-java                             1.6-2
ii  libjpf-java                                      1.5.1+dfsg-4
ii  libmysql-java                                    5.1.32-1
ii  libnetty-java                                    1:3.2.6.Final-2
ii  libosmpbf-java                                   1.3.3-2
ii  libplexus-classworlds-java                       1.5.0-5
ii  libpostgis-java                                  2.1.4+dfsg-2
ii  libpostgresql-jdbc-java                          9.2-1002-1
ii  libprotobuf-java                                 2.6.1-1
ii  libspring-beans-java                             3.0.6.RELEASE-17
ii  libspring-context-java                           3.0.6.RELEASE-17
ii  libspring-core-java                              3.0.6.RELEASE-17
ii  libspring-jdbc-java                              3.0.6.RELEASE-17
ii  libspring-transaction-java                       3.0.6.RELEASE-17
ii  libxerces2-java                                  2.11.0-7
ii  libxz-java                                       1.5-1
ii  openjdk-6-jre-headless [java6-runtime-headless]  6b31-1.13.3-1
ii  openjdk-7-jre-headless [java6-runtime-headless]  7u75-2.5.4-2

osmosis recommends no packages.

osmosis suggests no packages.

-- no debconf information