diff -u libxslt-1.1.26/config.guess libxslt-1.1.26/config.guess --- libxslt-1.1.26/config.guess +++ libxslt-1.1.26/config.guess @@ -2,9 +2,9 @@ # Attempt to guess a canonical system name. # Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, # 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, -# 2011 Free Software Foundation, Inc. +# 2011, 2012 Free Software Foundation, Inc. -timestamp='2011-05-11' +timestamp='2012-02-10' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by @@ -17,9 +17,7 @@ # General Public License for more details. # # You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA -# 02110-1301, USA. +# along with this program; if not, see . # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a @@ -57,8 +55,8 @@ Originally written by Per Bothner. Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, -2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free -Software Foundation, Inc. +2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 +Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." @@ -145,7 +143,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in *:NetBSD:*:*) # NetBSD (nbsd) targets should (where applicable) match one or - # more of the tupples: *-*-netbsdelf*, *-*-netbsdaout*, + # more of the tuples: *-*-netbsdelf*, *-*-netbsdaout*, # *-*-netbsdecoff* and *-*-netbsd*. For targets that recently # switched to ELF, *-*-netbsd* would select the old # object file format. This provides both forward @@ -792,13 +790,12 @@ echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE} exit ;; *:FreeBSD:*:*) - case ${UNAME_MACHINE} in - pc98) - echo i386-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; + UNAME_PROCESSOR=`/usr/bin/uname -p` + case ${UNAME_PROCESSOR} in amd64) echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; *) - echo ${UNAME_MACHINE}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; + echo ${UNAME_PROCESSOR}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;; esac exit ;; i*:CYGWIN*:*) @@ -807,6 +804,9 @@ *:MINGW*:*) echo ${UNAME_MACHINE}-pc-mingw32 exit ;; + i*:MSYS*:*) + echo ${UNAME_MACHINE}-pc-msys + exit ;; i*:windows32*:*) # uname -m includes "-pc" on this system. echo ${UNAME_MACHINE}-mingw32 @@ -861,6 +861,13 @@ i*86:Minix:*:*) echo ${UNAME_MACHINE}-pc-minix exit ;; + aarch64:Linux:*:*) + echo ${UNAME_MACHINE}-unknown-linux-gnu + exit ;; + aarch64_be:Linux:*:*) + UNAME_MACHINE=aarch64_be + echo ${UNAME_MACHINE}-unknown-linux-gnu + exit ;; alpha:Linux:*:*) case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in EV5) UNAME_MACHINE=alphaev5 ;; @@ -895,13 +902,16 @@ echo ${UNAME_MACHINE}-unknown-linux-gnu exit ;; cris:Linux:*:*) - echo cris-axis-linux-gnu + echo ${UNAME_MACHINE}-axis-linux-gnu exit ;; crisv32:Linux:*:*) - echo crisv32-axis-linux-gnu + echo ${UNAME_MACHINE}-axis-linux-gnu exit ;; frv:Linux:*:*) - echo frv-unknown-linux-gnu + echo ${UNAME_MACHINE}-unknown-linux-gnu + exit ;; + hexagon:Linux:*:*) + echo ${UNAME_MACHINE}-unknown-linux-gnu exit ;; i*86:Linux:*:*) LIBC=gnu @@ -943,7 +953,7 @@ test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; } ;; or32:Linux:*:*) - echo or32-unknown-linux-gnu + echo ${UNAME_MACHINE}-unknown-linux-gnu exit ;; padre:Linux:*:*) echo sparc-unknown-linux-gnu @@ -978,13 +988,13 @@ echo ${UNAME_MACHINE}-unknown-linux-gnu exit ;; tile*:Linux:*:*) - echo ${UNAME_MACHINE}-tilera-linux-gnu + echo ${UNAME_MACHINE}-unknown-linux-gnu exit ;; vax:Linux:*:*) echo ${UNAME_MACHINE}-dec-linux-gnu exit ;; x86_64:Linux:*:*) - echo x86_64-unknown-linux-gnu + echo ${UNAME_MACHINE}-unknown-linux-gnu exit ;; xtensa*:Linux:*:*) echo ${UNAME_MACHINE}-unknown-linux-gnu @@ -1315,6 +1325,9 @@ i*86:AROS:*:*) echo ${UNAME_MACHINE}-pc-aros exit ;; + x86_64:VMkernel:*:*) + echo ${UNAME_MACHINE}-unknown-esx + exit ;; esac #echo '(No uname command or uname output not recognized.)' 1>&2 diff -u libxslt-1.1.26/config.sub libxslt-1.1.26/config.sub --- libxslt-1.1.26/config.sub +++ libxslt-1.1.26/config.sub @@ -2,9 +2,9 @@ # Configuration validation subroutine script. # Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, # 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, -# 2011 Free Software Foundation, Inc. +# 2011, 2012 Free Software Foundation, Inc. -timestamp='2011-03-23' +timestamp='2012-02-10' # This file is (in principle) common to ALL GNU software. # The presence of a machine in this file suggests that SOME GNU software @@ -21,9 +21,7 @@ # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License -# along with this program; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA -# 02110-1301, USA. +# along with this program; if not, see . # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a @@ -76,8 +74,8 @@ GNU config.sub ($timestamp) Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, -2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free -Software Foundation, Inc. +2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 +Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." @@ -132,6 +130,10 @@ os=-$maybe_os basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'` ;; + android-linux) + os=-linux-android + basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown + ;; *) basic_machine=`echo $1 | sed 's/-[^-]*$//'` if [ $basic_machine != $1 ] @@ -247,17 +249,22 @@ # Some are omitted here because they have special meanings below. 1750a | 580 \ | a29k \ + | aarch64 | aarch64_be \ | alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \ | alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \ | am33_2.0 \ | arc | arm | arm[bl]e | arme[lb] | armv[2345] | armv[345][lb] | avr | avr32 \ + | be32 | be64 \ | bfin \ | c4x | clipper \ | d10v | d30v | dlx | dsp16xx \ + | epiphany \ | fido | fr30 | frv \ | h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \ + | hexagon \ | i370 | i860 | i960 | ia64 \ | ip2k | iq2000 \ + | le32 | le64 \ | lm32 \ | m32c | m32r | m32rle | m68000 | m68k | m88k \ | maxq | mb | microblaze | mcore | mep | metag \ @@ -291,7 +298,7 @@ | pdp10 | pdp11 | pj | pjl \ | powerpc | powerpc64 | powerpc64le | powerpcle \ | pyramid \ - | rx \ + | rl78 | rx \ | score \ | sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \ | sh64 | sh64le \ @@ -300,7 +307,7 @@ | spu \ | tahoe | tic4x | tic54x | tic55x | tic6x | tic80 | tron \ | ubicom32 \ - | v850 | v850e \ + | v850 | v850e | v850e1 | v850e2 | v850es | v850e2v3 \ | we32k \ | x86 | xc16x | xstormy16 | xtensa \ | z8k | z80) @@ -315,8 +322,7 @@ c6x) basic_machine=tic6x-unknown ;; - m6811 | m68hc11 | m6812 | m68hc12 | picochip) - # Motorola 68HC11/12. + m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | picochip) basic_machine=$basic_machine-unknown os=-none ;; @@ -329,7 +335,10 @@ strongarm | thumb | xscale) basic_machine=arm-unknown ;; - + xgate) + basic_machine=$basic_machine-unknown + os=-none + ;; xscaleeb) basic_machine=armeb-unknown ;; @@ -352,11 +361,13 @@ # Recognize the basic CPU types with company name. 580-* \ | a29k-* \ + | aarch64-* | aarch64_be-* \ | alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \ | alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \ | alphapca5[67]-* | alpha64pca5[67]-* | arc-* \ | arm-* | armbe-* | armle-* | armeb-* | armv*-* \ | avr-* | avr32-* \ + | be32-* | be64-* \ | bfin-* | bs2000-* \ | c[123]* | c30-* | [cjt]90-* | c4x-* \ | clipper-* | craynv-* | cydra-* \ @@ -365,8 +376,10 @@ | f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \ | h8300-* | h8500-* \ | hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \ + | hexagon-* \ | i*86-* | i860-* | i960-* | ia64-* \ | ip2k-* | iq2000-* \ + | le32-* | le64-* \ | lm32-* \ | m32c-* | m32r-* | m32rle-* \ | m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \ @@ -400,7 +413,7 @@ | pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \ | powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \ | pyramid-* \ - | romp-* | rs6000-* | rx-* \ + | rl78-* | romp-* | rs6000-* | rx-* \ | sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \ | shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \ | sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \ @@ -408,10 +421,11 @@ | sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx?-* \ | tahoe-* \ | tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \ - | tile-* | tilegx-* \ + | tile*-* \ | tron-* \ | ubicom32-* \ - | v850-* | v850e-* | vax-* \ + | v850-* | v850e-* | v850e1-* | v850es-* | v850e2-* | v850e2v3-* \ + | vax-* \ | we32k-* \ | x86-* | x86_64-* | xc16x-* | xps100-* \ | xstormy16-* | xtensa*-* \ @@ -711,7 +725,6 @@ i370-ibm* | ibm*) basic_machine=i370-ibm ;; -# I'm not sure what "Sysv32" means. Should this be sysv3.2? i*86v32) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-sysv32 @@ -808,10 +821,18 @@ ms1-*) basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'` ;; + msys) + basic_machine=i386-pc + os=-msys + ;; mvs) basic_machine=i370-ibm os=-mvs ;; + nacl) + basic_machine=le32-unknown + os=-nacl + ;; ncr3000) basic_machine=i486-ncr os=-sysv4 @@ -1120,13 +1141,8 @@ basic_machine=t90-cray os=-unicos ;; - # This must be matched before tile*. - tilegx*) - basic_machine=tilegx-unknown - os=-linux-gnu - ;; tile*) - basic_machine=tile-unknown + basic_machine=$basic_machine-unknown os=-linux-gnu ;; tx39) @@ -1336,7 +1352,7 @@ | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \ | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \ | -chorusos* | -chorusrdb* | -cegcc* \ - | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \ + | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \ | -mingw32* | -linux-gnu* | -linux-android* \ | -linux-newlib* | -linux-uclibc* \ | -uxpv* | -beos* | -mpeix* | -udk* \ @@ -1548,9 +1564,6 @@ ;; m68000-sun) os=-sunos3 - # This also exists in the configure program, but was not the - # default. - # os=-sunos4 ;; m68*-cisco) os=-aout diff -u libxslt-1.1.26/debian/changelog libxslt-1.1.26/debian/changelog --- libxslt-1.1.26/debian/changelog +++ libxslt-1.1.26/debian/changelog @@ -1,3 +1,60 @@ +libxslt (1.1.26-8ubuntu1.3~ppa1) precise; urgency=medium + + * debian/patches/000[4-8].patch: + Upstream post release patches. + + -- bigbax Sab, 29 Dec 2013 13:55:48 -0400 + +libxslt (1.1.26-8ubuntu1.3) precise; urgency=low + + * SECURITY UPDATE: denial of service via malformed stylesheet + - libxslt/functions.c, libxslt/keys.c: check for empty values + tests/*: add tests + - dc11b6b379a882418093ecc8adf11f6166682e8d + - 6c99c519d97e5fcbec7a9537d190efb442e4e833 + - CVE-2012-6139 + + -- Marc Deslauriers Thu, 28 Mar 2013 13:05:27 -0400 + +libxslt (1.1.26-8ubuntu1.2) precise; urgency=low + + * SECURITY UPDATE: denial of service via out-of-bounds read + - libxslt/pattern.c: fix improper loop exit. + - fe5a4fa33eb85bce3253ed3742b1ea6c4b59b41b + - CVE-2011-3970 + * SECURITY UPDATE: denial of service via out-of-bounds read + - libxslt/xsltutils.h: check for XML_ELEMENT_NODE + - e6a0bc8081271f33b9899eb78e1da1a2a0428419 + - CVE-2012-2825 + * SECURITY UPDATE: denial of service via crafted XSLT expression + - harden code in libexslt/functions.c, libxslt/attributes.c, + libxslt/functions.c, libxslt/pattern.c, libxslt/preproc.c, + libxslt/templates.c, libxslt/transform.c, libxslt/variables.c, + libxslt/xslt.c, libxslt/xsltutils.c. + - 8566ab4a10158d195adb5f1f61afe1ee8bfebd12 + - 4da0f7e207f14a03daad4663865c285eb27f93e9 + - 24653072221e76d2f1f06aa71225229b532f8946 + - 1564b30e994602a95863d9716be83612580a2fed + - CVE-2012-2870 + * SECURITY UPDATE: denial of service and possible code execution during + handling of XSL transforms + - libxslt/transform.c: check for XML_NAMESPACE_DECL + - 937ba2a3eb42d288f53c8adc211bd1122869f0bf + - CVE-2012-2871 + * SECURITY UPDATE: denial of service and possible code execution via + double free during XSL transforms + - libxslt/templates.c: Fix dictionary string usage + - 54977ed7966847e305a2008cb18892df26eeb065 + - CVE-2012-2893 + + -- Marc Deslauriers Fri, 28 Sep 2012 15:13:38 -0400 + +libxslt (1.1.26-8ubuntu1.1) precise-proposed; urgency=low + + * debian/control: mark libxslt1-dev as not M-A (LP: #1014197). + + -- Stéphane Graber Wed, 18 Jul 2012 15:01:41 -0400 + libxslt (1.1.26-8ubuntu1) precise; urgency=low * Build for multiarch. diff -u libxslt-1.1.26/debian/control libxslt-1.1.26/debian/control --- libxslt-1.1.26/debian/control +++ libxslt-1.1.26/debian/control @@ -28,7 +28,6 @@ Package: libxslt1-dev Section: libdevel Architecture: any -Multi-Arch: same Provides: libxslt-dev Depends: libxslt1.1 (= ${binary:Version}), libxml2-dev (>= 2.6.26), ${misc:Depends} Description: XSLT 1.0 processing library - development kit diff -u libxslt-1.1.26/libxslt/functions.c libxslt-1.1.26/libxslt/functions.c --- libxslt-1.1.26/libxslt/functions.c +++ libxslt-1.1.26/libxslt/functions.c @@ -260,7 +260,7 @@ obj = valuePop(ctxt); ret = xmlXPathNewNodeSet(NULL); - if (obj->nodesetval) { + if ((obj != NULL) && obj->nodesetval) { for (i = 0; i < obj->nodesetval->nodeNr; i++) { valuePush(ctxt, xmlXPathNewNodeSet(obj->nodesetval->nodeTab[i])); @@ -280,7 +280,8 @@ } } - xmlXPathFreeObject(obj); + if (obj != NULL) + xmlXPathFreeObject(obj); if (obj2 != NULL) xmlXPathFreeObject(obj2); valuePush(ctxt, ret); @@ -654,6 +655,7 @@ void xsltGenerateIdFunction(xmlXPathParserContextPtr ctxt, int nargs){ xmlNodePtr cur = NULL; + xmlXPathObjectPtr obj = NULL; long val; xmlChar str[30]; xmlDocPtr doc; @@ -661,7 +663,6 @@ if (nargs == 0) { cur = ctxt->context->node; } else if (nargs == 1) { - xmlXPathObjectPtr obj; xmlNodeSetPtr nodelist; int i, ret; @@ -684,7 +685,6 @@ if (ret == -1) cur = nodelist->nodeTab[i]; } - xmlXPathFreeObject(obj); } else { xsltTransformError(xsltXPathGetTransformContext(ctxt), NULL, NULL, "generate-id() : invalid number of args %d\n", nargs); @@ -707,6 +707,9 @@ } + if (obj) + xmlXPathFreeObject(obj); + val = (long)((char *)cur - (char *)doc); if (val >= 0) { sprintf((char *)str, "idp%ld", val); diff -u libxslt-1.1.26/tests/general/Makefile.in libxslt-1.1.26/tests/general/Makefile.in --- libxslt-1.1.26/tests/general/Makefile.in +++ libxslt-1.1.26/tests/general/Makefile.in @@ -395,6 +395,7 @@ bug-167.out bug-167.xsl \ bug-168.out bug-168.xsl \ bug-169.out bug-169.xsl bug-169.imp \ + bug-180.out bug-180.xsl bug-180.err \ character.out character.xsl \ character2.out character2.xsl \ itemschoose.out itemschoose.xsl \ diff -u libxslt-1.1.26/tests/docs/Makefile.in libxslt-1.1.26/tests/docs/Makefile.in --- libxslt-1.1.26/tests/docs/Makefile.in +++ libxslt-1.1.26/tests/docs/Makefile.in @@ -389,6 +389,7 @@ bug-167.xml \ bug-168.xml \ bug-169.xml \ + bug-180.xml \ character.xml \ array.xml \ items.xml only in patch2: unchanged: --- libxslt-1.1.26.orig/tests/docs/bug-180.xml +++ libxslt-1.1.26/tests/docs/bug-180.xml @@ -0,0 +1,2 @@ + + only in patch2: unchanged: --- libxslt-1.1.26.orig/tests/docs/Makefile.am +++ libxslt-1.1.26/tests/docs/Makefile.am @@ -168,6 +168,7 @@ bug-167.xml \ bug-168.xml \ bug-169.xml \ + bug-180.xml \ character.xml \ array.xml \ items.xml only in patch2: unchanged: --- libxslt-1.1.26.orig/tests/general/bug-180.xsl +++ libxslt-1.1.26/tests/general/bug-180.xsl @@ -0,0 +1,8 @@ + + + + + + + + only in patch2: unchanged: --- libxslt-1.1.26.orig/tests/general/bug-180.err +++ libxslt-1.1.26/tests/general/bug-180.err @@ -0,0 +1,4 @@ +runtime error: file ./bug-180.xsl line 4 element copy-of +Variable 'xxx' has not been declared. +XPath error : Stack usage errror +xmlXPathCompiledEval: 1 objects left on the stack. only in patch2: unchanged: --- libxslt-1.1.26.orig/tests/general/Makefile.am +++ libxslt-1.1.26/tests/general/Makefile.am @@ -177,6 +177,7 @@ bug-167.out bug-167.xsl \ bug-168.out bug-168.xsl \ bug-169.out bug-169.xsl bug-169.imp \ + bug-180.out bug-180.xsl bug-180.err \ character.out character.xsl \ character2.out character2.xsl \ itemschoose.out itemschoose.xsl \ only in patch2: unchanged: --- libxslt-1.1.26.orig/libexslt/functions.c +++ libxslt-1.1.26/libexslt/functions.c @@ -459,10 +459,9 @@ xmlHashTablePtr data; exsltFuncFunctionData *func; - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; - { xmlChar *qname; @@ -546,6 +545,9 @@ xmlChar *sel; exsltFuncResultPreComp *ret; + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) + return (NULL); + /* * "Validity" checking */ only in patch2: unchanged: --- libxslt-1.1.26.orig/libxslt/preproc.c +++ libxslt-1.1.26/libxslt/preproc.c @@ -669,7 +669,7 @@ #else xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -777,7 +777,7 @@ xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED comp = (xsltStyleItemCopyPtr) xsltNewStylePreComp(style, XSLT_FUNC_COPY); @@ -821,7 +821,7 @@ #endif const xmlChar *prop; - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -874,7 +874,7 @@ * * */ - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -991,7 +991,7 @@ * * */ - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1111,7 +1111,7 @@ xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1141,7 +1141,7 @@ xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1175,7 +1175,7 @@ xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1222,7 +1222,7 @@ #endif const xmlChar *prop; - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1347,7 +1347,7 @@ xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1406,7 +1406,7 @@ #endif const xmlChar *prop; - if ((style == NULL) || (cur == NULL)) + if ((style == NULL) || (cur == NULL) || (cur->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1520,7 +1520,7 @@ xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1550,7 +1550,7 @@ xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1589,7 +1589,7 @@ xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1641,7 +1641,7 @@ xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1672,7 +1672,7 @@ xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1718,7 +1718,7 @@ xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1764,7 +1764,7 @@ xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1812,7 +1812,7 @@ xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1875,7 +1875,7 @@ xsltStylePreCompPtr comp; #endif - if ((style == NULL) || (inst == NULL)) + if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -1967,7 +1967,7 @@ * the parsing mechanism for all elements in the XSLT namespace. */ if (style == NULL) { - if (node != NULL) + if ((node != NULL) && (node->type == XML_ELEMENT_NODE)) node->psvi = NULL; return; } @@ -2182,7 +2182,8 @@ * namespace- and local-name of the node, but can evaluate this * using cctxt->style->inode->category; */ - if (inst->psvi != NULL) + if ((inst == NULL) || (inst->type != XML_ELEMENT_NODE) || + (inst->psvi != NULL)) return; if (IS_XSLT_ELEM(inst)) { only in patch2: unchanged: --- libxslt-1.1.26.orig/libxslt/transform.c +++ libxslt-1.1.26/libxslt/transform.c @@ -726,7 +726,7 @@ #endif /* - * Play save and reset the merging mechanism for every new + * Play safe and reset the merging mechanism for every new * target node. */ if ((target == NULL) || (target->children == NULL)) { @@ -4832,7 +4832,10 @@ list = xmlXPathNodeSetCreate(NULL); if (list == NULL) goto error; - cur = node->children; + if (node->type != XML_NAMESPACE_DECL) + cur = node->children; + else + cur = NULL; while (cur != NULL) { switch (cur->type) { case XML_TEXT_NODE: @@ -4881,6 +4884,8 @@ if (cur->prev != NULL) cur->prev->next = cur->next; break; + case XML_NAMESPACE_DECL: + break; default: #ifdef WITH_XSLT_DEBUG_PROCESS XSLT_TRACE(ctxt,XSLT_TRACE_APPLY_TEMPLATES,xsltGenericDebug(xsltGenericDebugContext, only in patch2: unchanged: --- libxslt-1.1.26.orig/libxslt/xsltutils.h +++ libxslt-1.1.26/libxslt/xsltutils.h @@ -52,8 +52,8 @@ * Checks that the element pertains to XSLT namespace. */ #define IS_XSLT_ELEM(n) \ - (((n) != NULL) && ((n)->ns != NULL) && \ - (xmlStrEqual((n)->ns->href, XSLT_NAMESPACE))) + (((n) != NULL) && ((n)->type == XML_ELEMENT_NODE) && \ + ((n)->ns != NULL) && (xmlStrEqual((n)->ns->href, XSLT_NAMESPACE))) /** * IS_XSLT_NAME: only in patch2: unchanged: --- libxslt-1.1.26.orig/libxslt/xsltutils.c +++ libxslt-1.1.26/libxslt/xsltutils.c @@ -90,10 +90,15 @@ if ((node == NULL) || (style == NULL) || (style->dict == NULL)) return(NULL); - prop = node->properties; - if (nameSpace == NULL) { + if (nameSpace == NULL) return xmlGetProp(node, name); - } + + if (node->type == XML_NAMESPACE_DECL) + return(NULL); + if (node->type == XML_ELEMENT_NODE) + prop = node->properties; + else + prop = NULL; while (prop != NULL) { /* * One need to have @@ -130,7 +135,7 @@ attrDecl = xmlGetDtdAttrDesc(doc->intSubset, node->name, name); if ((attrDecl == NULL) && (doc->extSubset != NULL)) attrDecl = xmlGetDtdAttrDesc(doc->extSubset, node->name, name); - + if ((attrDecl != NULL) && (attrDecl->prefix != NULL)) { /* * The DTD declaration only allows a prefix search @@ -172,7 +177,15 @@ if (node == NULL) return(NULL); - prop = node->properties; + if (nameSpace == NULL) + return xmlGetProp(node, name); + + if (node->type == XML_NAMESPACE_DECL) + return(NULL); + if (node->type == XML_ELEMENT_NODE) + prop = node->properties; + else + prop = NULL; /* * TODO: Substitute xmlGetProp() for xmlGetNsProp(), since the former * is not namespace-aware and will return an attribute with equal @@ -182,8 +195,6 @@ * So this would return "myName" even if an attribute @name * in the XSLT was requested. */ - if (nameSpace == NULL) - return(xmlGetProp(node, name)); while (prop != NULL) { /* * One need to have @@ -216,7 +227,7 @@ attrDecl = xmlGetDtdAttrDesc(doc->intSubset, node->name, name); if ((attrDecl == NULL) && (doc->extSubset != NULL)) attrDecl = xmlGetDtdAttrDesc(doc->extSubset, node->name, name); - + if ((attrDecl != NULL) && (attrDecl->prefix != NULL)) { /* * The DTD declaration only allows a prefix search only in patch2: unchanged: --- libxslt-1.1.26.orig/libxslt/xslt.c +++ libxslt-1.1.26/libxslt/xslt.c @@ -1153,9 +1153,9 @@ xmlChar *element, *end; - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; - + prop = xmlGetNsProp(cur, (const xmlChar *) "version", NULL); if (prop != NULL) { if (style->version != NULL) @@ -1368,12 +1368,12 @@ xmlChar *prop; xsltDecimalFormatPtr format; xsltDecimalFormatPtr iter; - - if ((cur == NULL) || (style == NULL)) + + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; format = style->decimalFormat; - + prop = xmlGetNsProp(cur, BAD_CAST("name"), NULL); if (prop != NULL) { format = xsltDecimalFormatGetByName(style, prop); @@ -1475,7 +1475,7 @@ xmlChar *elements; xmlChar *element, *end; - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; elements = xmlGetNsProp(cur, (const xmlChar *)"elements", NULL); @@ -1549,7 +1549,7 @@ xmlChar *prefixes; xmlChar *prefix, *end; - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; if (isXsltElem) { @@ -1614,7 +1614,7 @@ xmlChar *elements; xmlChar *element, *end; - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; elements = xmlGetNsProp(cur, (const xmlChar *)"elements", NULL); @@ -1687,7 +1687,7 @@ xmlChar *prefixes; xmlChar *prefix, *end; - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return(0); if (isXsltElem) @@ -4278,7 +4278,7 @@ xsltParseUnknownXSLTElem(xsltCompilerCtxtPtr cctxt, xmlNodePtr node) { - if ((cctxt == NULL) || (node == NULL)) + if ((cctxt == NULL) || (node == NULL) || (node->type != XML_ELEMENT_NODE)) return(-1); /* @@ -4375,7 +4375,7 @@ if (cctxt->inode->category == XSLT_ELEMENT_CATEGORY_EXTENSION) { cctxt->inode->extContentHandled = 1; } - if (cur == NULL) + if ((cur == NULL) || (cur->type == XML_NAMESPACE_DECL)) return; /* * This is the content reffered to as a "template". @@ -4780,7 +4780,8 @@ */ void xsltParseTemplateContent(xsltStylesheetPtr style, xmlNodePtr templ) { - if ((style == NULL) || (templ == NULL)) + if ((style == NULL) || (templ == NULL) || + (templ->type == XML_NAMESPACE_DECL)) return; /* @@ -4829,6 +4830,10 @@ void xsltParseTemplateContent(xsltStylesheetPtr style, xmlNodePtr templ) { xmlNodePtr cur, delete; + + if ((style == NULL) || (templ == NULL) || + (templ->type == XML_NAMESPACE_DECL)) return; + /* * This content comes from the stylesheet * For stylesheets, the set of whitespace-preserving @@ -5048,7 +5053,7 @@ xmlChar *name = NULL; xmlChar *nameURI = NULL; - if ((style == NULL) || (key == NULL)) + if ((style == NULL) || (key == NULL) || (key->type != XML_ELEMENT_NODE)) return; /* @@ -5138,7 +5143,8 @@ xmlChar *prop; double priority; - if ((cctxt == NULL) || (templNode == NULL)) + if ((cctxt == NULL) || (templNode == NULL) || + (templNode->type != XML_ELEMENT_NODE)) return; /* @@ -5299,7 +5305,8 @@ xmlChar *modeURI = NULL; double priority; - if (template == NULL) + if ((style == NULL) || (template == NULL) || + (template->type != XML_ELEMENT_NODE)) return; /* @@ -5431,7 +5438,7 @@ xsltCompileXSLTIncludeElem(xsltCompilerCtxtPtr cctxt, xmlNodePtr node) { xsltStyleItemIncludePtr item; - if ((cctxt == NULL) || (node == NULL)) + if ((cctxt == NULL) || (node == NULL) || (node->type != XML_ELEMENT_NODE)) return(NULL); node->psvi = NULL; @@ -5951,7 +5958,7 @@ { xmlNodePtr cur, start; - if ((cctxt == NULL) || (node == NULL)) + if ((cctxt == NULL) || (node == NULL) || (node->type != XML_ELEMENT_NODE)) return(-1); if (node->children == NULL) @@ -6039,7 +6046,7 @@ int templates = 0; #endif - if (top == NULL) + if ((top == NULL) || (top->type != XML_ELEMENT_NODE)) return; prop = xmlGetNsProp(top, (const xmlChar *)"version", NULL); only in patch2: unchanged: --- libxslt-1.1.26.orig/libxslt/keys.c +++ libxslt-1.1.26/libxslt/keys.c @@ -311,8 +311,8 @@ end = skipPredicate(match, end); if (end <= 0) { xsltTransformError(NULL, style, inst, - "key pattern is malformed: %s", - key->match); + "xsl:key : 'match' pattern is malformed: %s", + key->match); if (style != NULL) style->errors++; goto error; } @@ -321,7 +321,7 @@ } if (current == end) { xsltTransformError(NULL, style, inst, - "key pattern is empty\n"); + "xsl:key : 'match' pattern is empty\n"); if (style != NULL) style->errors++; goto error; } @@ -344,6 +344,12 @@ } current = end; } + if (pattern == NULL) { + xsltTransformError(NULL, style, inst, + "xsl:key : 'match' pattern is empty\n"); + if (style != NULL) style->errors++; + goto error; + } #ifdef WITH_XSLT_DEBUG_KEYS xsltGenericDebug(xsltGenericDebugContext, " resulting pattern %s\n", pattern); @@ -359,14 +365,14 @@ key->comp = xsltXPathCompile(style, pattern); if (key->comp == NULL) { xsltTransformError(NULL, style, inst, - "xsl:key : XPath pattern compilation failed '%s'\n", + "xsl:key : 'match' pattern compilation failed '%s'\n", pattern); if (style != NULL) style->errors++; } key->usecomp = xsltXPathCompile(style, use); if (key->usecomp == NULL) { xsltTransformError(NULL, style, inst, - "xsl:key : XPath pattern compilation failed '%s'\n", + "xsl:key : 'use' expression compilation failed '%s'\n", use); if (style != NULL) style->errors++; } only in patch2: unchanged: --- libxslt-1.1.26.orig/libxslt/variables.c +++ libxslt-1.1.26/libxslt/variables.c @@ -1926,7 +1926,7 @@ the instruction itself. */ xsltStackElemPtr param = NULL; - if ((ctxt == NULL) || (inst == NULL)) + if ((ctxt == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE)) return(NULL); #ifdef XSLT_REFACTORED @@ -1985,7 +1985,7 @@ xsltStylePreCompPtr comp; #endif - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -2047,7 +2047,7 @@ xsltStylePreCompPtr comp; #endif - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; #ifdef XSLT_REFACTORED @@ -2110,7 +2110,7 @@ xsltStylePreCompPtr comp; #endif - if ((inst == NULL) || (ctxt == NULL)) + if ((inst == NULL) || (ctxt == NULL) || (inst->type != XML_ELEMENT_NODE)) return; comp = inst->psvi; @@ -2152,7 +2152,7 @@ xsltStylePreCompPtr comp; #endif - if ((cur == NULL) || (ctxt == NULL)) + if ((cur == NULL) || (ctxt == NULL) || (cur->type != XML_ELEMENT_NODE)) return; comp = cur->psvi; only in patch2: unchanged: --- libxslt-1.1.26.orig/libxslt/templates.c +++ libxslt-1.1.26/libxslt/templates.c @@ -18,6 +18,7 @@ #include #include #include +#include #include #include #include "xslt.h" @@ -198,7 +199,8 @@ xmlNodePtr oldInsert, insert = NULL; xmlChar *ret; - if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL)) + if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL) || + (inst->type != XML_ELEMENT_NODE)) return(NULL); if (inst->children == NULL) @@ -380,7 +382,8 @@ xmlChar *ret; xmlChar *expr; - if ((ctxt == NULL) || (inst == NULL) || (name == NULL)) + if ((ctxt == NULL) || (inst == NULL) || (name == NULL) || + (inst->type != XML_ELEMENT_NODE)) return(NULL); expr = xsltGetNsProp(inst, name, ns); @@ -424,7 +427,8 @@ const xmlChar *ret; xmlChar *expr; - if ((style == NULL) || (inst == NULL) || (name == NULL)) + if ((style == NULL) || (inst == NULL) || (name == NULL) || + (inst->type != XML_ELEMENT_NODE)) return(NULL); expr = xsltGetNsProp(inst, name, ns); @@ -465,7 +469,8 @@ const xmlChar *value; xmlAttrPtr ret; - if ((ctxt == NULL) || (attr == NULL) || (target == NULL)) + if ((ctxt == NULL) || (attr == NULL) || (target == NULL) || + (target->type != XML_ELEMENT_NODE)) return(NULL); if (attr->type != XML_ATTRIBUTE_NODE) @@ -572,7 +577,8 @@ } } else if ((ctxt->internalized) && (target != NULL) && (target->doc != NULL) && - (target->doc->dict == ctxt->dict)) { + (target->doc->dict == ctxt->dict) && + xmlDictOwns(ctxt->dict, value)) { text->content = (xmlChar *) value; } else { text->content = xmlStrdup(value); @@ -622,7 +628,8 @@ const xmlChar *value; xmlChar *valueAVT; - if ((ctxt == NULL) || (target == NULL) || (attrs == NULL)) + if ((ctxt == NULL) || (target == NULL) || (attrs == NULL) || + (target->type != XML_ELEMENT_NODE)) return(NULL); oldInsert = ctxt->insert; @@ -757,7 +764,8 @@ } } else if ((ctxt->internalized) && (target->doc != NULL) && - (target->doc->dict == ctxt->dict)) + (target->doc->dict == ctxt->dict) && + xmlDictOwns(ctxt->dict, value)) { text->content = (xmlChar *) value; } else { only in patch2: unchanged: --- libxslt-1.1.26.orig/libxslt/attributes.c +++ libxslt-1.1.26/libxslt/attributes.c @@ -293,7 +293,7 @@ xmlNodePtr child; xsltAttrElemPtr attrItems; - if ((cur == NULL) || (style == NULL)) + if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE)) return; value = xmlGetNsProp(cur, (const xmlChar *)"name", NULL); @@ -656,7 +656,8 @@ xmlNsPtr ns = NULL; xmlAttrPtr attr; - if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL)) + if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL) || + (inst->type != XML_ELEMENT_NODE) ) return; /* only in patch2: unchanged: --- libxslt-1.1.26.orig/libxslt/pattern.c +++ libxslt-1.1.26/libxslt/pattern.c @@ -303,6 +303,10 @@ "xsltCompMatchAdd: memory re-allocation failure.\n"); if (ctxt->style != NULL) ctxt->style->errors++; + if (value) + xmlFree(value); + if (value2) + xmlFree(value2); return (-1); } comp->maxStep *= 2; @@ -1381,17 +1385,22 @@ NEXT; SKIP_BLANKS; lit = xsltScanLiteral(ctxt); - if (ctxt->error) + if (ctxt->error) { + xsltTransformError(NULL, NULL, NULL, + "xsltCompileIdKeyPattern : Literal expected\n"); return; + } SKIP_BLANKS; if (CUR != ')') { xsltTransformError(NULL, NULL, NULL, "xsltCompileIdKeyPattern : ) expected\n"); + xmlFree(lit); ctxt->error = 1; return; } NEXT; PUSH(XSLT_OP_ID, lit, NULL, novar); + lit = NULL; } else if ((aid) && (xmlStrEqual(name, (const xmlChar *)"key"))) { if (axis != 0) { xsltTransformError(NULL, NULL, NULL, @@ -1402,8 +1411,11 @@ NEXT; SKIP_BLANKS; lit = xsltScanLiteral(ctxt); - if (ctxt->error) + if (ctxt->error) { + xsltTransformError(NULL, NULL, NULL, + "xsltCompileIdKeyPattern : Literal expected\n"); return; + } SKIP_BLANKS; if (CUR != ',') { xsltTransformError(NULL, NULL, NULL, @@ -1414,25 +1426,36 @@ NEXT; SKIP_BLANKS; lit2 = xsltScanLiteral(ctxt); - if (ctxt->error) + if (ctxt->error) { + xsltTransformError(NULL, NULL, NULL, + "xsltCompileIdKeyPattern : Literal expected\n"); + xmlFree(lit); return; + } SKIP_BLANKS; if (CUR != ')') { xsltTransformError(NULL, NULL, NULL, "xsltCompileIdKeyPattern : ) expected\n"); + xmlFree(lit); + xmlFree(lit2); ctxt->error = 1; return; } NEXT; /* URGENT TODO: support namespace in keys */ PUSH(XSLT_OP_KEY, lit, lit2, novar); + lit = NULL; + lit2 = NULL; } else if (xmlStrEqual(name, (const xmlChar *)"processing-instruction")) { NEXT; SKIP_BLANKS; if (CUR != ')') { lit = xsltScanLiteral(ctxt); - if (ctxt->error) + if (ctxt->error) { + xsltTransformError(NULL, NULL, NULL, + "xsltCompileIdKeyPattern : Literal expected\n"); return; + } SKIP_BLANKS; if (CUR != ')') { xsltTransformError(NULL, NULL, NULL, @@ -1443,6 +1466,7 @@ } NEXT; PUSH(XSLT_OP_PI, lit, NULL, novar); + lit = NULL; } else if (xmlStrEqual(name, (const xmlChar *)"text")) { NEXT; SKIP_BLANKS; @@ -1493,8 +1517,7 @@ return; } error: - if (name != NULL) - xmlFree(name); + return; } /** @@ -1557,6 +1580,8 @@ SKIP_BLANKS; if (CUR == '(') { xsltCompileIdKeyPattern(ctxt, token, 0, novar, axis); + xmlFree(token); + token = NULL; if (ctxt->error) goto error; } else if (CUR == ':') { @@ -1575,20 +1600,24 @@ "xsltCompileStepPattern : no namespace bound to prefix %s\n", prefix); xmlFree(prefix); + prefix=NULL; ctxt->error = 1; goto error; } else { URL = xmlStrdup(ns->href); } xmlFree(prefix); + prefix=NULL; if (token == NULL) { if (CUR == '*') { NEXT; if (axis == AXIS_ATTRIBUTE) { PUSH(XSLT_OP_ATTR, NULL, URL, novar); + URL = NULL; } else { PUSH(XSLT_OP_NS, URL, NULL, novar); + URL = NULL; } } else { xsltTransformError(NULL, NULL, NULL, @@ -1599,9 +1628,13 @@ } else { if (axis == AXIS_ATTRIBUTE) { PUSH(XSLT_OP_ATTR, token, URL, novar); + token = NULL; + URL = NULL; } else { PUSH(XSLT_OP_ELEM, token, URL, novar); + token = NULL; + URL = NULL; } } } else { @@ -1623,6 +1656,7 @@ goto error; } xmlFree(token); + token = NULL; SKIP_BLANKS; token = xsltScanNCName(ctxt); goto parse_node_test; @@ -1637,9 +1671,13 @@ URL = xmlStrdup(URI); if (axis == AXIS_ATTRIBUTE) { PUSH(XSLT_OP_ATTR, token, URL, novar); + token = NULL; + URL = NULL; } else { PUSH(XSLT_OP_ELEM, token, URL, novar); + token = NULL; + URL = NULL; } } parse_predicate: @@ -1679,6 +1717,7 @@ } ret = xmlStrndup(q, CUR_PTR - q); PUSH(XSLT_OP_PREDICATE, ret, NULL, novar); + ret = NULL; /* push the predicate lower than local test */ SWAP(); NEXT; @@ -1787,6 +1826,8 @@ SKIP_BLANKS; if ((CUR == '(') && !xmlXPathIsNodeType(name)) { xsltCompileIdKeyPattern(ctxt, name, 1, novar, 0); + xmlFree(name); + name = NULL; if ((CUR == '/') && (NXT(1) == '/')) { PUSH(XSLT_OP_ANCESTOR, NULL, NULL, novar); NEXT; @@ -1864,6 +1905,8 @@ while ((pattern[end] != 0) && (pattern[end] != '"')) end++; } + if (pattern[end] == 0) + break; end++; } if (current == end) {