From 6c99c519d97e5fcbec7a9537d190efb442e4e833 Mon Sep 17 00:00:00 2001

From: Nick Wellnhofer <[email protected]>

Date: Wed, 10 Oct 2012 10:09:36 +0000

Subject: Crash when passing an uninitialized variable to document()

https://bugzilla.gnome.org/show_bug.cgi?id=685330

Missing check for NULL

---

diff --git a/libxslt/functions.c b/libxslt/functions.c

index ed2c163..c754994 100644

--- a/libxslt/functions.c

+++ b/libxslt/functions.c

@@ -260,7 +260,7 @@ xsltDocumentFunction(xmlXPathParserContextPtr ctxt, int nargs)

         obj = valuePop(ctxt);

         ret = xmlXPathNewNodeSet(NULL);

-        if (obj->nodesetval) {

+        if ((obj != NULL) && obj->nodesetval) {

             for (i = 0; i < obj->nodesetval->nodeNr; i++) {

                 valuePush(ctxt,

                           xmlXPathNewNodeSet(obj->nodesetval->nodeTab[i]));

@@ -280,7 +280,8 @@ xsltDocumentFunction(xmlXPathParserContextPtr ctxt, int nargs)

             }

         }

-        xmlXPathFreeObject(obj);

+        if (obj != NULL)

+            xmlXPathFreeObject(obj);

         if (obj2 != NULL)

             xmlXPathFreeObject(obj2);

         valuePush(ctxt, ret);