[libxslt] Fix memory leaks in error paths

[Nick Wellnhofer <nwellnhof src gnome org>]

commit 73e8cc1cf81f42cd86bcae571c0239ca634ae317
Author: Nick Wellnhofer <wellnhofer aevum de>
Date:   Mon May 22 00:22:27 2017 +0200

    Fix memory leaks in error paths
    
    Found with libFuzzer and ASan.

 libxslt/keys.c      |    3 +++
 libxslt/pattern.c   |    2 ++
 libxslt/templates.c |    5 +++--
 libxslt/xslt.c      |    2 ++
 4 files changed, 10 insertions(+), 2 deletions(-)
---
diff --git a/libxslt/keys.c b/libxslt/keys.c
index 43a343e..85902b0 100644
--- a/libxslt/keys.c
+++ b/libxslt/keys.c
@@ -402,10 +402,13 @@ xsltAddKey(xsltStylesheetPtr style, const xmlChar *name,
        prev->next = key;
     }
     key->next = NULL;
+    key = NULL;
 
 error:
     if (pattern != NULL)
        xmlFree(pattern);
+    if (key != NULL)
+        xsltFreeKeyDef(key);
     return(0);
 }
 
diff --git a/libxslt/pattern.c b/libxslt/pattern.c
index 8359e4b..c094e97 100644
--- a/libxslt/pattern.c
+++ b/libxslt/pattern.c
@@ -1480,6 +1480,7 @@ xsltCompileIdKeyPattern(xsltParserContextPtr ctxt, xmlChar *name,
                xsltTransformError(NULL, NULL, NULL,
                        "xsltCompileIdKeyPattern : ) expected\n");
                ctxt->error = 1;
+                xmlFree(lit);
                return;
            }
        }
@@ -1642,6 +1643,7 @@ parse_node_test:
                    xsltTransformError(NULL, NULL, NULL,
                            "xsltCompileStepPattern : Name expected\n");
                    ctxt->error = 1;
+                    xmlFree(URL);
                    goto error;
                }
            } else {
diff --git a/libxslt/templates.c b/libxslt/templates.c
index ad83dce..4255921 100644
--- a/libxslt/templates.c
+++ b/libxslt/templates.c
@@ -308,12 +308,12 @@ xsltAttrTemplateValueProcessNode(xsltTransformContextPtr ctxt,
                xsltTransformError(ctxt, NULL, inst,
                        "xsltAttrTemplateValueProcessNode: unmatched '{'\n");
                ret = xmlStrncat(ret, str, cur - str);
-               return(ret);
+               goto exit;
            }
            str++;
            expr = xmlStrndup(str, cur - str);
            if (expr == NULL)
-               return(ret);
+               goto exit;
            else if (*expr == '{') {
                ret = xmlStrcat(ret, expr);
                xmlFree(expr);
@@ -361,6 +361,7 @@ xsltAttrTemplateValueProcessNode(xsltTransformContextPtr ctxt,
        ret = xmlStrncat(ret, str, cur - str);
     }
 
+exit:
     if (nsList != NULL)
        xmlFree(nsList);
 
diff --git a/libxslt/xslt.c b/libxslt/xslt.c
index b367f9e..7d9ddb6 100644
--- a/libxslt/xslt.c
+++ b/libxslt/xslt.c
@@ -1240,6 +1240,7 @@ xsltParseStylesheetOutput(xsltStylesheetPtr style, xmlNodePtr cur)
                xsltTransformError(NULL, style, cur,
                                  "invalid value for method: %s\n", prop);
                 if (style != NULL) style->warnings++;
+                xmlFree(prop);
             }
        } else {
            style->method = prop;
@@ -5446,6 +5447,7 @@ xsltParseStylesheetTemplate(xsltStylesheetPtr style, xmlNodePtr template) {
                xsltTransformError(NULL, style, template,
                    "xsl:template : error invalid name '%s'\n", prop);
                if (style != NULL) style->errors++;
+                xmlFree(prop);
                goto error;
            }
            ret->name = xmlDictLookup(style->dict, BAD_CAST prop, -1);