[xslt] Abort processing unknown variables inside translation

[Justin Fletcher <justin fletcher ntlworld com>]

Hiya,

This may be indicative of a larger problem but the attached stylesheet and
XML file generate an abort when used with xsltproc (1.0.4); although the
bug occurs with xslt, the abort happens in the xml library. I don't know
the location of the problem, so I post to just xslt. The command executed
was :

*xsltproc test.xsl test.xml
runtime error: file test.xsl line 7 element value-of
unregistered variable one
runtime error: file test.xsl line 7 element value-of
unregistered variable one

Illegal address (e.g. wildly outside array bounds)

Postmortem requested
  Arg2: 0x00000003 3
  Arg1: 0x000b8384 754564 -> [0x00000000 0x00000000 0x00000000 0x000b9790]
5b194 in function xmlXPathTranslateFunction
  Arg2: 0x000b5a0c 743948 -> [0x0000000e 0x00000006 0xffffffff 0x00000003]
  Arg1: 0x000b8384 754564 -> [0x00000000 0x00000000 0x00000000 0x000b9790]
75234 in function xmlXPathCompOpEval
  Arg2: 0x000b5a34 743988 -> [0x00000012 0x00000007 0xffffffff 0x00000000]
  Arg1: 0x000b8384 754564 -> [0x00000000 0x00000000 0x00000000 0x000b9790]
758dc in function xmlXPathCompOpEval
  Arg2: 0x000b9790 759696 -> [0x000b9a3c 0x000b99f0 0x00000000 0x00000000]
  Arg1: 0x000b79c4 752068 -> [0x00000009 0x0000000a 0x000b58f4 0x00000008]
75f3c in function xmlXPathCompiledEval
  Arg4: 0x000b6bc8 748488 -> [0x000b6c68 0x00000009 0x000813c8 0x000b71e0]
  Arg3: 0x000b71e0 750048 -> [0x000b6bc8 0x00000001 0x000b7384 0x00000000]
  Arg2: 0x000b99f0 760304 -> [0x00000000 0x00000001 0x000b99e0 0x000b99a4]
  Arg1: 0x000b9818 759832 -> [0x000b7044 0x00000000 0x000b6b28 0x00000001]
814c4 in function xsltValueOf
  Arg5: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg4: 0x000b6b28 748328 -> [0x00000000 0x000b7044 0x000b7374 0xcb3c61bd]
  Arg3: 0x000b71e0 750048 -> [0x000b6bc8 0x00000001 0x000b7384 0x00000000]
  Arg2: 0x000b99f0 760304 -> [0x00000000 0x00000001 0x000b99e0 0x000b99a4]
  Arg1: 0x000b9818 759832 -> [0x000b7044 0x00000000 0x000b6b28 0x00000001]
7f00c in function xsltApplyOneTemplate
  Arg3: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg2: 0x000b99f0 760304 -> [0x00000000 0x00000001 0x000b99e0 0x000b99a4]
  Arg1: 0x000b9818 759832 -> [0x000b7044 0x00000000 0x000b6b28 0x00000001]
7eca0 in function xsltProcessOneNode
  Arg2: 0x000b9a3c 760380 -> [0x00000000 0x00000009 0x00000000 0x000b99f0]
  Arg1: 0x000b9818 759832 -> [0x000b7044 0x00000000 0x000b6b28 0x00000001]
7e614 in function xsltDefaultProcessOneNode
  Arg3: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg2: 0x000b9a3c 760380 -> [0x00000000 0x00000009 0x00000000 0x000b99f0]
  Arg1: 0x000b9818 759832 -> [0x000b7044 0x00000000 0x000b6b28 0x00000001]
7eb3c in function xsltProcessOneNode
  Arg5: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg4: 0x00000000 0 -> [0xe59ff40c 0xe59ff40c 0xe59ff40c 0xe59ff40c]
  Arg3: 0x000a125c 660060 -> [0x00000000 0x00000000 0x00000000 0x00000000]
  Arg2: 0x000b9a3c 760380 -> [0x00000000 0x00000009 0x00000000 0x000b99f0]
  Arg1: 0x000b7044 749636 -> [0x00000000 0x00000000 0x00000000 0x00000000]
832dc in function xsltApplyStylesheetInternal
  Arg3: 0x000a125c 660060 -> [0x00000000 0x00000000 0x00000000 0x00000000]
  Arg2: 0x000b9a3c 760380 -> [0x00000000 0x00000009 0x00000000 0x000b99f0]
  Arg1: 0x000b7044 749636 -> [0x00000000 0x00000000 0x00000000 0x00000000]
8355c in function xsltApplyStylesheet
  Arg3: 0x000adc5a 711770
  Arg2: 0x000b7044 749636 -> [0x00000000 0x00000000 0x00000000 0x00000000]
  Arg1: 0x000b9a3c 760380 -> [0x00000000 0x00000009 0x00000000 0x000b99f0]
843c in function xsltProcess
  Arg2: 0x000adc30 711728 -> [0x000adc48 0x000adc51 0x000adc5a 0x00000000]
  Arg1: 0x00000003 3
983c in function main
3aa50fc in unknown procedure
9a4c in anonymous function

A brief glance at the code isn't helpful to me, but I'm guessing that the
failure of value-of is returning a NULL which is then passed on to the
parameters in xmlXPathTranslate and the access to it causes the abort.

-- 
Gerph {djf0-.3w6e2w2.226,6q6w2q2,2.3,2m4}
URL: http://www.movspclr.co.uk/
... Eyes to the heavens, screaming at the sky;
    Trying to send you messages, but choking on goodbye.
<?xml version="1.0"?>
<eins>
<content>content of one</content>
</eins>

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
 
<xsl:output method="xml" indent="yes" encoding="ISO-8859-1"/>
<xsl:variable name="two">abcde</xsl:variable>
 
<xsl:template match="*">
  <xsl:value-of select="translate('hello','ABCDE',$one)" />
</xsl:template>
 
</xsl:stylesheet>