[xslt] libxslt1.0.3, transform.c possible NULL dereference

[Justin Fletcher <justin fletcher ntlworld com>]

Hiya,

I've just had a report from someone using the RISC OS port that produced
output :

--8<--------
*xsltproc -V --profile -debug --maxdepth 50 --nonet --html --novalid -v -o simpl
e.html simple.xsl simple.xml
Using libxml 20403, libxslt 10003 and libexslt 301
xsltproc was compiled against libxml 20403, libxslt 10003 and libexslt 301
libxslt 10003 was compiled against libxml 20402
libexslt 301 was compiled against libxml 20402
RISC OS port 1.04 by Justin Fletcher Aug 24 2001
Added namespace: xsl mapped to http://www.w3.org/1999/XSL/Transform
xsltPrecomputeStylesheet: removing ignorable blank node
xsltParseStylesheetProcess : found stylesheet
xsltCompilePattern : parsing 'anj_webpage'
xsltCompilePattern : parsed anj_webpage, default priority 0.000000
added pattern : 'anj_webpage' priority 0.000000
parsed 1 templates
simple.xml:1: error: htmlParseStartTag: invalid element name
<?xml version="1.0"?>
^
simple.xml:2: error: htmlParseStartTag: invalid element name
<?xml-stylesheet type="text/xml" href="simple.xsl"?>
 ^
simple.xml:3: error: Tag anj_webpage invalid
<anj_webpage>
            ^
simple.xml:5: error: Tag content invalid
 <content>
         ^
Initializing keys on simple.xml
Registered 0 modules
Registering global variables
Registering global variables from simple.xsl
xsltProcessOneNode: no template found for <contents of zero page omitted>
xsltDefaultProcessOneNode: skipping node type 14
xsltDefaultProcessOneNode: removing ignorable blank node
xsltProcessOneNode: no template found for html
xsltProcessOneNode: no template found for body
...
--8<--------

Notice the zero page dereference (we happen to be able to read the zero page
contents - it comes out as a load of control characters and stuff - but
other systems may not be so lucky).

I don't know exactly what's going on, but the problem is caused by the file
specified being xml, but they are telling xsltproc that it is HTML; ie the
--html flag is in error. Even still, this shouldn't start to parse NULLs.

I assume that because the elements are being declared as invalid, a node is
created in the tree, but it is not given a valid name. I don't know enough
about the internals to suggest more, but I will attempt to investigate if
you need more information.

Example files available privately if required.

-- 
Gerph {djf0-.3w6e2w2.226,6q6w2q2,2.3,2m4}
URL: http://www.movspclr.co.uk/
... Eyes to the heavens, screaming at the sky;
    Trying to send you messages, but choking on goodbye.