[xslt] A test that succeeds in libxslt-1.0.23 gets a seg fault in libxslt-1.0.24

[Jean Anderson <jta bristowhill com>]

I run some "negative" tests that are based on the tests distributed with 
libxslt, and one of these gets a SIGSEGV in libxslt-1.0.24.

To reproduce the problem, cd to libxslt-1.0.24/tests/documents .

Here is test.xml:

    <?xml version="1.0"?>
    <files>
    <file name="docfile.xml"/>
    <file name="doc%5Ffile.xml"/>
    </files>

Copy that file to test-bad.xml and modify it to reference files that do 
not exist:

    <?xml version="1.0"?>
    <files>
    <file name="foofile.xml"/>
    <file name="foo%5Ffile.xml"/>
    </files>


Here is the expected libxslt-1.0.23 output for the postive (test.xml) 
and negative (test-bad.xml) tests:

    $ xsltproc -V
    Using libxml 20430, libxslt 10023 and libexslt 714
    xsltproc was compiled against libxml 20430, libxslt 10023 and 
libexslt 714
    libxslt 10023 was compiled against libxml 20430
    libexslt 714 was compiled against libxml 20430

    $ xsltproc test.xsl test.xml

    It work's
    It work's

    $ xsltproc test.xsl test-bad.xml
    warning: failed to load external entity "foofile.xml"
    warning: failed to load external entity "foo_file.xml"

    Can't Open File: foofile.xml
    Can't Open File: foo%5Ffile.xml

In libxslt-1.0.24, the postive test outputs correct results, but the 
negative test seg faults:

    $ xsltproc -V
    Using libxml 20430, libxslt 10024 and libexslt 715
    xsltproc was compiled against libxml 20430, libxslt 10024 and 
libexslt 715
    libxslt 10024 was compiled against libxml 20430
    libexslt 715 was compiled against libxml 20430

    $ xsltproc test.xsl test.xml

    It work's
    It work's

    $ xsltproc test.xsl test-bad.xml
    warning: failed to load external entity "foofile.xml"
    Segmentation fault


Here's where it fails:

    Program received signal SIGSEGV, Segmentation fault.
    xsltDocumentFunctionLoadDocument (ctxt=0x811abf8, URI=0x811af88 
"#oofile.xml")
        at functions.c:155
    155      doc = xsltdoc->doc;


   (gdb) where
   #0  xsltDocumentFunctionLoadDocument (ctxt=0x811abf8,
       URI=0x811af88 "#oofile.xml") at functions.c:155
   #1  0x08066502 in xsltDocumentFunction (ctxt=0x811abf8, nargs=2)
       at functions.c:324
   #2  0x0806632e in xsltDocumentFunction (ctxt=0x811abf8, nargs=1)
       at functions.c:266
   #3  0x080bc86d in xmlXPathCompOpEval (ctxt=0x811abf8, op=0x8111030)
       at xpath.c:10084
   #4  0x080bd01b in xmlXPathCompOpEval (ctxt=0x811abf8, op=0x8111058)
       at xpath.c:10369
   #5  0x080bd32b in xmlXPathRunEval (ctxt=0x811abf8) at xpath.c:10487
   #6  0x080bd64f in xmlXPathCompiledEval (comp=0x8110f78, ctx=0x811f4f8)
       at xpath.c:10655
   #7  0x08056433 in xsltEvalVariable (ctxt=0x811f448, elem=0x811aba8,
       precomp=0x8110e70) at variables.c:332
   #8  0x080570a1 in xsltBuildVariable (ctxt=0x811f448, comp=0x8110e70, 
tree=0x0)      at variables.c:1034
   #9  0x08057169 in xsltRegisterVariable (ctxt=0x811f448, comp=0x8110e70,
       tree=0x0, param=0) at variables.c:1077
    ...

I don't know enough about the libxslt source to attempt fixing this 
myself. Is this enough for someone else to go on?

thanks,

  -jean