libxml2/patches/libxml2-2.7.7-xpath-double-free.patch

   1 --- a/xpath.c
   2 +++ a/xpath.c
   3 @@ -11763,11 +11763,16 @@ xmlXPathCompOpEvalPositionalPredicate(xmlXPathParserContextPtr ctxt,
   4
   5             if ((ctxt->error != XPATH_EXPRESSION_OK) || (res == -1)) {
   6                 xmlXPathObjectPtr tmp;
   7 -               /* pop the result */
   8 +               /* pop the result if any */
   9                 tmp = valuePop(ctxt);
  10 -               xmlXPathReleaseObject(xpctxt, tmp);
  11 -               /* then pop off contextObj, which will be freed later */
  12 -               valuePop(ctxt);
  13 +                if (tmp != contextObj) {
  14 +                    /*
  15 +                     * Free up the result
  16 +                     * then pop off contextObj, which will be freed later
  17 +                     */
  18 +                    xmlXPathReleaseObject(xpctxt, tmp);
  19 +                    valuePop(ctxt);
  20 +                }
  21                 goto evaluation_error;
  22             }