Upgrade to libxml 2.9.2 and libxslt 1.1.28

third_party/libxml/src/xpointer.c

 /*
  * xpointer.c : Code to handle XML Pointer
  *
  * Base implementation was made accordingly to
  * W3C Candidate Recommendation 7 June 2000
  * http://www.w3.org/TR/2000/CR-xptr-20000607
  *
  * Added support for the element() scheme described in:
  * W3C Proposed Recommendation 13 November 2002
- * http://www.w3.org/TR/2002/PR-xptr-element-20021113/  
+ * http://www.w3.org/TR/2002/PR-xptr-element-20021113/
  *
  * See Copyright for the status of this software.
  *
  * daniel@veillard.com
  */
 
 #define IN_LIBXML
 #include "libxml.h"
 
 /*
@@ skipping 19 matching lines @@
 /* Add support of the xmlns() xpointer scheme to initialize the namespaces */
 #define XPTR_XMLNS_SCHEME
 
 /* #define DEBUG_RANGES */
 #ifdef DEBUG_RANGES
 #ifdef LIBXML_DEBUG_ENABLED
 #include <libxml/debugXML.h>
 #endif
 #endif
 
-#define TODO                                                            \
+#define TODO                                                            \
     xmlGenericError(xmlGenericErrorContext,                             \
             "Unimplemented block at %s:%d\n",                           \
             __FILE__, __LINE__);
 
-#define STRANGE                                                         \
+#define STRANGE                                                 \
     xmlGenericError(xmlGenericErrorContext,                             \
             "Internal error at %s:%d\n",                                \
             __FILE__, __LINE__);
 
 /************************************************************************
  *                                                                      *
- *              Some factorized error routines                          *
+ *              Some factorized error routines                          *
  *                                                                      *
  ************************************************************************/
 
 /**
  * xmlXPtrErrMemory:
  * @extra:  extra informations
  *
  * Handle a redefinition of attribute error
  */
 static void
@@ skipping 54 matching lines @@
 xmlNodePtr xmlXPtrAdvanceNode(xmlNodePtr cur, int *level);
 /**
  * xmlXPtrGetArity:
  * @cur:  the node
  *
  * Returns the number of child for an element, -1 in case of error
  */
 static int
 xmlXPtrGetArity(xmlNodePtr cur) {
     int i;
-    if (cur == NULL) 
+    if ((cur == NULL) || (cur->type == XML_NAMESPACE_DECL))
         return(-1);
     cur = cur->children;
     for (i = 0;cur != NULL;cur = cur->next) {
         if ((cur->type == XML_ELEMENT_NODE) ||
             (cur->type == XML_DOCUMENT_NODE) ||
             (cur->type == XML_HTML_DOCUMENT_NODE)) {
             i++;
         }
     }
     return(i);
 }
 
 /**
  * xmlXPtrGetIndex:
  * @cur:  the node
  *
  * Returns the index of the node in its parent children list, -1
  *         in case of error
  */
 static int
 xmlXPtrGetIndex(xmlNodePtr cur) {
     int i;
-    if (cur == NULL) 
+    if ((cur == NULL) || (cur->type == XML_NAMESPACE_DECL))
         return(-1);
     for (i = 1;cur != NULL;cur = cur->prev) {
         if ((cur->type == XML_ELEMENT_NODE) ||
             (cur->type == XML_DOCUMENT_NODE) ||
             (cur->type == XML_HTML_DOCUMENT_NODE)) {
             i++;
         }
     }
     return(i);
 }
 
 /**
  * xmlXPtrGetNthChild:
  * @cur:  the node
  * @no:  the child number
  *
  * Returns the @no'th element child of @cur or NULL
  */
 static xmlNodePtr
 xmlXPtrGetNthChild(xmlNodePtr cur, int no) {
     int i;
-    if (cur == NULL) 
+    if ((cur == NULL) || (cur->type == XML_NAMESPACE_DECL))
         return(cur);
     cur = cur->children;
     for (i = 0;i <= no;cur = cur->next) {
-        if (cur == NULL) 
+        if (cur == NULL)
             return(cur);
         if ((cur->type == XML_ELEMENT_NODE) ||
             (cur->type == XML_DOCUMENT_NODE) ||
             (cur->type == XML_HTML_DOCUMENT_NODE)) {
             i++;
             if (i == no)
                 break;
         }
     }
     return(cur);
@@ skipping 349 matching lines @@
     if (start == NULL)
         return(NULL);
     if (end == NULL)
         return(NULL);
     switch (end->type) {
         case XPATH_POINT:
         case XPATH_RANGE:
             break;
         case XPATH_NODESET:
             /*
-             * Empty set ... 
+             * Empty set ...
              */
             if (end->nodesetval->nodeNr <= 0)
                 return(NULL);
             break;
         default:
             /* TODO */
             return(NULL);
     }
 
     ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
@@ skipping 157 matching lines @@
     if (val == NULL) return;
 
     /*
      * check against doublons
      */
     for (i = 0;i < cur->locNr;i++)
         if (cur->locTab[i] == val) break;
 
     if (i >= cur->locNr) {
 #ifdef DEBUG
-        xmlGenericError(xmlGenericErrorContext, 
+        xmlGenericError(xmlGenericErrorContext,
                 "xmlXPtrLocationSetDel: Range wasn't found in RangeList\n");
 #endif
         return;
     }
     cur->locNr--;
     for (;i < cur->locNr;i++)
         cur->locTab[i] = cur->locTab[i + 1];
     cur->locTab[cur->locNr] = NULL;
 }
 
@@ skipping 151 matching lines @@
  *   NEXT    Skip to the next character, this does the proper decoding
  *           in UTF-8 mode. It also pop-up unfinished entities on the fly.
  *           It returns the pointer to the current xmlChar.
  */
 
 #define CUR (*ctxt->cur)
 #define SKIP(val) ctxt->cur += (val)
 #define NXT(val) ctxt->cur[(val)]
 #define CUR_PTR ctxt->cur
 
-#define SKIP_BLANKS                                                     \
+#define SKIP_BLANKS                                                     \
     while (IS_BLANK_CH(*(ctxt->cur))) NEXT
 
 #define CURRENT (*ctxt->cur)
 #define NEXT ((*ctxt->cur) ?  ctxt->cur++: ctxt->cur)
 
 /*
  * xmlXPtrGetChildNo:
  * @ctxt:  the XPointer Parser context
  * @index:  the child number
  *
@@ skipping 21 matching lines @@
         return;
     }
     oldset->nodeTab[0] = cur;
     valuePush(ctxt, obj);
 }
 
 /**
  * xmlXPtrEvalXPtrPart:
  * @ctxt:  the XPointer Parser context
  * @name:  the preparsed Scheme for the XPtrPart
- * 
+ *
  * XPtrPart ::= 'xpointer' '(' XPtrExpr ')'
  *            | Scheme '(' SchemeSpecificExpr ')'
  *
  * Scheme   ::=  NCName - 'xpointer' [VC: Non-XPointer schemes]
  *
  * SchemeSpecificExpr ::= StringWithBalancedParens
  *
- * StringWithBalancedParens ::=  
+ * StringWithBalancedParens ::=
  *              [^()]* ('(' StringWithBalancedParens ')' [^()]*)*
  *              [VC: Parenthesis escaping]
  *
  * XPtrExpr ::= Expr [VC: Parenthesis escaping]
  *
  * VC: Parenthesis escaping:
  *   The end of an XPointer part is signaled by the right parenthesis ")"
  *   character that is balanced with the left parenthesis "(" character
  *   that began the part. Any unbalanced parenthesis character inside the
  *   expression, even within literals, must be escaped with a circumflex (^)
  *   character preceding it. If the expression contains any literal
  *   occurrences of the circumflex, each must be escaped with an additional
  *   circumflex (that is, ^^). If the unescaped parentheses in the expression
  *   are not balanced, a syntax error results.
  *
  * Parse and evaluate an XPtrPart. Basically it generates the unescaped
  * string and if the scheme is 'xpointer' it will call the XPath interpreter.
- * 
+ *
  * TODO: there is no new scheme registration mechanism
  */
 
 static void
 xmlXPtrEvalXPtrPart(xmlXPathParserContextPtr ctxt, xmlChar *name) {
     xmlChar *buffer, *cur;
     int len;
     int level;
 
     if (name == NULL)
@@ skipping 18 matching lines @@
     while (CUR != 0) {
         if (CUR == ')') {
             level--;
             if (level == 0) {
                 NEXT;
                 break;
             }
         } else if (CUR == '(') {
             level++;
         } else if (CUR == '^') {
-            if ((NXT(1) == ')') || (NXT(1) == '(') || (NXT(1) == '^')) {
-                NEXT;
-            }
+            if ((NXT(1) == ')') || (NXT(1) == '(') || (NXT(1) == '^')) {
+                NEXT;
+            }
         }
-        *cur++ = CUR;
+        *cur++ = CUR;
         NEXT;
     }
     *cur = 0;
 
     if ((level != 0) && (CUR == 0)) {
         xmlFree(buffer);
         XP_ERROR(XPTR_SYNTAX_ERROR);
     }
 
     if (xmlStrEqual(name, (xmlChar *) "xpointer")) {
@@ skipping 62 matching lines @@
             XP_ERROR(XPTR_SYNTAX_ERROR);
         }
         URI = xmlSaveUri(value);
         xmlFreeURI(value);
         if (URI == NULL) {
             xmlFree(prefix);
             xmlFree(buffer);
             xmlFree(name);
             XP_ERROR(XPATH_MEMORY_ERROR);
         }
-        
+
         xmlXPathRegisterNs(ctxt->context, prefix, URI);
         CUR_PTR = left;
         xmlFree(URI);
         xmlFree(prefix);
 #endif /* XPTR_XMLNS_SCHEME */
     } else {
         xmlXPtrErr(ctxt, XML_XPTR_UNKNOWN_SCHEME,
                    "unsupported scheme '%s'\n", name);
     }
     xmlFree(buffer);
@@ skipping 111 matching lines @@
     if (name != NULL) {
         valuePush(ctxt, xmlXPathNewString(name));
         xmlFree(name);
         xmlXPathIdFunction(ctxt, 1);
         CHECK_ERROR;
     }
 
     while (CUR == '/') {
         int child = 0;
         NEXT;
-        
+
         while ((CUR >= '0') && (CUR <= '9')) {
             child = child * 10 + (CUR - '0');
             NEXT;
         }
         xmlXPtrGetChildNo(ctxt, child);
     }
 }
 
 
 /**
  * xmlXPtrEvalXPointer:
  * @ctxt:  the XPointer Parser context
  *
  *  XPointer ::= Name
  *             | ChildSeq
  *             | FullXPtr
  *
  * Parse and evaluate an XPointer
  */
 static void
 xmlXPtrEvalXPointer(xmlXPathParserContextPtr ctxt) {
     if (ctxt->valueTab == NULL) {
         /* Allocate the value stack */
-        ctxt->valueTab = (xmlXPathObjectPtr *) 
+        ctxt->valueTab = (xmlXPathObjectPtr *)
                          xmlMalloc(10 * sizeof(xmlXPathObjectPtr));
         if (ctxt->valueTab == NULL) {
             xmlXPtrErrMemory("allocating evaluation context");
             return;
         }
         ctxt->valueNr = 0;
         ctxt->valueMax = 10;
         ctxt->value = NULL;
+        ctxt->valueFrame = 0;
     }
     SKIP_BLANKS;
     if (CUR == '/') {
         xmlXPathRoot(ctxt);
         xmlXPtrEvalChildSeq(ctxt, NULL);
     } else {
         xmlChar *name;
 
         name = xmlXPathParseName(ctxt);
         if (name == NULL)
@@ skipping 92 matching lines @@
     xmlXPathObjectPtr res = NULL, tmp;
     xmlXPathObjectPtr init = NULL;
     int stack = 0;
 
     xmlXPathInit();
 
     if ((ctx == NULL) || (str == NULL))
         return(NULL);
 
     ctxt = xmlXPathNewParserContext(str, ctx);
+    if (ctxt == NULL)
+        return(NULL);
     ctxt->xptr = 1;
     xmlXPtrEvalXPointer(ctxt);
 
     if ((ctxt->value != NULL) &&
         (ctxt->value->type != XPATH_NODESET) &&
         (ctxt->value->type != XPATH_LOCATIONSET)) {
         xmlXPtrErr(ctxt, XML_XPTR_EVAL_FAILED,
                 "xmlXPtrEval: evaluation failed to return a node set\n",
                    NULL);
     } else {
         res = valuePop(ctxt);
     }
 
     do {
         tmp = valuePop(ctxt);
         if (tmp != NULL) {
             if (tmp != init) {
                 if (tmp->type == XPATH_NODESET) {
                     /*
                      * Evaluation may push a root nodeset which is unused
                      */
-                    xmlNodeSetPtr set; 
+                    xmlNodeSetPtr set;
                     set = tmp->nodesetval;
                     if ((set->nodeNr != 1) ||
                         (set->nodeTab[0] != (xmlNodePtr) ctx->doc))
                         stack++;
                 } else
-                    stack++;    
+                    stack++;
             }
             xmlXPathFreeObject(tmp);
         }
     } while (tmp != NULL);
     if (stack != 0) {
         xmlXPtrErr(ctxt, XML_XPTR_EXTRA_OBJECTS,
                    "xmlXPtrEval: object(s) left on the eval stack\n",
                    NULL);
     }
     if (ctxt->error != XPATH_EXPRESSION_OK) {
         xmlXPathFreeObject(res);
         res = NULL;
     }
-        
+
     xmlXPathFreeParserContext(ctxt);
     return(res);
 }
 
 /**
  * xmlXPtrBuildRangeNodeList:
  * @range:  a range object
  *
  * Build a node list tree copy of the range
  *
  * Returns an xmlNodePtr list or NULL.
  *         the caller has to free the node tree.
  */
 static xmlNodePtr
 xmlXPtrBuildRangeNodeList(xmlXPathObjectPtr range) {
     /* pointers to generated nodes */
     xmlNodePtr list = NULL, last = NULL, parent = NULL, tmp;
     /* pointers to traversal nodes */
     xmlNodePtr start, cur, end;
     int index1, index2;
 
     if (range == NULL)
         return(NULL);
     if (range->type != XPATH_RANGE)
         return(NULL);
     start = (xmlNodePtr) range->user;
 
-    if (start == NULL)
+    if ((start == NULL) || (start->type == XML_NAMESPACE_DECL))
         return(NULL);
     end = range->user2;
     if (end == NULL)
         return(xmlCopyNode(start, 1));
+    if (end->type == XML_NAMESPACE_DECL)
+        return(NULL);
 
     cur = start;
     index1 = range->index;
     index2 = range->index2;
     while (cur != NULL) {
         if (cur == end) {
             if (cur->type == XML_TEXT_NODE) {
                 const xmlChar *content = cur->content;
                 int len;
 
                 if (content == NULL) {
                     tmp = xmlNewTextLen(NULL, 0);
                 } else {
                     len = index2;
                     if ((cur == start) && (index1 > 1)) {
                         content += (index1 - 1);
                         len -= (index1 - 1);
                         index1 = 0;
                     } else {
                         len = index2;
                     }
                     tmp = xmlNewTextLen(content, len);
                 }
                 /* single sub text node selection */
                 if (list == NULL)
                     return(tmp);
                 /* prune and return full set */
                 if (last != NULL)
                     xmlAddNextSibling(last, tmp);
-                else 
+                else
                     xmlAddChild(parent, tmp);
                 return(list);
             } else {
                 tmp = xmlCopyNode(cur, 0);
                 if (list == NULL)
                     list = tmp;
                 else {
                     if (last != NULL)
                         xmlAddNextSibling(last, tmp);
                     else
@@ skipping 233 matching lines @@
             return(-1);
     }
     return(ret);
 }
 
 /**
  * xmlXPtrHereFunction:
  * @ctxt:  the XPointer Parser context
  * @nargs:  the number of args
  *
- * Function implementing here() operation 
+ * Function implementing here() operation
  * as described in 5.4.3
  */
 static void
 xmlXPtrHereFunction(xmlXPathParserContextPtr ctxt, int nargs) {
     CHECK_ARITY(0);
 
     if (ctxt->context->here == NULL)
         XP_ERROR(XPTR_SYNTAX_ERROR);
-    
+
     valuePush(ctxt, xmlXPtrNewLocationSetNodes(ctxt->context->here, NULL));
 }
 
 /**
  * xmlXPtrOriginFunction:
  * @ctxt:  the XPointer Parser context
  * @nargs:  the number of args
  *
- * Function implementing origin() operation 
+ * Function implementing origin() operation
  * as described in 5.4.3
  */
 static void
 xmlXPtrOriginFunction(xmlXPathParserContextPtr ctxt, int nargs) {
     CHECK_ARITY(0);
 
     if (ctxt->context->origin == NULL)
         XP_ERROR(XPTR_SYNTAX_ERROR);
-    
+
     valuePush(ctxt, xmlXPtrNewLocationSetNodes(ctxt->context->origin, NULL));
 }
 
 /**
  * xmlXPtrStartPointFunction:
  * @ctxt:  the XPointer Parser context
  * @nargs:  the number of args
  *
- * Function implementing start-point() operation 
+ * Function implementing start-point() operation
  * as described in 5.4.3
  * ----------------
  * location-set start-point(location-set)
  *
  * For each location x in the argument location-set, start-point adds a
  * location of type point to the result location-set. That point represents
  * the start point of location x and is determined by the following rules:
  *
  * - If x is of type point, the start point is x.
  * - If x is of type range, the start point is the start point of x.
@@ skipping 16 matching lines @@
          (ctxt->value->type != XPATH_NODESET)))
         XP_ERROR(XPATH_INVALID_TYPE)
 
     obj = valuePop(ctxt);
     if (obj->type == XPATH_NODESET) {
         /*
          * First convert to a location set
          */
         tmp = xmlXPtrNewLocationSetNodeSet(obj->nodesetval);
         xmlXPathFreeObject(obj);
+        if (tmp == NULL)
+            XP_ERROR(XPATH_MEMORY_ERROR)
         obj = tmp;
     }
 
     newset = xmlXPtrLocationSetCreate(NULL);
     if (newset == NULL) {
         xmlXPathFreeObject(obj);
         XP_ERROR(XPATH_MEMORY_ERROR);
     }
     oldset = (xmlLocationSetPtr) obj->user;
     if (oldset != NULL) {
@@ skipping 35 matching lines @@
     }
     xmlXPathFreeObject(obj);
     valuePush(ctxt, xmlXPtrWrapLocationSet(newset));
 }
 
 /**
  * xmlXPtrEndPointFunction:
  * @ctxt:  the XPointer Parser context
  * @nargs:  the number of args
  *
- * Function implementing end-point() operation 
+ * Function implementing end-point() operation
  * as described in 5.4.3
  * ----------------------------
  * location-set end-point(location-set)
  *
  * For each location x in the argument location-set, end-point adds a
  * location of type point to the result location-set. That point represents
  * the end point of location x and is determined by the following rules:
  *
  * - If x is of type point, the resulting point is x.
  * - If x is of type range, the resulting point is the end point of x.
@@ skipping 18 matching lines @@
          (ctxt->value->type != XPATH_NODESET)))
         XP_ERROR(XPATH_INVALID_TYPE)
 
     obj = valuePop(ctxt);
     if (obj->type == XPATH_NODESET) {
         /*
          * First convert to a location set
          */
         tmp = xmlXPtrNewLocationSetNodeSet(obj->nodesetval);
         xmlXPathFreeObject(obj);
+        if (tmp == NULL)
+            XP_ERROR(XPATH_MEMORY_ERROR)
         obj = tmp;
     }
 
     newset = xmlXPtrLocationSetCreate(NULL);
+    if (newset == NULL) {
+        xmlXPathFreeObject(obj);
+        XP_ERROR(XPATH_MEMORY_ERROR);
+    }
     oldset = (xmlLocationSetPtr) obj->user;
     if (oldset != NULL) {
         int i;
 
         for (i = 0; i < oldset->locNr; i++) {
             tmp = oldset->locTab[i];
             if (tmp == NULL)
                 continue;
             point = NULL;
             switch (tmp->type) {
@@ skipping 73 matching lines @@
                         case XML_ELEMENT_NODE:
                         case XML_TEXT_NODE:
                         case XML_CDATA_SECTION_NODE:
                         case XML_ENTITY_REF_NODE:
                         case XML_PI_NODE:
                         case XML_COMMENT_NODE:
                         case XML_DOCUMENT_NODE:
                         case XML_NOTATION_NODE:
                         case XML_HTML_DOCUMENT_NODE: {
                             int indx = xmlXPtrGetIndex(node);
-                             
+
                             node = node->parent;
                             return(xmlXPtrNewRange(node, indx - 1,
                                                    node, indx + 1));
                         }
                         default:
                             return(NULL);
                     }
                 }
             }
         default:
@@ skipping 30 matching lines @@
 
     set = valuePop(ctxt);
     if (set->type == XPATH_NODESET) {
         xmlXPathObjectPtr tmp;
 
         /*
          * First convert to a location set
          */
         tmp = xmlXPtrNewLocationSetNodeSet(set->nodesetval);
         xmlXPathFreeObject(set);
+        if (tmp == NULL)
+            XP_ERROR(XPATH_MEMORY_ERROR)
         set = tmp;
     }
     oldset = (xmlLocationSetPtr) set->user;
 
     /*
      * The loop is to compute the covering range for each item and add it
      */
     newset = xmlXPtrLocationSetCreate(NULL);
+    if (newset == NULL) {
+        xmlXPathFreeObject(set);
+        XP_ERROR(XPATH_MEMORY_ERROR);
+    }
     for (i = 0;i < oldset->locNr;i++) {
         xmlXPtrLocationSetAdd(newset,
                 xmlXPtrCoveringRange(ctxt, oldset->locTab[i]));
     }
 
     /*
      * Save the new value and cleanup
      */
     valuePush(ctxt, xmlXPtrWrapLocationSet(newset));
     xmlXPathFreeObject(set);
@@ skipping 118 matching lines @@
 
     set = valuePop(ctxt);
     if (set->type == XPATH_NODESET) {
         xmlXPathObjectPtr tmp;
 
         /*
          * First convert to a location set
          */
         tmp = xmlXPtrNewLocationSetNodeSet(set->nodesetval);
         xmlXPathFreeObject(set);
+        if (tmp == NULL)
+             XP_ERROR(XPATH_MEMORY_ERROR)
         set = tmp;
     }
     oldset = (xmlLocationSetPtr) set->user;
 
     /*
      * The loop is to compute the covering range for each item and add it
      */
     newset = xmlXPtrLocationSetCreate(NULL);
+    if (newset == NULL) {
+        xmlXPathFreeObject(set);
+        XP_ERROR(XPATH_MEMORY_ERROR);
+    }
     for (i = 0;i < oldset->locNr;i++) {
         xmlXPtrLocationSetAdd(newset,
                 xmlXPtrInsideRange(ctxt, oldset->locTab[i]));
     }
 
     /*
      * Save the new value and cleanup
      */
     valuePush(ctxt, xmlXPtrWrapLocationSet(newset));
     xmlXPathFreeObject(set);
@@ skipping 22 matching lines @@
      * Save the expression pointer since we will have to evaluate
      * it multiple times. Initialize the new set.
      */
     CHECK_TYPE(XPATH_NODESET);
     obj = valuePop(ctxt);
     oldset = obj->nodesetval;
     ctxt->context->node = NULL;
 
     cur = ctxt->cur;
     newset = xmlXPtrLocationSetCreate(NULL);
-    
+
     for (i = 0; i < oldset->nodeNr; i++) {
         ctxt->cur = cur;
 
         /*
          * Run the evaluation with a node list made of a single item
          * in the nodeset.
          */
         ctxt->context->node = oldset->nodeTab[i];
         tmp = xmlXPathNewNodeSet(ctxt->context->node);
         valuePush(ctxt, tmp);
@@ skipping 13 matching lines @@
 
         /*
          * Cleanup
          */
         if (res != NULL)
             xmlXPathFreeObject(res);
         if (ctxt->value == tmp) {
             res = valuePop(ctxt);
             xmlXPathFreeObject(res);
         }
-        
+
         ctxt->context->node = NULL;
     }
 
     /*
      * The result is used as the new evaluation set.
      */
     xmlXPathFreeObject(obj);
     ctxt->context->node = NULL;
     ctxt->context->contextSize = -1;
     ctxt->context->proximityPosition = -1;
     valuePush(ctxt, xmlXPtrWrapLocationSet(newset));
 }
 
 /**
  * xmlXPtrAdvanceNode:
  * @cur:  the node
  * @level: incremented/decremented to show level in tree
  *
  * Advance to the next element or text node in document order
- * TODO: add a stack for entering/exiting entities 
+ * TODO: add a stack for entering/exiting entities
  *
  * Returns -1 in case of failure, 0 otherwise
  */
 xmlNodePtr
 xmlXPtrAdvanceNode(xmlNodePtr cur, int *level) {
 next:
-    if (cur == NULL)
+    if ((cur == NULL) || (cur->type == XML_NAMESPACE_DECL))
         return(NULL);
     if (cur->children != NULL) {
         cur = cur->children ;
         if (level != NULL)
             (*level)++;
         goto found;
     }
 skip:           /* This label should only be needed if something is wrong! */
     if (cur->next != NULL) {
         cur = cur->next;
@@ skipping 37 matching lines @@
  */
 static int
 xmlXPtrAdvanceChar(xmlNodePtr *node, int *indx, int bytes) {
     xmlNodePtr cur;
     int pos;
     int len;
 
     if ((node == NULL) || (indx == NULL))
         return(-1);
     cur = *node;
-    if (cur == NULL)
+    if ((cur == NULL) || (cur->type == XML_NAMESPACE_DECL))
         return(-1);
     pos = *indx;
 
     while (bytes >= 0) {
         /*
          * First position to the beginning of the first text node
          * corresponding to this point
          */
         while ((cur != NULL) &&
                ((cur->type == XML_ELEMENT_NODE) ||
@@ skipping 17 matching lines @@
         /*
          * if there is no move needed return the current value.
          */
         if (pos == 0) pos = 1;
         if (bytes == 0) {
             *node = cur;
             *indx = pos;
             return(0);
         }
         /*
-         * We should have a text (or cdata) node ... 
+         * We should have a text (or cdata) node ...
          */
         len = 0;
         if ((cur->type != XML_ELEMENT_NODE) &&
             (cur->content != NULL)) {
             len = xmlStrlen(cur->content);
         }
         if (pos > len) {
             /* Strange, the indx in the text node is greater than it's len */
             STRANGE
             pos = len;
@@ skipping 32 matching lines @@
 xmlXPtrMatchString(const xmlChar *string, xmlNodePtr start, int startindex,
                     xmlNodePtr *end, int *endindex) {
     xmlNodePtr cur;
     int pos; /* 0 based */
     int len; /* in bytes */
     int stringlen; /* in bytes */
     int match;
 
     if (string == NULL)
         return(-1);
-    if (start == NULL)
+    if ((start == NULL) || (start->type == XML_NAMESPACE_DECL))
         return(-1);
-    if ((end == NULL) || (endindex == NULL))
+    if ((end == NULL) || (*end == NULL) ||
+        ((*end)->type == XML_NAMESPACE_DECL) || (endindex == NULL))
         return(-1);
     cur = start;
-    if (cur == NULL)
-        return(-1);
     pos = startindex - 1;
     stringlen = xmlStrlen(string);
 
     while (stringlen > 0) {
         if ((cur == *end) && (pos + stringlen > *endindex))
             return(0);
 
         if ((cur->type != XML_ELEMENT_NODE) && (cur->content != NULL)) {
             len = xmlStrlen(cur->content);
             if (len >= pos + stringlen) {
@@ skipping 58 matching lines @@
 xmlXPtrSearchString(const xmlChar *string, xmlNodePtr *start, int *startindex,
                     xmlNodePtr *end, int *endindex) {
     xmlNodePtr cur;
     const xmlChar *str;
     int pos; /* 0 based */
     int len; /* in bytes */
     xmlChar first;
 
     if (string == NULL)
         return(-1);
-    if ((start == NULL) || (startindex == NULL))
+    if ((start == NULL) || (*start == NULL) ||
+        ((*start)->type == XML_NAMESPACE_DECL) || (startindex == NULL))
         return(-1);
     if ((end == NULL) || (endindex == NULL))
         return(-1);
     cur = *start;
-    if (cur == NULL)
-        return(-1);
     pos = *startindex - 1;
     first = string[0];
 
     while (cur != NULL) {
         if ((cur->type != XML_ELEMENT_NODE) && (cur->content != NULL)) {
             len = xmlStrlen(cur->content);
             while (pos <= len) {
                 if (first != 0) {
                     str = xmlStrchr(&cur->content[pos], first);
                     if (str != NULL) {
@@ skipping 12 matching lines @@
                             return(1);
                         }
                         pos++;
                     } else {
                         pos = len + 1;
                     }
                 } else {
                     /*
                      * An empty string is considered to match before each
                      * character of the string-value and after the final
-                     * character. 
+                     * character.
                      */
 #ifdef DEBUG_RANGES
                     xmlGenericError(xmlGenericErrorContext,
                             "found '' at index %d of ->",
                             pos + 1);
                     xmlDebugDumpString(stdout, cur->content);
                     xmlGenericError(xmlGenericErrorContext, "\n");
 #endif
                     *start = cur;
                     *startindex = pos + 1;
@@ skipping 20 matching lines @@
  *
  * Computes the point coordinates of the last char of this point
  *
  * Returns -1 in case of failure, 0 otherwise
  */
 static int
 xmlXPtrGetLastChar(xmlNodePtr *node, int *indx) {
     xmlNodePtr cur;
     int pos, len = 0;
 
-    if ((node == NULL) || (indx == NULL))
+    if ((node == NULL) || (*node == NULL) ||
+        ((*node)->type == XML_NAMESPACE_DECL) || (indx == NULL))
         return(-1);
     cur = *node;
     pos = *indx;
 
-    if (cur == NULL)
-        return(-1);
-
     if ((cur->type == XML_ELEMENT_NODE) ||
         (cur->type == XML_DOCUMENT_NODE) ||
         (cur->type == XML_HTML_DOCUMENT_NODE)) {
         if (pos > 0) {
             cur = xmlXPtrGetNthChild(cur, pos);
         }
     }
     while (cur != NULL) {
         if (cur->last != NULL)
             cur = cur->last;
@@ skipping 83 matching lines @@
     }
     return(-1);
 }
 
 /**
  * xmlXPtrStringRangeFunction:
  * @ctxt:  the XPointer Parser context
  * @nargs:  the number of args
  *
  * Function implementing the string-range() function
- * range as described in 5.4.2 
+ * range as described in 5.4.2
  *
  * ------------------------------
  * [Definition: For each location in the location-set argument,
  * string-range returns a set of string ranges, a set of substrings in a
  * string. Specifically, the string-value of the location is searched for
  * substrings that match the string argument, and the resulting location-set
  * will contain a range location for each non-overlapping match.]
  * An empty string is considered to match before each character of the
  * string-value and after the final character. Whitespace in a string
  * is matched literally, with no normalization except that provided by
@@ skipping 48 matching lines @@
     }
     CHECK_TYPE(XPATH_STRING);
     string = valuePop(ctxt);
     if ((ctxt->value == NULL) ||
         ((ctxt->value->type != XPATH_LOCATIONSET) &&
          (ctxt->value->type != XPATH_NODESET)))
         XP_ERROR(XPATH_INVALID_TYPE)
 
     set = valuePop(ctxt);
     newset = xmlXPtrLocationSetCreate(NULL);
+    if (newset == NULL) {
+        xmlXPathFreeObject(set);
+        XP_ERROR(XPATH_MEMORY_ERROR);
+    }
     if (set->nodesetval == NULL) {
         goto error;
     }
     if (set->type == XPATH_NODESET) {
         xmlXPathObjectPtr tmp;
 
         /*
          * First convert to a location set
          */
         tmp = xmlXPtrNewLocationSetNodeSet(set->nodesetval);
         xmlXPathFreeObject(set);
+        if (tmp == NULL)
+             XP_ERROR(XPATH_MEMORY_ERROR)
         set = tmp;
     }
     oldset = (xmlLocationSetPtr) set->user;
 
     /*
      * The loop is to search for each element in the location set
      * the list of location set corresponding to that search
      */
     for (i = 0;i < oldset->locNr;i++) {
 #ifdef DEBUG_RANGES
@@ skipping 64 matching lines @@
     xmlXPathFreeObject(string);
     if (position) xmlXPathFreeObject(position);
     if (number) xmlXPathFreeObject(number);
 }
 
 /**
  * xmlXPtrEvalRangePredicate:
  * @ctxt:  the XPointer Parser context
  *
  *  [8]   Predicate ::=   '[' PredicateExpr ']'
- *  [9]   PredicateExpr ::=   Expr 
+ *  [9]   PredicateExpr ::=   Expr
  *
  * Evaluate a predicate as in xmlXPathEvalPredicate() but for
  * a Location Set instead of a node set
  */
 void
 xmlXPtrEvalRangePredicate(xmlXPathParserContextPtr ctxt) {
     const xmlChar *cur;
     xmlXPathObjectPtr res;
     xmlXPathObjectPtr obj, tmp;
     xmlLocationSetPtr newset = NULL;
@@ skipping 28 matching lines @@
             xmlXPathFreeObject(res);
         valuePush(ctxt, obj);
         CHECK_ERROR;
     } else {
         /*
          * Save the expression pointer since we will have to evaluate
          * it multiple times. Initialize the new set.
          */
         cur = ctxt->cur;
         newset = xmlXPtrLocationSetCreate(NULL);
-        
+
         for (i = 0; i < oldset->locNr; i++) {
             ctxt->cur = cur;
 
             /*
              * Run the evaluation with a node list made of a single item
              * in the nodeset.
              */
             ctxt->context->node = oldset->locTab[i]->user;
             tmp = xmlXPathNewNodeSet(ctxt->context->node);
             valuePush(ctxt, tmp);
@@ skipping 15 matching lines @@
 
             /*
              * Cleanup
              */
             if (res != NULL)
                 xmlXPathFreeObject(res);
             if (ctxt->value == tmp) {
                 res = valuePop(ctxt);
                 xmlXPathFreeObject(res);
             }
-            
+
             ctxt->context->node = NULL;
         }
 
         /*
          * The result is used as the new evaluation set.
          */
         xmlXPathFreeObject(obj);
         ctxt->context->node = NULL;
         ctxt->context->contextSize = -1;
         ctxt->context->proximityPosition = -1;
         valuePush(ctxt, xmlXPtrWrapLocationSet(newset));
     }
     if (CUR != ']') {
         XP_ERROR(XPATH_INVALID_PREDICATE_ERROR);
     }
 
     NEXT;
     SKIP_BLANKS;
 }
 
 #define bottom_xpointer
 #include "elfgcchack.h"
 #endif