Upgrade to libxml 2.9.2 and libxslt 1.1.28

third_party/libxml/src/xpath.c

 /*
  * xpath.c: XML Path Language implementation
  *          XPath is a language for addressing parts of an XML document,
  *          designed to be used by both XSLT and XPointer
  *f
  * Reference: W3C Recommendation 16 November 1999
  *     http://www.w3.org/TR/1999/REC-xpath-19991116
  * Public reference:
  *     http://www.w3.org/TR/xpath
  *
@@ skipping 37 matching lines @@
 #ifdef LIBXML_DEBUG_ENABLED
 #include <libxml/debugXML.h>
 #endif
 #include <libxml/xmlerror.h>
 #include <libxml/threads.h>
 #include <libxml/globals.h>
 #ifdef LIBXML_PATTERN_ENABLED
 #include <libxml/pattern.h>
 #endif
 
+#include "buf.h"
+
 #ifdef LIBXML_PATTERN_ENABLED
 #define XPATH_STREAMING
 #endif
 
 #define TODO                                                            \
     xmlGenericError(xmlGenericErrorContext,                             \
             "Unimplemented block at %s:%d\n",                           \
             __FILE__, __LINE__);
 
+/**
+ * WITH_TIM_SORT:
+ *
+ * Use the Timsort algorithm provided in timsort.h to sort
+ * nodeset as this is a great improvement over the old Shell sort
+ * used in xmlXPathNodeSetSort()
+ */
+#define WITH_TIM_SORT
+
 /*
 * XP_OPTIMIZED_NON_ELEM_COMPARISON:
 * If defined, this will use xmlXPathCmpNodesExt() instead of
 * xmlXPathCmpNodes(). The new function is optimized comparison of
 * non-element nodes; actually it will speed up comparison only if
 * xmlXPathOrderDocElems() was called in order to index the elements of
 * a tree in document order; Libxslt does such an indexing, thus it will
 * benefit from this optimization.
 */
 #define XP_OPTIMIZED_NON_ELEM_COMPARISON
 
 /*
 * XP_OPTIMIZED_FILTER_FIRST:
 * If defined, this will optimize expressions like "key('foo', 'val')[b][1]"
 * in a way, that it stop evaluation at the first node.
 */
 #define XP_OPTIMIZED_FILTER_FIRST
 
 /*
 * XP_DEBUG_OBJ_USAGE:
 * Internal flag to enable tracking of how much XPath objects have been
 * created.
 */
 /* #define XP_DEBUG_OBJ_USAGE */
 
 /*
+ * XPATH_MAX_STEPS:
+ * when compiling an XPath expression we arbitrary limit the maximum
+ * number of step operation in the compiled expression. 1000000 is
+ * an insanely large value which should never be reached under normal
+ * circumstances
+ */
+#define XPATH_MAX_STEPS 1000000
+
+/*
+ * XPATH_MAX_STACK_DEPTH:
+ * when evaluating an XPath expression we arbitrary limit the maximum
+ * number of object allowed to be pushed on the stack. 1000000 is
+ * an insanely large value which should never be reached under normal
+ * circumstances
+ */
+#define XPATH_MAX_STACK_DEPTH 1000000
+
+/*
+ * XPATH_MAX_NODESET_LENGTH:
+ * when evaluating an XPath expression nodesets are created and we
+ * arbitrary limit the maximum length of those node set. 10000000 is
+ * an insanely large value which should never be reached under normal
+ * circumstances, one would first need to construct an in memory tree
+ * with more than 10 millions nodes.
+ */
+#define XPATH_MAX_NODESET_LENGTH 10000000
+
+/*
  * TODO:
  * There are a few spots where some tests are done which depend upon ascii
  * data.  These should be enhanced for full UTF8 support (see particularly
  * any use of the macros IS_ASCII_CHARACTER and IS_ASCII_DIGIT)
  */
 
+#ifdef XP_OPTIMIZED_NON_ELEM_COMPARISON
+/**
+ * xmlXPathCmpNodesExt:
+ * @node1:  the first node
+ * @node2:  the second node
+ *
+ * Compare two nodes w.r.t document order.
+ * This one is optimized for handling of non-element nodes.
+ *
+ * Returns -2 in case of error 1 if first point < second point, 0 if
+ *         it's the same node, -1 otherwise
+ */
+static int
+xmlXPathCmpNodesExt(xmlNodePtr node1, xmlNodePtr node2) {
+    int depth1, depth2;
+    int misc = 0, precedence1 = 0, precedence2 = 0;
+    xmlNodePtr miscNode1 = NULL, miscNode2 = NULL;
+    xmlNodePtr cur, root;
+    long l1, l2;
+
+    if ((node1 == NULL) || (node2 == NULL))
+        return(-2);
+
+    if (node1 == node2)
+        return(0);
+
+    /*
+     * a couple of optimizations which will avoid computations in most cases
+     */
+    switch (node1->type) {
+        case XML_ELEMENT_NODE:
+            if (node2->type == XML_ELEMENT_NODE) {
+                if ((0 > (long) node1->content) && /* TODO: Would a != 0 suffice here? */
+                    (0 > (long) node2->content) &&
+                    (node1->doc == node2->doc))
+                {
+                    l1 = -((long) node1->content);
+                    l2 = -((long) node2->content);
+                    if (l1 < l2)
+                        return(1);
+                    if (l1 > l2)
+                        return(-1);
+                } else
+                    goto turtle_comparison;
+            }
+            break;
+        case XML_ATTRIBUTE_NODE:
+            precedence1 = 1; /* element is owner */
+            miscNode1 = node1;
+            node1 = node1->parent;
+            misc = 1;
+            break;
+        case XML_TEXT_NODE:
+        case XML_CDATA_SECTION_NODE:
+        case XML_COMMENT_NODE:
+        case XML_PI_NODE: {
+            miscNode1 = node1;
+            /*
+            * Find nearest element node.
+            */
+            if (node1->prev != NULL) {
+                do {
+                    node1 = node1->prev;
+                    if (node1->type == XML_ELEMENT_NODE) {
+                        precedence1 = 3; /* element in prev-sibl axis */
+                        break;
+                    }
+                    if (node1->prev == NULL) {
+                        precedence1 = 2; /* element is parent */
+                        /*
+                        * URGENT TODO: Are there any cases, where the
+                        * parent of such a node is not an element node?
+                        */
+                        node1 = node1->parent;
+                        break;
+                    }
+                } while (1);
+            } else {
+                precedence1 = 2; /* element is parent */
+                node1 = node1->parent;
+            }
+            if ((node1 == NULL) || (node1->type != XML_ELEMENT_NODE) ||
+                (0 <= (long) node1->content)) {
+                /*
+                * Fallback for whatever case.
+                */
+                node1 = miscNode1;
+                precedence1 = 0;
+            } else
+                misc = 1;
+        }
+            break;
+        case XML_NAMESPACE_DECL:
+            /*
+            * TODO: why do we return 1 for namespace nodes?
+            */
+            return(1);
+        default:
+            break;
+    }
+    switch (node2->type) {
+        case XML_ELEMENT_NODE:
+            break;
+        case XML_ATTRIBUTE_NODE:
+            precedence2 = 1; /* element is owner */
+            miscNode2 = node2;
+            node2 = node2->parent;
+            misc = 1;
+            break;
+        case XML_TEXT_NODE:
+        case XML_CDATA_SECTION_NODE:
+        case XML_COMMENT_NODE:
+        case XML_PI_NODE: {
+            miscNode2 = node2;
+            if (node2->prev != NULL) {
+                do {
+                    node2 = node2->prev;
+                    if (node2->type == XML_ELEMENT_NODE) {
+                        precedence2 = 3; /* element in prev-sibl axis */
+                        break;
+                    }
+                    if (node2->prev == NULL) {
+                        precedence2 = 2; /* element is parent */
+                        node2 = node2->parent;
+                        break;
+                    }
+                } while (1);
+            } else {
+                precedence2 = 2; /* element is parent */
+                node2 = node2->parent;
+            }
+            if ((node2 == NULL) || (node2->type != XML_ELEMENT_NODE) ||
+                (0 <= (long) node2->content))
+            {
+                node2 = miscNode2;
+                precedence2 = 0;
+            } else
+                misc = 1;
+        }
+            break;
+        case XML_NAMESPACE_DECL:
+            return(1);
+        default:
+            break;
+    }
+    if (misc) {
+        if (node1 == node2) {
+            if (precedence1 == precedence2) {
+                /*
+                * The ugly case; but normally there aren't many
+                * adjacent non-element nodes around.
+                */
+                cur = miscNode2->prev;
+                while (cur != NULL) {
+                    if (cur == miscNode1)
+                        return(1);
+                    if (cur->type == XML_ELEMENT_NODE)
+                        return(-1);
+                    cur = cur->prev;
+                }
+                return (-1);
+            } else {
+                /*
+                * Evaluate based on higher precedence wrt to the element.
+                * TODO: This assumes attributes are sorted before content.
+                *   Is this 100% correct?
+                */
+                if (precedence1 < precedence2)
+                    return(1);
+                else
+                    return(-1);
+            }
+        }
+        /*
+        * Special case: One of the helper-elements is contained by the other.
+        * <foo>
+        *   <node2>
+        *     <node1>Text-1(precedence1 == 2)</node1>
+        *   </node2>
+        *   Text-6(precedence2 == 3)
+        * </foo>
+        */
+        if ((precedence2 == 3) && (precedence1 > 1)) {
+            cur = node1->parent;
+            while (cur) {
+                if (cur == node2)
+                    return(1);
+                cur = cur->parent;
+            }
+        }
+        if ((precedence1 == 3) && (precedence2 > 1)) {
+            cur = node2->parent;
+            while (cur) {
+                if (cur == node1)
+                    return(-1);
+                cur = cur->parent;
+            }
+        }
+    }
+
+    /*
+     * Speedup using document order if availble.
+     */
+    if ((node1->type == XML_ELEMENT_NODE) &&
+        (node2->type == XML_ELEMENT_NODE) &&
+        (0 > (long) node1->content) &&
+        (0 > (long) node2->content) &&
+        (node1->doc == node2->doc)) {
+
+        l1 = -((long) node1->content);
+        l2 = -((long) node2->content);
+        if (l1 < l2)
+            return(1);
+        if (l1 > l2)
+            return(-1);
+    }
+
+turtle_comparison:
+
+    if (node1 == node2->prev)
+        return(1);
+    if (node1 == node2->next)
+        return(-1);
+    /*
+     * compute depth to root
+     */
+    for (depth2 = 0, cur = node2;cur->parent != NULL;cur = cur->parent) {
+        if (cur == node1)
+            return(1);
+        depth2++;
+    }
+    root = cur;
+    for (depth1 = 0, cur = node1;cur->parent != NULL;cur = cur->parent) {
+        if (cur == node2)
+            return(-1);
+        depth1++;
+    }
+    /*
+     * Distinct document (or distinct entities :-( ) case.
+     */
+    if (root != cur) {
+        return(-2);
+    }
+    /*
+     * get the nearest common ancestor.
+     */
+    while (depth1 > depth2) {
+        depth1--;
+        node1 = node1->parent;
+    }
+    while (depth2 > depth1) {
+        depth2--;
+        node2 = node2->parent;
+    }
+    while (node1->parent != node2->parent) {
+        node1 = node1->parent;
+        node2 = node2->parent;
+        /* should not happen but just in case ... */
+        if ((node1 == NULL) || (node2 == NULL))
+            return(-2);
+    }
+    /*
+     * Find who's first.
+     */
+    if (node1 == node2->prev)
+        return(1);
+    if (node1 == node2->next)
+        return(-1);
+    /*
+     * Speedup using document order if availble.
+     */
+    if ((node1->type == XML_ELEMENT_NODE) &&
+        (node2->type == XML_ELEMENT_NODE) &&
+        (0 > (long) node1->content) &&
+        (0 > (long) node2->content) &&
+        (node1->doc == node2->doc)) {
+
+        l1 = -((long) node1->content);
+        l2 = -((long) node2->content);
+        if (l1 < l2)
+            return(1);
+        if (l1 > l2)
+            return(-1);
+    }
+
+    for (cur = node1->next;cur != NULL;cur = cur->next)
+        if (cur == node2)
+            return(1);
+    return(-1); /* assume there is no sibling list corruption */
+}
+#endif /* XP_OPTIMIZED_NON_ELEM_COMPARISON */
+
+/*
+ * Wrapper for the Timsort argorithm from timsort.h
+ */
+#ifdef WITH_TIM_SORT
+#define SORT_NAME libxml_domnode
+#define SORT_TYPE xmlNodePtr
+/**
+ * wrap_cmp:
+ * @x: a node
+ * @y: another node
+ *
+ * Comparison function for the Timsort implementation
+ *
+ * Returns -2 in case of error -1 if first point < second point, 0 if
+ *         it's the same node, +1 otherwise
+ */
+static
+int wrap_cmp( xmlNodePtr x, xmlNodePtr y );
+#ifdef XP_OPTIMIZED_NON_ELEM_COMPARISON
+    static int wrap_cmp( xmlNodePtr x, xmlNodePtr y )
+    {
+        int res = xmlXPathCmpNodesExt(x, y);
+        return res == -2 ? res : -res;
+    }
+#else
+    static int wrap_cmp( xmlNodePtr x, xmlNodePtr y )
+    {
+        int res = xmlXPathCmpNodes(x, y);
+        return res == -2 ? res : -res;
+    }
+#endif
+#define SORT_CMP(x, y)  (wrap_cmp(x, y))
+#include "timsort.h"
+#endif /* WITH_TIM_SORT */
+
 #if defined(LIBXML_XPATH_ENABLED) || defined(LIBXML_SCHEMAS_ENABLED)
 
 /************************************************************************
  *                                                                      *
  *                      Floating point stuff                            *
  *                                                                      *
  ************************************************************************/
 
 #ifndef TRIO_REPLACE_STDIO
 #define TRIO_PUBLIC static
@@ skipping 136 matching lines @@
     "Invalid context size\n",
     "Invalid context position\n",
     "Memory allocation error\n",
     "Syntax error\n",
     "Resource error\n",
     "Sub resource error\n",
     "Undefined namespace prefix\n",
     "Encoding error\n",
     "Char out of XML range\n",
     "Invalid or incomplete context\n",
+    "Stack usage error\n",
+    "Forbidden variable\n",
     "?? Unknown error ??\n"     /* Must be last in the list! */
 };
 #define MAXERRNO ((int)(sizeof(xmlXPathErrorMessages) / \
                    sizeof(xmlXPathErrorMessages[0])) - 1)
 /**
  * xmlXPathErrMemory:
  * @ctxt:  an XPath context
  * @extra:  extra informations
  *
  * Handle a redefinition of attribute error
@@ skipping 147 matching lines @@
 * and here, we should make the functions public.
 */
 static int
 xmlPointerListAddSize(xmlPointerListPtr list,
                        void *item,
                        int initialSize)
 {
     if (list->items == NULL) {
         if (initialSize <= 0)
             initialSize = 1;
-        list->items = (void **) xmlMalloc(
-            initialSize * sizeof(void *));
+        list->items = (void **) xmlMalloc(initialSize * sizeof(void *));
         if (list->items == NULL) {
             xmlXPathErrMemory(NULL,
                 "xmlPointerListCreate: allocating item\n");
             return(-1);
         }
         list->number = 0;
         list->size = initialSize;
     } else if (list->size <= list->number) {
+        if (list->size > 50000000) {
+            xmlXPathErrMemory(NULL,
+                "xmlPointerListAddSize: re-allocating item\n");
+            return(-1);
+        }
         list->size *= 2;
         list->items = (void **) xmlRealloc(list->items,
             list->size * sizeof(void *));
         if (list->items == NULL) {
             xmlXPathErrMemory(NULL,
-                "xmlPointerListCreate: re-allocating item\n");
+                "xmlPointerListAddSize: re-allocating item\n");
             list->size = 0;
             return(-1);
         }
     }
     list->items[list->number++] = item;
     return(0);
 }
 
 /**
  * xsltPointerListCreate:
@@ skipping 97 matching lines @@
     NODE_TEST_NAME = 5
 } xmlXPathTestVal;
 
 typedef enum {
     NODE_TYPE_NODE = 0,
     NODE_TYPE_COMMENT = XML_COMMENT_NODE,
     NODE_TYPE_TEXT = XML_TEXT_NODE,
     NODE_TYPE_PI = XML_PI_NODE
 } xmlXPathTypeVal;
 
-#define XP_REWRITE_DOS_CHILD_ELEM 1
-
 typedef struct _xmlXPathStepOp xmlXPathStepOp;
 typedef xmlXPathStepOp *xmlXPathStepOpPtr;
 struct _xmlXPathStepOp {
     xmlXPathOp op;              /* The identifier of the operation */
     int ch1;                    /* First child */
     int ch2;                    /* Second child */
     int value;
     int value2;
     int value3;
     void *value4;
     void *value5;
     void *cache;
     void *cacheURI;
-    int rewriteType;
 };
 
 struct _xmlXPathCompExpr {
     int nbStep;                 /* Number of steps in this expression */
     int maxStep;                /* Maximum number of steps allocated */
     xmlXPathStepOp *steps;      /* ops for computation of this expression */
     int last;                   /* index of last step in expression */
     xmlChar *expr;              /* the expression being computed */
     xmlDictPtr dict;            /* the dictionnary to use if any */
 #ifdef DEBUG_EVAL_COUNTS
@@ skipping 134 matching lines @@
  *
  * Returns -1 in case of failure, the index otherwise
  */
 static int
 xmlXPathCompExprAdd(xmlXPathCompExprPtr comp, int ch1, int ch2,
    xmlXPathOp op, int value,
    int value2, int value3, void *value4, void *value5) {
     if (comp->nbStep >= comp->maxStep) {
         xmlXPathStepOp *real;
 
+        if (comp->maxStep >= XPATH_MAX_STEPS) {
+            xmlXPathErrMemory(NULL, "adding step\n");
+            return(-1);
+        }
         comp->maxStep *= 2;
         real = (xmlXPathStepOp *) xmlRealloc(comp->steps,
                                       comp->maxStep * sizeof(xmlXPathStepOp));
         if (real == NULL) {
             comp->maxStep /= 2;
             xmlXPathErrMemory(NULL, "adding step\n");
             return(-1);
         }
         comp->steps = real;
     }
     comp->last = comp->nbStep;
-    comp->steps[comp->nbStep].rewriteType = 0;
     comp->steps[comp->nbStep].ch1 = ch1;
     comp->steps[comp->nbStep].ch2 = ch2;
     comp->steps[comp->nbStep].op = op;
     comp->steps[comp->nbStep].value = value;
     comp->steps[comp->nbStep].value2 = value2;
     comp->steps[comp->nbStep].value3 = value3;
     if ((comp->dict != NULL) &&
         ((op == XPATH_OP_FUNCTION) || (op == XPATH_OP_VARIABLE) ||
          (op == XPATH_OP_COLLECT))) {
         if (value4 != NULL) {
@@ skipping 1297 matching lines @@
             /*
             * Fallback to misc-cache.
             */
 
             ret = (xmlXPathObjectPtr)
                 cache->miscObjs->items[--cache->miscObjs->number];
 
             ret->type = XPATH_NODESET;
             ret->boolval = 0;
             ret->nodesetval = xmlXPathNodeSetCreate(val);
+            if (ret->nodesetval == NULL) {
+                ctxt->lastError.domain = XML_FROM_XPATH;
+                ctxt->lastError.code = XML_ERR_NO_MEMORY;
+                return(NULL);
+            }
 #ifdef XP_DEBUG_OBJ_USAGE
             xmlXPathDebugObjUsageRequested(ctxt, XPATH_NODESET);
 #endif
             return(ret);
         }
     }
     return(xmlXPathNewNodeSet(val));
 }
 
 /**
@@ skipping 327 matching lines @@
     return(ret);
 }
 
 /************************************************************************
  *                                                                      *
  *              Parser stacks related functions and macros              *
  *                                                                      *
  ************************************************************************/
 
 /**
+ * xmlXPathSetFrame:
+ * @ctxt: an XPath parser context
+ *
+ * Set the callee evaluation frame
+ *
+ * Returns the previous frame value to be restored once done
+ */
+static int
+xmlXPathSetFrame(xmlXPathParserContextPtr ctxt) {
+    int ret;
+
+    if (ctxt == NULL)
+        return(0);
+    ret = ctxt->valueFrame;
+    ctxt->valueFrame = ctxt->valueNr;
+    return(ret);
+}
+
+/**
+ * xmlXPathPopFrame:
+ * @ctxt: an XPath parser context
+ * @frame: the previous frame value
+ *
+ * Remove the callee evaluation frame
+ */
+static void
+xmlXPathPopFrame(xmlXPathParserContextPtr ctxt, int frame) {
+    if (ctxt == NULL)
+        return;
+    if (ctxt->valueNr < ctxt->valueFrame) {
+        xmlXPatherror(ctxt, __FILE__, __LINE__, XPATH_STACK_ERROR);
+    }
+    ctxt->valueFrame = frame;
+}
+
+/**
  * valuePop:
  * @ctxt: an XPath evaluation context
  *
  * Pops the top XPath object from the value stack
  *
  * Returns the XPath object just removed
  */
 xmlXPathObjectPtr
 valuePop(xmlXPathParserContextPtr ctxt)
 {
     xmlXPathObjectPtr ret;
 
     if ((ctxt == NULL) || (ctxt->valueNr <= 0))
         return (NULL);
+
+    if (ctxt->valueNr <= ctxt->valueFrame) {
+        xmlXPatherror(ctxt, __FILE__, __LINE__, XPATH_STACK_ERROR);
+        return (NULL);
+    }
+
     ctxt->valueNr--;
     if (ctxt->valueNr > 0)
         ctxt->value = ctxt->valueTab[ctxt->valueNr - 1];
     else
         ctxt->value = NULL;
     ret = ctxt->valueTab[ctxt->valueNr];
     ctxt->valueTab[ctxt->valueNr] = NULL;
     return (ret);
 }
 /**
  * valuePush:
  * @ctxt:  an XPath evaluation context
  * @value:  the XPath object
  *
  * Pushes a new XPath object on top of the value stack
  *
  * returns the number of items on the value stack
  */
 int
 valuePush(xmlXPathParserContextPtr ctxt, xmlXPathObjectPtr value)
 {
     if ((ctxt == NULL) || (value == NULL)) return(-1);
     if (ctxt->valueNr >= ctxt->valueMax) {
         xmlXPathObjectPtr *tmp;
 
+        if (ctxt->valueMax >= XPATH_MAX_STACK_DEPTH) {
+            xmlXPathErrMemory(NULL, "XPath stack depth limit reached\n");
+            ctxt->error = XPATH_MEMORY_ERROR;
+            return (0);
+        }
         tmp = (xmlXPathObjectPtr *) xmlRealloc(ctxt->valueTab,
                                              2 * ctxt->valueMax *
                                              sizeof(ctxt->valueTab[0]));
         if (tmp == NULL) {
-            xmlGenericError(xmlGenericErrorContext, "realloc failed !\n");
+            xmlXPathErrMemory(NULL, "pushing value\n");
+            ctxt->error = XPATH_MEMORY_ERROR;
             return (0);
         }
         ctxt->valueMax *= 2;
         ctxt->valueTab = tmp;
     }
     ctxt->valueTab[ctxt->valueNr] = value;
     ctxt->value = value;
     return (ctxt->valueNr++);
 }
 
@@ skipping 289 matching lines @@
                         fraction_place = DBL_DIG - integer_place - 1;
                     else
                         fraction_place = DBL_DIG - integer_place;
                 } else {
                     fraction_place = 1;
                 }
                 size = snprintf(work, sizeof(work), "%0.*f",
                                 fraction_place, number);
             }
 
+            /* Remove leading spaces sometimes inserted by snprintf */
+            while (work[0] == ' ') {
+                for (ptr = &work[0];(ptr[0] = ptr[1]);ptr++);
+                size--;
+            }
+
             /* Remove fractional trailing zeroes */
             after_fraction = work + size;
             ptr = after_fraction;
             while (*(--ptr) == '0')
                 ;
             if (*ptr != '.')
                 ptr++;
             while ((*ptr++ = *after_fraction++) != 0);
 
             /* Finally copy result back to caller */
@@ skipping 120 matching lines @@
     if ((node1->type == XML_NAMESPACE_DECL) ||
         (node2->type == XML_NAMESPACE_DECL))
         return(1);
     if (node1 == node2->prev)
         return(1);
     if (node1 == node2->next)
         return(-1);
 
     /*
      * Speedup using document order if availble.
-     */
-    if ((node1->type == XML_ELEMENT_NODE) &&
-        (node2->type == XML_ELEMENT_NODE) &&
-        (0 > (long) node1->content) &&
-        (0 > (long) node2->content) &&
-        (node1->doc == node2->doc)) {
-        long l1, l2;
-
-        l1 = -((long) node1->content);
-        l2 = -((long) node2->content);
-        if (l1 < l2)
-            return(1);
-        if (l1 > l2)
-            return(-1);
-    }
-
-    /*
-     * compute depth to root
-     */
-    for (depth2 = 0, cur = node2;cur->parent != NULL;cur = cur->parent) {
-        if (cur == node1)
-            return(1);
-        depth2++;
-    }
-    root = cur;
-    for (depth1 = 0, cur = node1;cur->parent != NULL;cur = cur->parent) {
-        if (cur == node2)
-            return(-1);
-        depth1++;
-    }
-    /*
-     * Distinct document (or distinct entities :-( ) case.
-     */
-    if (root != cur) {
-        return(-2);
-    }
-    /*
-     * get the nearest common ancestor.
-     */
-    while (depth1 > depth2) {
-        depth1--;
-        node1 = node1->parent;
-    }
-    while (depth2 > depth1) {
-        depth2--;
-        node2 = node2->parent;
-    }
-    while (node1->parent != node2->parent) {
-        node1 = node1->parent;
-        node2 = node2->parent;
-        /* should not happen but just in case ... */
-        if ((node1 == NULL) || (node2 == NULL))
-            return(-2);
-    }
-    /*
-     * Find who's first.
-     */
-    if (node1 == node2->prev)
-        return(1);
-    if (node1 == node2->next)
-        return(-1);
-    /*
-     * Speedup using document order if availble.
-     */
-    if ((node1->type == XML_ELEMENT_NODE) &&
-        (node2->type == XML_ELEMENT_NODE) &&
-        (0 > (long) node1->content) &&
-        (0 > (long) node2->content) &&
-        (node1->doc == node2->doc)) {
-        long l1, l2;
-
-        l1 = -((long) node1->content);
-        l2 = -((long) node2->content);
-        if (l1 < l2)
-            return(1);
-        if (l1 > l2)
-            return(-1);
-    }
-
-    for (cur = node1->next;cur != NULL;cur = cur->next)
-        if (cur == node2)
-            return(1);
-    return(-1); /* assume there is no sibling list corruption */
-}
-
-#ifdef XP_OPTIMIZED_NON_ELEM_COMPARISON
-/**
- * xmlXPathCmpNodesExt:
- * @node1:  the first node
- * @node2:  the second node
- *
- * Compare two nodes w.r.t document order.
- * This one is optimized for handling of non-element nodes.
- *
- * Returns -2 in case of error 1 if first point < second point, 0 if
- *         it's the same node, -1 otherwise
- */
-static int
-xmlXPathCmpNodesExt(xmlNodePtr node1, xmlNodePtr node2) {
-    int depth1, depth2;
-    int misc = 0, precedence1 = 0, precedence2 = 0;
-    xmlNodePtr miscNode1 = NULL, miscNode2 = NULL;
-    xmlNodePtr cur, root;
-    long l1, l2;
-
-    if ((node1 == NULL) || (node2 == NULL))
-        return(-2);
-
-    if (node1 == node2)
-        return(0);
-
-    /*
-     * a couple of optimizations which will avoid computations in most cases
-     */
-    switch (node1->type) {
-        case XML_ELEMENT_NODE:
-            if (node2->type == XML_ELEMENT_NODE) {
-                if ((0 > (long) node1->content) && /* TODO: Would a != 0 suffice here? */
-                    (0 > (long) node2->content) &&
-                    (node1->doc == node2->doc))
-                {
-                    l1 = -((long) node1->content);
-                    l2 = -((long) node2->content);
-                    if (l1 < l2)
-                        return(1);
-                    if (l1 > l2)
-                        return(-1);
-                } else
-                    goto turtle_comparison;
-            }
-            break;
-        case XML_ATTRIBUTE_NODE:
-            precedence1 = 1; /* element is owner */
-            miscNode1 = node1;
-            node1 = node1->parent;
-            misc = 1;
-            break;
-        case XML_TEXT_NODE:
-        case XML_CDATA_SECTION_NODE:
-        case XML_COMMENT_NODE:
-        case XML_PI_NODE: {
-            miscNode1 = node1;
-            /*
-            * Find nearest element node.
-            */
-            if (node1->prev != NULL) {
-                do {
-                    node1 = node1->prev;
-                    if (node1->type == XML_ELEMENT_NODE) {
-                        precedence1 = 3; /* element in prev-sibl axis */
-                        break;
-                    }
-                    if (node1->prev == NULL) {
-                        precedence1 = 2; /* element is parent */
-                        /*
-                        * URGENT TODO: Are there any cases, where the
-                        * parent of such a node is not an element node?
-                        */
-                        node1 = node1->parent;
-                        break;
-                    }
-                } while (1);
-            } else {
-                precedence1 = 2; /* element is parent */
-                node1 = node1->parent;
-            }
-            if ((node1 == NULL) || (node1->type != XML_ELEMENT_NODE) ||
-                (0 <= (long) node1->content)) {
-                /*
-                * Fallback for whatever case.
-                */
-                node1 = miscNode1;
-                precedence1 = 0;
-            } else
-                misc = 1;
-        }
-            break;
-        case XML_NAMESPACE_DECL:
-            /*
-            * TODO: why do we return 1 for namespace nodes?
-            */
-            return(1);
-        default:
-            break;
-    }
-    switch (node2->type) {
-        case XML_ELEMENT_NODE:
-            break;
-        case XML_ATTRIBUTE_NODE:
-            precedence2 = 1; /* element is owner */
-            miscNode2 = node2;
-            node2 = node2->parent;
-            misc = 1;
-            break;
-        case XML_TEXT_NODE:
-        case XML_CDATA_SECTION_NODE:
-        case XML_COMMENT_NODE:
-        case XML_PI_NODE: {
-            miscNode2 = node2;
-            if (node2->prev != NULL) {
-                do {
-                    node2 = node2->prev;
-                    if (node2->type == XML_ELEMENT_NODE) {
-                        precedence2 = 3; /* element in prev-sibl axis */
-                        break;
-                    }
-                    if (node2->prev == NULL) {
-                        precedence2 = 2; /* element is parent */
-                        node2 = node2->parent;
-                        break;
-                    }
-                } while (1);
-            } else {
-                precedence2 = 2; /* element is parent */
-                node2 = node2->parent;
-            }
-            if ((node2 == NULL) || (node2->type != XML_ELEMENT_NODE) ||
-                (0 <= (long) node1->content))
-            {
-                node2 = miscNode2;
-                precedence2 = 0;
-            } else
-                misc = 1;
-        }
-            break;
-        case XML_NAMESPACE_DECL:
-            return(1);
-        default:
-            break;
-    }
-    if (misc) {
-        if (node1 == node2) {
-            if (precedence1 == precedence2) {
-                /*
-                * The ugly case; but normally there aren't many
-                * adjacent non-element nodes around.
-                */
-                cur = miscNode2->prev;
-                while (cur != NULL) {
-                    if (cur == miscNode1)
-                        return(1);
-                    if (cur->type == XML_ELEMENT_NODE)
-                        return(-1);
-                    cur = cur->prev;
-                }
-                return (-1);
-            } else {
-                /*
-                * Evaluate based on higher precedence wrt to the element.
-                * TODO: This assumes attributes are sorted before content.
-                *   Is this 100% correct?
-                */
-                if (precedence1 < precedence2)
-                    return(1);
-                else
-                    return(-1);
-            }
-        }
-        /*
-        * Special case: One of the helper-elements is contained by the other.
-        * <foo>
-        *   <node2>
-        *     <node1>Text-1(precedence1 == 2)</node1>
-        *   </node2>
-        *   Text-6(precedence2 == 3)
-        * </foo>
-        */
-        if ((precedence2 == 3) && (precedence1 > 1)) {
-            cur = node1->parent;
-            while (cur) {
-                if (cur == node2)
-                    return(1);
-                cur = cur->parent;
-            }
-        }
-        if ((precedence1 == 3) && (precedence2 > 1)) {
-            cur = node2->parent;
-            while (cur) {
-                if (cur == node1)
-                    return(-1);
-                cur = cur->parent;
-            }
-        }
-    }
-
-    /*
-     * Speedup using document order if availble.
      */
     if ((node1->type == XML_ELEMENT_NODE) &&
         (node2->type == XML_ELEMENT_NODE) &&
         (0 > (long) node1->content) &&
         (0 > (long) node2->content) &&
         (node1->doc == node2->doc)) {
+        long l1, l2;
 
         l1 = -((long) node1->content);
         l2 = -((long) node2->content);
         if (l1 < l2)
             return(1);
         if (l1 > l2)
             return(-1);
     }
 
-turtle_comparison:
-
-    if (node1 == node2->prev)
-        return(1);
-    if (node1 == node2->next)
-        return(-1);
     /*
      * compute depth to root
      */
     for (depth2 = 0, cur = node2;cur->parent != NULL;cur = cur->parent) {
         if (cur == node1)
             return(1);
         depth2++;
     }
     root = cur;
     for (depth1 = 0, cur = node1;cur->parent != NULL;cur = cur->parent) {
@@ skipping 33 matching lines @@
     if (node1 == node2->next)
         return(-1);
     /*
      * Speedup using document order if availble.
      */
     if ((node1->type == XML_ELEMENT_NODE) &&
         (node2->type == XML_ELEMENT_NODE) &&
         (0 > (long) node1->content) &&
         (0 > (long) node2->content) &&
         (node1->doc == node2->doc)) {
+        long l1, l2;
 
         l1 = -((long) node1->content);
         l2 = -((long) node2->content);
         if (l1 < l2)
             return(1);
         if (l1 > l2)
             return(-1);
     }
 
     for (cur = node1->next;cur != NULL;cur = cur->next)
         if (cur == node2)
             return(1);
     return(-1); /* assume there is no sibling list corruption */
 }
-#endif /* XP_OPTIMIZED_NON_ELEM_COMPARISON */
 
 /**
  * xmlXPathNodeSetSort:
  * @set:  the node set
  *
  * Sort the node set in document order
  */
 void
 xmlXPathNodeSetSort(xmlNodeSetPtr set) {
+#ifndef WITH_TIM_SORT
     int i, j, incr, len;
     xmlNodePtr tmp;
+#endif
 
     if (set == NULL)
         return;
 
-    /* Use Shell's sort to sort the node-set */
+#ifndef WITH_TIM_SORT
+    /*
+     * Use the old Shell's sort implementation to sort the node-set
+     * Timsort ought to be quite faster
+     */
     len = set->nodeNr;
     for (incr = len / 2; incr > 0; incr /= 2) {
         for (i = incr; i < len; i++) {
             j = i - incr;
             while (j >= 0) {
 #ifdef XP_OPTIMIZED_NON_ELEM_COMPARISON
                 if (xmlXPathCmpNodesExt(set->nodeTab[j],
                         set->nodeTab[j + incr]) == -1)
 #else
                 if (xmlXPathCmpNodes(set->nodeTab[j],
                         set->nodeTab[j + incr]) == -1)
 #endif
                 {
                     tmp = set->nodeTab[j];
                     set->nodeTab[j] = set->nodeTab[j + incr];
                     set->nodeTab[j + incr] = tmp;
                     j -= incr;
                 } else
                     break;
             }
         }
     }
+#else /* WITH_TIM_SORT */
+    libxml_domnode_tim_sort(set->nodeTab, set->nodeNr);
+#endif /* WITH_TIM_SORT */
 }
 
 #define XML_NODESET_DEFAULT     10
 /**
  * xmlXPathNodeSetDupNs:
  * @node:  the parent node of the namespace XPath node
  * @ns:  the libxml namespace declaration node.
  *
  * Namespace node in libxml don't match the XPath semantic. In a node set
  * the namespace nodes are duplicated and the next pointer is set to the
@@ skipping 158 matching lines @@
     return(0);
 }
 
 /**
  * xmlXPathNodeSetAddNs:
  * @cur:  the initial node set
  * @node:  the hosting node
  * @ns:  a the namespace node
  *
  * add a new namespace node to an existing NodeSet
+ *
+ * Returns 0 in case of success and -1 in case of error
  */
-void
+int
 xmlXPathNodeSetAddNs(xmlNodeSetPtr cur, xmlNodePtr node, xmlNsPtr ns) {
     int i;
 
 
     if ((cur == NULL) || (ns == NULL) || (node == NULL) ||
         (ns->type != XML_NAMESPACE_DECL) ||
         (node->type != XML_ELEMENT_NODE))
-        return;
+        return(-1);
 
     /* @@ with_ns to check whether namespace nodes should be looked at @@ */
     /*
      * prevent duplicates
      */
     for (i = 0;i < cur->nodeNr;i++) {
         if ((cur->nodeTab[i] != NULL) &&
             (cur->nodeTab[i]->type == XML_NAMESPACE_DECL) &&
             (((xmlNsPtr)cur->nodeTab[i])->next == (xmlNsPtr) node) &&
             (xmlStrEqual(ns->prefix, ((xmlNsPtr)cur->nodeTab[i])->prefix)))
-            return;
+            return(0);
     }
 
     /*
      * grow the nodeTab if needed
      */
     if (cur->nodeMax == 0) {
         cur->nodeTab = (xmlNodePtr *) xmlMalloc(XML_NODESET_DEFAULT *
                                              sizeof(xmlNodePtr));
         if (cur->nodeTab == NULL) {
             xmlXPathErrMemory(NULL, "growing nodeset\n");
-            return;
+            return(-1);
         }
         memset(cur->nodeTab, 0 ,
                XML_NODESET_DEFAULT * (size_t) sizeof(xmlNodePtr));
         cur->nodeMax = XML_NODESET_DEFAULT;
     } else if (cur->nodeNr == cur->nodeMax) {
         xmlNodePtr *temp;
 
-        cur->nodeMax *= 2;
-        temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
+        if (cur->nodeMax >= XPATH_MAX_NODESET_LENGTH) {
+            xmlXPathErrMemory(NULL, "growing nodeset hit limit\n");
+            return(-1);
+        }
+        temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
                                       sizeof(xmlNodePtr));
         if (temp == NULL) {
             xmlXPathErrMemory(NULL, "growing nodeset\n");
-            return;
+            return(-1);
         }
+        cur->nodeMax *= 2;
         cur->nodeTab = temp;
     }
     cur->nodeTab[cur->nodeNr++] = xmlXPathNodeSetDupNs(node, ns);
+    return(0);
 }
 
 /**
  * xmlXPathNodeSetAdd:
  * @cur:  the initial node set
  * @val:  a new xmlNodePtr
  *
  * add a new xmlNodePtr to an existing NodeSet
+ *
+ * Returns 0 in case of success, and -1 in case of error
  */
-void
+int
 xmlXPathNodeSetAdd(xmlNodeSetPtr cur, xmlNodePtr val) {
     int i;
 
-    if ((cur == NULL) || (val == NULL)) return;
-
-#if 0
-    if ((val->type == XML_ELEMENT_NODE) && (val->name[0] == ' '))
-        return; /* an XSLT fake node */
-#endif
+    if ((cur == NULL) || (val == NULL)) return(-1);
 
     /* @@ with_ns to check whether namespace nodes should be looked at @@ */
     /*
      * prevent duplcates
      */
     for (i = 0;i < cur->nodeNr;i++)
-        if (cur->nodeTab[i] == val) return;
+        if (cur->nodeTab[i] == val) return(0);
 
     /*
      * grow the nodeTab if needed
      */
     if (cur->nodeMax == 0) {
         cur->nodeTab = (xmlNodePtr *) xmlMalloc(XML_NODESET_DEFAULT *
                                              sizeof(xmlNodePtr));
         if (cur->nodeTab == NULL) {
             xmlXPathErrMemory(NULL, "growing nodeset\n");
-            return;
+            return(-1);
         }
         memset(cur->nodeTab, 0 ,
                XML_NODESET_DEFAULT * (size_t) sizeof(xmlNodePtr));
         cur->nodeMax = XML_NODESET_DEFAULT;
     } else if (cur->nodeNr == cur->nodeMax) {
         xmlNodePtr *temp;
 
-        cur->nodeMax *= 2;
-        temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
+        if (cur->nodeMax >= XPATH_MAX_NODESET_LENGTH) {
+            xmlXPathErrMemory(NULL, "growing nodeset hit limit\n");
+            return(-1);
+        }
+        temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
                                       sizeof(xmlNodePtr));
         if (temp == NULL) {
             xmlXPathErrMemory(NULL, "growing nodeset\n");
-            return;
+            return(-1);
         }
+        cur->nodeMax *= 2;
         cur->nodeTab = temp;
     }
     if (val->type == XML_NAMESPACE_DECL) {
         xmlNsPtr ns = (xmlNsPtr) val;
 
         cur->nodeTab[cur->nodeNr++] =
             xmlXPathNodeSetDupNs((xmlNodePtr) ns->next, ns);
     } else
         cur->nodeTab[cur->nodeNr++] = val;
+    return(0);
 }
 
 /**
  * xmlXPathNodeSetAddUnique:
  * @cur:  the initial node set
  * @val:  a new xmlNodePtr
  *
  * add a new xmlNodePtr to an existing NodeSet, optimized version
  * when we are sure the node is not already in the set.
+ *
+ * Returns 0 in case of success and -1 in case of failure
  */
-void
+int
 xmlXPathNodeSetAddUnique(xmlNodeSetPtr cur, xmlNodePtr val) {
-    if ((cur == NULL) || (val == NULL)) return;
-
-#if 0
-    if ((val->type == XML_ELEMENT_NODE) && (val->name[0] == ' '))
-        return; /* an XSLT fake node */
-#endif
+    if ((cur == NULL) || (val == NULL)) return(-1);
 
     /* @@ with_ns to check whether namespace nodes should be looked at @@ */
     /*
      * grow the nodeTab if needed
      */
     if (cur->nodeMax == 0) {
         cur->nodeTab = (xmlNodePtr *) xmlMalloc(XML_NODESET_DEFAULT *
                                              sizeof(xmlNodePtr));
         if (cur->nodeTab == NULL) {
             xmlXPathErrMemory(NULL, "growing nodeset\n");
-            return;
+            return(-1);
         }
         memset(cur->nodeTab, 0 ,
                XML_NODESET_DEFAULT * (size_t) sizeof(xmlNodePtr));
         cur->nodeMax = XML_NODESET_DEFAULT;
     } else if (cur->nodeNr == cur->nodeMax) {
         xmlNodePtr *temp;
 
-        cur->nodeMax *= 2;
-        temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
+        if (cur->nodeMax >= XPATH_MAX_NODESET_LENGTH) {
+            xmlXPathErrMemory(NULL, "growing nodeset hit limit\n");
+            return(-1);
+        }
+        temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
                                       sizeof(xmlNodePtr));
         if (temp == NULL) {
             xmlXPathErrMemory(NULL, "growing nodeset\n");
-            return;
+            return(-1);
         }
         cur->nodeTab = temp;
+        cur->nodeMax *= 2;
     }
     if (val->type == XML_NAMESPACE_DECL) {
         xmlNsPtr ns = (xmlNsPtr) val;
 
         cur->nodeTab[cur->nodeNr++] =
             xmlXPathNodeSetDupNs((xmlNodePtr) ns->next, ns);
     } else
         cur->nodeTab[cur->nodeNr++] = val;
+    return(0);
 }
 
 /**
  * xmlXPathNodeSetMerge:
  * @val1:  the first NodeSet or NULL
  * @val2:  the second NodeSet
  *
  * Merges two nodesets, all nodes from @val2 are added to @val1
  * if @val1 is NULL, a new set is created and copied from @val2
  *
@@ skipping 75 matching lines @@
             if (val1->nodeTab == NULL) {
                 xmlXPathErrMemory(NULL, "merging nodeset\n");
                 return(NULL);
             }
             memset(val1->nodeTab, 0 ,
                    XML_NODESET_DEFAULT * (size_t) sizeof(xmlNodePtr));
             val1->nodeMax = XML_NODESET_DEFAULT;
         } else if (val1->nodeNr == val1->nodeMax) {
             xmlNodePtr *temp;
 
-            val1->nodeMax *= 2;
-            temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax *
+            if (val1->nodeMax >= XPATH_MAX_NODESET_LENGTH) {
+                xmlXPathErrMemory(NULL, "merging nodeset hit limit\n");
+                return(NULL);
+            }
+            temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax * 2 *
                                              sizeof(xmlNodePtr));
             if (temp == NULL) {
                 xmlXPathErrMemory(NULL, "merging nodeset\n");
                 return(NULL);
             }
             val1->nodeTab = temp;
+            val1->nodeMax *= 2;
         }
         if (n2->type == XML_NAMESPACE_DECL) {
             xmlNsPtr ns = (xmlNsPtr) n2;
 
             val1->nodeTab[val1->nodeNr++] =
                 xmlXPathNodeSetDupNs((xmlNodePtr) ns->next, ns);
         } else
             val1->nodeTab[val1->nodeNr++] = n2;
     }
 
     return(val1);
 }
 
-#if 0 /* xmlXPathNodeSetMergeUnique() is currently not used anymore */
-/**
- * xmlXPathNodeSetMergeUnique:
- * @val1:  the first NodeSet or NULL
- * @val2:  the second NodeSet
- *
- * Merges two nodesets, all nodes from @val2 are added to @val1
- * if @val1 is NULL, a new set is created and copied from @val2
- *
- * Returns @val1 once extended or NULL in case of error.
- */
-static xmlNodeSetPtr
-xmlXPathNodeSetMergeUnique(xmlNodeSetPtr val1, xmlNodeSetPtr val2) {
-    int i;
-
-    if (val2 == NULL) return(val1);
-    if (val1 == NULL) {
-        val1 = xmlXPathNodeSetCreate(NULL);
-    }
-    if (val1 == NULL)
-        return (NULL);
-
-    /* @@ with_ns to check whether namespace nodes should be looked at @@ */
-
-    for (i = 0;i < val2->nodeNr;i++) {
-        /*
-         * grow the nodeTab if needed
-         */
-        if (val1->nodeMax == 0) {
-            val1->nodeTab = (xmlNodePtr *) xmlMalloc(XML_NODESET_DEFAULT *
-                                                    sizeof(xmlNodePtr));
-            if (val1->nodeTab == NULL) {
-                xmlXPathErrMemory(NULL, "merging nodeset\n");
-                return(NULL);
-            }
-            memset(val1->nodeTab, 0 ,
-                   XML_NODESET_DEFAULT * (size_t) sizeof(xmlNodePtr));
-            val1->nodeMax = XML_NODESET_DEFAULT;
-        } else if (val1->nodeNr == val1->nodeMax) {
-            xmlNodePtr *temp;
-
-            val1->nodeMax *= 2;
-            temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax *
-                                             sizeof(xmlNodePtr));
-            if (temp == NULL) {
-                xmlXPathErrMemory(NULL, "merging nodeset\n");
-                return(NULL);
-            }
-            val1->nodeTab = temp;
-        }
-        if (val2->nodeTab[i]->type == XML_NAMESPACE_DECL) {
-            xmlNsPtr ns = (xmlNsPtr) val2->nodeTab[i];
-
-            val1->nodeTab[val1->nodeNr++] =
-                xmlXPathNodeSetDupNs((xmlNodePtr) ns->next, ns);
-        } else
-            val1->nodeTab[val1->nodeNr++] = val2->nodeTab[i];
-    }
-
-    return(val1);
-}
-#endif /* xmlXPathNodeSetMergeUnique() is currently not used anymore */
 
 /**
  * xmlXPathNodeSetMergeAndClear:
  * @set1:  the first NodeSet or NULL
  * @set2:  the second NodeSet
  * @hasSet2NsNodes: 1 if set2 contains namespaces nodes
  *
  * Merges two nodesets, all nodes from @set2 are added to @set1
  * if @set1 is NULL, a new set is created and copied from @set2.
  * Checks for duplicate nodes. Clears set2.
@@ skipping 66 matching lines @@
                 if (set1->nodeTab == NULL) {
                     xmlXPathErrMemory(NULL, "merging nodeset\n");
                     return(NULL);
                 }
                 memset(set1->nodeTab, 0,
                     XML_NODESET_DEFAULT * (size_t) sizeof(xmlNodePtr));
                 set1->nodeMax = XML_NODESET_DEFAULT;
             } else if (set1->nodeNr >= set1->nodeMax) {
                 xmlNodePtr *temp;
 
-                set1->nodeMax *= 2;
+                if (set1->nodeMax >= XPATH_MAX_NODESET_LENGTH) {
+                    xmlXPathErrMemory(NULL, "merging nodeset hit limit\n");
+                    return(NULL);
+                }
                 temp = (xmlNodePtr *) xmlRealloc(
-                    set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
+                    set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
                 if (temp == NULL) {
                     xmlXPathErrMemory(NULL, "merging nodeset\n");
                     return(NULL);
                 }
                 set1->nodeTab = temp;
+                set1->nodeMax *= 2;
             }
             if (n2->type == XML_NAMESPACE_DECL) {
                 xmlNsPtr ns = (xmlNsPtr) n2;
 
                 set1->nodeTab[set1->nodeNr++] =
                     xmlXPathNodeSetDupNs((xmlNodePtr) ns->next, ns);
             } else
                 set1->nodeTab[set1->nodeNr++] = n2;
 skip_node:
             {}
@@ skipping 56 matching lines @@
                 if (set1->nodeTab == NULL) {
                     xmlXPathErrMemory(NULL, "merging nodeset\n");
                     return(NULL);
                 }
                 memset(set1->nodeTab, 0,
                     XML_NODESET_DEFAULT * (size_t) sizeof(xmlNodePtr));
                 set1->nodeMax = XML_NODESET_DEFAULT;
             } else if (set1->nodeNr >= set1->nodeMax) {
                 xmlNodePtr *temp;
 
-                set1->nodeMax *= 2;
+                if (set1->nodeMax >= XPATH_MAX_NODESET_LENGTH) {
+                    xmlXPathErrMemory(NULL, "merging nodeset hit limit\n");
+                    return(NULL);
+                }
                 temp = (xmlNodePtr *) xmlRealloc(
-                    set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
+                    set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
                 if (temp == NULL) {
                     xmlXPathErrMemory(NULL, "merging nodeset\n");
                     return(NULL);
                 }
                 set1->nodeTab = temp;
+                set1->nodeMax *= 2;
             }
             set1->nodeTab[set1->nodeNr++] = n2;
         }
     }
     set2->nodeNr = 0;
     return(set1);
 }
 
 /**
  * xmlXPathNodeSetDel:
@@ skipping 270 matching lines @@
 {
     xmlXPathObjectPtr ret;
     int i;
 
     if (val == NULL)
         ret = NULL;
     else if (val->nodeTab == NULL)
         ret = xmlXPathNewNodeSet(NULL);
     else {
         ret = xmlXPathNewNodeSet(val->nodeTab[0]);
-        if (ret)
-            for (i = 1; i < val->nodeNr; ++i)
-                xmlXPathNodeSetAddUnique(ret->nodesetval, val->nodeTab[i]);
+        if (ret) {
+            for (i = 1; i < val->nodeNr; ++i) {
+                if (xmlXPathNodeSetAddUnique(ret->nodesetval, val->nodeTab[i])
+                    < 0) break;
+            }
+        }
     }
 
     return (ret);
 }
 
 /**
  * xmlXPathWrapNodeSet:
  * @val:  the NodePtr value
  *
  * Wrap the Nodeset @val in a new xmlXPathObjectPtr
@@ skipping 55 matching lines @@
         return(nodes1);
 
     ret = xmlXPathNodeSetCreate(NULL);
     if (xmlXPathNodeSetIsEmpty(nodes1))
         return(ret);
 
     l1 = xmlXPathNodeSetGetLength(nodes1);
 
     for (i = 0; i < l1; i++) {
         cur = xmlXPathNodeSetItem(nodes1, i);
-        if (!xmlXPathNodeSetContains(nodes2, cur))
-            xmlXPathNodeSetAddUnique(ret, cur);
+        if (!xmlXPathNodeSetContains(nodes2, cur)) {
+            if (xmlXPathNodeSetAddUnique(ret, cur) < 0)
+                break;
+        }
     }
     return(ret);
 }
 
 /**
  * xmlXPathIntersection:
  * @nodes1:  a node-set
  * @nodes2:  a node-set
  *
  * Implements the EXSLT - Sets intersection() function:
@@ skipping 12 matching lines @@
         return(ret);
     if (xmlXPathNodeSetIsEmpty(nodes1))
         return(ret);
     if (xmlXPathNodeSetIsEmpty(nodes2))
         return(ret);
 
     l1 = xmlXPathNodeSetGetLength(nodes1);
 
     for (i = 0; i < l1; i++) {
         cur = xmlXPathNodeSetItem(nodes1, i);
-        if (xmlXPathNodeSetContains(nodes2, cur))
-            xmlXPathNodeSetAddUnique(ret, cur);
+        if (xmlXPathNodeSetContains(nodes2, cur)) {
+            if (xmlXPathNodeSetAddUnique(ret, cur) < 0)
+                break;
+        }
     }
     return(ret);
 }
 
 /**
  * xmlXPathDistinctSorted:
  * @nodes:  a node-set, sorted by document order
  *
  * Implements the EXSLT - Sets distinct() function:
  *    node-set set:distinct (node-set)
@@ skipping 15 matching lines @@
     ret = xmlXPathNodeSetCreate(NULL);
     if (ret == NULL)
         return(ret);
     l = xmlXPathNodeSetGetLength(nodes);
     hash = xmlHashCreate (l);
     for (i = 0; i < l; i++) {
         cur = xmlXPathNodeSetItem(nodes, i);
         strval = xmlXPathCastNodeToString(cur);
         if (xmlHashLookup(hash, strval) == NULL) {
             xmlHashAddEntry(hash, strval, strval);
-            xmlXPathNodeSetAddUnique(ret, cur);
+            if (xmlXPathNodeSetAddUnique(ret, cur) < 0)
+                break;
         } else {
             xmlFree(strval);
         }
     }
     xmlHashFree(hash, (xmlHashDeallocator) xmlFree);
     return(ret);
 }
 
 /**
  * xmlXPathDistinct:
@@ skipping 71 matching lines @@
         return(ret);
     if (xmlXPathNodeSetIsEmpty(nodes) ||
         (!xmlXPathNodeSetContains(nodes, node)))
         return(ret);
 
     l = xmlXPathNodeSetGetLength(nodes);
     for (i = 0; i < l; i++) {
         cur = xmlXPathNodeSetItem(nodes, i);
         if (cur == node)
             break;
-        xmlXPathNodeSetAddUnique(ret, cur);
+        if (xmlXPathNodeSetAddUnique(ret, cur) < 0)
+            break;
     }
     return(ret);
 }
 
 /**
  * xmlXPathNodeLeading:
  * @nodes:  a node-set
  * @node:  a node
  *
  * Implements the EXSLT - Sets leading() function:
@@ skipping 83 matching lines @@
         return(ret);
     if (xmlXPathNodeSetIsEmpty(nodes) ||
         (!xmlXPathNodeSetContains(nodes, node)))
         return(ret);
 
     l = xmlXPathNodeSetGetLength(nodes);
     for (i = l - 1; i >= 0; i--) {
         cur = xmlXPathNodeSetItem(nodes, i);
         if (cur == node)
             break;
-        xmlXPathNodeSetAddUnique(ret, cur);
+        if (xmlXPathNodeSetAddUnique(ret, cur) < 0)
+            break;
     }
     xmlXPathNodeSetSort(ret);   /* bug 413451 */
     return(ret);
 }
 
 /**
  * xmlXPathNodeTrailing:
  * @nodes:  a node-set
  * @node:  a node
  *
@@ skipping 1499 matching lines @@
     ret->valueTab = (xmlXPathObjectPtr *)
                      xmlMalloc(10 * sizeof(xmlXPathObjectPtr));
     if (ret->valueTab == NULL) {
         xmlFree(ret);
         xmlXPathErrMemory(ctxt, "creating evaluation context\n");
         return(NULL);
     }
     ret->valueNr = 0;
     ret->valueMax = 10;
     ret->value = NULL;
+    ret->valueFrame = 0;
 
     ret->context = ctxt;
     ret->comp = comp;
 
     return(ret);
 }
 
 /**
  * xmlXPathFreeParserContext:
  * @ctxt:  the context to free
@@ skipping 1482 matching lines @@
             return(cur->next);
         cur = cur->next;
         do {
             cur = cur->next;
         } while ((cur != NULL) && (cur->type != XML_ELEMENT_NODE));
         return(cur);
     }
     return(NULL);
 }
 
+#if 0
 /**
  * xmlXPathNextDescendantOrSelfElemParent:
  * @ctxt:  the XPath Parser context
  * @cur:  the current node in the traversal
  *
  * Traversal function for the "descendant-or-self" axis.
  * Additionally it returns only nodes which can be parents of
  * element nodes.
  *
  *
  * Returns the next element following that axis
  */
 static xmlNodePtr
 xmlXPathNextDescendantOrSelfElemParent(xmlNodePtr cur,
                                        xmlNodePtr contextNode)
 {
     if (cur == NULL) {
         if (contextNode == NULL)
             return(NULL);
         switch (contextNode->type) {
             case XML_ELEMENT_NODE:
             case XML_XINCLUDE_START:
             case XML_DOCUMENT_FRAG_NODE:
             case XML_DOCUMENT_NODE:
 #ifdef LIBXML_DOCB_ENABLED
             case XML_DOCB_DOCUMENT_NODE:
 #endif
-            case XML_HTML_DOCUMENT_NODE:            
+            case XML_HTML_DOCUMENT_NODE:
                 return(contextNode);
             default:
                 return(NULL);
         }
         return(NULL);
     } else {
         xmlNodePtr start = cur;
 
         while (cur != NULL) {
             switch (cur->type) {
@@ skipping 27 matching lines @@
             if (cur->next != NULL) {
                 cur = cur->next;
             } else {
                 cur = cur->parent;
                 goto next_sibling;
             }
         }
     }
     return(NULL);
 }
+#endif
 
 /**
  * xmlXPathNextDescendant:
  * @ctxt:  the XPath Parser context
  * @cur:  the current node in the traversal
  *
  * Traversal function for the "descendant" direction
  * the descendant axis contains the descendants of the context node in document
  * order; a descendant is a child or a child of a child and so on.
  *
  * Returns the next element following that axis
  */
 xmlNodePtr
 xmlXPathNextDescendant(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
     if (cur == NULL) {
         if (ctxt->context->node == NULL)
             return(NULL);
         if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
             (ctxt->context->node->type == XML_NAMESPACE_DECL))
             return(NULL);
 
         if (ctxt->context->node == (xmlNodePtr) ctxt->context->doc)
             return(ctxt->context->doc->children);
         return(ctxt->context->node->children);
     }
 
+    if (cur->type == XML_NAMESPACE_DECL)
+        return(NULL);
     if (cur->children != NULL) {
         /*
          * Do not descend on entities declarations
          */
         if (cur->children->type != XML_ENTITY_DECL) {
             cur = cur->children;
             /*
              * Skip DTDs
              */
             if (cur->type != XML_DTD_NODE)
@@ skipping 362 matching lines @@
  * @ancestor:  the ancestor node
  * @node:  the current node
  *
  * Check that @ancestor is a @node's ancestor
  *
  * returns 1 if @ancestor is a @node's ancestor, 0 otherwise.
  */
 static int
 xmlXPathIsAncestor(xmlNodePtr ancestor, xmlNodePtr node) {
     if ((ancestor == NULL) || (node == NULL)) return(0);
+    if (node->type == XML_NAMESPACE_DECL)
+        return(0);
+    if (ancestor->type == XML_NAMESPACE_DECL)
+        return(0);
     /* nodes need to be in the same document */
     if (ancestor->doc != node->doc) return(0);
     /* avoid searching if ancestor or node is the root node */
     if (ancestor == (xmlNodePtr) node->doc) return(1);
     if (node == (xmlNodePtr) ancestor->doc) return(0);
     while (node->parent != NULL) {
         if (node->parent == ancestor)
             return(1);
         node = node->parent;
     }
@@ skipping 17 matching lines @@
 xmlXPathNextPreceding(xmlXPathParserContextPtr ctxt, xmlNodePtr cur)
 {
     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
     if (cur == NULL) {
         cur = ctxt->context->node;
         if (cur->type == XML_NAMESPACE_DECL)
             return(NULL);
         if (cur->type == XML_ATTRIBUTE_NODE)
             return(cur->parent);
     }
-    if (cur == NULL)
+    if ((cur == NULL) || (cur->type == XML_NAMESPACE_DECL))
         return (NULL);
     if ((cur->prev != NULL) && (cur->prev->type == XML_DTD_NODE))
         cur = cur->prev;
     do {
         if (cur->prev != NULL) {
             for (cur = cur->prev; cur->last != NULL; cur = cur->last) ;
             return (cur);
         }
 
         cur = cur->parent;
@@ skipping 26 matching lines @@
 {
     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
     if (cur == NULL) {
         cur = ctxt->context->node;
         if (cur == NULL)
             return (NULL);
         if (cur->type == XML_NAMESPACE_DECL)
             return (NULL);
         ctxt->ancestor = cur->parent;
     }
+    if (cur->type == XML_NAMESPACE_DECL)
+        return(NULL);
     if ((cur->prev != NULL) && (cur->prev->type == XML_DTD_NODE))
         cur = cur->prev;
     while (cur->prev == NULL) {
         cur = cur->parent;
         if (cur == NULL)
             return (NULL);
         if (cur == ctxt->context->doc->children)
             return (NULL);
         if (cur != ctxt->ancestor)
             return (cur);
@@ skipping 187 matching lines @@
             (double) cur->nodesetval->nodeNr));
     } else {
         if ((cur->nodesetval->nodeNr != 1) ||
             (cur->nodesetval->nodeTab == NULL)) {
             valuePush(ctxt, xmlXPathCacheNewFloat(ctxt->context, (double) 0));
         } else {
             xmlNodePtr tmp;
             int i = 0;
 
             tmp = cur->nodesetval->nodeTab[0];
-            if (tmp != NULL) {
+            if ((tmp != NULL) && (tmp->type != XML_NAMESPACE_DECL)) {
                 tmp = tmp->children;
                 while (tmp != NULL) {
                     tmp = tmp->next;
                     i++;
                 }
             }
             valuePush(ctxt, xmlXPathCacheNewFloat(ctxt->context, (double) i));
         }
     }
     xmlXPathReleaseObject(ctxt->context, cur);
@@ skipping 649 matching lines @@
  * The substring-before function returns the substring of the first
  * argument string that precedes the first occurrence of the second
  * argument string in the first argument string, or the empty string
  * if the first argument string does not contain the second argument
  * string. For example, substring-before("1999/04/01","/") returns 1999.
  */
 void
 xmlXPathSubstringBeforeFunction(xmlXPathParserContextPtr ctxt, int nargs) {
   xmlXPathObjectPtr str;
   xmlXPathObjectPtr find;
-  xmlBufferPtr target;
+  xmlBufPtr target;
   const xmlChar *point;
   int offset;
 
   CHECK_ARITY(2);
   CAST_TO_STRING;
   find = valuePop(ctxt);
   CAST_TO_STRING;
   str = valuePop(ctxt);
 
-  target = xmlBufferCreate();
+  target = xmlBufCreate();
   if (target) {
     point = xmlStrstr(str->stringval, find->stringval);
     if (point) {
       offset = (int)(point - str->stringval);
-      xmlBufferAdd(target, str->stringval, offset);
+      xmlBufAdd(target, str->stringval, offset);
     }
     valuePush(ctxt, xmlXPathCacheNewString(ctxt->context,
-        xmlBufferContent(target)));
-    xmlBufferFree(target);
+        xmlBufContent(target)));
+    xmlBufFree(target);
   }
   xmlXPathReleaseObject(ctxt->context, str);
   xmlXPathReleaseObject(ctxt->context, find);
 }
 
 /**
  * xmlXPathSubstringAfterFunction:
  * @ctxt:  the XPath Parser context
  * @nargs:  the number of arguments
  *
  * Implement the substring-after() XPath function
  *    string substring-after(string, string)
  * The substring-after function returns the substring of the first
  * argument string that follows the first occurrence of the second
  * argument string in the first argument string, or the empty stringi
  * if the first argument string does not contain the second argument
  * string. For example, substring-after("1999/04/01","/") returns 04/01,
  * and substring-after("1999/04/01","19") returns 99/04/01.
  */
 void
 xmlXPathSubstringAfterFunction(xmlXPathParserContextPtr ctxt, int nargs) {
   xmlXPathObjectPtr str;
   xmlXPathObjectPtr find;
-  xmlBufferPtr target;
+  xmlBufPtr target;
   const xmlChar *point;
   int offset;
 
   CHECK_ARITY(2);
   CAST_TO_STRING;
   find = valuePop(ctxt);
   CAST_TO_STRING;
   str = valuePop(ctxt);
 
-  target = xmlBufferCreate();
+  target = xmlBufCreate();
   if (target) {
     point = xmlStrstr(str->stringval, find->stringval);
     if (point) {
       offset = (int)(point - str->stringval) + xmlStrlen(find->stringval);
-      xmlBufferAdd(target, &str->stringval[offset],
+      xmlBufAdd(target, &str->stringval[offset],
                    xmlStrlen(str->stringval) - offset);
     }
     valuePush(ctxt, xmlXPathCacheNewString(ctxt->context,
-        xmlBufferContent(target)));
-    xmlBufferFree(target);
+        xmlBufContent(target)));
+    xmlBufFree(target);
   }
   xmlXPathReleaseObject(ctxt->context, str);
   xmlXPathReleaseObject(ctxt->context, find);
 }
 
 /**
  * xmlXPathNormalizeFunction:
  * @ctxt:  the XPath Parser context
  * @nargs:  the number of arguments
  *
  * Implement the normalize-space() XPath function
  *    string normalize-space(string?)
  * The normalize-space function returns the argument string with white
  * space normalized by stripping leading and trailing whitespace
  * and replacing sequences of whitespace characters by a single
  * space. Whitespace characters are the same allowed by the S production
  * in XML. If the argument is omitted, it defaults to the context
  * node converted to a string, in other words the value of the context node.
  */
 void
 xmlXPathNormalizeFunction(xmlXPathParserContextPtr ctxt, int nargs) {
   xmlXPathObjectPtr obj = NULL;
   xmlChar *source = NULL;
-  xmlBufferPtr target;
+  xmlBufPtr target;
   xmlChar blank;
 
   if (ctxt == NULL) return;
   if (nargs == 0) {
     /* Use current context node */
       valuePush(ctxt,
           xmlXPathCacheWrapString(ctxt->context,
             xmlXPathCastNodeToString(ctxt->context->node)));
     nargs = 1;
   }
 
   CHECK_ARITY(1);
   CAST_TO_STRING;
   CHECK_TYPE(XPATH_STRING);
   obj = valuePop(ctxt);
   source = obj->stringval;
 
-  target = xmlBufferCreate();
+  target = xmlBufCreate();
   if (target && source) {
 
     /* Skip leading whitespaces */
     while (IS_BLANK_CH(*source))
       source++;
 
     /* Collapse intermediate whitespaces, and skip trailing whitespaces */
     blank = 0;
     while (*source) {
       if (IS_BLANK_CH(*source)) {
         blank = 0x20;
       } else {
         if (blank) {
-          xmlBufferAdd(target, &blank, 1);
+          xmlBufAdd(target, &blank, 1);
           blank = 0;
         }
-        xmlBufferAdd(target, source, 1);
+        xmlBufAdd(target, source, 1);
       }
       source++;
     }
     valuePush(ctxt, xmlXPathCacheNewString(ctxt->context,
-        xmlBufferContent(target)));
-    xmlBufferFree(target);
+        xmlBufContent(target)));
+    xmlBufFree(target);
   }
   xmlXPathReleaseObject(ctxt->context, obj);
 }
 
 /**
  * xmlXPathTranslateFunction:
  * @ctxt:  the XPath Parser context
  * @nargs:  the number of arguments
  *
  * Implement the translate() XPath function
@@ skipping 10 matching lines @@
  * returns "AAA". If a character occurs more than once in second
  * argument string, then the first occurrence determines the replacement
  * character. If the third argument string is longer than the second
  * argument string, then excess characters are ignored.
  */
 void
 xmlXPathTranslateFunction(xmlXPathParserContextPtr ctxt, int nargs) {
     xmlXPathObjectPtr str;
     xmlXPathObjectPtr from;
     xmlXPathObjectPtr to;
-    xmlBufferPtr target;
+    xmlBufPtr target;
     int offset, max;
     xmlChar ch;
     const xmlChar *point;
     xmlChar *cptr;
 
     CHECK_ARITY(3);
 
     CAST_TO_STRING;
     to = valuePop(ctxt);
     CAST_TO_STRING;
     from = valuePop(ctxt);
     CAST_TO_STRING;
     str = valuePop(ctxt);
 
-    target = xmlBufferCreate();
+    target = xmlBufCreate();
     if (target) {
         max = xmlUTF8Strlen(to->stringval);
         for (cptr = str->stringval; (ch=*cptr); ) {
             offset = xmlUTF8Strloc(from->stringval, cptr);
             if (offset >= 0) {
                 if (offset < max) {
                     point = xmlUTF8Strpos(to->stringval, offset);
                     if (point)
-                        xmlBufferAdd(target, point, xmlUTF8Strsize(point, 1));
+                        xmlBufAdd(target, point, xmlUTF8Strsize(point, 1));
                 }
             } else
-                xmlBufferAdd(target, cptr, xmlUTF8Strsize(cptr, 1));
+                xmlBufAdd(target, cptr, xmlUTF8Strsize(cptr, 1));
 
             /* Step to next character in input */
             cptr++;
             if ( ch & 0x80 ) {
                 /* if not simple ascii, verify proper format */
                 if ( (ch & 0xc0) != 0xc0 ) {
                     xmlGenericError(xmlGenericErrorContext,
                         "xmlXPathTranslateFunction: Invalid UTF8 string\n");
+                    /* not asserting an XPath error is probably better */
                     break;
                 }
                 /* then skip over remaining bytes for this char */
                 while ( (ch <<= 1) & 0x80 )
                     if ( (*cptr++ & 0xc0) != 0x80 ) {
                         xmlGenericError(xmlGenericErrorContext,
                             "xmlXPathTranslateFunction: Invalid UTF8 string\n");
+                        /* not asserting an XPath error is probably better */
                         break;
                     }
                 if (ch & 0x80) /* must have had error encountered */
                     break;
             }
         }
     }
     valuePush(ctxt, xmlXPathCacheNewString(ctxt->context,
-        xmlBufferContent(target)));
-    xmlBufferFree(target);
+        xmlBufContent(target)));
+    xmlBufFree(target);
     xmlXPathReleaseObject(ctxt->context, str);
     xmlXPathReleaseObject(ctxt->context, from);
     xmlXPathReleaseObject(ctxt->context, to);
 }
 
 /**
  * xmlXPathBooleanFunction:
  * @ctxt:  the XPath Parser context
  * @nargs:  the number of arguments
  *
@@ skipping 486 matching lines @@
  *
  * [5] Name ::= (Letter | '_' | ':') (NameChar)*
  *
  * Returns the namespace name or NULL
  */
 
 xmlChar *
 xmlXPathParseName(xmlXPathParserContextPtr ctxt) {
     const xmlChar *in;
     xmlChar *ret;
-    int count = 0;
+    size_t count = 0;
 
     if ((ctxt == NULL) || (ctxt->cur == NULL)) return(NULL);
     /*
      * Accelerator for simple ASCII names
      */
     in = ctxt->cur;
     if (((*in >= 0x61) && (*in <= 0x7A)) ||
         ((*in >= 0x41) && (*in <= 0x5A)) ||
         (*in == '_') || (*in == ':')) {
         in++;
         while (((*in >= 0x61) && (*in <= 0x7A)) ||
                ((*in >= 0x41) && (*in <= 0x5A)) ||
                ((*in >= 0x30) && (*in <= 0x39)) ||
                (*in == '_') || (*in == '-') ||
                (*in == ':') || (*in == '.'))
             in++;
         if ((*in > 0) && (*in < 0x80)) {
             count = in - ctxt->cur;
+            if (count > XML_MAX_NAME_LENGTH) {
+                ctxt->cur = in;
+                XP_ERRORNULL(XPATH_EXPR_ERROR);
+            }
             ret = xmlStrndup(ctxt->cur, count);
             ctxt->cur = in;
             return(ret);
         }
     }
     return(xmlXPathParseNameComplex(ctxt, 1));
 }
 
 static xmlChar *
 xmlXPathParseNameComplex(xmlXPathParserContextPtr ctxt, int qualified) {
@@ skipping 23 matching lines @@
         NEXTL(l);
         c = CUR_CHAR(l);
         if (len >= XML_MAX_NAMELEN) {
             /*
              * Okay someone managed to make a huge name, so he's ready to pay
              * for the processing speed.
              */
             xmlChar *buffer;
             int max = len * 2;
 
+            if (len > XML_MAX_NAME_LENGTH) {
+                XP_ERRORNULL(XPATH_EXPR_ERROR);
+            }
             buffer = (xmlChar *) xmlMallocAtomic(max * sizeof(xmlChar));
             if (buffer == NULL) {
                 XP_ERRORNULL(XPATH_MEMORY_ERROR);
             }
             memcpy(buffer, buf, len);
             while ((IS_LETTER(c)) || (IS_DIGIT(c)) || /* test bigname.xml */
                    (c == '.') || (c == '-') ||
                    (c == '_') || ((qualified) && (c == ':')) ||
                    (IS_COMBINING(c)) ||
                    (IS_EXTENDER(c))) {
                 if (len + 10 > max) {
+                    if (max > XML_MAX_NAME_LENGTH) {
+                        XP_ERRORNULL(XPATH_EXPR_ERROR);
+                    }
                     max *= 2;
                     buffer = (xmlChar *) xmlRealloc(buffer,
                                                     max * sizeof(xmlChar));
                     if (buffer == NULL) {
                         XP_ERRORNULL(XPATH_MEMORY_ERROR);
                     }
                 }
                 COPY_BUF(l,buffer,len,c);
                 NEXTL(l);
                 c = CUR_CHAR(l);
@@ skipping 132 matching lines @@
  *                    | '.' Digits
  *  [31]   Digits ::=   [0-9]+
  *
  * Compile a Number, then push it on the stack
  *
  */
 static void
 xmlXPathCompNumber(xmlXPathParserContextPtr ctxt)
 {
     double ret = 0.0;
-    double mult = 1;
     int ok = 0;
     int exponent = 0;
     int is_exponent_negative = 0;
 #ifdef __GNUC__
     unsigned long tmp = 0;
     double temp;
 #endif
 
     CHECK_ERROR;
     if ((CUR != '.') && ((CUR < '0') || (CUR > '9'))) {
@@ skipping 15 matching lines @@
     }
 #else
     ret = 0;
     while ((CUR >= '0') && (CUR <= '9')) {
         ret = ret * 10 + (CUR - '0');
         ok = 1;
         NEXT;
     }
 #endif
     if (CUR == '.') {
+        int v, frac = 0;
+        double fraction = 0;
+
         NEXT;
         if (((CUR < '0') || (CUR > '9')) && (!ok)) {
             XP_ERROR(XPATH_NUMBER_ERROR);
         }
-        while ((CUR >= '0') && (CUR <= '9')) {
-            mult /= 10;
-            ret = ret + (CUR - '0') * mult;
+        while ((CUR >= '0') && (CUR <= '9') && (frac < MAX_FRAC)) {
+            v = (CUR - '0');
+            fraction = fraction * 10 + v;
+            frac = frac + 1;
             NEXT;
         }
+        fraction /= my_pow10[frac];
+        ret = ret + fraction;
+        while ((CUR >= '0') && (CUR <= '9'))
+            NEXT;
     }
     if ((CUR == 'e') || (CUR == 'E')) {
         NEXT;
         if (CUR == '-') {
             is_exponent_negative = 1;
             NEXT;
         } else if (CUR == '+') {
             NEXT;
         }
         while ((CUR >= '0') && (CUR <= '9')) {
@@ skipping 128 matching lines @@
     NEXT;
     name = xmlXPathParseQName(ctxt, &prefix);
     if (name == NULL) {
         XP_ERROR(XPATH_VARIABLE_REF_ERROR);
     }
     ctxt->comp->last = -1;
     PUSH_LONG_EXPR(XPATH_OP_VARIABLE, 0, 0, 0,
                    name, prefix);
     SKIP_BLANKS;
     if ((ctxt->context != NULL) && (ctxt->context->flags & XML_XPATH_NOVAR)) {
-        XP_ERROR(XPATH_UNDEF_VARIABLE_ERROR);
+        XP_ERROR(XPATH_FORBID_VARIABLE_ERROR);
     }
 }
 
 /**
  * xmlXPathIsNodeType:
  * @name:  a name string
  *
  * Is the name given a NodeType one.
  *
  *  [38]   NodeType ::=   'comment'
@@ skipping 1004 matching lines @@
                     axis = AXIS_CHILD;
                 }
             } else if (CUR == '@') {
                 NEXT;
                 axis = AXIS_ATTRIBUTE;
             } else {
                 axis = AXIS_CHILD;
             }
         }
 
-        CHECK_ERROR;
+        if (ctxt->error != XPATH_EXPRESSION_OK) {
+            xmlFree(name);
+            return;
+        }
 
         name = xmlXPathCompNodeTest(ctxt, &test, &type, &prefix, name);
         if (test == 0)
             return;
 
         if ((prefix != NULL) && (ctxt->context != NULL) &&
             (ctxt->context->flags & XML_XPATH_CHECKNS)) {
             if (xmlXPathNsLookup(ctxt->context, prefix) == NULL) {
                 xmlXPathErr(ctxt, XPATH_UNDEF_PREFIX_ERROR);
             }
@@ skipping 315 matching lines @@
             if ((contextNode->type != XML_NAMESPACE_DECL) &&
                 (contextNode->doc != NULL))
                 xpctxt->doc = contextNode->doc;
             /*
             * Evaluate the predicate expression with 1 context node
             * at a time; this node is packaged into a node set; this
             * node set is handed over to the evaluation mechanism.
             */
             if (contextObj == NULL)
                 contextObj = xmlXPathCacheNewNodeSet(xpctxt, contextNode);
-            else
-                xmlXPathNodeSetAddUnique(contextObj->nodesetval,
-                    contextNode);
+            else {
+                if (xmlXPathNodeSetAddUnique(contextObj->nodesetval,
+                    contextNode) < 0) {
+                    ctxt->error = XPATH_MEMORY_ERROR;
+                    goto evaluation_exit;
+                }
+            }
 
             valuePush(ctxt, contextObj);
 
             res = xmlXPathCompOpEvalToBoolean(ctxt, exprOp, 1);
 
             if ((ctxt->error != XPATH_EXPRESSION_OK) || (res == -1)) {
                 xmlXPathNodeSetClear(set, hasNsNodes);
                 newContextSize = 0;
                 goto evaluation_exit;
             }
@@ skipping 80 matching lines @@
         * TODO: Can this ever happen?
         */
         return (contextSize);
     } else {
         xmlDocPtr oldContextDoc;
         int i, pos = 0, newContextSize = 0, contextPos = 0, res;
         xmlXPathStepOpPtr exprOp;
         xmlXPathObjectPtr contextObj = NULL, exprRes = NULL;
         xmlNodePtr oldContextNode, contextNode = NULL;
         xmlXPathContextPtr xpctxt = ctxt->context;
+        int frame;
 
 #ifdef LIBXML_XPTR_ENABLED
             /*
             * URGENT TODO: Check the following:
             *  We don't expect location sets if evaluating prediates, right?
             *  Only filters should expect location sets, right?
         */
 #endif /* LIBXML_XPTR_ENABLED */
 
         /*
         * Save old context.
         */
         oldContextNode = xpctxt->node;
         oldContextDoc = xpctxt->doc;
         /*
         * Get the expression of this predicate.
         */
         exprOp = &ctxt->comp->steps[op->ch2];
         for (i = 0; i < set->nodeNr; i++) {
+            xmlXPathObjectPtr tmp;
+
             if (set->nodeTab[i] == NULL)
                 continue;
 
             contextNode = set->nodeTab[i];
             xpctxt->node = contextNode;
             xpctxt->contextSize = contextSize;
             xpctxt->proximityPosition = ++contextPos;
 
             /*
             * Initialize the new set.
             * Also set the xpath document in case things like
             * key() evaluation are attempted on the predicate
             */
             if ((contextNode->type != XML_NAMESPACE_DECL) &&
                 (contextNode->doc != NULL))
                 xpctxt->doc = contextNode->doc;
             /*
             * Evaluate the predicate expression with 1 context node
             * at a time; this node is packaged into a node set; this
             * node set is handed over to the evaluation mechanism.
             */
             if (contextObj == NULL)
                 contextObj = xmlXPathCacheNewNodeSet(xpctxt, contextNode);
-            else
-                xmlXPathNodeSetAddUnique(contextObj->nodesetval,
-                    contextNode);
+            else {
+                if (xmlXPathNodeSetAddUnique(contextObj->nodesetval,
+                    contextNode) < 0) {
+                    ctxt->error = XPATH_MEMORY_ERROR;
+                    goto evaluation_exit;
+                }
+            }
 
+            frame = xmlXPathSetFrame(ctxt);
             valuePush(ctxt, contextObj);
             res = xmlXPathCompOpEvalToBoolean(ctxt, exprOp, 1);
+            tmp = valuePop(ctxt);
+            xmlXPathPopFrame(ctxt, frame);
 
             if ((ctxt->error != XPATH_EXPRESSION_OK) || (res == -1)) {
-                xmlXPathObjectPtr tmp;
-                /* pop the result if any */
-                tmp = valuePop(ctxt);
                 while (tmp != contextObj) {
                     /*
                      * Free up the result
                      * then pop off contextObj, which will be freed later
                      */
                     xmlXPathReleaseObject(xpctxt, tmp);
                     tmp = valuePop(ctxt);
                 }
                 goto evaluation_error;
             }
+            /* push the result back onto the stack */
+            valuePush(ctxt, tmp);
 
             if (res)
                 pos++;
 
             if (res && (pos >= minPos) && (pos <= maxPos)) {
                 /*
                 * Fits in the requested range.
                 */
                 newContextSize++;
                 if (minPos == maxPos) {
@@ skipping 131 matching lines @@
 static int
 xmlXPathNodeCollectAndTest(xmlXPathParserContextPtr ctxt,
                            xmlXPathStepOpPtr op,
                            xmlNodePtr * first, xmlNodePtr * last,
                            int toBool)
 {
 
 #define XP_TEST_HIT \
     if (hasAxisRange != 0) { \
         if (++pos == maxPos) { \
-            addNode(seq, cur); \
-        goto axis_range_end; } \
+            if (addNode(seq, cur) < 0) \
+                ctxt->error = XPATH_MEMORY_ERROR; \
+            goto axis_range_end; } \
     } else { \
-        addNode(seq, cur); \
+        if (addNode(seq, cur) < 0) \
+            ctxt->error = XPATH_MEMORY_ERROR; \
         if (breakOnFirstHit) goto first_hit; }
 
 #define XP_TEST_HIT_NS \
     if (hasAxisRange != 0) { \
         if (++pos == maxPos) { \
             hasNsNodes = 1; \
-            xmlXPathNodeSetAddNs(seq, xpctxt->node, (xmlNsPtr) cur); \
+            if (xmlXPathNodeSetAddNs(seq, xpctxt->node, (xmlNsPtr) cur) < 0) \
+                ctxt->error = XPATH_MEMORY_ERROR; \
         goto axis_range_end; } \
     } else { \
         hasNsNodes = 1; \
-        xmlXPathNodeSetAddNs(seq, \
-        xpctxt->node, (xmlNsPtr) cur); \
+        if (xmlXPathNodeSetAddNs(seq, xpctxt->node, (xmlNsPtr) cur) < 0) \
+            ctxt->error = XPATH_MEMORY_ERROR; \
         if (breakOnFirstHit) goto first_hit; }
 
     xmlXPathAxisVal axis = (xmlXPathAxisVal) op->value;
     xmlXPathTestVal test = (xmlXPathTestVal) op->value2;
     xmlXPathTypeVal type = (xmlXPathTypeVal) op->value3;
     const xmlChar *prefix = op->value4;
     const xmlChar *name = op->value5;
     const xmlChar *URI = NULL;
 
 #ifdef DEBUG_STEP
     int nbMatches = 0, prevMatches = 0;
 #endif
     int total = 0, hasNsNodes = 0;
     /* The popped object holding the context nodes */
     xmlXPathObjectPtr obj;
     /* The set of context nodes for the node tests */
     xmlNodeSetPtr contextSeq;
     int contextIdx;
     xmlNodePtr contextNode;
-    /* The context node for a compound traversal */
-    xmlNodePtr outerContextNode;
     /* The final resulting node set wrt to all context nodes */
     xmlNodeSetPtr outSeq;
     /*
     * The temporary resulting node set wrt 1 context node.
     * Used to feed predicate evaluation.
     */
     xmlNodeSetPtr seq;
     xmlNodePtr cur;
     /* First predicate operator */
     xmlXPathStepOpPtr predOp;
     int maxPos; /* The requested position() (when a "[n]" predicate) */
     int hasPredicateRange, hasAxisRange, pos, size, newSize;
     int breakOnFirstHit;
 
     xmlXPathTraversalFunction next = NULL;
-    /* compound axis traversal */
-    xmlXPathTraversalFunctionExt outerNext = NULL;
-    void (*addNode) (xmlNodeSetPtr, xmlNodePtr);
+    int (*addNode) (xmlNodeSetPtr, xmlNodePtr);
     xmlXPathNodeSetMergeFunction mergeAndClear;
     xmlNodePtr oldContextNode;
     xmlXPathContextPtr xpctxt = ctxt->context;
 
 
     CHECK_TYPE0(XPATH_NODESET);
     obj = valuePop(ctxt);
     /*
     * Setup namespaces.
     */
@@ skipping 28 matching lines @@
             next = xmlXPathNextAncestorOrSelf;
             break;
         case AXIS_ATTRIBUTE:
             first = NULL;
             last = NULL;
             next = xmlXPathNextAttribute;
             mergeAndClear = xmlXPathNodeSetMergeAndClearNoDupls;
             break;
         case AXIS_CHILD:
             last = NULL;
-            if (op->rewriteType == XP_REWRITE_DOS_CHILD_ELEM) {
-                /*
-                * This iterator will give us only nodes which can
-                * hold element nodes.
-                */
-                outerNext = xmlXPathNextDescendantOrSelfElemParent;
-            }
             if (((test == NODE_TEST_NAME) || (test == NODE_TEST_ALL)) &&
                 (type == NODE_TYPE_NODE))
             {
                 /*
                 * Optimization if an element node type is 'element'.
                 */
                 next = xmlXPathNextChildElement;
             } else
                 next = xmlXPathNextChild;
             mergeAndClear = xmlXPathNodeSetMergeAndClearNoDupls;
@@ skipping 109 matching lines @@
      *  - For other axes, the principal node type is element.
      *
      * A node test * is true for any node of the
      * principal node type. For example, child::* will
      * select all element children of the context node
      */
     oldContextNode = xpctxt->node;
     addNode = xmlXPathNodeSetAddUnique;
     outSeq = NULL;
     seq = NULL;
-    outerContextNode = NULL;
     contextNode = NULL;
     contextIdx = 0;
 
 
-    while ((contextIdx < contextSeq->nodeNr) || (contextNode != NULL)) {
-        if (outerNext != NULL) {
-            /*
-            * This is a compound traversal.
-            */
-            if (contextNode == NULL) {
-                /*
-                * Set the context for the outer traversal.
-                */
-                outerContextNode = contextSeq->nodeTab[contextIdx++];
-                contextNode = outerNext(NULL, outerContextNode);
-            } else
-                contextNode = outerNext(contextNode, outerContextNode);
-            if (contextNode == NULL)
-                continue;
-            /*
-            * Set the context for the main traversal.
-            */
-            xpctxt->node = contextNode;
-        } else
-            xpctxt->node = contextSeq->nodeTab[contextIdx++];
+    while (((contextIdx < contextSeq->nodeNr) || (contextNode != NULL)) &&
+           (ctxt->error == XPATH_EXPRESSION_OK)) {
+        xpctxt->node = contextSeq->nodeTab[contextIdx++];
 
         if (seq == NULL) {
             seq = xmlXPathNodeSetCreate(NULL);
             if (seq == NULL) {
                 total = 0;
                 goto error;
             }
         }
         /*
         * Traverse the axis and test the nodes.
@@ skipping 87 matching lines @@
                     if ((cur->type == XML_PI_NODE) &&
                         ((name == NULL) || xmlStrEqual(name, cur->name)))
                     {
                         XP_TEST_HIT
                     }
                     break;
                 case NODE_TEST_ALL:
                     if (axis == AXIS_ATTRIBUTE) {
                         if (cur->type == XML_ATTRIBUTE_NODE)
                         {
-                            XP_TEST_HIT
+                            if (prefix == NULL)
+                            {
+                                XP_TEST_HIT
+                            } else if ((cur->ns != NULL) &&
+                                (xmlStrEqual(URI, cur->ns->href)))
+                            {
+                                XP_TEST_HIT
+                            }
                         }
                     } else if (axis == AXIS_NAMESPACE) {
                         if (cur->type == XML_NAMESPACE_DECL)
                         {
                             XP_TEST_HIT_NS
                         }
                     } else {
                         if (cur->type == XML_ELEMENT_NODE) {
                             if (prefix == NULL)
                             {
@@ skipping 69 matching lines @@
                                 {
                                     XP_TEST_HIT_NS
                                 }
                             }
                             break;
                         default:
                             break;
                     }
                     break;
             } /* switch(test) */
-        } while (cur != NULL);
+        } while ((cur != NULL) && (ctxt->error == XPATH_EXPRESSION_OK));
 
         goto apply_predicates;
 
 axis_range_end: /* ----------------------------------------------------- */
         /*
         * We have a "/foo[n]", and position() = n was reached.
         * Note that we can have as well "/foo/::parent::foo[1]", so
         * a duplicate-aware merge is still needed.
         * Merge with the result.
         */
@@ skipping 20 matching lines @@
         } else
             outSeq = mergeAndClear(outSeq, seq, 0);
         break;
 
 #ifdef DEBUG_STEP
         if (seq != NULL)
             nbMatches += seq->nodeNr;
 #endif
 
 apply_predicates: /* --------------------------------------------------- */
+        if (ctxt->error != XPATH_EXPRESSION_OK)
+            goto error;
+
         /*
         * Apply predicates.
         */
         if ((predOp != NULL) && (seq->nodeNr > 0)) {
             /*
             * E.g. when we have a "/foo[some expression][n]".
-            */      
+            */
             /*
             * QUESTION TODO: The old predicate evaluation took into
             *  account location-sets.
             *  (E.g. ctxt->value->type == XPATH_LOCATIONSET)
             *  Do we expect such a set here?
             *  All what I learned now from the evaluation semantics
             *  does not indicate that a location-set will be processed
             *  here, so this looks OK.
-            */      
+            */
             /*
             * Iterate over all predicates, starting with the outermost
             * predicate.
             * TODO: Problem: we cannot execute the inner predicates first
             *  since we cannot go back *up* the operator tree!
             *  Options we have:
             *  1) Use of recursive functions (like is it currently done
             *     via xmlXPathCompOpEval())
             *  2) Add a predicate evaluation information stack to the
             *     context struct
@@ skipping 472 matching lines @@
             * Run the evaluation with a node list made of a
             * single item in the nodelocset.
             */
             ctxt->context->node = oldlocset->locTab[i]->user;
             ctxt->context->contextSize = oldlocset->locNr;
             ctxt->context->proximityPosition = i + 1;
             if (tmp == NULL) {
                 tmp = xmlXPathCacheNewNodeSet(ctxt->context,
                     ctxt->context->node);
             } else {
-                xmlXPathNodeSetAddUnique(tmp->nodesetval,
-                    ctxt->context->node);
+                if (xmlXPathNodeSetAddUnique(tmp->nodesetval,
+                                             ctxt->context->node) < 0) {
+                    ctxt->error = XPATH_MEMORY_ERROR;
+                }
             }
             valuePush(ctxt, tmp);
             if (op->ch2 != -1)
                 total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]);
             if (ctxt->error != XPATH_EXPRESSION_OK) {
                 xmlXPathFreeObject(obj);
                 return(0);
             }
             /*
             * The result of the evaluation need to be tested to
@@ skipping 92 matching lines @@
             * a single item in the nodeset.
             */
             ctxt->context->node = oldset->nodeTab[i];
             if ((oldset->nodeTab[i]->type != XML_NAMESPACE_DECL) &&
                 (oldset->nodeTab[i]->doc != NULL))
                 ctxt->context->doc = oldset->nodeTab[i]->doc;
             if (tmp == NULL) {
                 tmp = xmlXPathCacheNewNodeSet(ctxt->context,
                     ctxt->context->node);
             } else {
-                xmlXPathNodeSetAddUnique(tmp->nodesetval,
-                    ctxt->context->node);
+                if (xmlXPathNodeSetAddUnique(tmp->nodesetval,
+                                             ctxt->context->node) < 0) {
+                    ctxt->error = XPATH_MEMORY_ERROR;
+                }
             }
             valuePush(ctxt, tmp);
             ctxt->context->contextSize = oldset->nodeNr;
             ctxt->context->proximityPosition = i + 1;
             if (op->ch2 != -1)
                 total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]);
             if (ctxt->error != XPATH_EXPRESSION_OK) {
                 xmlXPathFreeNodeSet(newset);
                 xmlXPathFreeObject(obj);
                 return(0);
             }
             /*
             * The result of the evaluation needs to be tested to
             * decide whether the filter succeeded or not
             */
             res = valuePop(ctxt);
             if (xmlXPathEvaluatePredicateResult(ctxt, res)) {
-                xmlXPathNodeSetAdd(newset, oldset->nodeTab[i]);
+                if (xmlXPathNodeSetAdd(newset, oldset->nodeTab[i]) < 0)
+                    ctxt->error = XPATH_MEMORY_ERROR;
             }
             /*
             * Cleanup
             */
             if (res != NULL) {
                 xmlXPathReleaseObject(ctxt->context, res);
             }
             if (ctxt->value == tmp) {
                 valuePop(ctxt);
                 /*
@@ skipping 288 matching lines @@
                         return(0);
                     }
                     valuePush(ctxt, val);
                 }
                 return (total);
             }
         case XPATH_OP_FUNCTION:{
                 xmlXPathFunction func;
                 const xmlChar *oldFunc, *oldFuncURI;
                 int i;
+                int frame;
 
-                if (op->ch1 != -1)
+                frame = xmlXPathSetFrame(ctxt);
+                if (op->ch1 != -1) {
                     total +=
                         xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]);
-                if (ctxt->valueNr < op->value) {
+                    if (ctxt->error != XPATH_EXPRESSION_OK) {
+                        xmlXPathPopFrame(ctxt, frame);
+                        return (total);
+                    }
+                }
+                if (ctxt->valueNr < ctxt->valueFrame + op->value) {
                     xmlGenericError(xmlGenericErrorContext,
                             "xmlXPathCompOpEval: parameter error\n");
                     ctxt->error = XPATH_INVALID_OPERAND;
+                    xmlXPathPopFrame(ctxt, frame);
                     return (total);
                 }
-                for (i = 0; i < op->value; i++)
+                for (i = 0; i < op->value; i++) {
                     if (ctxt->valueTab[(ctxt->valueNr - 1) - i] == NULL) {
                         xmlGenericError(xmlGenericErrorContext,
                                 "xmlXPathCompOpEval: parameter error\n");
                         ctxt->error = XPATH_INVALID_OPERAND;
+                        xmlXPathPopFrame(ctxt, frame);
                         return (total);
                     }
+                }
                 if (op->cache != NULL)
                     XML_CAST_FPTR(func) = op->cache;
                 else {
                     const xmlChar *URI = NULL;
 
                     if (op->value5 == NULL)
                         func =
                             xmlXPathFunctionLookup(ctxt->context,
                                                    op->value4);
                     else {
                         URI = xmlXPathNsLookup(ctxt->context, op->value5);
                         if (URI == NULL) {
                             xmlGenericError(xmlGenericErrorContext,
             "xmlXPathCompOpEval: function %s bound to undefined prefix %s\n",
                                     (char *)op->value4, (char *)op->value5);
+                            xmlXPathPopFrame(ctxt, frame);
                             ctxt->error = XPATH_UNDEF_PREFIX_ERROR;
                             return (total);
                         }
                         func = xmlXPathFunctionLookupNS(ctxt->context,
                                                         op->value4, URI);
                     }
                     if (func == NULL) {
                         xmlGenericError(xmlGenericErrorContext,
                                 "xmlXPathCompOpEval: function %s not found\n",
                                         (char *)op->value4);
                         XP_ERROR0(XPATH_UNKNOWN_FUNC_ERROR);
                     }
                     op->cache = XML_CAST_FPTR(func);
                     op->cacheURI = (void *) URI;
                 }
                 oldFunc = ctxt->context->function;
                 oldFuncURI = ctxt->context->functionURI;
                 ctxt->context->function = op->value4;
                 ctxt->context->functionURI = op->cacheURI;
                 func(ctxt, op->value);
                 ctxt->context->function = oldFunc;
                 ctxt->context->functionURI = oldFuncURI;
+                xmlXPathPopFrame(ctxt, frame);
                 return (total);
             }
         case XPATH_OP_ARG:
             bakd = ctxt->context->doc;
             bak = ctxt->context->node;
             pp = ctxt->context->proximityPosition;
             cs = ctxt->context->contextSize;
-            if (op->ch1 != -1)
+            if (op->ch1 != -1) {
                 total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch1]);
-            ctxt->context->contextSize = cs;
-            ctxt->context->proximityPosition = pp;
-            ctxt->context->node = bak;
-            ctxt->context->doc = bakd;
-            CHECK_ERROR0;
+                ctxt->context->contextSize = cs;
+                ctxt->context->proximityPosition = pp;
+                ctxt->context->node = bak;
+                ctxt->context->doc = bakd;
+                CHECK_ERROR0;
+            }
             if (op->ch2 != -1) {
                 total += xmlXPathCompOpEval(ctxt, &comp->steps[op->ch2]);
-                ctxt->context->doc = bakd;
-                ctxt->context->node = bak;
+                ctxt->context->contextSize = cs;
+                ctxt->context->proximityPosition = pp;
+                ctxt->context->node = bak;
+                ctxt->context->doc = bakd;
                 CHECK_ERROR0;
             }
             return (total);
         case XPATH_OP_PREDICATE:
         case XPATH_OP_FILTER:{
                 xmlXPathObjectPtr res;
                 xmlXPathObjectPtr obj, tmp;
                 xmlNodeSetPtr newset = NULL;
                 xmlNodeSetPtr oldset;
                 xmlNodePtr oldnode;
@@ skipping 271 matching lines @@
                          * a single item in the nodeset.
                          */
                         ctxt->context->node = oldset->nodeTab[i];
                         if ((oldset->nodeTab[i]->type != XML_NAMESPACE_DECL) &&
                             (oldset->nodeTab[i]->doc != NULL))
                             ctxt->context->doc = oldset->nodeTab[i]->doc;
                         if (tmp == NULL) {
                             tmp = xmlXPathCacheNewNodeSet(ctxt->context,
                                 ctxt->context->node);
                         } else {
-                            xmlXPathNodeSetAddUnique(tmp->nodesetval,
-                                ctxt->context->node);
+                            if (xmlXPathNodeSetAddUnique(tmp->nodesetval,
+                                               ctxt->context->node) < 0) {
+                                ctxt->error = XPATH_MEMORY_ERROR;
+                            }
                         }
                         valuePush(ctxt, tmp);
                         ctxt->context->contextSize = oldset->nodeNr;
                         ctxt->context->proximityPosition = i + 1;
                         /*
                         * Evaluate the predicate against the context node.
                         * Can/should we optimize position() predicates
                         * here (e.g. "[1]")?
                         */
                         if (op->ch2 != -1)
                             total +=
                                 xmlXPathCompOpEval(ctxt,
                                                    &comp->steps[op->ch2]);
                         if (ctxt->error != XPATH_EXPRESSION_OK) {
                             xmlXPathFreeNodeSet(newset);
                             xmlXPathFreeObject(obj);
                             return(0);
                         }
 
                         /*
                          * The result of the evaluation needs to be tested to
                          * decide whether the filter succeeded or not
                          */
                         /*
                         * OPTIMIZE TODO: Can we use
                         * xmlXPathNodeSetAdd*Unique()* instead?
                         */
                         res = valuePop(ctxt);
                         if (xmlXPathEvaluatePredicateResult(ctxt, res)) {
-                            xmlXPathNodeSetAdd(newset, oldset->nodeTab[i]);
+                            if (xmlXPathNodeSetAdd(newset, oldset->nodeTab[i])
+                                < 0)
+                                ctxt->error = XPATH_MEMORY_ERROR;
                         }
 
                         /*
                          * Cleanup
                          */
                         if (res != NULL) {
                             xmlXPathReleaseObject(ctxt->context, res);
                         }
                         if (ctxt->value == tmp) {
                             valuePop(ctxt);
@@ skipping 195 matching lines @@
                 ctxt->context->node = NULL;
                 ctxt->context->contextSize = -1;
                 ctxt->context->proximityPosition = -1;
                 valuePush(ctxt, xmlXPtrWrapLocationSet(newlocset));
                 return (total);
             }
 #endif /* LIBXML_XPTR_ENABLED */
     }
     xmlGenericError(xmlGenericErrorContext,
                     "XPath: unknown precompiled operation %d\n", op->op);
+    ctxt->error = XPATH_INVALID_OPERAND;
     return (total);
 }
 
 /**
  * xmlXPathCompOpEvalToBoolean:
  * @ctxt:  the XPath parser context
  *
  * Evaluates if the expression evaluates to true.
  *
  * Returns 1 if true, 0 if false and -1 on API or internal errors.
@@ skipping 126 matching lines @@
 
     /*
      * handle the special cases of "/" amd "." being matched
      */
     if (min_depth == 0) {
         if (from_root) {
             /* Select "/" */
             if (toBool)
                 return(1);
             xmlXPathNodeSetAddUnique((*resultSeq)->nodesetval,
-                (xmlNodePtr) ctxt->doc);
+                                     (xmlNodePtr) ctxt->doc);
         } else {
             /* Select "self::node()" */
             if (toBool)
                 return(1);
             xmlXPathNodeSetAddUnique((*resultSeq)->nodesetval, ctxt->node);
         }
     }
     if (max_depth == 0) {
         return(0);
     }
@@ skipping 72 matching lines @@
                 } else if (eval_all_nodes)
                     ret = xmlStreamPushNode(patstream, NULL, NULL, cur->type);
                 else
                     break;
 
                 if (ret < 0) {
                     /* NOP. */
                 } else if (ret == 1) {
                     if (toBool)
                         goto return_1;
-                    xmlXPathNodeSetAddUnique((*resultSeq)->nodesetval, cur);
+                    if (xmlXPathNodeSetAddUnique((*resultSeq)->nodesetval, cur)
+                        < 0) {
+                        ctxt->lastError.domain = XML_FROM_XPATH;
+                        ctxt->lastError.code = XML_ERR_NO_MEMORY;
+                    }
                 }
                 if ((cur->children == NULL) || (depth >= max_depth)) {
                     ret = xmlStreamPop(patstream);
                     while (cur->next != NULL) {
                         cur = cur->next;
                         if ((cur->type != XML_ENTITY_DECL) &&
                             (cur->type != XML_DTD_NODE))
                             goto next_node;
                     }
                 }
             default:
                 break;
         }
 
 scan_children:
+        if (cur->type == XML_NAMESPACE_DECL) break;
         if ((cur->children != NULL) && (depth < max_depth)) {
             /*
              * Do not descend on entities declarations
              */
             if (cur->children->type != XML_ENTITY_DECL) {
                 cur = cur->children;
                 depth++;
                 /*
                  * Skip DTDs
                  */
@@ skipping 72 matching lines @@
         /* Allocate the value stack */
         ctxt->valueTab = (xmlXPathObjectPtr *)
                          xmlMalloc(10 * sizeof(xmlXPathObjectPtr));
         if (ctxt->valueTab == NULL) {
             xmlXPathPErrMemory(ctxt, "creating evaluation context\n");
             xmlFree(ctxt);
         }
         ctxt->valueNr = 0;
         ctxt->valueMax = 10;
         ctxt->value = NULL;
+        ctxt->valueFrame = 0;
     }
 #ifdef XPATH_STREAMING
     if (ctxt->comp->stream) {
         int res;
 
         if (toBool) {
             /*
             * Evaluation to boolean result.
             */
             res = xmlXPathRunStreamEval(ctxt->context,
@@ skipping 207 matching lines @@
             if (comp->dict)
                 xmlDictReference(comp->dict);
             return(comp);
         }
         xmlFreePattern(stream);
     }
     return(NULL);
 }
 #endif /* XPATH_STREAMING */
 
-static int
-xmlXPathCanRewriteDosExpression(xmlChar *expr)
-{
-    if (expr == NULL)
-        return(0);
-    do {
-        if ((*expr == '/') && (*(++expr) == '/'))
-            return(1);
-    } while (*expr++);
-    return(0);
-}
 static void
-xmlXPathRewriteDOSExpression(xmlXPathCompExprPtr comp, xmlXPathStepOpPtr op)
+xmlXPathOptimizeExpression(xmlXPathCompExprPtr comp, xmlXPathStepOpPtr op)
 {
     /*
     * Try to rewrite "descendant-or-self::node()/foo" to an optimized
     * internal representation.
     */
-    if (op->ch1 != -1) {
-        if ((op->op == XPATH_OP_COLLECT /* 11 */) &&
-            ((xmlXPathAxisVal) op->value == AXIS_CHILD /* 4 */) &&
-            ((xmlXPathTestVal) op->value2 == NODE_TEST_NAME /* 5 */) &&
-            ((xmlXPathTypeVal) op->value3 == NODE_TYPE_NODE /* 0 */))
-        {
-            /*
-            * This is a "child::foo"
-            */
-            xmlXPathStepOpPtr prevop = &comp->steps[op->ch1];
 
-            if ((prevop->op == XPATH_OP_COLLECT /* 11 */) &&
-                (prevop->ch1 != -1) &&
-                ((xmlXPathAxisVal) prevop->value ==
-                    AXIS_DESCENDANT_OR_SELF) &&
-                (prevop->ch2 == -1) &&
-                ((xmlXPathTestVal) prevop->value2 == NODE_TEST_TYPE) &&
-                ((xmlXPathTypeVal) prevop->value3 == NODE_TYPE_NODE) &&
-                (comp->steps[prevop->ch1].op == XPATH_OP_ROOT))
-            {
-                /*
-                * This is a "/descendant-or-self::node()" without predicates.
-                * Eliminate it.
-                */
-                op->ch1 = prevop->ch1;
-                op->rewriteType = XP_REWRITE_DOS_CHILD_ELEM;
-            }
+    if ((op->op == XPATH_OP_COLLECT /* 11 */) &&
+        (op->ch1 != -1) &&
+        (op->ch2 == -1 /* no predicate */))
+    {
+        xmlXPathStepOpPtr prevop = &comp->steps[op->ch1];
+
+        if ((prevop->op == XPATH_OP_COLLECT /* 11 */) &&
+            ((xmlXPathAxisVal) prevop->value ==
+                AXIS_DESCENDANT_OR_SELF) &&
+            (prevop->ch2 == -1) &&
+            ((xmlXPathTestVal) prevop->value2 == NODE_TEST_TYPE) &&
+            ((xmlXPathTypeVal) prevop->value3 == NODE_TYPE_NODE))
+        {
+            /*
+            * This is a "descendant-or-self::node()" without predicates.
+            * Try to eliminate it.
+            */
+
+            switch ((xmlXPathAxisVal) op->value) {
+                case AXIS_CHILD:
+                case AXIS_DESCENDANT:
+                    /*
+                    * Convert "descendant-or-self::node()/child::" or
+                    * "descendant-or-self::node()/descendant::" to
+                    * "descendant::"
+                    */
+                    op->ch1   = prevop->ch1;
+                    op->value = AXIS_DESCENDANT;
+                    break;
+                case AXIS_SELF:
+                case AXIS_DESCENDANT_OR_SELF:
+                    /*
+                    * Convert "descendant-or-self::node()/self::" or
+                    * "descendant-or-self::node()/descendant-or-self::" to
+                    * to "descendant-or-self::"
+                    */
+                    op->ch1   = prevop->ch1;
+                    op->value = AXIS_DESCENDANT_OR_SELF;
+                    break;
+                default:
+                    break;
+            }
         }
-        if (op->ch1 != -1)
-            xmlXPathRewriteDOSExpression(comp, &comp->steps[op->ch1]);
     }
+
+    /* Recurse */
+    if (op->ch1 != -1)
+        xmlXPathOptimizeExpression(comp, &comp->steps[op->ch1]);
     if (op->ch2 != -1)
-        xmlXPathRewriteDOSExpression(comp, &comp->steps[op->ch2]);
+        xmlXPathOptimizeExpression(comp, &comp->steps[op->ch2]);
 }
 
 /**
  * xmlXPathCtxtCompile:
  * @ctxt: an XPath context
  * @str:  the XPath expression
  *
  * Compile an XPath expression
  *
  * Returns the xmlXPathCompExprPtr resulting from the compilation or NULL.
@@ skipping 37 matching lines @@
         pctxt->comp = NULL;
     }
     xmlXPathFreeParserContext(pctxt);
 
     if (comp != NULL) {
         comp->expr = xmlStrdup(str);
 #ifdef DEBUG_EVAL_COUNTS
         comp->string = xmlStrdup(str);
         comp->nb = 0;
 #endif
-        if ((comp->expr != NULL) &&
-            (comp->nbStep > 2) &&
-            (comp->last >= 0) &&
-            (xmlXPathCanRewriteDosExpression(comp->expr) == 1))
-        {
-            xmlXPathRewriteDOSExpression(comp, &comp->steps[comp->last]);
+        if ((comp->nbStep > 1) && (comp->last >= 0)) {
+            xmlXPathOptimizeExpression(comp, &comp->steps[comp->last]);
         }
     }
     return(comp);
 }
 
 /**
  * xmlXPathCompile:
  * @str:  the XPath expression
  *
  * Compile an XPath expression
@@ skipping 156 matching lines @@
     if (comp != NULL) {
         if (ctxt->comp != NULL)
             xmlXPathFreeCompExpr(ctxt->comp);
         ctxt->comp = comp;
         if (ctxt->cur != NULL)
             while (*ctxt->cur != 0) ctxt->cur++;
     } else
 #endif
     {
         xmlXPathCompileExpr(ctxt, 1);
-        /*
-        * In this scenario the expression string will sit in ctxt->base.
-        */
         if ((ctxt->error == XPATH_EXPRESSION_OK) &&
             (ctxt->comp != NULL) &&
-            (ctxt->base != NULL) &&
-            (ctxt->comp->nbStep > 2) &&
-            (ctxt->comp->last >= 0) &&
-            (xmlXPathCanRewriteDosExpression((xmlChar *) ctxt->base) == 1))
+            (ctxt->comp->nbStep > 1) &&
+            (ctxt->comp->last >= 0))
         {
-            xmlXPathRewriteDOSExpression(ctxt->comp,
+            xmlXPathOptimizeExpression(ctxt->comp,
                 &ctxt->comp->steps[ctxt->comp->last]);
         }
     }
     CHECK_ERROR;
     xmlXPathRunEval(ctxt, 0);
 }
 
 /**
  * xmlXPathEval:
  * @str:  the XPath expression
@@ skipping 50 matching lines @@
     if (ctxt->error != XPATH_EXPRESSION_OK) {
         xmlXPathFreeObject(res);
         res = NULL;
     }
 
     xmlXPathFreeParserContext(ctxt);
     return(res);
 }
 
 /**
+ * xmlXPathSetContextNode:
+ * @node: the node to to use as the context node
+ * @ctx:  the XPath context
+ *
+ * Sets 'node' as the context node. The node must be in the same
+ * document as that associated with the context.
+ *
+ * Returns -1 in case of error or 0 if successful
+ */
+int
+xmlXPathSetContextNode(xmlNodePtr node, xmlXPathContextPtr ctx) {
+    if ((node == NULL) || (ctx == NULL))
+        return(-1);
+
+    if (node->doc == ctx->doc) {
+        ctx->node = node;
+        return(0);
+    }
+    return(-1);
+}
+
+/**
+ * xmlXPathNodeEval:
+ * @node: the node to to use as the context node
+ * @str:  the XPath expression
+ * @ctx:  the XPath context
+ *
+ * Evaluate the XPath Location Path in the given context. The node 'node'
+ * is set as the context node. The context node is not restored.
+ *
+ * Returns the xmlXPathObjectPtr resulting from the evaluation or NULL.
+ *         the caller has to free the object.
+ */
+xmlXPathObjectPtr
+xmlXPathNodeEval(xmlNodePtr node, const xmlChar *str, xmlXPathContextPtr ctx) {
+    if (str == NULL)
+        return(NULL);
+    if (xmlXPathSetContextNode(node, ctx) < 0)
+        return(NULL);
+    return(xmlXPathEval(str, ctx));
+}
+
+/**
  * xmlXPathEvalExpression:
  * @str:  the XPath expression
  * @ctxt:  the XPath context
  *
  * Evaluate the XPath expression in the given context.
  *
  * Returns the xmlXPathObjectPtr resulting from the evaluation or NULL.
  *         the caller has to free the object.
  */
 xmlXPathObjectPtr
@@ skipping 83 matching lines @@
  *  xf:escape-uri ("gopher://spinaltap.micro.umn.edu/00/Weather/California/Los%20Angeles#ocean"), true())
  *  returns "gopher%3A%2F%2Fspinaltap.micro.umn.edu%2F00%2FWeather%2FCalifornia%2FLos%20Angeles%23ocean"
  *  xf:escape-uri ("gopher://spinaltap.micro.umn.edu/00/Weather/California/Los%20Angeles#ocean"), false())
  *  returns "gopher://spinaltap.micro.umn.edu/00/Weather/California/Los%20Angeles%23ocean"
  *
  */
 static void
 xmlXPathEscapeUriFunction(xmlXPathParserContextPtr ctxt, int nargs) {
     xmlXPathObjectPtr str;
     int escape_reserved;
-    xmlBufferPtr target;
+    xmlBufPtr target;
     xmlChar *cptr;
     xmlChar escape[4];
 
     CHECK_ARITY(2);
 
     escape_reserved = xmlXPathPopBoolean(ctxt);
 
     CAST_TO_STRING;
     str = valuePop(ctxt);
 
-    target = xmlBufferCreate();
+    target = xmlBufCreate();
 
     escape[0] = '%';
     escape[3] = 0;
 
     if (target) {
         for (cptr = str->stringval; *cptr; cptr++) {
             if ((*cptr >= 'A' && *cptr <= 'Z') ||
                 (*cptr >= 'a' && *cptr <= 'z') ||
                 (*cptr >= '0' && *cptr <= '9') ||
                 *cptr == '-' || *cptr == '_' || *cptr == '.' ||
                 *cptr == '!' || *cptr == '~' || *cptr == '*' ||
                 *cptr == '\''|| *cptr == '(' || *cptr == ')' ||
                 (*cptr == '%' &&
                  ((cptr[1] >= 'A' && cptr[1] <= 'F') ||
                   (cptr[1] >= 'a' && cptr[1] <= 'f') ||
                   (cptr[1] >= '0' && cptr[1] <= '9')) &&
                  ((cptr[2] >= 'A' && cptr[2] <= 'F') ||
                   (cptr[2] >= 'a' && cptr[2] <= 'f') ||
                   (cptr[2] >= '0' && cptr[2] <= '9'))) ||
                 (!escape_reserved &&
                  (*cptr == ';' || *cptr == '/' || *cptr == '?' ||
                   *cptr == ':' || *cptr == '@' || *cptr == '&' ||
                   *cptr == '=' || *cptr == '+' || *cptr == '$' ||
                   *cptr == ','))) {
-                xmlBufferAdd(target, cptr, 1);
+                xmlBufAdd(target, cptr, 1);
             } else {
                 if ((*cptr >> 4) < 10)
                     escape[1] = '0' + (*cptr >> 4);
                 else
                     escape[1] = 'A' - 10 + (*cptr >> 4);
                 if ((*cptr & 0xF) < 10)
                     escape[2] = '0' + (*cptr & 0xF);
                 else
                     escape[2] = 'A' - 10 + (*cptr & 0xF);
 
-                xmlBufferAdd(target, &escape[0], 3);
+                xmlBufAdd(target, &escape[0], 3);
             }
         }
     }
     valuePush(ctxt, xmlXPathCacheNewString(ctxt->context,
-        xmlBufferContent(target)));
-    xmlBufferFree(target);
+        xmlBufContent(target)));
+    xmlBufFree(target);
     xmlXPathReleaseObject(ctxt->context, str);
 }
 
 /**
  * xmlXPathRegisterAllFunctions:
  * @ctxt:  the XPath context
  *
  * Registers all default XPath functions in this context
  */
 void
@@ skipping 55 matching lines @@
                          xmlXPathTranslateFunction);
 
     xmlXPathRegisterFuncNS(ctxt, (const xmlChar *)"escape-uri",
          (const xmlChar *)"http://www.w3.org/2002/08/xquery-functions",
                          xmlXPathEscapeUriFunction);
 }
 
 #endif /* LIBXML_XPATH_ENABLED */
 #define bottom_xpath
 #include "elfgcchack.h"