commit e905f08123e4a6e7731549e6f09dadff4cab65bd
author Nick Wellnhofer <wellnhofer@aevum.de> Sun Jun 26 12:38:28 2016 +0200
committer Nick Wellnhofer <wellnhofer@aevum.de> Wed Oct 12 14:00:03 2016 +0200
tree 034373954448be2b0830ac4940f0f34df27edbee
parent 229d1f93ceaa5e29a1e8455e73a7f346993d20b3

Fix more NULL pointer derefs in xpointer.c

Found with afl-fuzz.

xpointer.c

diff --git a/xpointer.c b/xpointer.c
index 694d120..e643ee9 100644
--- a/xpointer.c
+++ b/xpointer.c
@@ -542,7 +542,7 @@
 	    /*
 	     * Empty set ...
 	     */
-	    if (end->nodesetval->nodeNr <= 0)
+	    if ((end->nodesetval == NULL) || (end->nodesetval->nodeNr <= 0))
 		return(NULL);
 	    endNode = end->nodesetval->nodeTab[end->nodesetval->nodeNr - 1];
 	    endIndex = -1;
@@ -1361,7 +1361,7 @@
 		     */
 		    xmlNodeSetPtr set;
 		    set = tmp->nodesetval;
-		    if ((set->nodeNr != 1) ||
+		    if ((set == NULL) || (set->nodeNr != 1) ||
 			(set->nodeTab[0] != (xmlNodePtr) ctx->doc))
 			stack++;
 		} else
@@ -2034,9 +2034,11 @@
 	xmlXPathFreeObject(set);
         XP_ERROR(XPATH_MEMORY_ERROR);
     }
-    for (i = 0;i < oldset->locNr;i++) {
-	xmlXPtrLocationSetAdd(newset,
-		xmlXPtrCoveringRange(ctxt, oldset->locTab[i]));
+    if (oldset != NULL) {
+        for (i = 0;i < oldset->locNr;i++) {
+            xmlXPtrLocationSetAdd(newset,
+                    xmlXPtrCoveringRange(ctxt, oldset->locTab[i]));
+        }
     }
 
     /*