Fixed a double-free in xmlXPathCompOpEvalToBoolean(), revealed by a
* xpath.c: Fixed a double-free in xmlXPathCompOpEvalToBoolean(),
revealed by a Libxslt regression test.
diff --git a/xpath.c b/xpath.c
index 06d670d..00a2536 100644
--- a/xpath.c
+++ b/xpath.c
@@ -13915,7 +13915,9 @@
return (0);
case XPATH_OP_VALUE:
resObj = (xmlXPathObjectPtr) op->value4;
- break;
+ if (isPredicate)
+ return(xmlXPathEvaluatePredicateResult(ctxt, resObj));
+ return(xmlXPathCastToBoolean(resObj));
case XPATH_OP_SORT:
/*
* We don't need sorting for boolean results. Skip this one.
@@ -13951,7 +13953,7 @@
resObj = valuePop(ctxt);
if (resObj == NULL)
- return(-1);
+ return(-1);
break;
}