Commit 91ac664f4b3d3ed55f5ff297f1ddbc7acb425006
2016-04-26T14:47:56
Fix OOB write in xmlXPathEmptyNodeSet xmlXPathEmptyNodeSet would write a NULL pointer just beyond the end of the nodeTab array. This macro isn't used in libxml2, but in some of the math functions in libexslt where it can result in heap corruption and denial of service. Found by afl-fuzz and ASan.