expat-2.2.6

    int      *useNamespaceAxis,
    xpathParseVarCB *varParseCB,
    char    **errMsg
)
{
    int  l, allocated;
    int  i, k, start, offset;
    char delim, *ps, save, tmpErr[80], *tailptr;
    const char *uri;
    XPathTokens tokens;
    int token = EOS;


    tokens = (XPathTokens)MALLOC(INITIAL_SIZE * sizeof(XPathToken));
    if (tokens == NULL) {

                               tokens[l].intvalue = strtol(ps, NULL, 10);
                               if (errno == ERANGE 
                                   && ( tokens[l].intvalue == LONG_MAX 
                                        || tokens[l].intvalue == LONG_MIN)) {
                                   token = REALNUMBER;
                               }
                           }
                           tokens[l].realvalue = strtod(ps, &tailptr);
                           xpath[i--] = save;
                           if (tokens[l].realvalue == 0.0 && tailptr == ps) {
                               sprintf (tmpErr, "Number value too large "
                                        "at position %d", i);
                               *errMsg = tdomstrdup (tmpErr);
                               return tokens;
                           }
                       } else {
                           sprintf (tmpErr, "Unexpected character '%c' at "
                                    "position %d", xpath[i], i);
                           *errMsg = tdomstrdup (tmpErr);
                           return tokens;
                       }
                       break;

                        varParseCB, errMsg);
    if (*errMsg != NULL) {
        if (tokens != NULL) xpathFreeTokens (tokens);
        return XPATH_LEX_ERR;
    }
    DDBG(
        for (i=0; tokens[i].token != EOS; i++) {
            fprintf(stderr, "%3d %-12s %5ld %8.3g %5d  %s\n",
                            i,
                            token2str[tokens[i].token-LPAR],
                            tokens[i].intvalue,
                            tokens[i].realvalue,
                            tokens[i].pos,
                            tokens[i].strvalue
            );

        newlen = strlen(xpath);
        *errMsg = (char*)REALLOC(*errMsg, len+newlen+10);
        memmove(*errMsg + len, " for '", 6);
        memmove(*errMsg + len+6, xpath, newlen);
        memmove(*errMsg + len+6+newlen, "' ", 3);

        for (i=0; tokens[i].token != EOS; i++) {
            sprintf(tmp, "%s\n%3s%3d %-12s %5ld %09.3g %5d  ",
                         (i==0) ? "\n\nParsed symbols:" : "",
                         (i==l) ? "-->" : "   ",
                          i,
                         token2str[tokens[i].token-LPAR],
                         tokens[i].intvalue,
                         tokens[i].realvalue,
                         tokens[i].pos

        case RealResult:
            if (IS_NAN (rs->realvalue)) return tdomstrdup ("NaN");
            else if (IS_INF (rs->realvalue)) {
                if (IS_INF (rs->realvalue) == 1) return tdomstrdup ("Infinity");
                else                             return tdomstrdup ("-Infinity");
            }
            sprintf(tmp, "%g", rs->realvalue);
            /* strip trailing 0 and . */
            len = strlen(tmp);
            for (; (len > 0) && (tmp[len-1] == '0'); len--) tmp[len-1] = '\0';
            if ((len > 0) && (tmp[len-1] == '.'))   tmp[len-1] = '\0';
            return (tdomstrdup(tmp));
            
        case NaNResult:

                rsSetReal (result, dLeft / dRight);
            }
            break;
        case Mod:
            if ((int)dRight == 0) {
                rsSetNaN (result);
            } else {
                if (dRight < LONG_MIN - 0.1
                    || dRight > LONG_MAX + 0.1
                    || dLeft < LONG_MIN - 0.1
                    || dLeft > LONG_MAX + 0.1) {
                    rsSetNaN (result);
                } else {
                    rsSetInt  (result, ((long)dLeft) % ((long)dRight));
                }
            }
            break;
        default:        break;
        }
        xpathRSFree (&rightResult);
        xpathRSFree (&leftResult);
        return XPATH_OK;

    xsltState *xs,
    domNode   *node,
    double     precedence,
    char     **errMsg
)
{
    xsltTemplate  *tpl, *t;
    char          *prioStr, *str, prefix[MAX_PREFIX_LEN], *tailptr;
    const char    *localName;
    int            rc, hnew;
    domNS         *ns;
    Tcl_HashEntry *h;
    Tcl_DString    dStr;
    xsltSubDoc    *sDoc;

    tpl->prio       = 0.5;
    tpl->content    = node;
    tpl->precedence = precedence;
    tpl->next       = NULL;

    prioStr = getAttr(node,"priority", a_prio);
    if (prioStr) {
        tpl->prio = strtod (prioStr, &tailptr);
        if (tpl->prio == 0.0 && prioStr == tailptr) {
            /* If the template has a name attribute, it is already stored in
               in the namedTemplates hash table and will be freed. */
            if (!tpl->name) {
                FREE ((char*)tpl);
            }
            return -1;
        }
    }
    
    sDoc = xs->subDocs;
    while (sDoc) {
        if (sDoc->doc == node->ownerDocument) break;
        sDoc = sDoc->next;
    }
    tpl->sDoc = sDoc;

test xpath-5.1 {erroneous XPath expr: missing right brace in predicate} {
    set result [catch {$root selectNodes {*[1}} errMsg]
    list $result $errMsg
} {1 {Predicate: Expected "RBRACKET" for '*[1' 

Parsed symbols:
     0 WCARDNAME        0 000000000     0  *
     1 LBRACKET         0 000000000     1  
     2 INTNUMBER        1 000000001     2  }}

test xpath-5.2 {erroneous XPath expr: missing right brace in predicate} {
    set result [catch {$root selectNodes {*[1][@attr}} errMsg]
    list $result $errMsg
} {1 {Predicate: Expected "RBRACKET" for '*[1][@attr' 

Parsed symbols:
     0 WCARDNAME        0 000000000     0  *
     1 LBRACKET         0 000000000     1  
     2 INTNUMBER        1 000000001     2  
     3 RBRACKET         0 000000000     3  
     4 LBRACKET         0 000000000     4  
     5 ATTRIBUTE        0 000000000     9  attr}}

test xpath-5.3 {erroneous XPath expr: missing left brace in predicate} {
    catch {$root selectNodes {*1]}}
} {1}

test xpath-5.4 {erroneous XPath expr} {
    catch {$root selectNodes {myNS: bar}} errMsg

    set result [catch {$doc selectNodes {a[b %nodeName='another value']}} errMsg]
    lappend result $errMsg
    $doc delete
    set result
} {1 {Predicate: Expected "RBRACKET" for 'a[b %nodeName='another value']' 

Parsed symbols:
     0 WCARDNAME        0 000000000     0  a
     1 LBRACKET         0 000000000     1  
     2 WCARDNAME        0 000000000     2  b
-->  3 WCARDNAME        1 000000000    12  with spaces
     4 EQUAL            0 000000000    13  
     5 LITERAL          0 000000000    28  another value
     6 RBRACKET         0 000000000    29  }}

test xpath-5.47 {Element name injected with tcl variable} {
    set doc [dom parse -json {{"a":{"":"the value"},"a":{"":"another value"}}}]
    set nodeName ""
    set node [$doc selectNodes {a[%nodeName='another value']}]
    set result [list]
    lappend result [$node nodeName]

    set nodeName1 "a/b"
    set result [list]
    lappend result [$doc selectNodes string(%nodeName0/%nodeName1)]
    lappend result [$doc selectNodes string(a/a/b)]
    $doc delete
    set result
} {a/b b}

test xpath-5.57 {afl-fuzz found seg fault in reporting error in invalid expr} {
    set doc [dom createDocument doc]
    catch {$doc selectNodes /[string repeat 1 2500]}
    catch {$doc selectNodes /[string repeat 1 250]}
    $doc delete
} {}

test xpath-5.58 {afl-fuzz found seg fault in reporting error in invalid expr} {
    set doc [dom createDocument doc]
    catch {$doc selectNodes concat([string repeat 1 250],1,1)}
    $doc delete
} {}

test xpath-5.59 {afl-fuzz found floating point exception in mod calulation} {
    set doc [dom createDocument doc]
    set result [list]
    lappend result [$doc selectNodes "1111111111111 mod -1"]
    lappend result [$doc selectNodes "111111111111111111111111111111111111111 mod -1"]
    $doc delete
    set result
} {0 NaN}

test xpath-5.60 {afl-fuzz found floating point exception in mod calulation} {
    set doc [dom createDocument doc]
    set result [list]
    for {set i 1} {$i < 20} {incr i} {
        for {set j 1} {$j < 20} {incr j} {
            set this [$doc selectNodes "$i mod $j"]
            if {$this != ($i % $j)} {
                lappend result [list $i $j $this [expr "$i % $j"]]
            }
        }
    }
    $doc delete
    set result
} {}

set doc [dom parse {
<root>
  <asub>asub2</asub>
  <asub>asub3</asub>
  <asub>asub4</asub>
  <bsub>bsub1</bsub>

    set result ""
    foreach node [$root selectNodes {bsub|asub}] {
        append result "[$node text] "
    }
    set result
} {asub1 asub2 asub3 asub4 bsub1 bsub2 }

catch {$doc delete}


set doc [dom parse {
<!-- comment 1 -->
<!-- comment 2 -->
<?api pi data?>
<!-- still not the document element -->

    catch {$xmldoc xslt $xsltdoc resultDoc} errMsg
    $xmldoc delete
    $xsltdoc delete
    set errMsg
} {The 'current' function is not allowed in Pattern. for '*[current() != 'notthis']' 

Parsed symbols:
     0 WCARDNAME        0 000000000     0  *
     1 LBRACKET         0 000000000     1  
     2 FUNCTION         0 000000000     8  current
     3 LPAR             0 000000000     9  
     4 RPAR             0 000000000    10  
     5 NOTEQ            0 000000000    13  
     6 LITERAL          0 000000000    23  notthis
     7 RBRACKET         0 000000000    24  }

set xslt-8.2.xml {<?xml version="1.0"?>
<Workbook xmlns="urn:schemas-microsoft-com:office:spreadsheet" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:html="http://www.w3.org/TR/REC-html40">
	<DocumentProperties xmlns="urn:schemas-microsoft-com:office:office">
	</DocumentProperties>
	<OfficeDocumentSettings xmlns="urn:schemas-microsoft-com:office:office">
	</OfficeDocumentSettings>