Ensure special treatment for namespace nodes (CVE-2012-2871) and fix use-after-free errors (CVE-2012-2870); bug #433603, thanks to Paweł Hajdan, Jr. Fix non-posix comparison in configure; bug #420335, thanks to Richard Yao.

(Portage version: 2.2.0_alpha124/cvs/Linux x86_64)

9 files changed, 1683 insertions, 1 deletions

diff --git a/dev-libs/libxslt/ChangeLog b/dev-libs/libxslt/ChangeLog
index 5ccd8182242e..321bd34b1833 100644
--- a/dev-libs/libxslt/ChangeLog
+++ b/dev-libs/libxslt/ChangeLog
@@ -1,6 +1,21 @@
 # ChangeLog for dev-libs/libxslt
 # Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxslt/ChangeLog,v 1.229 2012/04/26 17:11:48 aballier Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxslt/ChangeLog,v 1.230 2012/09/10 05:24:48 tetromino Exp $
+
+*libxslt-1.1.26-r4 (10 Sep 2012)
+
+  10 Sep 2012; Alexandre Rostovtsev <tetromino@gentoo.org>
+  +files/0002-Hardening-ofcodecheckingnodetypesinvariousentrypoint.patch,
+  +libxslt-1.1.26-r4.ebuild, +files/libxslt-1.1.26-generate-id-crash.patch,
+  +files/libxslt-1.1.26-node-type-1.patch,
+  +files/libxslt-1.1.26-node-type-2.patch,
+  +files/libxslt-1.1.26-node-type-3.patch,
+  +files/libxslt-1.1.26-pattern-compile-crash.patch,
+  +files/libxslt-1.1.26-posix-comparison.patch:
+  Ensure special treatment for namespace nodes (CVE-2012-2871) and fix
+  use-after-free errors (CVE-2012-2870); bug #433603, thanks to Paweł Hajdan,
+  Jr. Fix non-posix comparison in configure; bug #420335, thanks to Richard
+  Yao.
 
   26 Apr 2012; Alexis Ballier <aballier@gentoo.org> libxslt-1.1.26-r3.ebuild:
   keyword ~amd64-fbsd
diff --git a/dev-libs/libxslt/files/0002-Hardening-ofcodecheckingnodetypesinvariousentrypoint.patch b/dev-libs/libxslt/files/0002-Hardening-ofcodecheckingnodetypesinvariousentrypoint.patch
new file mode 100644
index 000000000000..d8081b2b829d
--- /dev/null
+++ b/dev-libs/libxslt/files/0002-Hardening-ofcodecheckingnodetypesinvariousentrypoint.patch
@@ -0,0 +1,590 @@
+From 1564b30e994602a95863d9716be83612580a2fed Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Thu, 9 Aug 2012 16:18:51 +0800
+Subject: [PATCH] Hardening of code checking node types in various entry point
+
+---
+ libxslt/attributes.c |  5 +++--
+ libxslt/preproc.c    | 45 +++++++++++++++++++++++----------------------
+ libxslt/templates.c  | 15 ++++++++++-----
+ libxslt/transform.c  |  2 +-
+ libxslt/variables.c  | 10 +++++-----
+ libxslt/xslt.c       | 43 +++++++++++++++++++++++++------------------
+ libxslt/xsltutils.c  | 27 +++++++++++++++++++--------
+ 7 files changed, 86 insertions(+), 61 deletions(-)
+
+diff --git a/libxslt/attributes.c b/libxslt/attributes.c
+index ce47df7..11d558b 100644
+--- a/libxslt/attributes.c
++++ b/libxslt/attributes.c
+@@ -293,7 +293,7 @@ xsltParseStylesheetAttributeSet(xsltStylesheetPtr style, xmlNodePtr cur) {
+     xmlNodePtr child;
+     xsltAttrElemPtr attrItems;
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     value = xmlGetNsProp(cur, (const xmlChar *)"name", NULL);
+@@ -656,7 +656,8 @@ xsltAttributeInternal(xsltTransformContextPtr ctxt,
+     xmlNsPtr ns = NULL;
+     xmlAttrPtr attr;    
+ 
+-    if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL))
++    if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL) ||
++        (inst->type != XML_ELEMENT_NODE) )
+         return;
+ 
+     /* 
+diff --git a/libxslt/preproc.c b/libxslt/preproc.c
+index f5d265d..4d483ff 100644
+--- a/libxslt/preproc.c
++++ b/libxslt/preproc.c
+@@ -680,7 +680,7 @@ xsltSortComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+ #else
+     xsltStylePreCompPtr comp;
+ #endif
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -788,7 +788,7 @@ xsltCopyComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ #ifdef XSLT_REFACTORED
+     comp = (xsltStyleItemCopyPtr) xsltNewStylePreComp(style, XSLT_FUNC_COPY);
+@@ -832,7 +832,7 @@ xsltTextComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+ #endif
+     const xmlChar *prop;
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -885,7 +885,7 @@ xsltElementComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     *   <!-- Content: template -->
+     * </xsl:element>
+     */
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1002,7 +1002,7 @@ xsltAttributeComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     *   <!-- Content: template -->
+     * </xsl:attribute>
+     */
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1122,7 +1122,7 @@ xsltCommentComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1152,7 +1152,7 @@ xsltProcessingInstructionComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1186,7 +1186,7 @@ xsltCopyOfComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1233,7 +1233,7 @@ xsltValueOfComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+ #endif
+     const xmlChar *prop;
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1358,7 +1358,7 @@ xsltWithParamComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1417,7 +1417,7 @@ xsltNumberComp(xsltStylesheetPtr style, xmlNodePtr cur) {
+ #endif
+     const xmlChar *prop;
+ 
+-    if ((style == NULL) || (cur == NULL))
++    if ((style == NULL) || (cur == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1543,7 +1543,7 @@ xsltApplyImportsComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1573,7 +1573,7 @@ xsltCallTemplateComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1612,7 +1612,7 @@ xsltApplyTemplatesComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1664,7 +1664,7 @@ xsltChooseComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1695,7 +1695,7 @@ xsltIfComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1741,7 +1741,7 @@ xsltWhenComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1787,7 +1787,7 @@ xsltForEachComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1835,7 +1835,7 @@ xsltVariableComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1914,7 +1914,7 @@ xsltParamComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -2006,7 +2006,7 @@ xsltStylePreCompute(xsltStylesheetPtr style, xmlNodePtr node) {
+     *  the parsing mechanism for all elements in the XSLT namespace.
+     */
+     if (style == NULL) {
+-	if (node != NULL)
++	if ((node != NULL) && (node->type == XML_ELEMENT_NODE))
+ 	    node->psvi = NULL;
+ 	return;
+     }
+@@ -2221,7 +2221,8 @@ xsltStylePreCompute(xsltStylesheetPtr style, xmlNodePtr inst) {
+     *   namespace- and local-name of the node, but can evaluate this
+     *   using cctxt->style->inode->category;
+     */
+-    if (inst->psvi != NULL)
++    if ((inst == NULL) || (inst->type != XML_ELEMENT_NODE) ||
++        (inst->psvi != NULL))
+ 	return;
+ 
+     if (IS_XSLT_ELEM(inst)) {
+diff --git a/libxslt/templates.c b/libxslt/templates.c
+index 52bb3cf..169afd9 100644
+--- a/libxslt/templates.c
++++ b/libxslt/templates.c
+@@ -198,7 +198,8 @@ xsltEvalTemplateString(xsltTransformContextPtr ctxt,
+     xmlNodePtr oldInsert, insert = NULL;
+     xmlChar *ret;
+ 
+-    if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL))
++    if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL) ||
++        (inst->type != XML_ELEMENT_NODE))
+ 	return(NULL);
+ 
+     if (inst->children == NULL)
+@@ -390,7 +391,8 @@ xsltEvalAttrValueTemplate(xsltTransformContextPtr ctxt, xmlNodePtr inst,
+     xmlChar *ret;
+     xmlChar *expr;
+ 
+-    if ((ctxt == NULL) || (inst == NULL) || (name == NULL))
++    if ((ctxt == NULL) || (inst == NULL) || (name == NULL) ||
++        (inst->type != XML_ELEMENT_NODE))
+ 	return(NULL);
+ 
+     expr = xsltGetNsProp(inst, name, ns);
+@@ -434,7 +436,8 @@ xsltEvalStaticAttrValueTemplate(xsltStylesheetPtr style, xmlNodePtr inst,
+     const xmlChar *ret;
+     xmlChar *expr;
+ 
+-    if ((style == NULL) || (inst == NULL) || (name == NULL))
++    if ((style == NULL) || (inst == NULL) || (name == NULL) ||
++        (inst->type != XML_ELEMENT_NODE))
+ 	return(NULL);
+ 
+     expr = xsltGetNsProp(inst, name, ns);
+@@ -475,7 +478,8 @@ xsltAttrTemplateProcess(xsltTransformContextPtr ctxt, xmlNodePtr target,
+     const xmlChar *value;
+     xmlAttrPtr ret;
+ 
+-    if ((ctxt == NULL) || (attr == NULL) || (target == NULL))
++    if ((ctxt == NULL) || (attr == NULL) || (target == NULL) ||
++        (target->type != XML_ELEMENT_NODE))
+ 	return(NULL);
+     
+     if (attr->type != XML_ATTRIBUTE_NODE)
+@@ -632,7 +636,8 @@ xsltAttrListTemplateProcess(xsltTransformContextPtr ctxt,
+     const xmlChar *value;
+     xmlChar *valueAVT;
+ 
+-    if ((ctxt == NULL) || (target == NULL) || (attrs == NULL))
++    if ((ctxt == NULL) || (target == NULL) || (attrs == NULL) ||
++        (target->type != XML_ELEMENT_NODE))
+ 	return(NULL);
+ 
+     oldInsert = ctxt->insert;
+diff --git a/libxslt/transform.c b/libxslt/transform.c
+index c6df19e..bc6d851 100644
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -777,7 +777,7 @@ xsltCopyTextString(xsltTransformContextPtr ctxt, xmlNodePtr target,
+ #endif
+ 
+     /*
+-    * Play save and reset the merging mechanism for every new
++    * Play safe and reset the merging mechanism for every new
+     * target node.
+     */
+     if ((target == NULL) || (target->children == NULL)) {
+diff --git a/libxslt/variables.c b/libxslt/variables.c
+index cb0d4b0..2d26872 100644
+--- a/libxslt/variables.c
++++ b/libxslt/variables.c
+@@ -1935,7 +1935,7 @@ xsltParseStylesheetCallerParam(xsltTransformContextPtr ctxt, xmlNodePtr inst)
+                                the instruction itself. */
+     xsltStackElemPtr param = NULL;
+     
+-    if ((ctxt == NULL) || (inst == NULL))
++    if ((ctxt == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return(NULL);
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1994,7 +1994,7 @@ xsltParseGlobalVariable(xsltStylesheetPtr style, xmlNodePtr cur)
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+     
+ #ifdef XSLT_REFACTORED
+@@ -2056,7 +2056,7 @@ xsltParseGlobalParam(xsltStylesheetPtr style, xmlNodePtr cur) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+     
+ #ifdef XSLT_REFACTORED
+@@ -2119,7 +2119,7 @@ xsltParseStylesheetVariable(xsltTransformContextPtr ctxt, xmlNodePtr inst)
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((inst == NULL) || (ctxt == NULL))
++    if ((inst == NULL) || (ctxt == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     comp = inst->psvi;
+@@ -2161,7 +2161,7 @@ xsltParseStylesheetParam(xsltTransformContextPtr ctxt, xmlNodePtr cur)
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((cur == NULL) || (ctxt == NULL))
++    if ((cur == NULL) || (ctxt == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     comp = cur->psvi;
+diff --git a/libxslt/xslt.c b/libxslt/xslt.c
+index 6293bb3..2bc8af5 100644
+--- a/libxslt/xslt.c
++++ b/libxslt/xslt.c
+@@ -1162,9 +1162,9 @@ xsltParseStylesheetOutput(xsltStylesheetPtr style, xmlNodePtr cur)
+     xmlChar *element,
+      *end;
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+         return;
+-   
++
+     prop = xmlGetNsProp(cur, (const xmlChar *) "version", NULL);
+     if (prop != NULL) {
+         if (style->version != NULL)
+@@ -1377,12 +1377,12 @@ xsltParseStylesheetDecimalFormat(xsltStylesheetPtr style, xmlNodePtr cur)
+     xmlChar *prop;
+     xsltDecimalFormatPtr format;
+     xsltDecimalFormatPtr iter;
+-    
+-    if ((cur == NULL) || (style == NULL))
++
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     format = style->decimalFormat;
+-    
++
+     prop = xmlGetNsProp(cur, BAD_CAST("name"), NULL);
+     if (prop != NULL) {
+ 	format = xsltDecimalFormatGetByName(style, prop);
+@@ -1484,7 +1484,7 @@ xsltParseStylesheetPreserveSpace(xsltStylesheetPtr style, xmlNodePtr cur) {
+     xmlChar *elements;
+     xmlChar *element, *end;
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     elements = xmlGetNsProp(cur, (const xmlChar *)"elements", NULL);
+@@ -1558,7 +1558,7 @@ xsltParseStylesheetExtPrefix(xsltStylesheetPtr style, xmlNodePtr cur,
+     xmlChar *prefixes;
+     xmlChar *prefix, *end;
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     if (isXsltElem) {
+@@ -1623,7 +1623,7 @@ xsltParseStylesheetStripSpace(xsltStylesheetPtr style, xmlNodePtr cur) {
+     xmlChar *elements;
+     xmlChar *element, *end;
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     elements = xmlGetNsProp(cur, (const xmlChar *)"elements", NULL);
+@@ -1696,7 +1696,7 @@ xsltParseStylesheetExcludePrefix(xsltStylesheetPtr style, xmlNodePtr cur,
+     xmlChar *prefixes;
+     xmlChar *prefix, *end;
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return(0);
+ 
+     if (isXsltElem)
+@@ -4287,7 +4287,7 @@ static int
+ xsltParseUnknownXSLTElem(xsltCompilerCtxtPtr cctxt,
+ 			    xmlNodePtr node)
+ {
+-    if ((cctxt == NULL) || (node == NULL))
++    if ((cctxt == NULL) || (node == NULL) || (node->type != XML_ELEMENT_NODE))
+ 	return(-1);
+ 
+     /*
+@@ -4384,7 +4384,7 @@ xsltParseSequenceConstructor(xsltCompilerCtxtPtr cctxt, xmlNodePtr cur)
+     if (cctxt->inode->category == XSLT_ELEMENT_CATEGORY_EXTENSION) {
+ 	cctxt->inode->extContentHandled = 1;
+     }
+-    if (cur == NULL)
++    if ((cur == NULL) || (cur->type == XML_NAMESPACE_DECL))
+ 	return;
+     /*
+     * This is the content reffered to as a "template".
+@@ -4789,7 +4789,8 @@ xsltParseSequenceConstructor(xsltCompilerCtxtPtr cctxt, xmlNodePtr cur)
+  */
+ void
+ xsltParseTemplateContent(xsltStylesheetPtr style, xmlNodePtr templ) {
+-    if ((style == NULL) || (templ == NULL))
++    if ((style == NULL) || (templ == NULL) ||
++        (templ->type == XML_NAMESPACE_DECL))
+ 	return;
+ 
+     /*
+@@ -4838,6 +4839,10 @@ xsltParseTemplateContent(xsltStylesheetPtr style, xmlNodePtr templ) {
+ void
+ xsltParseTemplateContent(xsltStylesheetPtr style, xmlNodePtr templ) {
+     xmlNodePtr cur, delete;
++
++    if ((style == NULL) || (templ == NULL) ||
++        (templ->type == XML_NAMESPACE_DECL)) return;
++
+     /*
+      * This content comes from the stylesheet
+      * For stylesheets, the set of whitespace-preserving
+@@ -5057,7 +5062,7 @@ xsltParseStylesheetKey(xsltStylesheetPtr style, xmlNodePtr key) {
+     xmlChar *name = NULL;
+     xmlChar *nameURI = NULL;
+ 
+-    if ((style == NULL) || (key == NULL))
++    if ((style == NULL) || (key == NULL) || (key->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     /*
+@@ -5147,7 +5152,8 @@ xsltParseXSLTTemplate(xsltCompilerCtxtPtr cctxt, xmlNodePtr templNode) {
+     xmlChar *prop;    
+     double  priority;    
+ 
+-    if ((cctxt == NULL) || (templNode == NULL))
++    if ((cctxt == NULL) || (templNode == NULL) ||
++        (templNode->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     /*
+@@ -5308,7 +5314,8 @@ xsltParseStylesheetTemplate(xsltStylesheetPtr style, xmlNodePtr template) {
+     xmlChar *modeURI = NULL;
+     double  priority;
+ 
+-    if (template == NULL)
++    if ((style == NULL) || (template == NULL) ||
++        (template->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     /*
+@@ -5440,7 +5447,7 @@ static xsltStyleItemIncludePtr
+ xsltCompileXSLTIncludeElem(xsltCompilerCtxtPtr cctxt, xmlNodePtr node) {
+     xsltStyleItemIncludePtr item;
+ 
+-    if ((cctxt == NULL) || (node == NULL))
++    if ((cctxt == NULL) || (node == NULL) || (node->type != XML_ELEMENT_NODE))
+ 	return(NULL);
+ 
+     node->psvi = NULL;
+@@ -5960,7 +5967,7 @@ xsltParseXSLTStylesheetElem(xsltCompilerCtxtPtr cctxt, xmlNodePtr node)
+ {
+     xmlNodePtr cur, start;
+ 
+-    if ((cctxt == NULL) || (node == NULL))
++    if ((cctxt == NULL) || (node == NULL) || (node->type != XML_ELEMENT_NODE))
+ 	return(-1);
+     
+     if (node->children == NULL)
+@@ -6048,7 +6055,7 @@ xsltParseStylesheetTop(xsltStylesheetPtr style, xmlNodePtr top) {
+     int templates = 0;
+ #endif
+ 
+-    if (top == NULL)
++    if ((top == NULL) || (top->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     prop = xmlGetNsProp(top, (const xmlChar *)"version", NULL);
+diff --git a/libxslt/xsltutils.c b/libxslt/xsltutils.c
+index 7a4caf0..6a0e8f2 100644
+--- a/libxslt/xsltutils.c
++++ b/libxslt/xsltutils.c
+@@ -91,10 +91,15 @@ xsltGetCNsProp(xsltStylesheetPtr style, xmlNodePtr node,
+     if ((node == NULL) || (style == NULL) || (style->dict == NULL))
+ 	return(NULL);
+ 
+-    prop = node->properties;
+-    if (nameSpace == NULL) {
++    if (nameSpace == NULL)
+         return xmlGetProp(node, name);
+-    }
++
++    if (node->type == XML_NAMESPACE_DECL)
++        return(NULL);
++    if (node->type == XML_ELEMENT_NODE)
++	prop = node->properties;
++    else
++	prop = NULL;
+     while (prop != NULL) {
+ 	/*
+ 	 * One need to have
+@@ -131,7 +136,7 @@ xsltGetCNsProp(xsltStylesheetPtr style, xmlNodePtr node,
+ 	    attrDecl = xmlGetDtdAttrDesc(doc->intSubset, node->name, name);
+ 	    if ((attrDecl == NULL) && (doc->extSubset != NULL))
+ 		attrDecl = xmlGetDtdAttrDesc(doc->extSubset, node->name, name);
+-		
++
+ 	    if ((attrDecl != NULL) && (attrDecl->prefix != NULL)) {
+ 	        /*
+ 		 * The DTD declaration only allows a prefix search
+@@ -173,7 +178,15 @@ xsltGetNsProp(xmlNodePtr node, const xmlChar *name, const xmlChar *nameSpace) {
+     if (node == NULL)
+ 	return(NULL);
+ 
+-    prop = node->properties;
++    if (nameSpace == NULL)
++        return xmlGetProp(node, name);
++
++    if (node->type == XML_NAMESPACE_DECL)
++        return(NULL);
++    if (node->type == XML_ELEMENT_NODE)
++	prop = node->properties;
++    else
++	prop = NULL;
+     /*
+     * TODO: Substitute xmlGetProp() for xmlGetNsProp(), since the former
+     * is not namespace-aware and will return an attribute with equal
+@@ -183,8 +196,6 @@ xsltGetNsProp(xmlNodePtr node, const xmlChar *name, const xmlChar *nameSpace) {
+     *   So this would return "myName" even if an attribute @name
+     *   in the XSLT was requested.
+     */
+-    if (nameSpace == NULL)
+-	return(xmlGetProp(node, name));
+     while (prop != NULL) {
+ 	/*
+ 	 * One need to have
+@@ -217,7 +228,7 @@ xsltGetNsProp(xmlNodePtr node, const xmlChar *name, const xmlChar *nameSpace) {
+ 	    attrDecl = xmlGetDtdAttrDesc(doc->intSubset, node->name, name);
+ 	    if ((attrDecl == NULL) && (doc->extSubset != NULL))
+ 		attrDecl = xmlGetDtdAttrDesc(doc->extSubset, node->name, name);
+-		
++
+ 	    if ((attrDecl != NULL) && (attrDecl->prefix != NULL)) {
+ 	        /*
+ 		 * The DTD declaration only allows a prefix search
+-- 
+1.7.12
+
diff --git a/dev-libs/libxslt/files/libxslt-1.1.26-generate-id-crash.patch b/dev-libs/libxslt/files/libxslt-1.1.26-generate-id-crash.patch
new file mode 100644
index 000000000000..c0882e20ddc4
--- /dev/null
+++ b/dev-libs/libxslt/files/libxslt-1.1.26-generate-id-crash.patch
@@ -0,0 +1,51 @@
+From 4da0f7e207f14a03daad4663865c285eb27f93e9 Mon Sep 17 00:00:00 2001
+From: Chris Evans <cevans@chromium.org>
+Date: Mon, 3 Sep 2012 18:16:44 +0800
+Subject: [PATCH] Avoid a heap use after free error
+
+For https://code.google.com/p/chromium/issues/detail?id=140368
+---
+ libxslt/functions.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/libxslt/functions.c b/libxslt/functions.c
+index 5a8eb79..fe2f1ca 100644
+--- a/libxslt/functions.c
++++ b/libxslt/functions.c
+@@ -660,6 +660,7 @@ xsltFormatNumberFunction(xmlXPathParserContextPtr ctxt, int nargs)
+ void
+ xsltGenerateIdFunction(xmlXPathParserContextPtr ctxt, int nargs){
+     xmlNodePtr cur = NULL;
++    xmlXPathObjectPtr obj = NULL;
+     long val;
+     xmlChar str[30];
+     xmlDocPtr doc;
+@@ -667,7 +668,6 @@ xsltGenerateIdFunction(xmlXPathParserContextPtr ctxt, int nargs){
+     if (nargs == 0) {
+ 	cur = ctxt->context->node;
+     } else if (nargs == 1) {
+-	xmlXPathObjectPtr obj;
+ 	xmlNodeSetPtr nodelist;
+ 	int i, ret;
+ 
+@@ -690,7 +690,6 @@ xsltGenerateIdFunction(xmlXPathParserContextPtr ctxt, int nargs){
+ 	    if (ret == -1)
+ 	        cur = nodelist->nodeTab[i];
+ 	}
+-	xmlXPathFreeObject(obj);
+     } else {
+ 	xsltTransformError(xsltXPathGetTransformContext(ctxt), NULL, NULL,
+ 		"generate-id() : invalid number of args %d\n", nargs);
+@@ -713,6 +712,9 @@ xsltGenerateIdFunction(xmlXPathParserContextPtr ctxt, int nargs){
+ 
+     }
+ 
++    if (obj)
++        xmlXPathFreeObject(obj);
++
+     val = (long)((char *)cur - (char *)doc);
+     if (val >= 0) {
+       sprintf((char *)str, "idp%ld", val);
+-- 
+1.7.12
+
diff --git a/dev-libs/libxslt/files/libxslt-1.1.26-node-type-1.patch b/dev-libs/libxslt/files/libxslt-1.1.26-node-type-1.patch
new file mode 100644
index 000000000000..c20770c4fc91
--- /dev/null
+++ b/dev-libs/libxslt/files/libxslt-1.1.26-node-type-1.patch
@@ -0,0 +1,37 @@
+From 937ba2a3eb42d288f53c8adc211bd1122869f0bf Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Wed, 8 Aug 2012 15:31:05 +0800
+Subject: [PATCH] Fix default template processing on namespace nodes
+
+---
+ libxslt/transform.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/libxslt/transform.c b/libxslt/transform.c
+index 53eefcc..c6df19e 100644
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -4895,7 +4895,10 @@ xsltApplyTemplates(xsltTransformContextPtr ctxt, xmlNodePtr node,
+ 	list = xmlXPathNodeSetCreate(NULL);
+ 	if (list == NULL)
+ 	    goto error;
+-	cur = node->children;
++	if (node->type != XML_NAMESPACE_DECL)
++	    cur = node->children;
++	else
++	    cur = NULL;
+ 	while (cur != NULL) {
+ 	    switch (cur->type) {
+ 		case XML_TEXT_NODE:
+@@ -4944,6 +4947,8 @@ xsltApplyTemplates(xsltTransformContextPtr ctxt, xmlNodePtr node,
+ 		    if (cur->prev != NULL)
+ 			cur->prev->next = cur->next;
+ 		    break;
++		case XML_NAMESPACE_DECL:
++		    break;
+ 		default:
+ #ifdef WITH_XSLT_DEBUG_PROCESS
+ 		    XSLT_TRACE(ctxt,XSLT_TRACE_APPLY_TEMPLATES,xsltGenericDebug(xsltGenericDebugContext,
+-- 
+1.7.12
+
diff --git a/dev-libs/libxslt/files/libxslt-1.1.26-node-type-2.patch b/dev-libs/libxslt/files/libxslt-1.1.26-node-type-2.patch
new file mode 100644
index 000000000000..d8081b2b829d
--- /dev/null
+++ b/dev-libs/libxslt/files/libxslt-1.1.26-node-type-2.patch
@@ -0,0 +1,590 @@
+From 1564b30e994602a95863d9716be83612580a2fed Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Thu, 9 Aug 2012 16:18:51 +0800
+Subject: [PATCH] Hardening of code checking node types in various entry point
+
+---
+ libxslt/attributes.c |  5 +++--
+ libxslt/preproc.c    | 45 +++++++++++++++++++++++----------------------
+ libxslt/templates.c  | 15 ++++++++++-----
+ libxslt/transform.c  |  2 +-
+ libxslt/variables.c  | 10 +++++-----
+ libxslt/xslt.c       | 43 +++++++++++++++++++++++++------------------
+ libxslt/xsltutils.c  | 27 +++++++++++++++++++--------
+ 7 files changed, 86 insertions(+), 61 deletions(-)
+
+diff --git a/libxslt/attributes.c b/libxslt/attributes.c
+index ce47df7..11d558b 100644
+--- a/libxslt/attributes.c
++++ b/libxslt/attributes.c
+@@ -293,7 +293,7 @@ xsltParseStylesheetAttributeSet(xsltStylesheetPtr style, xmlNodePtr cur) {
+     xmlNodePtr child;
+     xsltAttrElemPtr attrItems;
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     value = xmlGetNsProp(cur, (const xmlChar *)"name", NULL);
+@@ -656,7 +656,8 @@ xsltAttributeInternal(xsltTransformContextPtr ctxt,
+     xmlNsPtr ns = NULL;
+     xmlAttrPtr attr;    
+ 
+-    if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL))
++    if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL) ||
++        (inst->type != XML_ELEMENT_NODE) )
+         return;
+ 
+     /* 
+diff --git a/libxslt/preproc.c b/libxslt/preproc.c
+index f5d265d..4d483ff 100644
+--- a/libxslt/preproc.c
++++ b/libxslt/preproc.c
+@@ -680,7 +680,7 @@ xsltSortComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+ #else
+     xsltStylePreCompPtr comp;
+ #endif
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -788,7 +788,7 @@ xsltCopyComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ #ifdef XSLT_REFACTORED
+     comp = (xsltStyleItemCopyPtr) xsltNewStylePreComp(style, XSLT_FUNC_COPY);
+@@ -832,7 +832,7 @@ xsltTextComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+ #endif
+     const xmlChar *prop;
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -885,7 +885,7 @@ xsltElementComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     *   <!-- Content: template -->
+     * </xsl:element>
+     */
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1002,7 +1002,7 @@ xsltAttributeComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     *   <!-- Content: template -->
+     * </xsl:attribute>
+     */
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1122,7 +1122,7 @@ xsltCommentComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1152,7 +1152,7 @@ xsltProcessingInstructionComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1186,7 +1186,7 @@ xsltCopyOfComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1233,7 +1233,7 @@ xsltValueOfComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+ #endif
+     const xmlChar *prop;
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1358,7 +1358,7 @@ xsltWithParamComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1417,7 +1417,7 @@ xsltNumberComp(xsltStylesheetPtr style, xmlNodePtr cur) {
+ #endif
+     const xmlChar *prop;
+ 
+-    if ((style == NULL) || (cur == NULL))
++    if ((style == NULL) || (cur == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1543,7 +1543,7 @@ xsltApplyImportsComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1573,7 +1573,7 @@ xsltCallTemplateComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1612,7 +1612,7 @@ xsltApplyTemplatesComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1664,7 +1664,7 @@ xsltChooseComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1695,7 +1695,7 @@ xsltIfComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1741,7 +1741,7 @@ xsltWhenComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1787,7 +1787,7 @@ xsltForEachComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1835,7 +1835,7 @@ xsltVariableComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1914,7 +1914,7 @@ xsltParamComp(xsltStylesheetPtr style, xmlNodePtr inst) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+ #ifdef XSLT_REFACTORED
+@@ -2006,7 +2006,7 @@ xsltStylePreCompute(xsltStylesheetPtr style, xmlNodePtr node) {
+     *  the parsing mechanism for all elements in the XSLT namespace.
+     */
+     if (style == NULL) {
+-	if (node != NULL)
++	if ((node != NULL) && (node->type == XML_ELEMENT_NODE))
+ 	    node->psvi = NULL;
+ 	return;
+     }
+@@ -2221,7 +2221,8 @@ xsltStylePreCompute(xsltStylesheetPtr style, xmlNodePtr inst) {
+     *   namespace- and local-name of the node, but can evaluate this
+     *   using cctxt->style->inode->category;
+     */
+-    if (inst->psvi != NULL)
++    if ((inst == NULL) || (inst->type != XML_ELEMENT_NODE) ||
++        (inst->psvi != NULL))
+ 	return;
+ 
+     if (IS_XSLT_ELEM(inst)) {
+diff --git a/libxslt/templates.c b/libxslt/templates.c
+index 52bb3cf..169afd9 100644
+--- a/libxslt/templates.c
++++ b/libxslt/templates.c
+@@ -198,7 +198,8 @@ xsltEvalTemplateString(xsltTransformContextPtr ctxt,
+     xmlNodePtr oldInsert, insert = NULL;
+     xmlChar *ret;
+ 
+-    if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL))
++    if ((ctxt == NULL) || (contextNode == NULL) || (inst == NULL) ||
++        (inst->type != XML_ELEMENT_NODE))
+ 	return(NULL);
+ 
+     if (inst->children == NULL)
+@@ -390,7 +391,8 @@ xsltEvalAttrValueTemplate(xsltTransformContextPtr ctxt, xmlNodePtr inst,
+     xmlChar *ret;
+     xmlChar *expr;
+ 
+-    if ((ctxt == NULL) || (inst == NULL) || (name == NULL))
++    if ((ctxt == NULL) || (inst == NULL) || (name == NULL) ||
++        (inst->type != XML_ELEMENT_NODE))
+ 	return(NULL);
+ 
+     expr = xsltGetNsProp(inst, name, ns);
+@@ -434,7 +436,8 @@ xsltEvalStaticAttrValueTemplate(xsltStylesheetPtr style, xmlNodePtr inst,
+     const xmlChar *ret;
+     xmlChar *expr;
+ 
+-    if ((style == NULL) || (inst == NULL) || (name == NULL))
++    if ((style == NULL) || (inst == NULL) || (name == NULL) ||
++        (inst->type != XML_ELEMENT_NODE))
+ 	return(NULL);
+ 
+     expr = xsltGetNsProp(inst, name, ns);
+@@ -475,7 +478,8 @@ xsltAttrTemplateProcess(xsltTransformContextPtr ctxt, xmlNodePtr target,
+     const xmlChar *value;
+     xmlAttrPtr ret;
+ 
+-    if ((ctxt == NULL) || (attr == NULL) || (target == NULL))
++    if ((ctxt == NULL) || (attr == NULL) || (target == NULL) ||
++        (target->type != XML_ELEMENT_NODE))
+ 	return(NULL);
+     
+     if (attr->type != XML_ATTRIBUTE_NODE)
+@@ -632,7 +636,8 @@ xsltAttrListTemplateProcess(xsltTransformContextPtr ctxt,
+     const xmlChar *value;
+     xmlChar *valueAVT;
+ 
+-    if ((ctxt == NULL) || (target == NULL) || (attrs == NULL))
++    if ((ctxt == NULL) || (target == NULL) || (attrs == NULL) ||
++        (target->type != XML_ELEMENT_NODE))
+ 	return(NULL);
+ 
+     oldInsert = ctxt->insert;
+diff --git a/libxslt/transform.c b/libxslt/transform.c
+index c6df19e..bc6d851 100644
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -777,7 +777,7 @@ xsltCopyTextString(xsltTransformContextPtr ctxt, xmlNodePtr target,
+ #endif
+ 
+     /*
+-    * Play save and reset the merging mechanism for every new
++    * Play safe and reset the merging mechanism for every new
+     * target node.
+     */
+     if ((target == NULL) || (target->children == NULL)) {
+diff --git a/libxslt/variables.c b/libxslt/variables.c
+index cb0d4b0..2d26872 100644
+--- a/libxslt/variables.c
++++ b/libxslt/variables.c
+@@ -1935,7 +1935,7 @@ xsltParseStylesheetCallerParam(xsltTransformContextPtr ctxt, xmlNodePtr inst)
+                                the instruction itself. */
+     xsltStackElemPtr param = NULL;
+     
+-    if ((ctxt == NULL) || (inst == NULL))
++    if ((ctxt == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return(NULL);
+ 
+ #ifdef XSLT_REFACTORED
+@@ -1994,7 +1994,7 @@ xsltParseGlobalVariable(xsltStylesheetPtr style, xmlNodePtr cur)
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+     
+ #ifdef XSLT_REFACTORED
+@@ -2056,7 +2056,7 @@ xsltParseGlobalParam(xsltStylesheetPtr style, xmlNodePtr cur) {
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+     
+ #ifdef XSLT_REFACTORED
+@@ -2119,7 +2119,7 @@ xsltParseStylesheetVariable(xsltTransformContextPtr ctxt, xmlNodePtr inst)
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((inst == NULL) || (ctxt == NULL))
++    if ((inst == NULL) || (ctxt == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     comp = inst->psvi;
+@@ -2161,7 +2161,7 @@ xsltParseStylesheetParam(xsltTransformContextPtr ctxt, xmlNodePtr cur)
+     xsltStylePreCompPtr comp;
+ #endif
+ 
+-    if ((cur == NULL) || (ctxt == NULL))
++    if ((cur == NULL) || (ctxt == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     comp = cur->psvi;
+diff --git a/libxslt/xslt.c b/libxslt/xslt.c
+index 6293bb3..2bc8af5 100644
+--- a/libxslt/xslt.c
++++ b/libxslt/xslt.c
+@@ -1162,9 +1162,9 @@ xsltParseStylesheetOutput(xsltStylesheetPtr style, xmlNodePtr cur)
+     xmlChar *element,
+      *end;
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+         return;
+-   
++
+     prop = xmlGetNsProp(cur, (const xmlChar *) "version", NULL);
+     if (prop != NULL) {
+         if (style->version != NULL)
+@@ -1377,12 +1377,12 @@ xsltParseStylesheetDecimalFormat(xsltStylesheetPtr style, xmlNodePtr cur)
+     xmlChar *prop;
+     xsltDecimalFormatPtr format;
+     xsltDecimalFormatPtr iter;
+-    
+-    if ((cur == NULL) || (style == NULL))
++
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     format = style->decimalFormat;
+-    
++
+     prop = xmlGetNsProp(cur, BAD_CAST("name"), NULL);
+     if (prop != NULL) {
+ 	format = xsltDecimalFormatGetByName(style, prop);
+@@ -1484,7 +1484,7 @@ xsltParseStylesheetPreserveSpace(xsltStylesheetPtr style, xmlNodePtr cur) {
+     xmlChar *elements;
+     xmlChar *element, *end;
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     elements = xmlGetNsProp(cur, (const xmlChar *)"elements", NULL);
+@@ -1558,7 +1558,7 @@ xsltParseStylesheetExtPrefix(xsltStylesheetPtr style, xmlNodePtr cur,
+     xmlChar *prefixes;
+     xmlChar *prefix, *end;
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     if (isXsltElem) {
+@@ -1623,7 +1623,7 @@ xsltParseStylesheetStripSpace(xsltStylesheetPtr style, xmlNodePtr cur) {
+     xmlChar *elements;
+     xmlChar *element, *end;
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     elements = xmlGetNsProp(cur, (const xmlChar *)"elements", NULL);
+@@ -1696,7 +1696,7 @@ xsltParseStylesheetExcludePrefix(xsltStylesheetPtr style, xmlNodePtr cur,
+     xmlChar *prefixes;
+     xmlChar *prefix, *end;
+ 
+-    if ((cur == NULL) || (style == NULL))
++    if ((cur == NULL) || (style == NULL) || (cur->type != XML_ELEMENT_NODE))
+ 	return(0);
+ 
+     if (isXsltElem)
+@@ -4287,7 +4287,7 @@ static int
+ xsltParseUnknownXSLTElem(xsltCompilerCtxtPtr cctxt,
+ 			    xmlNodePtr node)
+ {
+-    if ((cctxt == NULL) || (node == NULL))
++    if ((cctxt == NULL) || (node == NULL) || (node->type != XML_ELEMENT_NODE))
+ 	return(-1);
+ 
+     /*
+@@ -4384,7 +4384,7 @@ xsltParseSequenceConstructor(xsltCompilerCtxtPtr cctxt, xmlNodePtr cur)
+     if (cctxt->inode->category == XSLT_ELEMENT_CATEGORY_EXTENSION) {
+ 	cctxt->inode->extContentHandled = 1;
+     }
+-    if (cur == NULL)
++    if ((cur == NULL) || (cur->type == XML_NAMESPACE_DECL))
+ 	return;
+     /*
+     * This is the content reffered to as a "template".
+@@ -4789,7 +4789,8 @@ xsltParseSequenceConstructor(xsltCompilerCtxtPtr cctxt, xmlNodePtr cur)
+  */
+ void
+ xsltParseTemplateContent(xsltStylesheetPtr style, xmlNodePtr templ) {
+-    if ((style == NULL) || (templ == NULL))
++    if ((style == NULL) || (templ == NULL) ||
++        (templ->type == XML_NAMESPACE_DECL))
+ 	return;
+ 
+     /*
+@@ -4838,6 +4839,10 @@ xsltParseTemplateContent(xsltStylesheetPtr style, xmlNodePtr templ) {
+ void
+ xsltParseTemplateContent(xsltStylesheetPtr style, xmlNodePtr templ) {
+     xmlNodePtr cur, delete;
++
++    if ((style == NULL) || (templ == NULL) ||
++        (templ->type == XML_NAMESPACE_DECL)) return;
++
+     /*
+      * This content comes from the stylesheet
+      * For stylesheets, the set of whitespace-preserving
+@@ -5057,7 +5062,7 @@ xsltParseStylesheetKey(xsltStylesheetPtr style, xmlNodePtr key) {
+     xmlChar *name = NULL;
+     xmlChar *nameURI = NULL;
+ 
+-    if ((style == NULL) || (key == NULL))
++    if ((style == NULL) || (key == NULL) || (key->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     /*
+@@ -5147,7 +5152,8 @@ xsltParseXSLTTemplate(xsltCompilerCtxtPtr cctxt, xmlNodePtr templNode) {
+     xmlChar *prop;    
+     double  priority;    
+ 
+-    if ((cctxt == NULL) || (templNode == NULL))
++    if ((cctxt == NULL) || (templNode == NULL) ||
++        (templNode->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     /*
+@@ -5308,7 +5314,8 @@ xsltParseStylesheetTemplate(xsltStylesheetPtr style, xmlNodePtr template) {
+     xmlChar *modeURI = NULL;
+     double  priority;
+ 
+-    if (template == NULL)
++    if ((style == NULL) || (template == NULL) ||
++        (template->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     /*
+@@ -5440,7 +5447,7 @@ static xsltStyleItemIncludePtr
+ xsltCompileXSLTIncludeElem(xsltCompilerCtxtPtr cctxt, xmlNodePtr node) {
+     xsltStyleItemIncludePtr item;
+ 
+-    if ((cctxt == NULL) || (node == NULL))
++    if ((cctxt == NULL) || (node == NULL) || (node->type != XML_ELEMENT_NODE))
+ 	return(NULL);
+ 
+     node->psvi = NULL;
+@@ -5960,7 +5967,7 @@ xsltParseXSLTStylesheetElem(xsltCompilerCtxtPtr cctxt, xmlNodePtr node)
+ {
+     xmlNodePtr cur, start;
+ 
+-    if ((cctxt == NULL) || (node == NULL))
++    if ((cctxt == NULL) || (node == NULL) || (node->type != XML_ELEMENT_NODE))
+ 	return(-1);
+     
+     if (node->children == NULL)
+@@ -6048,7 +6055,7 @@ xsltParseStylesheetTop(xsltStylesheetPtr style, xmlNodePtr top) {
+     int templates = 0;
+ #endif
+ 
+-    if (top == NULL)
++    if ((top == NULL) || (top->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+     prop = xmlGetNsProp(top, (const xmlChar *)"version", NULL);
+diff --git a/libxslt/xsltutils.c b/libxslt/xsltutils.c
+index 7a4caf0..6a0e8f2 100644
+--- a/libxslt/xsltutils.c
++++ b/libxslt/xsltutils.c
+@@ -91,10 +91,15 @@ xsltGetCNsProp(xsltStylesheetPtr style, xmlNodePtr node,
+     if ((node == NULL) || (style == NULL) || (style->dict == NULL))
+ 	return(NULL);
+ 
+-    prop = node->properties;
+-    if (nameSpace == NULL) {
++    if (nameSpace == NULL)
+         return xmlGetProp(node, name);
+-    }
++
++    if (node->type == XML_NAMESPACE_DECL)
++        return(NULL);
++    if (node->type == XML_ELEMENT_NODE)
++	prop = node->properties;
++    else
++	prop = NULL;
+     while (prop != NULL) {
+ 	/*
+ 	 * One need to have
+@@ -131,7 +136,7 @@ xsltGetCNsProp(xsltStylesheetPtr style, xmlNodePtr node,
+ 	    attrDecl = xmlGetDtdAttrDesc(doc->intSubset, node->name, name);
+ 	    if ((attrDecl == NULL) && (doc->extSubset != NULL))
+ 		attrDecl = xmlGetDtdAttrDesc(doc->extSubset, node->name, name);
+-		
++
+ 	    if ((attrDecl != NULL) && (attrDecl->prefix != NULL)) {
+ 	        /*
+ 		 * The DTD declaration only allows a prefix search
+@@ -173,7 +178,15 @@ xsltGetNsProp(xmlNodePtr node, const xmlChar *name, const xmlChar *nameSpace) {
+     if (node == NULL)
+ 	return(NULL);
+ 
+-    prop = node->properties;
++    if (nameSpace == NULL)
++        return xmlGetProp(node, name);
++
++    if (node->type == XML_NAMESPACE_DECL)
++        return(NULL);
++    if (node->type == XML_ELEMENT_NODE)
++	prop = node->properties;
++    else
++	prop = NULL;
+     /*
+     * TODO: Substitute xmlGetProp() for xmlGetNsProp(), since the former
+     * is not namespace-aware and will return an attribute with equal
+@@ -183,8 +196,6 @@ xsltGetNsProp(xmlNodePtr node, const xmlChar *name, const xmlChar *nameSpace) {
+     *   So this would return "myName" even if an attribute @name
+     *   in the XSLT was requested.
+     */
+-    if (nameSpace == NULL)
+-	return(xmlGetProp(node, name));
+     while (prop != NULL) {
+ 	/*
+ 	 * One need to have
+@@ -217,7 +228,7 @@ xsltGetNsProp(xmlNodePtr node, const xmlChar *name, const xmlChar *nameSpace) {
+ 	    attrDecl = xmlGetDtdAttrDesc(doc->intSubset, node->name, name);
+ 	    if ((attrDecl == NULL) && (doc->extSubset != NULL))
+ 		attrDecl = xmlGetDtdAttrDesc(doc->extSubset, node->name, name);
+-		
++
+ 	    if ((attrDecl != NULL) && (attrDecl->prefix != NULL)) {
+ 	        /*
+ 		 * The DTD declaration only allows a prefix search
+-- 
+1.7.12
+
diff --git a/dev-libs/libxslt/files/libxslt-1.1.26-node-type-3.patch b/dev-libs/libxslt/files/libxslt-1.1.26-node-type-3.patch
new file mode 100644
index 000000000000..9f8cd118db0f
--- /dev/null
+++ b/dev-libs/libxslt/files/libxslt-1.1.26-node-type-3.patch
@@ -0,0 +1,38 @@
+From 24653072221e76d2f1f06aa71225229b532f8946 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Thu, 16 Aug 2012 15:51:35 +0800
+Subject: [PATCH] Hardening of code checking node types in EXSLT
+
+---
+ libexslt/functions.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/libexslt/functions.c b/libexslt/functions.c
+index 13fd06e..4c68cea 100644
+--- a/libexslt/functions.c
++++ b/libexslt/functions.c
+@@ -459,10 +459,9 @@ exsltFuncFunctionComp (xsltStylesheetPtr style, xmlNodePtr inst) {
+     xmlHashTablePtr data;
+     exsltFuncFunctionData *func;
+ 
+-    if ((style == NULL) || (inst == NULL))
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
+ 	return;
+ 
+-
+     {
+ 	xmlChar *qname;
+ 
+@@ -546,6 +545,9 @@ exsltFuncResultComp (xsltStylesheetPtr style, xmlNodePtr inst,
+     xmlChar *sel;
+     exsltFuncResultPreComp *ret;
+ 
++    if ((style == NULL) || (inst == NULL) || (inst->type != XML_ELEMENT_NODE))
++        return (NULL);
++
+     /*
+      * "Validity" checking
+      */
+-- 
+1.7.12
+
diff --git a/dev-libs/libxslt/files/libxslt-1.1.26-pattern-compile-crash.patch b/dev-libs/libxslt/files/libxslt-1.1.26-pattern-compile-crash.patch
new file mode 100644
index 000000000000..218b945bc990
--- /dev/null
+++ b/dev-libs/libxslt/files/libxslt-1.1.26-pattern-compile-crash.patch
@@ -0,0 +1,209 @@
+From 8566ab4a10158d195adb5f1f61afe1ee8bfebd12 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Thu, 9 Aug 2012 15:31:07 +0800
+Subject: [PATCH] Cleanup of the pattern compilation code
+
+Avoid potential crashes and memory leaks
+---
+ libxslt/pattern.c | 53 +++++++++++++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 47 insertions(+), 6 deletions(-)
+
+diff --git a/libxslt/pattern.c b/libxslt/pattern.c
+index 1155b54..a6140cb 100644
+--- a/libxslt/pattern.c
++++ b/libxslt/pattern.c
+@@ -303,6 +303,10 @@ xsltCompMatchAdd(xsltParserContextPtr ctxt, xsltCompMatchPtr comp,
+ 	     "xsltCompMatchAdd: memory re-allocation failure.\n");
+ 	    if (ctxt->style != NULL)
+ 		ctxt->style->errors++;
++	    if (value)
++	        xmlFree(value);
++	    if (value2)
++	        xmlFree(value2);
+ 	    return (-1);
+ 	}
+         comp->maxStep *= 2;
+@@ -1384,17 +1388,22 @@ xsltCompileIdKeyPattern(xsltParserContextPtr ctxt, xmlChar *name,
+ 	NEXT;
+ 	SKIP_BLANKS;
+         lit = xsltScanLiteral(ctxt);
+-	if (ctxt->error)
++	if (ctxt->error) {
++	    xsltTransformError(NULL, NULL, NULL,
++		    "xsltCompileIdKeyPattern : Literal expected\n");
+ 	    return;
++	}
+ 	SKIP_BLANKS;
+ 	if (CUR != ')') {
+ 	    xsltTransformError(NULL, NULL, NULL,
+ 		    "xsltCompileIdKeyPattern : ) expected\n");
++	    xmlFree(lit);
+ 	    ctxt->error = 1;
+ 	    return;
+ 	}
+ 	NEXT;
+ 	PUSH(XSLT_OP_ID, lit, NULL, novar);
++	lit = NULL;
+     } else if ((aid) && (xmlStrEqual(name, (const xmlChar *)"key"))) {
+ 	if (axis != 0) {
+ 	    xsltTransformError(NULL, NULL, NULL,
+@@ -1405,8 +1414,11 @@ xsltCompileIdKeyPattern(xsltParserContextPtr ctxt, xmlChar *name,
+ 	NEXT;
+ 	SKIP_BLANKS;
+         lit = xsltScanLiteral(ctxt);
+-	if (ctxt->error)
++	if (ctxt->error) {
++	    xsltTransformError(NULL, NULL, NULL,
++		    "xsltCompileIdKeyPattern : Literal expected\n");
+ 	    return;
++	}
+ 	SKIP_BLANKS;
+ 	if (CUR != ',') {
+ 	    xsltTransformError(NULL, NULL, NULL,
+@@ -1417,25 +1429,36 @@ xsltCompileIdKeyPattern(xsltParserContextPtr ctxt, xmlChar *name,
+ 	NEXT;
+ 	SKIP_BLANKS;
+         lit2 = xsltScanLiteral(ctxt);
+-	if (ctxt->error)
++	if (ctxt->error) {
++	    xsltTransformError(NULL, NULL, NULL,
++		    "xsltCompileIdKeyPattern : Literal expected\n");
++	    xmlFree(lit);
+ 	    return;
++	}
+ 	SKIP_BLANKS;
+ 	if (CUR != ')') {
+ 	    xsltTransformError(NULL, NULL, NULL,
+ 		    "xsltCompileIdKeyPattern : ) expected\n");
++	    xmlFree(lit);
++	    xmlFree(lit2);
+ 	    ctxt->error = 1;
+ 	    return;
+ 	}
+ 	NEXT;
+ 	/* URGENT TODO: support namespace in keys */
+ 	PUSH(XSLT_OP_KEY, lit, lit2, novar);
++	lit = NULL;
++	lit2 = NULL;
+     } else if (xmlStrEqual(name, (const xmlChar *)"processing-instruction")) {
+ 	NEXT;
+ 	SKIP_BLANKS;
+ 	if (CUR != ')') {
+ 	    lit = xsltScanLiteral(ctxt);
+-	    if (ctxt->error)
++	    if (ctxt->error) {
++		xsltTransformError(NULL, NULL, NULL,
++			"xsltCompileIdKeyPattern : Literal expected\n");
+ 		return;
++	    }
+ 	    SKIP_BLANKS;
+ 	    if (CUR != ')') {
+ 		xsltTransformError(NULL, NULL, NULL,
+@@ -1446,6 +1469,7 @@ xsltCompileIdKeyPattern(xsltParserContextPtr ctxt, xmlChar *name,
+ 	}
+ 	NEXT;
+ 	PUSH(XSLT_OP_PI, lit, NULL, novar);
++	lit = NULL;
+     } else if (xmlStrEqual(name, (const xmlChar *)"text")) {
+ 	NEXT;
+ 	SKIP_BLANKS;
+@@ -1496,8 +1520,7 @@ xsltCompileIdKeyPattern(xsltParserContextPtr ctxt, xmlChar *name,
+ 	return;
+     }
+ error:
+-    if (name != NULL)
+-	xmlFree(name);
++    return;
+ }
+ 
+ /**
+@@ -1560,6 +1583,8 @@ parse_node_test:
+     SKIP_BLANKS;
+     if (CUR == '(') {
+ 	xsltCompileIdKeyPattern(ctxt, token, 0, novar, axis);
++	xmlFree(token);
++	token = NULL;
+ 	if (ctxt->error)
+ 	    goto error;
+     } else if (CUR == ':') {
+@@ -1578,20 +1603,24 @@ parse_node_test:
+ 	    "xsltCompileStepPattern : no namespace bound to prefix %s\n",
+ 				 prefix);
+ 		xmlFree(prefix);
++		prefix=NULL;
+ 		ctxt->error = 1;
+ 		goto error;
+ 	    } else {
+ 		URL = xmlStrdup(ns->href);
+ 	    }
+ 	    xmlFree(prefix);
++	    prefix=NULL;
+ 	    if (token == NULL) {
+ 		if (CUR == '*') {
+ 		    NEXT;
+                     if (axis == AXIS_ATTRIBUTE) {
+                         PUSH(XSLT_OP_ATTR, NULL, URL, novar);
++			URL = NULL;
+                     }
+                     else {
+                         PUSH(XSLT_OP_NS, URL, NULL, novar);
++			URL = NULL;
+                     }
+ 		} else {
+ 		    xsltTransformError(NULL, NULL, NULL,
+@@ -1602,9 +1631,13 @@ parse_node_test:
+ 	    } else {
+                 if (axis == AXIS_ATTRIBUTE) {
+                     PUSH(XSLT_OP_ATTR, token, URL, novar);
++		    token = NULL;
++		    URL = NULL;
+                 }
+                 else {
+                     PUSH(XSLT_OP_ELEM, token, URL, novar);
++		    token = NULL;
++		    URL = NULL;
+                 }
+ 	    }
+ 	} else {
+@@ -1626,6 +1659,7 @@ parse_node_test:
+ 		goto error;
+ 	    }
+ 	    xmlFree(token);
++	    token = NULL;
+             SKIP_BLANKS;
+             token = xsltScanNCName(ctxt);
+ 	    goto parse_node_test;
+@@ -1640,9 +1674,13 @@ parse_node_test:
+ 	    URL = xmlStrdup(URI);
+         if (axis == AXIS_ATTRIBUTE) {
+             PUSH(XSLT_OP_ATTR, token, URL, novar);
++	    token = NULL;
++	    URL = NULL;
+         }
+         else {
+             PUSH(XSLT_OP_ELEM, token, URL, novar);
++	    token = NULL;
++	    URL = NULL;
+         }
+     }
+ parse_predicate:
+@@ -1682,6 +1720,7 @@ parse_predicate:
+         }
+ 	ret = xmlStrndup(q, CUR_PTR - q);
+ 	PUSH(XSLT_OP_PREDICATE, ret, NULL, novar);
++	ret = NULL;
+ 	/* push the predicate lower than local test */
+ 	SWAP();
+ 	NEXT;
+@@ -1790,6 +1829,8 @@ xsltCompileLocationPathPattern(xsltParserContextPtr ctxt, int novar) {
+ 	SKIP_BLANKS;
+ 	if ((CUR == '(') && !xmlXPathIsNodeType(name)) {
+ 	    xsltCompileIdKeyPattern(ctxt, name, 1, novar, 0);
++	    xmlFree(name);
++	    name = NULL;
+ 	    if ((CUR == '/') && (NXT(1) == '/')) {
+ 		PUSH(XSLT_OP_ANCESTOR, NULL, NULL, novar);
+ 		NEXT;
+-- 
+1.7.12
+
diff --git a/dev-libs/libxslt/files/libxslt-1.1.26-posix-comparison.patch b/dev-libs/libxslt/files/libxslt-1.1.26-posix-comparison.patch
new file mode 100644
index 000000000000..dbfd415a8e8a
--- /dev/null
+++ b/dev-libs/libxslt/files/libxslt-1.1.26-posix-comparison.patch
@@ -0,0 +1,15 @@
+https://bugs.gentoo.org/show_bug.cgi?id=420335
+
+diff --git a/configure.in b/configure.in
+index 756003d..46e8e8f 100644
+--- a/configure.in
++++ b/configure.in
+@@ -130,7 +130,7 @@ dnl
+ VERSION_SCRIPT_FLAGS=
+ $(/usr/bin/ld --help 2>&1 | grep -- --version-script >/dev/null) && \
+     VERSION_SCRIPT_FLAGS=-Wl,--version-script=
+-test "`uname`" == "SunOS" && \
++test "`uname`" = "SunOS" && \
+     VERSION_SCRIPT_FLAGS="-Wl,-M -Wl,"
+ AC_SUBST(VERSION_SCRIPT_FLAGS)
+ AM_CONDITIONAL([USE_VERSION_SCRIPT], [test -n "$VERSION_SCRIPT_FLAGS"])
diff --git a/dev-libs/libxslt/libxslt-1.1.26-r4.ebuild b/dev-libs/libxslt/libxslt-1.1.26-r4.ebuild
new file mode 100644
index 000000000000..920eba70946b
--- /dev/null
+++ b/dev-libs/libxslt/libxslt-1.1.26-r4.ebuild
@@ -0,0 +1,137 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/libxslt/libxslt-1.1.26-r4.ebuild,v 1.1 2012/09/10 05:24:48 tetromino Exp $
+
+EAPI="4"
+PYTHON_DEPEND="python? 2"
+SUPPORT_PYTHON_ABIS="1"
+RESTRICT_PYTHON_ABIS="3.* *-jython *-pypy-*"
+
+inherit autotools eutils python toolchain-funcs
+
+DESCRIPTION="XSLT libraries and tools"
+HOMEPAGE="http://www.xmlsoft.org/"
+SRC_URI="ftp://xmlsoft.org/${PN}/${P}.tar.gz"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd"
+IUSE="crypt debug python static-libs"
+
+DEPEND=">=dev-libs/libxml2-2.6.27:2
+	crypt?  ( >=dev-libs/libgcrypt-1.1.42 )"
+RDEPEND="${DEPEND}"
+
+pkg_setup() {
+	if use python; then
+		python_pkg_setup
+	fi
+	DOCS="AUTHORS ChangeLog FEATURES NEWS README TODO"
+}
+
+src_prepare() {
+	epatch "${FILESDIR}"/libxslt.m4-${P}.patch \
+		"${FILESDIR}"/${PN}-1.1.23-parallel-install.patch \
+		"${FILESDIR}"/${P}-undefined.patch \
+		"${FILESDIR}"/${P}-disable_static_modules.patch
+
+	# Python bindings are built/tested/installed manually.
+	sed -e "s/@PYTHON_SUBDIR@//" -i Makefile.am || die "sed failed"
+
+	# Fix generate-id() to not expose object addresses, bug #358615
+	epatch "${FILESDIR}/${P}-id-generation.patch"
+
+	# Fix off-by-one in xsltCompilePatternInternal, bug #402861
+	epatch "${FILESDIR}/${P}-pattern-out-of-bounds-read.patch"
+
+	# Namespace nodes require special treatment, bug #433603
+	epatch "${FILESDIR}/${P}-node-type-"{1,2,3}.patch
+
+	# Use-after-free errors, bug #433603
+	epatch "${FILESDIR}/${P}-pattern-compile-crash.patch"
+	epatch "${FILESDIR}/${P}-generate-id-crash.patch"
+
+	# Build fix for freebsd, bug #420335
+	epatch "${FILESDIR}/${P}-posix-comparison.patch"
+
+	eautoreconf
+	epunt_cxx
+}
+
+src_configure() {
+	# libgcrypt is missing pkg-config file, so fixing cross-compile
+	# here. see bug 267503.
+	if tc-is-cross-compiler; then
+		export LIBGCRYPT_CONFIG="${SYSROOT}/usr/bin/libgcrypt-config"
+	fi
+
+	econf \
+		--disable-dependency-tracking \
+		--with-html-dir=/usr/share/doc/${PF} \
+		--with-html-subdir=html \
+		$(use_with crypt crypto) \
+		$(use_with python) \
+		$(use_with debug) \
+		$(use_with debug mem-debug) \
+		$(use_enable static-libs static)
+}
+
+src_compile() {
+	default
+
+	if use python; then
+		python_copy_sources python
+		building() {
+			emake PYTHON_INCLUDES="$(python_get_includedir)" \
+				PYTHON_SITE_PACKAGES="$(python_get_sitedir)" \
+				PYTHON_VERSION="$(python_get_version)"
+		}
+		python_execute_function -s --source-dir python building
+	fi
+}
+
+src_test() {
+	default
+
+	if use python; then
+		testing() {
+			emake test
+		}
+		python_execute_function -s --source-dir python testing
+	fi
+}
+
+src_install() {
+	default
+
+	if use python; then
+		installation() {
+			emake DESTDIR="${D}" \
+				PYTHON_SITE_PACKAGES="$(python_get_sitedir)" \
+				install
+		}
+		python_execute_function -s --source-dir python installation
+
+		python_clean_installation_image
+	fi
+
+	mv -vf "${ED}"/usr/share/doc/${PN}-python-${PV} \
+		"${ED}"/usr/share/doc/${PF}/python
+
+	if ! use static-libs; then
+		# Remove useless .la files
+		find "${D}" -name '*.la' -exec rm -f {} + || die "la file removal failed"
+	fi
+}
+
+pkg_postinst() {
+	if use python; then
+		python_mod_optimize libxslt.py
+	fi
+}
+
+pkg_postrm() {
+	if use python; then
+		python_mod_cleanup libxslt.py
+	fi
+}