[libxml2] Propagate memory errors in valuePush

[Nick Wellnhofer <nwellnhof src gnome org>]

commit 429d4ecaae5d61d591f279220125a583836fb84e
Author: Nick Wellnhofer <wellnhofer aevum de>
Date:   Sun Oct 20 14:22:20 2019 +0200

    Propagate memory errors in valuePush
    
    Currently, many memory allocation errors in xpath.c aren't propagated to
    the parser/evaluation context and for the most part ignored. Most
    XPath objects allocated via one of the New, Wrap or Copy functions end
    up being pushed on the stack, so adding a check in valuePush handles
    many cases without much effort.
    
    Also simplify the code a little and make sure to return -1 in case of
    error.

 xpath.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)
---
diff --git a/xpath.c b/xpath.c
index 4fd2ae7b..ced5697e 100644
--- a/xpath.c
+++ b/xpath.c
@@ -2872,29 +2872,36 @@ valuePop(xmlXPathParserContextPtr ctxt)
  * @ctxt:  an XPath evaluation context
  * @value:  the XPath object
  *
- * Pushes a new XPath object on top of the value stack
+ * Pushes a new XPath object on top of the value stack. If value is NULL,
+ * a memory error is recorded in the parser context.
  *
- * returns the number of items on the value stack
+ * Returns the number of items on the value stack, or -1 in case of error.
  */
 int
 valuePush(xmlXPathParserContextPtr ctxt, xmlXPathObjectPtr value)
 {
-    if ((ctxt == NULL) || (value == NULL)) return(-1);
+    if (ctxt == NULL) return(-1);
+    if (value == NULL) {
+        /*
+         * A NULL value typically indicates that a memory allocation failed,
+         * so we set ctxt->error here to propagate the error.
+         */
+       ctxt->error = XPATH_MEMORY_ERROR;
+        return(-1);
+    }
     if (ctxt->valueNr >= ctxt->valueMax) {
         xmlXPathObjectPtr *tmp;
 
         if (ctxt->valueMax >= XPATH_MAX_STACK_DEPTH) {
-            xmlXPathErrMemory(NULL, "XPath stack depth limit reached\n");
-            ctxt->error = XPATH_MEMORY_ERROR;
-            return (0);
+            xmlXPathPErrMemory(ctxt, "XPath stack depth limit reached\n");
+            return (-1);
         }
         tmp = (xmlXPathObjectPtr *) xmlRealloc(ctxt->valueTab,
                                              2 * ctxt->valueMax *
                                              sizeof(ctxt->valueTab[0]));
         if (tmp == NULL) {
-            xmlXPathErrMemory(NULL, "pushing value\n");
-            ctxt->error = XPATH_MEMORY_ERROR;
-            return (0);
+            xmlXPathPErrMemory(ctxt, "pushing value\n");
+            return (-1);
         }
         ctxt->valueMax *= 2;
        ctxt->valueTab = tmp;