$NetBSD: patch-CVE-2025-11731,v 1.1 2026/01/06 10:21:12 nia Exp $

Subject: [PATCH] End function node ancestor search at document

Avoids dereferencing a non-existent ->ns property on an
XML_DOCUMENT_NODE pointer.

Fixes #151.

--- libexslt/functions.c.orig	2025-03-12 17:57:19.000000000 +0000
+++ libexslt/functions.c
@@ -617,8 +617,13 @@ exsltFuncResultComp (xsltStylesheetPtr style, xmlNodeP
      * instanciation of a func:result element.
      */
     for (test = inst->parent; test != NULL; test = test->parent) {
-	if (IS_XSLT_ELEM(test) &&
-	    IS_XSLT_NAME(test, "stylesheet")) {
+	if (/* Traversal has reached the top-level document without
+         * finding a func:function ancestor. */
+        (test != NULL && test->type == XML_DOCUMENT_NODE) ||
+        /* Traversal reached a stylesheet-namespace node,
+         * and has left the function namespace. */
+        (IS_XSLT_ELEM(test) &&
+         IS_XSLT_NAME(test, "stylesheet"))) {
 	    xsltGenericError(xsltGenericErrorContext,
 			     "func:result element not a descendant "
 			     "of a func:function\n");
