fixed bug #78858

1 files changed, 5 insertions, 3 deletions

diff --git a/xpath.c b/xpath.c
index b56c462f..8262e1d9 100644
--- a/xpath.c
+++ b/xpath.c
@@ -10220,15 +10220,17 @@ xmlXPathRunEval(xmlXPathParserContextPtr ctxt) {
 			 xmlMalloc(10 * sizeof(xmlXPathObjectPtr));
 	if (ctxt->valueTab == NULL) {
 	    xmlFree(ctxt);
-	    xmlGenericError(xmlGenericErrorContext,
-		    "xmlXPathRunEval: out of memory\n");
-	    return;
 	}
 	ctxt->valueNr = 0;
 	ctxt->valueMax = 10;
 	ctxt->value = NULL;
     }
     comp = ctxt->comp;
+    if(comp->last < 0) {
+	xmlGenericError(xmlGenericErrorContext,
+	    "xmlXPathRunEval: last is less than zero\n");
+	return;
+    }
     xmlXPathCompOpEval(ctxt, &comp->steps[comp->last]);
 }