1 files changed, 4 insertions, 19 deletions

diff --git a/chromium/third_party/libxslt/libxslt/functions.c b/chromium/third_party/libxslt/libxslt/functions.c
index dc61994572e..a5e7021010f 100644
--- a/chromium/third_party/libxslt/libxslt/functions.c
+++ b/chromium/third_party/libxslt/libxslt/functions.c
@@ -180,7 +180,6 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt, xmlChar* URI)
     resObj = xmlXPtrEval(fragment, xptrctxt);
     xmlXPathFreeContext(xptrctxt);
 #endif
-    xmlFree(fragment);
 
     if (resObj == NULL)
 	goto out_fragment;
@@ -204,6 +203,7 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt, xmlChar* URI)
     }
 
     valuePush(ctxt, resObj);
+    xmlFree(fragment);
     return;
 
 out_object:
@@ -211,6 +211,7 @@ out_object:
 
 out_fragment:
     valuePush(ctxt, xmlXPathNewNodeSet(NULL));
+    xmlFree(fragment);
 }
 
 /**
@@ -665,7 +666,6 @@ xsltGenerateIdFunction(xmlXPathParserContextPtr ctxt, int nargs){
     xmlXPathObjectPtr obj = NULL;
     long val;
     xmlChar str[30];
-    xmlDocPtr doc;
 
     if (nargs == 0) {
 	cur = ctxt->context->node;
@@ -698,30 +698,15 @@ xsltGenerateIdFunction(xmlXPathParserContextPtr ctxt, int nargs){
 	ctxt->error = XPATH_INVALID_ARITY;
 	return;
     }
-    /*
-     * Okay this is ugly but should work, use the NodePtr address
-     * to forge the ID
-     */
-    if (cur->type != XML_NAMESPACE_DECL)
-        doc = cur->doc;
-    else {
-        xmlNsPtr ns = (xmlNsPtr) cur;
-
-        if (ns->context != NULL)
-            doc = ns->context;
-        else
-            doc = ctxt->context->doc;
-
-    }
 
     if (obj)
         xmlXPathFreeObject(obj);
 
     val = (long)((char *)cur - (char *)&base_address);
     if (val >= 0) {
-      sprintf((char *)str, "idp%ld", val);
+      snprintf((char *)str, sizeof(str), "idp%ld", val);
     } else {
-      sprintf((char *)str, "idm%ld", -val);
+      snprintf((char *)str, sizeof(str), "idm%ld", -val);
     }
     valuePush(ctxt, xmlXPathNewString(str));
 }