Created attachment 267359 [details]
example stylesheet

The following causes a segfault:

  <xsl:variable name="newclass" select="
      concat(
          'x ',
          substring-after(@class, $newclass)
      )
  " />

Specifically, xsltproc says:

  Variable 'newclass' has not been declared.
  XPath error : Stack usage errror
  Segmentation fault (core dumped)

Obviously the XSLT is at fault by referencing a variable that hasn't been declared, but the segfault is unexpected.

Oddly, if the substring-after() function is the *first* argument to concat() then there is no segfault.

I original discovered this problem with PHP/Apache, but xsltproc also exhibits this issue.

$ xsltproc --version
Using libxml 20708, libxslt 10126 and libexslt 815
xsltproc was compiled against libxml 20708, libxslt 10126 and libexslt 815
libxslt 10126 was compiled against libxml 20708
libexslt 815 was compiled against libxml 20708

$ uname -srvmpio
Linux 3.8.0-35-generic #50~precise1-Ubuntu SMP Wed Dec 4 17:25:51 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

See attached XML and XSL.