Created attachment 225622 [details]
Minimized test case

The attached test case will crash the latest libxslt release (1.1.27). A read at NULL occurs in SKIP_BLANKS when an invalid "use" parameter is given to "xsl:key":

$ xsltproc --version
Using libxml 20900, libxslt 10127 and libexslt 816
xsltproc was compiled against libxml 20900, libxslt 10127 and libexslt 816
libxslt 10127 was compiled against libxml 20900
libexslt 816 was compiled against libxml 20900

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff72748ca in xmlXPathCompUnaryExpr (ctxt=Unhandled dwarf expression opcode 0x0
) at xpath.c:10807
10807	    SKIP_BLANKS;
(gdb) x/i $rip
=> 0x7ffff72748ca <xmlXPathCompUnaryExpr+154>:	mov    (%rdi),%cl
(gdb) info reg
rax            0xffffeb6e690	17592164476560
rbx            0x7ffff5b73480	140737315812480
rcx            0x100000000000	17592186044416
rdx            0x7ffff5b5c280	140737315717760
rsi            0x1ffffeb6e690	35184350520976
rdi            0x0	0
rbp            0x7fffffffde10	0x7fffffffde10
rsp            0x7fffffffdde0	0x7fffffffdde0
r8             0x100000000000	17592186044416
r9             0x39e	926
r10            0x0	0
r11            0x7ffff5e05ba6	140737318509478
r12            0x7ffff4f5b480	140737303131264
r13            0x7ffff5b73480	140737315812480
r14            0x7ffff5b73480	140737315812480
r15            0x7ffff5b73480	140737315812480
rip            0x7ffff72748ca	0x7ffff72748ca <xmlXPathCompUnaryExpr+154>
eflags         0x10246	[ PF ZF IF RF ]