Fix some SAST warnings (RHEL-42444)

Resolves: RHEL-42444

libxslt-1.1.39-fix-SAST-warnings.patch

@@ -0,0 +1,37 @@
+From d87983e6514c6c45b2f3dfe877e73dd412f40204 Mon Sep 17 00:00:00 2001
+From: David King <dking@redhat.com>
+Date: Fri, 24 Jul 2026 08:44:46 +0100
+Subject: [PATCH] Fix race in xsltUnregisterExtModule
+
+Do the NULL check inside the lock in order to avoid a race. Found by
+Coverity. Similarly with xsltUnregisterAllExtModuleFunction in the same
+file.
+---
+ libxslt/extensions.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/libxslt/extensions.c b/libxslt/extensions.c
+index 91df1d44..253cc7b0 100644
+--- a/libxslt/extensions.c
++++ b/libxslt/extensions.c
+@@ -1363,13 +1363,12 @@ xsltUnregisterExtModule(const xmlChar * URI)
+ static void
+ xsltUnregisterAllExtModules(void)
+ {
+-    if (xsltExtensionsHash == NULL)
+-        return;
+-
+     xmlMutexLock(xsltExtMutex);
+ 
+-    xmlHashFree(xsltExtensionsHash, xsltFreeExtModuleEntry);
+-    xsltExtensionsHash = NULL;
++    if (xsltExtensionsHash != NULL) {
++        xmlHashFree(xsltExtensionsHash, xsltFreeExtModuleEntry);
++        xsltExtensionsHash = NULL;
++    }
+ 
+     xmlMutexUnlock(xsltExtMutex);
+ }
+-- 
+2.55.0
+

libxslt.spec

@@ -1,7 +1,7 @@
 Name:           libxslt
 Summary:        Library providing the Gnome XSLT engine
 Version:        1.1.39
-Release:        9%{?dist}
+Release:        10%{?dist}
 
 License:        MIT
 URL:            https://gitlab.gnome.org/GNOME/libxslt
@@ -29,6 +29,8 @@ Patch3:         libxslt-1.1.39-CVE-2025-24855.patch
 Patch4:         libxslt-1.1.39-CVE-2025-7424.patch
 # https://redhat.atlassian.net/browse/RHEL-172000
 Patch5:         libxslt-1.1.39-CVE-2025-10911.patch
+# https://redhat.atlassian.net/browse/RHEL-42444
+Patch6:         libxslt-1.1.39-fix-SAST-warnings.patch
 
 %description
 This C library allows to transform XML files into other XML files
@@ -142,6 +144,9 @@ rm -vrf %{buildroot}%{_docdir}
 %endif
 
 %changelog
+* Fri Jul 24 2026 David King <dking@redhat.com> - 1.1.39-10
+- Fix some SAST warnings (RHEL-42444)
+
 * Tue May 19 2026 David King <dking@redhat.com> - 1.1.39-9
 - Fix CVE-2025-10911 (RHEL-172000)