=== modified file 'xpath.c'
--- old/xpath.c	2008-08-29 00:14:24 +0000
+++ new/xpath.c	2008-08-29 00:17:04 +0000
@@ -9778,7 +9778,7 @@
 
     *prefix = NULL;
     ret = xmlXPathParseNCName(ctxt);
-    if (CUR == ':') {
+    if (ret && CUR == ':') {
         *prefix = ret;
 	NEXT;
 	ret = xmlXPathParseNCName(ctxt);
@@ -10274,6 +10274,7 @@
 
     name = xmlXPathParseQName(ctxt, &prefix);
     if (name == NULL) {
+	xmlFree(prefix);
 	XP_ERROR(XPATH_EXPR_ERROR);
     }
     SKIP_BLANKS;
@@ -10306,7 +10307,11 @@
 	    int op1 = ctxt->comp->last;
 	    ctxt->comp->last = -1;
 	    xmlXPathCompileExpr(ctxt, sort);
-	    CHECK_ERROR;
+	    if (ctxt->error != XPATH_EXPRESSION_OK) {
+		xmlFree(name);
+		xmlFree(prefix);
+		return;
+	    }
 	    PUSH_BINARY_EXPR(XPATH_OP_ARG, op1, ctxt->comp->last, 0, 0);
 	    nbargs++;
 	    if (CUR == ')') break;