A NULL pointer dereference exists when parsing XML schemas in libxml2 xmlSchemaCheckCOSSTDerivedOK libxml2 Hashing of empty dict strings isn't deterministic. When hashing empty strings which aren't null-terminated, xmlDictComputeFastKey could produce inconsistent results. This could lead to various logic or memory errors, including double frees