pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNodecompare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocumentcreateAttribute legitimately leave those fields NULL. When ixmlElementremoveAttributeNode compares two distinct attribute objects with the same nodeName through findconditionnode, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.