Upgrade to libxml 2.9.2 and libxslt 1.1.28

third_party/libxml/src/parser.c

 /*
  * parser.c : an XML 1.0 parser, namespaces and validity support are mostly
  *            implemented on top of the SAX interfaces
  *
  * References:
  *   The XML specification:
  *     http://www.w3.org/TR/REC-xml
  *   Original 1.0 version:
  *     http://www.w3.org/TR/1998/REC-xml-19980210
  *   XML second edition working draft
  *     http://www.w3.org/TR/2000/WD-xml-2e-20000814
  *
  * Okay this is a big file, the parser core is around 7000 lines, then it
  * is followed by the progressive parser top routines, then the various
  * high level APIs to call the parser and a few miscellaneous functions.
  * A number of helper functions and deprecated ones have been moved to
  * parserInternals.c to reduce this file size.
  * As much as possible the functions are associated with their relative
  * production in the XML specification. A few productions defining the
- * different ranges of character are actually implanted either in 
+ * different ranges of character are actually implanted either in
  * parserInternals.h or parserInternals.c
  * The DOM tree build is realized from the default SAX callbacks in
  * the module SAX.c.
  * The routines doing the validation checks are in valid.c and called either
  * from the SAX callbacks or as standalone functions using a preparsed
  * document.
  *
  * See Copyright for the status of this software.
  *
  * daniel@veillard.com
  */
 
 #define IN_LIBXML
 #include "libxml.h"
 
 #if defined(WIN32) && !defined (__CYGWIN__)
 #define XML_DIR_SEP '\\'
 #else
 #define XML_DIR_SEP '/'
 #endif
 
 #include <stdlib.h>
+#include <limits.h>
 #include <string.h>
 #include <stdarg.h>
 #include <libxml/xmlmemory.h>
 #include <libxml/threads.h>
 #include <libxml/globals.h>
 #include <libxml/tree.h>
 #include <libxml/parser.h>
 #include <libxml/parserInternals.h>
 #include <libxml/valid.h>
 #include <libxml/entities.h>
@@ skipping 19 matching lines @@
 #endif
 #ifdef HAVE_FCNTL_H
 #include <fcntl.h>
 #endif
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
 #ifdef HAVE_ZLIB_H
 #include <zlib.h>
 #endif
+#ifdef HAVE_LZMA_H
+#include <lzma.h>
+#endif
+
+#include "buf.h"
+#include "enc.h"
 
 static void
 xmlFatalErr(xmlParserCtxtPtr ctxt, xmlParserErrors error, const char *info);
 
 static xmlParserCtxtPtr
 xmlCreateEntityParserCtxtInternal(const xmlChar *URL, const xmlChar *ID,
                           const xmlChar *base, xmlParserCtxtPtr pctx);
 
 /************************************************************************
  *                                                                      *
@@ skipping 15 matching lines @@
 /*
  * xmlParserEntityCheck
  *
  * Function to check non-linear entity expansion behaviour
  * This is here to detect and stop exponential linear entity expansion
  * This is not a limitation of the parser but a safety
  * boundary feature. It can be disabled with the XML_PARSE_HUGE
  * parser option.
  */
 static int
-xmlParserEntityCheck(xmlParserCtxtPtr ctxt, unsigned long size,
-                     xmlEntityPtr ent)
+xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size,
+                     xmlEntityPtr ent, size_t replacement)
 {
-    unsigned long consumed = 0;
+    size_t consumed = 0;
 
     if ((ctxt == NULL) || (ctxt->options & XML_PARSE_HUGE))
         return (0);
     if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
         return (1);
-    if (size != 0) {
+
+    /*
+     * This may look absurd but is needed to detect
+     * entities problems
+     */
+    if ((ent != NULL) && (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY) &&
+        (ent->content != NULL) && (ent->checked == 0)) {
+        unsigned long oldnbent = ctxt->nbentities;
+        xmlChar *rep;
+
+        ent->checked = 1;
+
+        rep = xmlStringDecodeEntities(ctxt, ent->content,
+                                  XML_SUBSTITUTE_REF, 0, 0, 0);
+
+        ent->checked = (ctxt->nbentities - oldnbent + 1) * 2;
+        if (rep != NULL) {
+            if (xmlStrchr(rep, '<'))
+                ent->checked |= 1;
+            xmlFree(rep);
+            rep = NULL;
+        }
+    }
+    if (replacement != 0) {
+        if (replacement < XML_MAX_TEXT_LENGTH)
+            return(0);
+
+        /*
+         * If the volume of entity copy reaches 10 times the
+         * amount of parsed data and over the large text threshold
+         * then that's very likely to be an abuse.
+         */
+        if (ctxt->input != NULL) {
+            consumed = ctxt->input->consumed +
+                       (ctxt->input->cur - ctxt->input->base);
+        }
+        consumed += ctxt->sizeentities;
+
+        if (replacement < XML_PARSER_NON_LINEAR * consumed)
+            return(0);
+    } else if (size != 0) {
         /*
          * Do the check based on the replacement size of the entity
          */
         if (size < XML_PARSER_BIG_ENTITY)
             return(0);
 
         /*
          * A limit on the amount of text data reasonably used
          */
         if (ctxt->input != NULL) {
             consumed = ctxt->input->consumed +
                 (ctxt->input->cur - ctxt->input->base);
         }
         consumed += ctxt->sizeentities;
 
         if ((size < XML_PARSER_NON_LINEAR * consumed) &&
             (ctxt->nbentities * 3 < XML_PARSER_NON_LINEAR * consumed))
             return (0);
     } else if (ent != NULL) {
         /*
          * use the number of parsed entities in the replacement
          */
-        size = ent->checked;
+        size = ent->checked / 2;
 
         /*
          * The amount of data parsed counting entities size only once
          */
         if (ctxt->input != NULL) {
             consumed = ctxt->input->consumed +
                 (ctxt->input->cur - ctxt->input->base);
         }
         consumed += ctxt->sizeentities;
 
         /*
          * Check the density of entities for the amount of data
          * knowing an entity reference will take at least 3 bytes
          */
         if (size * 3 < consumed * XML_PARSER_NON_LINEAR)
             return (0);
     } else {
         /*
-         * strange we got no data for checking just return
+         * strange we got no data for checking
          */
-        return (0);
+        if (((ctxt->lastError.code != XML_ERR_UNDECLARED_ENTITY) &&
+             (ctxt->lastError.code != XML_WAR_UNDECLARED_ENTITY)) ||
+            (ctxt->nbentities <= 10000))
+            return (0);
     }
-
     xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
     return (1);
 }
 
 /**
  * xmlParserMaxDepth:
  *
  * arbitrary depth limit for the XML documents that we allow to
  * process. This is not a limitation of the parser but a safety
  * boundary feature. It can be disabled with the XML_PARSE_HUGE
  * parser option.
  */
 unsigned int xmlParserMaxDepth = 256;
 
 
 
 #define SAX2 1
 #define XML_PARSER_BIG_BUFFER_SIZE 300
 #define XML_PARSER_BUFFER_SIZE 100
 #define SAX_COMPAT_MODE BAD_CAST "SAX compatibility mode document"
 
+/**
+ * XML_PARSER_CHUNK_SIZE
+ *
+ * When calling GROW that's the minimal amount of data
+ * the parser expected to have received. It is not a hard
+ * limit but an optimization when reading strings like Names
+ * It is not strictly needed as long as inputs available characters
+ * are followed by 0, which should be provided by the I/O level
+ */
+#define XML_PARSER_CHUNK_SIZE 100
+
 /*
  * List of XML prefixed PI allowed by W3C specs
  */
 
 static const char *xmlW3CPIs[] = {
     "xml-stylesheet",
+    "xml-model",
     NULL
 };
 
 
 /* DEPR void xmlParserHandleReference(xmlParserCtxtPtr ctxt); */
 static xmlEntityPtr xmlParseStringPEReference(xmlParserCtxtPtr ctxt,
                                               const xmlChar **str);
 
 static xmlParserErrors
 xmlParseExternalEntityPrivate(xmlDocPtr doc, xmlParserCtxtPtr oldctxt,
@@ skipping 12 matching lines @@
 
 static xmlParserErrors
 xmlParseBalancedChunkMemoryInternal(xmlParserCtxtPtr oldctxt,
                       const xmlChar *string, void *user_data, xmlNodePtr *lst);
 
 static int
 xmlLoadEntityContent(xmlParserCtxtPtr ctxt, xmlEntityPtr entity);
 
 /************************************************************************
  *                                                                      *
- *              Some factorized error routines                          *
+ *              Some factorized error routines                          *
  *                                                                      *
  ************************************************************************/
 
 /**
  * xmlErrAttributeDup:
  * @ctxt:  an XML parser context
  * @prefix:  the attribute prefix
  * @localname:  the attribute localname
  *
  * Handle a redefinition of attribute error
@@ skipping 31 matching lines @@
  * @ctxt:  an XML parser context
  * @error:  the error number
  * @extra:  extra information string
  *
  * Handle a fatal parser error, i.e. violating Well-Formedness constraints
  */
 static void
 xmlFatalErr(xmlParserCtxtPtr ctxt, xmlParserErrors error, const char *info)
 {
     const char *errmsg;
+    char errstr[129] = "";
 
     if ((ctxt != NULL) && (ctxt->disableSAX != 0) &&
         (ctxt->instate == XML_PARSER_EOF))
         return;
     switch (error) {
         case XML_ERR_INVALID_HEX_CHARREF:
-            errmsg = "CharRef: invalid hexadecimal value\n";
+            errmsg = "CharRef: invalid hexadecimal value";
             break;
         case XML_ERR_INVALID_DEC_CHARREF:
-            errmsg = "CharRef: invalid decimal value\n";
+            errmsg = "CharRef: invalid decimal value";
             break;
         case XML_ERR_INVALID_CHARREF:
-            errmsg = "CharRef: invalid value\n";
+            errmsg = "CharRef: invalid value";
             break;
         case XML_ERR_INTERNAL_ERROR:
             errmsg = "internal error";
             break;
         case XML_ERR_PEREF_AT_EOF:
-            errmsg = "PEReference at end of document\n";
+            errmsg = "PEReference at end of document";
             break;
         case XML_ERR_PEREF_IN_PROLOG:
-            errmsg = "PEReference in prolog\n";
+            errmsg = "PEReference in prolog";
             break;
         case XML_ERR_PEREF_IN_EPILOG:
-            errmsg = "PEReference in epilog\n";
+            errmsg = "PEReference in epilog";
             break;
         case XML_ERR_PEREF_NO_NAME:
-            errmsg = "PEReference: no name\n";
+            errmsg = "PEReference: no name";
             break;
         case XML_ERR_PEREF_SEMICOL_MISSING:
-            errmsg = "PEReference: expecting ';'\n";
+            errmsg = "PEReference: expecting ';'";
             break;
         case XML_ERR_ENTITY_LOOP:
-            errmsg = "Detected an entity reference loop\n";
+            errmsg = "Detected an entity reference loop";
             break;
         case XML_ERR_ENTITY_NOT_STARTED:
-            errmsg = "EntityValue: \" or ' expected\n";
+            errmsg = "EntityValue: \" or ' expected";
             break;
         case XML_ERR_ENTITY_PE_INTERNAL:
-            errmsg = "PEReferences forbidden in internal subset\n";
+            errmsg = "PEReferences forbidden in internal subset";
             break;
         case XML_ERR_ENTITY_NOT_FINISHED:
-            errmsg = "EntityValue: \" or ' expected\n";
+            errmsg = "EntityValue: \" or ' expected";
             break;
         case XML_ERR_ATTRIBUTE_NOT_STARTED:
-            errmsg = "AttValue: \" or ' expected\n";
+            errmsg = "AttValue: \" or ' expected";
             break;
         case XML_ERR_LT_IN_ATTRIBUTE:
-            errmsg = "Unescaped '<' not allowed in attributes values\n";
+            errmsg = "Unescaped '<' not allowed in attributes values";
             break;
         case XML_ERR_LITERAL_NOT_STARTED:
-            errmsg = "SystemLiteral \" or ' expected\n";
+            errmsg = "SystemLiteral \" or ' expected";
             break;
         case XML_ERR_LITERAL_NOT_FINISHED:
-            errmsg = "Unfinished System or Public ID \" or ' expected\n";
+            errmsg = "Unfinished System or Public ID \" or ' expected";
             break;
         case XML_ERR_MISPLACED_CDATA_END:
-            errmsg = "Sequence ']]>' not allowed in content\n";
+            errmsg = "Sequence ']]>' not allowed in content";
             break;
         case XML_ERR_URI_REQUIRED:
-            errmsg = "SYSTEM or PUBLIC, the URI is missing\n";
+            errmsg = "SYSTEM or PUBLIC, the URI is missing";
             break;
         case XML_ERR_PUBID_REQUIRED:
-            errmsg = "PUBLIC, the Public Identifier is missing\n";
+            errmsg = "PUBLIC, the Public Identifier is missing";
             break;
         case XML_ERR_HYPHEN_IN_COMMENT:
-            errmsg = "Comment must not contain '--' (double-hyphen)\n";
+            errmsg = "Comment must not contain '--' (double-hyphen)";
             break;
         case XML_ERR_PI_NOT_STARTED:
-            errmsg = "xmlParsePI : no target name\n";
+            errmsg = "xmlParsePI : no target name";
             break;
         case XML_ERR_RESERVED_XML_NAME:
-            errmsg = "Invalid PI name\n";
+            errmsg = "Invalid PI name";
             break;
         case XML_ERR_NOTATION_NOT_STARTED:
-            errmsg = "NOTATION: Name expected here\n";
+            errmsg = "NOTATION: Name expected here";
             break;
         case XML_ERR_NOTATION_NOT_FINISHED:
-            errmsg = "'>' required to close NOTATION declaration\n";
+            errmsg = "'>' required to close NOTATION declaration";
             break;
         case XML_ERR_VALUE_REQUIRED:
-            errmsg = "Entity value required\n";
+            errmsg = "Entity value required";
             break;
         case XML_ERR_URI_FRAGMENT:
             errmsg = "Fragment not allowed";
             break;
         case XML_ERR_ATTLIST_NOT_STARTED:
-            errmsg = "'(' required to start ATTLIST enumeration\n";
+            errmsg = "'(' required to start ATTLIST enumeration";
             break;
         case XML_ERR_NMTOKEN_REQUIRED:
-            errmsg = "NmToken expected in ATTLIST enumeration\n";
+            errmsg = "NmToken expected in ATTLIST enumeration";
             break;
         case XML_ERR_ATTLIST_NOT_FINISHED:
-            errmsg = "')' required to finish ATTLIST enumeration\n";
+            errmsg = "')' required to finish ATTLIST enumeration";
             break;
         case XML_ERR_MIXED_NOT_STARTED:
-            errmsg = "MixedContentDecl : '|' or ')*' expected\n";
+            errmsg = "MixedContentDecl : '|' or ')*' expected";
             break;
         case XML_ERR_PCDATA_REQUIRED:
-            errmsg = "MixedContentDecl : '#PCDATA' expected\n";
+            errmsg = "MixedContentDecl : '#PCDATA' expected";
             break;
         case XML_ERR_ELEMCONTENT_NOT_STARTED:
-            errmsg = "ContentDecl : Name or '(' expected\n";
+            errmsg = "ContentDecl : Name or '(' expected";
             break;
         case XML_ERR_ELEMCONTENT_NOT_FINISHED:
-            errmsg = "ContentDecl : ',' '|' or ')' expected\n";
+            errmsg = "ContentDecl : ',' '|' or ')' expected";
             break;
         case XML_ERR_PEREF_IN_INT_SUBSET:
             errmsg =
-                "PEReference: forbidden within markup decl in internal subset\n";
+                "PEReference: forbidden within markup decl in internal subset";
             break;
         case XML_ERR_GT_REQUIRED:
-            errmsg = "expected '>'\n";
+            errmsg = "expected '>'";
             break;
         case XML_ERR_CONDSEC_INVALID:
-            errmsg = "XML conditional section '[' expected\n";
+            errmsg = "XML conditional section '[' expected";
             break;
         case XML_ERR_EXT_SUBSET_NOT_FINISHED:
-            errmsg = "Content error in the external subset\n";
+            errmsg = "Content error in the external subset";
             break;
         case XML_ERR_CONDSEC_INVALID_KEYWORD:
             errmsg =
-                "conditional section INCLUDE or IGNORE keyword expected\n";
+                "conditional section INCLUDE or IGNORE keyword expected";
             break;
         case XML_ERR_CONDSEC_NOT_FINISHED:
-            errmsg = "XML conditional section not closed\n";
+            errmsg = "XML conditional section not closed";
             break;
         case XML_ERR_XMLDECL_NOT_STARTED:
-            errmsg = "Text declaration '<?xml' required\n";
+            errmsg = "Text declaration '<?xml' required";
             break;
         case XML_ERR_XMLDECL_NOT_FINISHED:
-            errmsg = "parsing XML declaration: '?>' expected\n";
+            errmsg = "parsing XML declaration: '?>' expected";
             break;
         case XML_ERR_EXT_ENTITY_STANDALONE:
-            errmsg = "external parsed entities cannot be standalone\n";
+            errmsg = "external parsed entities cannot be standalone";
             break;
         case XML_ERR_ENTITYREF_SEMICOL_MISSING:
-            errmsg = "EntityRef: expecting ';'\n";
+            errmsg = "EntityRef: expecting ';'";
             break;
         case XML_ERR_DOCTYPE_NOT_FINISHED:
-            errmsg = "DOCTYPE improperly terminated\n";
+            errmsg = "DOCTYPE improperly terminated";
             break;
         case XML_ERR_LTSLASH_REQUIRED:
-            errmsg = "EndTag: '</' not found\n";
+            errmsg = "EndTag: '</' not found";
             break;
         case XML_ERR_EQUAL_REQUIRED:
-            errmsg = "expected '='\n";
+            errmsg = "expected '='";
             break;
         case XML_ERR_STRING_NOT_CLOSED:
-            errmsg = "String not closed expecting \" or '\n";
+            errmsg = "String not closed expecting \" or '";
             break;
         case XML_ERR_STRING_NOT_STARTED:
-            errmsg = "String not started expecting ' or \"\n";
+            errmsg = "String not started expecting ' or \"";
             break;
         case XML_ERR_ENCODING_NAME:
-            errmsg = "Invalid XML encoding name\n";
+            errmsg = "Invalid XML encoding name";
             break;
         case XML_ERR_STANDALONE_VALUE:
-            errmsg = "standalone accepts only 'yes' or 'no'\n";
+            errmsg = "standalone accepts only 'yes' or 'no'";
             break;
         case XML_ERR_DOCUMENT_EMPTY:
-            errmsg = "Document is empty\n";
+            errmsg = "Document is empty";
             break;
         case XML_ERR_DOCUMENT_END:
-            errmsg = "Extra content at the end of the document\n";
+            errmsg = "Extra content at the end of the document";
             break;
         case XML_ERR_NOT_WELL_BALANCED:
-            errmsg = "chunk is not well balanced\n";
+            errmsg = "chunk is not well balanced";
             break;
         case XML_ERR_EXTRA_CONTENT:
-            errmsg = "extra content at the end of well balanced chunk\n";
+            errmsg = "extra content at the end of well balanced chunk";
             break;
         case XML_ERR_VERSION_MISSING:
-            errmsg = "Malformed declaration expecting version\n";
+            errmsg = "Malformed declaration expecting version";
+            break;
+        case XML_ERR_NAME_TOO_LONG:
+            errmsg = "Name too long use XML_PARSE_HUGE option";
             break;
 #if 0
         case:
-            errmsg = "\n";
+            errmsg = "";
             break;
 #endif
         default:
-            errmsg = "Unregistered error message\n";
+            errmsg = "Unregistered error message";
     }
+    if (info == NULL)
+        snprintf(errstr, 128, "%s\n", errmsg);
+    else
+        snprintf(errstr, 128, "%s: %%s\n", errmsg);
     if (ctxt != NULL)
         ctxt->errNo = error;
     __xmlRaiseError(NULL, NULL, NULL, ctxt, NULL, XML_FROM_PARSER, error,
-                    XML_ERR_FATAL, NULL, 0, info, NULL, NULL, 0, 0, errmsg,
+                    XML_ERR_FATAL, NULL, 0, info, NULL, NULL, 0, 0, &errstr[0],
                     info);
     if (ctxt != NULL) {
         ctxt->wellFormed = 0;
         if (ctxt->recovery == 0)
             ctxt->disableSAX = 1;
     }
 }
 
 /**
  * xmlFatalErrMsg:
@@ skipping 134 matching lines @@
  * @error:  the error number
  * @msg:  the error message
  * @str1:  an string info
  * @val:  an integer value
  * @str2:  an string info
  *
  * Handle a fatal parser error, i.e. violating Well-Formedness constraints
  */
 static void
 xmlFatalErrMsgStrIntStr(xmlParserCtxtPtr ctxt, xmlParserErrors error,
-                  const char *msg, const xmlChar *str1, int val, 
+                  const char *msg, const xmlChar *str1, int val,
                   const xmlChar *str2)
 {
     if ((ctxt != NULL) && (ctxt->disableSAX != 0) &&
         (ctxt->instate == XML_PARSER_EOF))
         return;
     if (ctxt != NULL)
         ctxt->errNo = error;
     __xmlRaiseError(NULL, NULL, NULL,
                     ctxt, NULL, XML_FROM_PARSER, error, XML_ERR_FATAL,
                     NULL, 0, (const char *) str1, (const char *) str2,
@@ skipping 88 matching lines @@
 }
 
 /**
  * xmlNsWarn
  * @ctxt:  an XML parser context
  * @error:  the error number
  * @msg:  the message
  * @info1:  extra information string
  * @info2:  extra information string
  *
- * Handle a fatal parser error, i.e. violating Well-Formedness constraints
+ * Handle a namespace warning error
  */
 static void
 xmlNsWarn(xmlParserCtxtPtr ctxt, xmlParserErrors error,
          const char *msg,
          const xmlChar * info1, const xmlChar * info2,
          const xmlChar * info3)
 {
     if ((ctxt != NULL) && (ctxt->disableSAX != 0) &&
         (ctxt->instate == XML_PARSER_EOF))
         return;
     __xmlRaiseError(NULL, NULL, NULL, ctxt, NULL, XML_FROM_NAMESPACE, error,
                     XML_ERR_WARNING, NULL, 0, (const char *) info1,
                     (const char *) info2, (const char *) info3, 0, 0, msg,
                     info1, info2, info3);
 }
 
 /************************************************************************
  *                                                                      *
- *              Library wide options                                    *
+ *              Library wide options                                    *
  *                                                                      *
  ************************************************************************/
 
 /**
   * xmlHasFeature:
   * @feature: the feature to be examined
   *
   * Examines if the library has been compiled with a given feature.
   *
   * Returns a non-zero value if the feature exist, otherwise zero.
@@ skipping 183 matching lines @@
             return(1);
 #else
             return(0);
 #endif
         case XML_WITH_ZLIB:
 #ifdef LIBXML_ZLIB_ENABLED
             return(1);
 #else
             return(0);
 #endif
+        case XML_WITH_LZMA:
+#ifdef LIBXML_LZMA_ENABLED
+            return(1);
+#else
+            return(0);
+#endif
         case XML_WITH_ICU:
 #ifdef LIBXML_ICU_ENABLED
             return(1);
 #else
             return(0);
 #endif
         default:
             break;
      }
      return(0);
 }
 
 /************************************************************************
  *                                                                      *
- *              SAX2 defaulted attributes handling                      *
+ *              SAX2 defaulted attributes handling                      *
  *                                                                      *
  ************************************************************************/
 
 /**
  * xmlDetectSAX2:
  * @ctxt:  an XML parser context
  *
  * Do the SAX2 detection and specific intialization
  */
 static void
 xmlDetectSAX2(xmlParserCtxtPtr ctxt) {
     if (ctxt == NULL) return;
 #ifdef LIBXML_SAX1_ENABLED
     if ((ctxt->sax) &&  (ctxt->sax->initialized == XML_SAX2_MAGIC) &&
         ((ctxt->sax->startElementNs != NULL) ||
          (ctxt->sax->endElementNs != NULL))) ctxt->sax2 = 1;
 #else
     ctxt->sax2 = 1;
 #endif /* LIBXML_SAX1_ENABLED */
 
     ctxt->str_xml = xmlDictLookup(ctxt->dict, BAD_CAST "xml", 3);
     ctxt->str_xmlns = xmlDictLookup(ctxt->dict, BAD_CAST "xmlns", 5);
     ctxt->str_xml_ns = xmlDictLookup(ctxt->dict, XML_XML_NAMESPACE, 36);
-    if ((ctxt->str_xml==NULL) || (ctxt->str_xmlns==NULL) || 
-                (ctxt->str_xml_ns == NULL)) {
+    if ((ctxt->str_xml==NULL) || (ctxt->str_xmlns==NULL) ||
+                (ctxt->str_xml_ns == NULL)) {
         xmlErrMemory(ctxt, NULL);
     }
 }
 
 typedef struct _xmlDefAttrs xmlDefAttrs;
 typedef xmlDefAttrs *xmlDefAttrsPtr;
 struct _xmlDefAttrs {
     int nbAttrs;        /* number of defaulted attributes on that element */
     int maxAttrs;       /* the size of the array */
     const xmlChar *values[5]; /* array of localname/prefix/values/external */
@@ skipping 289 matching lines @@
  * NOTE: this is somewhat deprecated, those productions were removed from
  *       the XML Second edition.
  *
  * [33] LanguageID ::= Langcode ('-' Subcode)*
  * [34] Langcode ::= ISO639Code |  IanaCode |  UserCode
  * [35] ISO639Code ::= ([a-z] | [A-Z]) ([a-z] | [A-Z])
  * [36] IanaCode ::= ('i' | 'I') '-' ([a-z] | [A-Z])+
  * [37] UserCode ::= ('x' | 'X') '-' ([a-z] | [A-Z])+
  * [38] Subcode ::= ([a-z] | [A-Z])+
  *
+ * The current REC reference the sucessors of RFC 1766, currently 5646
+ *
+ * http://www.rfc-editor.org/rfc/rfc5646.txt
+ * langtag       = language
+ *                 ["-" script]
+ *                 ["-" region]
+ *                 *("-" variant)
+ *                 *("-" extension)
+ *                 ["-" privateuse]
+ * language      = 2*3ALPHA            ; shortest ISO 639 code
+ *                 ["-" extlang]       ; sometimes followed by
+ *                                     ; extended language subtags
+ *               / 4ALPHA              ; or reserved for future use
+ *               / 5*8ALPHA            ; or registered language subtag
+ *
+ * extlang       = 3ALPHA              ; selected ISO 639 codes
+ *                 *2("-" 3ALPHA)      ; permanently reserved
+ *
+ * script        = 4ALPHA              ; ISO 15924 code
+ *
+ * region        = 2ALPHA              ; ISO 3166-1 code
+ *               / 3DIGIT              ; UN M.49 code
+ *
+ * variant       = 5*8alphanum         ; registered variants
+ *               / (DIGIT 3alphanum)
+ *
+ * extension     = singleton 1*("-" (2*8alphanum))
+ *
+ *                                     ; Single alphanumerics
+ *                                     ; "x" reserved for private use
+ * singleton     = DIGIT               ; 0 - 9
+ *               / %x41-57             ; A - W
+ *               / %x59-5A             ; Y - Z
+ *               / %x61-77             ; a - w
+ *               / %x79-7A             ; y - z
+ *
+ * it sounds right to still allow Irregular i-xxx IANA and user codes too
+ * The parser below doesn't try to cope with extension or privateuse
+ * that could be added but that's not interoperable anyway
+ *
  * Returns 1 if correct 0 otherwise
  **/
 int
 xmlCheckLanguageID(const xmlChar * lang)
 {
-    const xmlChar *cur = lang;
+    const xmlChar *cur = lang, *nxt;
 
     if (cur == NULL)
         return (0);
     if (((cur[0] == 'i') && (cur[1] == '-')) ||
-        ((cur[0] == 'I') && (cur[1] == '-'))) {
+        ((cur[0] == 'I') && (cur[1] == '-')) ||
+        ((cur[0] == 'x') && (cur[1] == '-')) ||
+        ((cur[0] == 'X') && (cur[1] == '-'))) {
         /*
-         * IANA code
+         * Still allow IANA code and user code which were coming
+         * from the previous version of the XML-1.0 specification
+         * it's deprecated but we should not fail
          */
         cur += 2;
-        while (((cur[0] >= 'A') && (cur[0] <= 'Z')) ||  /* non input consuming */
+        while (((cur[0] >= 'A') && (cur[0] <= 'Z')) ||
                ((cur[0] >= 'a') && (cur[0] <= 'z')))
             cur++;
-    } else if (((cur[0] == 'x') && (cur[1] == '-')) ||
-               ((cur[0] == 'X') && (cur[1] == '-'))) {
+        return(cur[0] == 0);
+    }
+    nxt = cur;
+    while (((nxt[0] >= 'A') && (nxt[0] <= 'Z')) ||
+           ((nxt[0] >= 'a') && (nxt[0] <= 'z')))
+           nxt++;
+    if (nxt - cur >= 4) {
         /*
-         * User code
+         * Reserved
          */
-        cur += 2;
-        while (((cur[0] >= 'A') && (cur[0] <= 'Z')) ||  /* non input consuming */
-               ((cur[0] >= 'a') && (cur[0] <= 'z')))
-            cur++;
-    } else if (((cur[0] >= 'A') && (cur[0] <= 'Z')) ||
-               ((cur[0] >= 'a') && (cur[0] <= 'z'))) {
-        /*
-         * ISO639
-         */
-        cur++;
-        if (((cur[0] >= 'A') && (cur[0] <= 'Z')) ||
-            ((cur[0] >= 'a') && (cur[0] <= 'z')))
-            cur++;
-        else
-            return (0);
-    } else
-        return (0);
-    while (cur[0] != 0) {       /* non input consuming */
-        if (cur[0] != '-')
-            return (0);
-        cur++;
-        if (((cur[0] >= 'A') && (cur[0] <= 'Z')) ||
-            ((cur[0] >= 'a') && (cur[0] <= 'z')))
-            cur++;
-        else
-            return (0);
-        while (((cur[0] >= 'A') && (cur[0] <= 'Z')) ||  /* non input consuming */
-               ((cur[0] >= 'a') && (cur[0] <= 'z')))
-            cur++;
+        if ((nxt - cur > 8) || (nxt[0] != 0))
+            return(0);
+        return(1);
     }
+    if (nxt - cur < 2)
+        return(0);
+    /* we got an ISO 639 code */
+    if (nxt[0] == 0)
+        return(1);
+    if (nxt[0] != '-')
+        return(0);
+
+    nxt++;
+    cur = nxt;
+    /* now we can have extlang or script or region or variant */
+    if ((nxt[0] >= '0') && (nxt[0] <= '9'))
+        goto region_m49;
+
+    while (((nxt[0] >= 'A') && (nxt[0] <= 'Z')) ||
+           ((nxt[0] >= 'a') && (nxt[0] <= 'z')))
+           nxt++;
+    if (nxt - cur == 4)
+        goto script;
+    if (nxt - cur == 2)
+        goto region;
+    if ((nxt - cur >= 5) && (nxt - cur <= 8))
+        goto variant;
+    if (nxt - cur != 3)
+        return(0);
+    /* we parsed an extlang */
+    if (nxt[0] == 0)
+        return(1);
+    if (nxt[0] != '-')
+        return(0);
+
+    nxt++;
+    cur = nxt;
+    /* now we can have script or region or variant */
+    if ((nxt[0] >= '0') && (nxt[0] <= '9'))
+        goto region_m49;
+
+    while (((nxt[0] >= 'A') && (nxt[0] <= 'Z')) ||
+           ((nxt[0] >= 'a') && (nxt[0] <= 'z')))
+           nxt++;
+    if (nxt - cur == 2)
+        goto region;
+    if ((nxt - cur >= 5) && (nxt - cur <= 8))
+        goto variant;
+    if (nxt - cur != 4)
+        return(0);
+    /* we parsed a script */
+script:
+    if (nxt[0] == 0)
+        return(1);
+    if (nxt[0] != '-')
+        return(0);
+
+    nxt++;
+    cur = nxt;
+    /* now we can have region or variant */
+    if ((nxt[0] >= '0') && (nxt[0] <= '9'))
+        goto region_m49;
+
+    while (((nxt[0] >= 'A') && (nxt[0] <= 'Z')) ||
+           ((nxt[0] >= 'a') && (nxt[0] <= 'z')))
+           nxt++;
+
+    if ((nxt - cur >= 5) && (nxt - cur <= 8))
+        goto variant;
+    if (nxt - cur != 2)
+        return(0);
+    /* we parsed a region */
+region:
+    if (nxt[0] == 0)
+        return(1);
+    if (nxt[0] != '-')
+        return(0);
+
+    nxt++;
+    cur = nxt;
+    /* now we can just have a variant */
+    while (((nxt[0] >= 'A') && (nxt[0] <= 'Z')) ||
+           ((nxt[0] >= 'a') && (nxt[0] <= 'z')))
+           nxt++;
+
+    if ((nxt - cur < 5) || (nxt - cur > 8))
+        return(0);
+
+    /* we parsed a variant */
+variant:
+    if (nxt[0] == 0)
+        return(1);
+    if (nxt[0] != '-')
+        return(0);
+    /* extensions and private use subtags not checked */
     return (1);
+
+region_m49:
+    if (((nxt[1] >= '0') && (nxt[1] <= '9')) &&
+        ((nxt[2] >= '0') && (nxt[2] <= '9'))) {
+        nxt += 3;
+        goto region;
+    }
+    return(0);
 }
 
 /************************************************************************
  *                                                                      *
  *              Parser stacks related functions and macros              *
  *                                                                      *
  ************************************************************************/
 
 static xmlEntityPtr xmlParseStringEntityRef(xmlParserCtxtPtr ctxt,
                                             const xmlChar ** str);
 
 #ifdef SAX2
 /**
  * nsPush:
  * @ctxt:  an XML parser context
  * @prefix:  the namespace prefix or NULL
  * @URL:  the namespace name
  *
  * Pushes a new parser namespace on top of the ns stack
  *
  * Returns -1 in case of error, -2 if the namespace should be discarded
  *         and the index in the stack otherwise.
  */
 static int
 nsPush(xmlParserCtxtPtr ctxt, const xmlChar *prefix, const xmlChar *URL)
 {
     if (ctxt->options & XML_PARSE_NSCLEAN) {
         int i;
-        for (i = 0;i < ctxt->nsNr;i += 2) {
+        for (i = ctxt->nsNr - 2;i >= 0;i -= 2) {
             if (ctxt->nsTab[i] == prefix) {
                 /* in scope */
                 if (ctxt->nsTab[i + 1] == URL)
                     return(-2);
                 /* out of scope keep it */
                 break;
             }
         }
     }
     if ((ctxt->nsMax == 0) || (ctxt->nsTab == NULL)) {
@@ skipping 291 matching lines @@
  *
  * Returns -1 in case of error, the index in the stack otherwise
  */
 int
 namePush(xmlParserCtxtPtr ctxt, const xmlChar * value)
 {
     if (ctxt == NULL) return (-1);
 
     if (ctxt->nameNr >= ctxt->nameMax) {
         const xmlChar * *tmp;
-        ctxt->nameMax *= 2;
         tmp = (const xmlChar * *) xmlRealloc((xmlChar * *)ctxt->nameTab,
-                                    ctxt->nameMax *
+                                    ctxt->nameMax * 2 *
                                     sizeof(ctxt->nameTab[0]));
         if (tmp == NULL) {
-            ctxt->nameMax /= 2;
             goto mem_error;
         }
         ctxt->nameTab = tmp;
+        ctxt->nameMax *= 2;
     }
     ctxt->nameTab[ctxt->nameNr] = value;
     ctxt->name = value;
     return (ctxt->nameNr++);
 mem_error:
     xmlErrMemory(ctxt, NULL);
     return (-1);
 }
 /**
  * namePop:
@@ skipping 65 matching lines @@
  *   CUR     returns the current xmlChar value, i.e. a 8 bit value if compiled
  *           This should be used internally by the parser
  *           only to compare to ASCII values otherwise it would break when
  *           running with UTF-8 encoding.
  *   RAW     same as CUR but in the input buffer, bypass any token
  *           extraction that may have been done
  *   NXT(n)  returns the n'th next xmlChar. Same as CUR is should be used only
  *           to compare on ASCII based substring.
  *   SKIP(n) Skip n xmlChar, and must also be used only to skip ASCII defined
  *           strings without newlines within the parser.
- *   NEXT1(l) Skip 1 xmlChar, and must also be used only to skip 1 non-newline ASCII 
+ *   NEXT1(l) Skip 1 xmlChar, and must also be used only to skip 1 non-newline ASCII
  *           defined char within the parser.
  * Clean macros, not dependent of an ASCII context, expect UTF-8 encoding
  *
  *   NEXT    Skip to the next character, this does the proper decoding
  *           in UTF-8 mode. It also pop-up unfinished entities on the fly.
  *   NEXTL(l) Skip the current unicode character of l xmlChars long.
  *   CUR_CHAR(l) returns the current unicode character (int), set l
  *           to the number of xmlChars used for the encoding [0-5].
  *   CUR_SCHAR  same but operate on a string instead of the context
  *   COPY_BUF  copy the current unicode char to the target buffer, increment
@@ skipping 28 matching lines @@
     ctxt->nbChars += (val),ctxt->input->cur += (val),ctxt->input->col+=(val);                   \
     if (*ctxt->input->cur == '%') xmlParserHandlePEReference(ctxt);     \
     if ((*ctxt->input->cur == 0) &&                                     \
         (xmlParserInputGrow(ctxt->input, INPUT_CHUNK) <= 0))            \
             xmlPopInput(ctxt);                                          \
   } while (0)
 
 #define SKIPL(val) do {                                                 \
     int skipl;                                                          \
     for(skipl=0; skipl<val; skipl++) {                                  \
-        if (*(ctxt->input->cur) == '\n') {                              \
+        if (*(ctxt->input->cur) == '\n') {                              \
         ctxt->input->line++; ctxt->input->col = 1;                      \
-        } else ctxt->input->col++;                                      \
-        ctxt->nbChars++;                                                \
+        } else ctxt->input->col++;                                      \
+        ctxt->nbChars++;                                                \
         ctxt->input->cur++;                                             \
     }                                                                   \
     if (*ctxt->input->cur == '%') xmlParserHandlePEReference(ctxt);     \
     if ((*ctxt->input->cur == 0) &&                                     \
         (xmlParserInputGrow(ctxt->input, INPUT_CHUNK) <= 0))            \
             xmlPopInput(ctxt);                                          \
   } while (0)
 
 #define SHRINK if ((ctxt->progressive == 0) &&                          \
                    (ctxt->input->cur - ctxt->input->base > 2 * INPUT_CHUNK) && \
                    (ctxt->input->end - ctxt->input->cur < 2 * INPUT_CHUNK)) \
         xmlSHRINK (ctxt);
 
 static void xmlSHRINK (xmlParserCtxtPtr ctxt) {
     xmlParserInputShrink(ctxt->input);
     if ((*ctxt->input->cur == 0) &&
         (xmlParserInputGrow(ctxt->input, INPUT_CHUNK) <= 0))
             xmlPopInput(ctxt);
   }
 
 #define GROW if ((ctxt->progressive == 0) &&                            \
                  (ctxt->input->end - ctxt->input->cur < INPUT_CHUNK))   \
         xmlGROW (ctxt);
 
 static void xmlGROW (xmlParserCtxtPtr ctxt) {
+    unsigned long curEnd = ctxt->input->end - ctxt->input->cur;
+    unsigned long curBase = ctxt->input->cur - ctxt->input->base;
+
+    if (((curEnd > (unsigned long) XML_MAX_LOOKUP_LIMIT) ||
+         (curBase > (unsigned long) XML_MAX_LOOKUP_LIMIT)) &&
+         ((ctxt->input->buf) && (ctxt->input->buf->readcallback != (xmlInputReadCallback) xmlNop)) &&
+        ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+        xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
+        ctxt->instate = XML_PARSER_EOF;
+    }
     xmlParserInputGrow(ctxt->input, INPUT_CHUNK);
     if ((ctxt->input->cur != NULL) && (*ctxt->input->cur == 0) &&
         (xmlParserInputGrow(ctxt->input, INPUT_CHUNK) <= 0))
             xmlPopInput(ctxt);
 }
 
 #define SKIP_BLANKS xmlSkipBlankChars(ctxt)
 
 #define NEXT xmlNextChar(ctxt)
 
@@ skipping 40 matching lines @@
      */
     if ((ctxt->inputNr == 1) && (ctxt->instate != XML_PARSER_DTD)) {
         const xmlChar *cur;
         /*
          * if we are in the document content, go really fast
          */
         cur = ctxt->input->cur;
         while (IS_BLANK_CH(*cur)) {
             if (*cur == '\n') {
                 ctxt->input->line++; ctxt->input->col = 1;
+            } else {
+                ctxt->input->col++;
             }
             cur++;
             res++;
             if (*cur == 0) {
                 ctxt->input->cur = cur;
                 xmlParserInputGrow(ctxt->input, INPUT_CHUNK);
                 cur = ctxt->input->cur;
             }
         }
         ctxt->input->cur = cur;
@@ skipping 81 matching lines @@
  * xmlParseCharRef:
  * @ctxt:  an XML parser context
  *
  * parse Reference declarations
  *
  * [66] CharRef ::= '&#' [0-9]+ ';' |
  *                  '&#x' [0-9a-fA-F]+ ';'
  *
  * [ WFC: Legal Character ]
  * Characters referred to using character references must match the
- * production for Char. 
+ * production for Char.
  *
  * Returns the value parsed (as an int), 0 in case of error
  */
 int
 xmlParseCharRef(xmlParserCtxtPtr ctxt) {
     unsigned int val = 0;
     int count = 0;
     unsigned int outofrange = 0;
 
     /*
      * Using RAW/CUR/NEXT is okay since we are working on ASCII range here
      */
     if ((RAW == '&') && (NXT(1) == '#') &&
         (NXT(2) == 'x')) {
         SKIP(3);
         GROW;
         while (RAW != ';') { /* loop blocked by count */
             if (count++ > 20) {
                 count = 0;
                 GROW;
                 if (ctxt->instate == XML_PARSER_EOF)
                     return(0);
             }
-            if ((RAW >= '0') && (RAW <= '9')) 
+            if ((RAW >= '0') && (RAW <= '9'))
                 val = val * 16 + (CUR - '0');
             else if ((RAW >= 'a') && (RAW <= 'f') && (count < 20))
                 val = val * 16 + (CUR - 'a') + 10;
             else if ((RAW >= 'A') && (RAW <= 'F') && (count < 20))
                 val = val * 16 + (CUR - 'A') + 10;
             else {
                 xmlFatalErr(ctxt, XML_ERR_INVALID_HEX_CHARREF, NULL);
                 val = 0;
                 break;
             }
@@ skipping 12 matching lines @@
     } else if  ((RAW == '&') && (NXT(1) == '#')) {
         SKIP(2);
         GROW;
         while (RAW != ';') { /* loop blocked by count */
             if (count++ > 20) {
                 count = 0;
                 GROW;
                 if (ctxt->instate == XML_PARSER_EOF)
                     return(0);
             }
-            if ((RAW >= '0') && (RAW <= '9')) 
+            if ((RAW >= '0') && (RAW <= '9'))
                 val = val * 10 + (CUR - '0');
             else {
                 xmlFatalErr(ctxt, XML_ERR_INVALID_DEC_CHARREF, NULL);
                 val = 0;
                 break;
             }
             if (val > 0x10FFFF)
                 outofrange = val;
 
             NEXT;
             count++;
         }
         if (RAW == ';') {
             /* on purpose to avoid reentrancy problems with NEXT and SKIP */
             ctxt->input->col++;
             ctxt->nbChars ++;
             ctxt->input->cur++;
         }
     } else {
         xmlFatalErr(ctxt, XML_ERR_INVALID_CHARREF, NULL);
     }
 
     /*
      * [ WFC: Legal Character ]
      * Characters referred to using character references must match the
-     * production for Char. 
+     * production for Char.
      */
     if ((IS_CHAR(val) && (outofrange == 0))) {
         return(val);
     } else {
         xmlFatalErrMsgInt(ctxt, XML_ERR_INVALID_CHAR,
                           "xmlParseCharRef: invalid xmlChar value %d\n",
                           val);
     }
     return(0);
 }
 
 /**
  * xmlParseStringCharRef:
  * @ctxt:  an XML parser context
  * @str:  a pointer to an index in the string
  *
  * parse Reference declarations, variant parsing from a string rather
  * than an an input flow.
  *
  * [66] CharRef ::= '&#' [0-9]+ ';' |
  *                  '&#x' [0-9a-fA-F]+ ';'
  *
  * [ WFC: Legal Character ]
  * Characters referred to using character references must match the
- * production for Char. 
+ * production for Char.
  *
  * Returns the value parsed (as an int), 0 in case of error, str will be
  *         updated to the current value of the index
  */
 static int
 xmlParseStringCharRef(xmlParserCtxtPtr ctxt, const xmlChar **str) {
     const xmlChar *ptr;
     xmlChar cur;
     unsigned int val = 0;
     unsigned int outofrange = 0;
 
     if ((str == NULL) || (*str == NULL)) return(0);
     ptr = *str;
     cur = *ptr;
     if ((cur == '&') && (ptr[1] == '#') && (ptr[2] == 'x')) {
         ptr += 3;
         cur = *ptr;
         while (cur != ';') { /* Non input consuming loop */
-            if ((cur >= '0') && (cur <= '9')) 
+            if ((cur >= '0') && (cur <= '9'))
                 val = val * 16 + (cur - '0');
             else if ((cur >= 'a') && (cur <= 'f'))
                 val = val * 16 + (cur - 'a') + 10;
             else if ((cur >= 'A') && (cur <= 'F'))
                 val = val * 16 + (cur - 'A') + 10;
             else {
                 xmlFatalErr(ctxt, XML_ERR_INVALID_HEX_CHARREF, NULL);
                 val = 0;
                 break;
             }
             if (val > 0x10FFFF)
                 outofrange = val;
 
             ptr++;
             cur = *ptr;
         }
         if (cur == ';')
             ptr++;
     } else if  ((cur == '&') && (ptr[1] == '#')){
         ptr += 2;
         cur = *ptr;
         while (cur != ';') { /* Non input consuming loops */
-            if ((cur >= '0') && (cur <= '9')) 
+            if ((cur >= '0') && (cur <= '9'))
                 val = val * 10 + (cur - '0');
             else {
                 xmlFatalErr(ctxt, XML_ERR_INVALID_DEC_CHARREF, NULL);
                 val = 0;
                 break;
             }
             if (val > 0x10FFFF)
                 outofrange = val;
 
             ptr++;
             cur = *ptr;
         }
         if (cur == ';')
             ptr++;
     } else {
         xmlFatalErr(ctxt, XML_ERR_INVALID_CHARREF, NULL);
         return(0);
     }
     *str = ptr;
 
     /*
      * [ WFC: Legal Character ]
      * Characters referred to using character references must match the
-     * production for Char. 
+     * production for Char.
      */
     if ((IS_CHAR(val) && (outofrange == 0))) {
         return(val);
     } else {
         xmlFatalErrMsgInt(ctxt, XML_ERR_INVALID_CHAR,
                           "xmlParseStringCharRef: invalid xmlChar value %d\n",
                           val);
     }
     return(0);
 }
 
 /**
  * xmlNewBlanksWrapperInputStream:
  * @ctxt:  an XML parser context
  * @entity:  an Entity pointer
  *
  * Create a new input stream for wrapping
  * blanks around a PEReference
  *
  * Returns the new input stream or NULL
  */
- 
+
 static void deallocblankswrapper (xmlChar *str) {xmlFree(str);}
- 
+
 static xmlParserInputPtr
 xmlNewBlanksWrapperInputStream(xmlParserCtxtPtr ctxt, xmlEntityPtr entity) {
     xmlParserInputPtr input;
     xmlChar *buffer;
     size_t length;
     if (entity == NULL) {
         xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR,
                     "xmlNewBlanksWrapperInputStream entity\n");
         return(NULL);
     }
     if (xmlParserDebugEntities)
         xmlGenericError(xmlGenericErrorContext,
                 "new blanks wrapper for entity: %s\n", entity->name);
     input = xmlNewInputStream(ctxt);
     if (input == NULL) {
         return(NULL);
     }
     length = xmlStrlen(entity->name) + 5;
     buffer = xmlMallocAtomic(length);
     if (buffer == NULL) {
         xmlErrMemory(ctxt, NULL);
         xmlFree(input);
-        return(NULL);
+        return(NULL);
     }
     buffer [0] = ' ';
     buffer [1] = '%';
     buffer [length-3] = ';';
     buffer [length-2] = ' ';
     buffer [length-1] = 0;
     memcpy(buffer + 2, entity->name, length - 5);
     input->free = deallocblankswrapper;
     input->base = buffer;
     input->cur = buffer;
     input->length = length;
     input->end = &buffer[length];
     return(input);
 }
 
 /**
  * xmlParserHandlePEReference:
  * @ctxt:  the parser context
- * 
+ *
  * [69] PEReference ::= '%' Name ';'
  *
  * [ WFC: No Recursion ]
  * A parsed entity must not contain a recursive
- * reference to itself, either directly or indirectly. 
+ * reference to itself, either directly or indirectly.
  *
  * [ WFC: Entity Declared ]
  * In a document without any DTD, a document with only an internal DTD
  * subset which contains no parameter entity references, or a document
  * with "standalone='yes'", ...  ... The declaration of a parameter
  * entity must precede any reference to it...
  *
  * [ VC: Entity Declared ]
  * In a document with an external subset or external parameter entities
  * with "standalone='no'", ...  ... The declaration of a parameter entity
  * must precede any reference to it...
  *
  * [ WFC: In DTD ]
  * Parameter-entity references may only appear in the DTD.
  * NOTE: misleading but this is handled.
  *
  * A PEReference may have been detected in the current input stream
- * the handling is done accordingly to 
+ * the handling is done accordingly to
  *      http://www.w3.org/TR/REC-xml#entproc
- * i.e. 
+ * i.e.
  *   - Included in literal in entity values
  *   - Included as Parameter Entity reference within DTDs
  */
 void
 xmlParserHandlePEReference(xmlParserCtxtPtr ctxt) {
     const xmlChar *name;
     xmlEntityPtr entity = NULL;
     xmlParserInputPtr input;
 
     if (RAW != '%') return;
@@ skipping 59 matching lines @@
     if (name == NULL) {
         xmlFatalErr(ctxt, XML_ERR_PEREF_NO_NAME, NULL);
     } else {
         if (RAW == ';') {
             NEXT;
             if ((ctxt->sax != NULL) && (ctxt->sax->getParameterEntity != NULL))
                 entity = ctxt->sax->getParameterEntity(ctxt->userData, name);
             if (ctxt->instate == XML_PARSER_EOF)
                 return;
             if (entity == NULL) {
-                
+
                 /*
                  * [ WFC: Entity Declared ]
                  * In a document without any DTD, a document with only an
                  * internal DTD subset which contains no parameter entity
                  * references, or a document with "standalone='yes'", ...
                  * ... The declaration of a parameter entity must precede
                  * any reference to it...
                  */
                 if ((ctxt->standalone == 1) ||
                     ((ctxt->hasExternalSubset == 0) &&
                      (ctxt->hasPErefs == 0))) {
                     xmlFatalErrMsgStr(ctxt, XML_ERR_UNDECLARED_ENTITY,
                          "PEReference: %%%s; not found\n", name);
                 } else {
                     /*
                      * [ VC: Entity Declared ]
                      * In a document with an external subset or external
                      * parameter entities with "standalone='no'", ...
                      * ... The declaration of a parameter entity must precede
                      * any reference to it...
                      */
                     if ((ctxt->validate) && (ctxt->vctxt.error != NULL)) {
                         xmlValidityError(ctxt, XML_WAR_UNDECLARED_ENTITY,
                                          "PEReference: %%%s; not found\n",
                                          name, NULL);
-                    } else 
+                    } else
                         xmlWarningMsg(ctxt, XML_WAR_UNDECLARED_ENTITY,
                                       "PEReference: %%%s; not found\n",
                                       name, NULL);
                     ctxt->valid = 0;
                 }
+                xmlParserEntityCheck(ctxt, 0, NULL, 0);
             } else if (ctxt->input->free != deallocblankswrapper) {
                     input = xmlNewBlanksWrapperInputStream(ctxt, entity);
                     if (xmlPushInput(ctxt, input) < 0)
                         return;
             } else {
                 if ((entity->etype == XML_INTERNAL_PARAMETER_ENTITY) ||
                     (entity->etype == XML_EXTERNAL_PARAMETER_ENTITY)) {
                     xmlChar start[4];
                     xmlCharEncoding enc;
 
                     /*
+                     * Note: external parameter entities will not be loaded, it
+                     * is not required for a non-validating parser, unless the
+                     * option of validating, or substituting entities were
+                     * given. Doing so is far more secure as the parser will
+                     * only process data coming from the document entity by
+                     * default.
+                     */
+                    if ((entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) &&
+                        ((ctxt->options & XML_PARSE_NOENT) == 0) &&
+                        ((ctxt->options & XML_PARSE_DTDVALID) == 0) &&
+                        ((ctxt->options & XML_PARSE_DTDLOAD) == 0) &&
+                        ((ctxt->options & XML_PARSE_DTDATTR) == 0) &&
+                        (ctxt->replaceEntities == 0) &&
+                        (ctxt->validate == 0))
+                        return;
+
+                    /*
                      * handle the extra spaces added before and after
                      * c.f. http://www.w3.org/TR/REC-xml#as-PE
                      * this is done independently.
                      */
                     input = xmlNewEntityInputStream(ctxt, entity);
                     if (xmlPushInput(ctxt, input) < 0)
                         return;
 
-                    /* 
+                    /*
                      * Get the 4 first bytes and decode the charset
                      * if enc != XML_CHAR_ENCODING_NONE
                      * plug some encoding conversion routines.
                      * Note that, since we may have some non-UTF8
                      * encoding (like UTF16, bug 135229), the 'length'
                      * is not known, but we can calculate based upon
                      * the amount of data in the buffer.
                      */
                     GROW
                     if (ctxt->instate == XML_PARSER_EOF)
@@ skipping 21 matching lines @@
                 }
             }
         } else {
             xmlFatalErr(ctxt, XML_ERR_PEREF_SEMICOL_MISSING, NULL);
         }
     }
 }
 
 /*
  * Macro used to grow the current buffer.
+ * buffer##_size is expected to be a size_t
+ * mem_error: is expected to handle memory allocation failures
  */
 #define growBuffer(buffer, n) {                                         \
     xmlChar *tmp;                                                       \
-    buffer##_size *= 2;                                                 \
-    buffer##_size += n;                                                 \
-    tmp = (xmlChar *)                                                   \
-                xmlRealloc(buffer, buffer##_size * sizeof(xmlChar));    \
+    size_t new_size = buffer##_size * 2 + n;                            \
+    if (new_size < buffer##_size) goto mem_error;                       \
+    tmp = (xmlChar *) xmlRealloc(buffer, new_size);                     \
     if (tmp == NULL) goto mem_error;                                    \
     buffer = tmp;                                                       \
+    buffer##_size = new_size;                                           \
 }
 
 /**
  * xmlStringLenDecodeEntities:
  * @ctxt:  the parser context
  * @str:  the input string
  * @len: the string length
  * @what:  combination of XML_SUBSTITUTE_REF and XML_SUBSTITUTE_PEREF
  * @end:  an end marker xmlChar, 0 if none
  * @end2:  an end marker xmlChar, 0 if none
  * @end3:  an end marker xmlChar, 0 if none
- * 
+ *
  * Takes a entity string content and process to do the adequate substitutions.
  *
  * [67] Reference ::= EntityRef | CharRef
  *
  * [69] PEReference ::= '%' Name ';'
  *
  * Returns A newly allocated string with the substitution done. The caller
  *      must deallocate it !
  */
 xmlChar *
 xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
                       int what, xmlChar end, xmlChar  end2, xmlChar end3) {
     xmlChar *buffer = NULL;
-    int buffer_size = 0;
+    size_t buffer_size = 0;
+    size_t nbchars = 0;
 
     xmlChar *current = NULL;
     xmlChar *rep = NULL;
     const xmlChar *last;
     xmlEntityPtr ent;
     int c,l;
-    int nbchars = 0;
 
     if ((ctxt == NULL) || (str == NULL) || (len < 0))
         return(NULL);
     last = str + len;
 
     if (((ctxt->depth > 40) &&
          ((ctxt->options & XML_PARSE_HUGE) == 0)) ||
         (ctxt->depth > 1024)) {
         xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
         return(NULL);
     }
 
     /*
      * allocate a translation buffer.
      */
     buffer_size = XML_PARSER_BIG_BUFFER_SIZE;
-    buffer = (xmlChar *) xmlMallocAtomic(buffer_size * sizeof(xmlChar));
+    buffer = (xmlChar *) xmlMallocAtomic(buffer_size);
     if (buffer == NULL) goto mem_error;
 
     /*
      * OK loop until we reach one of the ending char or a size limit.
      * we are operating on already parsed values.
      */
     if (str < last)
         c = CUR_SCHAR(str, l);
     else
         c = 0;
     while ((c != 0) && (c != end) && /* non input consuming loop */
            (c != end2) && (c != end3)) {
 
         if (c == 0) break;
         if ((c == '&') && (str[1] == '#')) {
             int val = xmlParseStringCharRef(ctxt, &str);
             if (val != 0) {
                 COPY_BUF(0,buffer,nbchars,val);
             }
-            if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
+            if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
                 growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
             }
         } else if ((c == '&') && (what & XML_SUBSTITUTE_REF)) {
             if (xmlParserDebugEntities)
                 xmlGenericError(xmlGenericErrorContext,
                         "String decoding Entity Reference: %.30s\n",
                         str);
             ent = xmlParseStringEntityRef(ctxt, &str);
             if ((ctxt->lastError.code == XML_ERR_ENTITY_LOOP) ||
                 (ctxt->lastError.code == XML_ERR_INTERNAL_ERROR))
                 goto int_error;
+            xmlParserEntityCheck(ctxt, 0, ent, 0);
             if (ent != NULL)
-                ctxt->nbentities += ent->checked;
+                ctxt->nbentities += ent->checked / 2;
             if ((ent != NULL) &&
                 (ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
                 if (ent->content != NULL) {
                     COPY_BUF(0,buffer,nbchars,ent->content[0]);
-                    if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
+                    if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
                         growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
                     }
                 } else {
                     xmlFatalErrMsg(ctxt, XML_ERR_INTERNAL_ERROR,
                             "predefined entity has no content\n");
                 }
             } else if ((ent != NULL) && (ent->content != NULL)) {
                 ctxt->depth++;
                 rep = xmlStringDecodeEntities(ctxt, ent->content, what,
                                               0, 0, 0);
                 ctxt->depth--;
 
                 if (rep != NULL) {
                     current = rep;
                     while (*current != 0) { /* non input consuming loop */
                         buffer[nbchars++] = *current++;
-                        if (nbchars >
-                            buffer_size - XML_PARSER_BUFFER_SIZE) {
-                            if (xmlParserEntityCheck(ctxt, nbchars, ent))
+                        if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
+                            if (xmlParserEntityCheck(ctxt, nbchars, ent, 0))
                                 goto int_error;
                             growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
                         }
                     }
                     xmlFree(rep);
                     rep = NULL;
                 }
             } else if (ent != NULL) {
                 int i = xmlStrlen(ent->name);
                 const xmlChar *cur = ent->name;
 
                 buffer[nbchars++] = '&';
-                if (nbchars > buffer_size - i - XML_PARSER_BUFFER_SIZE) {
+                if (nbchars + i + XML_PARSER_BUFFER_SIZE > buffer_size) {
                     growBuffer(buffer, i + XML_PARSER_BUFFER_SIZE);
                 }
                 for (;i > 0;i--)
                     buffer[nbchars++] = *cur++;
                 buffer[nbchars++] = ';';
             }
         } else if (c == '%' && (what & XML_SUBSTITUTE_PEREF)) {
             if (xmlParserDebugEntities)
                 xmlGenericError(xmlGenericErrorContext,
                         "String decoding PE Reference: %.30s\n", str);
             ent = xmlParseStringPEReference(ctxt, &str);
             if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
                 goto int_error;
+            xmlParserEntityCheck(ctxt, 0, ent, 0);
             if (ent != NULL)
-                ctxt->nbentities += ent->checked;
+                ctxt->nbentities += ent->checked / 2;
             if (ent != NULL) {
                 if (ent->content == NULL) {
                     xmlLoadEntityContent(ctxt, ent);
                 }
                 ctxt->depth++;
                 rep = xmlStringDecodeEntities(ctxt, ent->content, what,
                                               0, 0, 0);
                 ctxt->depth--;
                 if (rep != NULL) {
                     current = rep;
                     while (*current != 0) { /* non input consuming loop */
                         buffer[nbchars++] = *current++;
-                        if (nbchars >
-                            buffer_size - XML_PARSER_BUFFER_SIZE) {
-                            if (xmlParserEntityCheck(ctxt, nbchars, ent))
+                        if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
+                            if (xmlParserEntityCheck(ctxt, nbchars, ent, 0))
                                 goto int_error;
                             growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
                         }
                     }
                     xmlFree(rep);
                     rep = NULL;
                 }
             }
         } else {
             COPY_BUF(l,buffer,nbchars,c);
             str += l;
-            if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
-              growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
+            if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
+                growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
             }
         }
         if (str < last)
             c = CUR_SCHAR(str, l);
         else
             c = 0;
     }
     buffer[nbchars] = 0;
     return(buffer);
 
 mem_error:
     xmlErrMemory(ctxt, NULL);
 int_error:
     if (rep != NULL)
         xmlFree(rep);
     if (buffer != NULL)
         xmlFree(buffer);
     return(NULL);
 }
 
 /**
  * xmlStringDecodeEntities:
  * @ctxt:  the parser context
  * @str:  the input string
  * @what:  combination of XML_SUBSTITUTE_REF and XML_SUBSTITUTE_PEREF
  * @end:  an end marker xmlChar, 0 if none
  * @end2:  an end marker xmlChar, 0 if none
  * @end3:  an end marker xmlChar, 0 if none
- * 
+ *
  * Takes a entity string content and process to do the adequate substitutions.
  *
  * [67] Reference ::= EntityRef | CharRef
  *
  * [69] PEReference ::= '%' Name ';'
  *
  * Returns A newly allocated string with the substitution done. The caller
  *      must deallocate it !
  */
 xmlChar *
@@ skipping 342 matching lines @@
              ((c >= 0x2070) && (c <= 0x218F)) ||
              ((c >= 0x2C00) && (c <= 0x2FEF)) ||
              ((c >= 0x3001) && (c <= 0xD7FF)) ||
              ((c >= 0xF900) && (c <= 0xFDCF)) ||
              ((c >= 0xFDF0) && (c <= 0xFFFD)) ||
              ((c >= 0x10000) && (c <= 0xEFFFF))))
              return(1);
     } else {
         if ((IS_LETTER(c)) || (IS_DIGIT(c)) ||
             (c == '.') || (c == '-') ||
-            (c == '_') || (c == ':') || 
+            (c == '_') || (c == ':') ||
             (IS_COMBINING(c)) ||
             (IS_EXTENDER(c)))
             return(1);
     }
     return(0);
 }
 
 static xmlChar * xmlParseAttValueInternal(xmlParserCtxtPtr ctxt,
                                           int *len, int *alloc, int normalize);
 
 static const xmlChar *
 xmlParseNameComplex(xmlParserCtxtPtr ctxt) {
     int len = 0, l;
     int c;
     int count = 0;
 
 #ifdef DEBUG
     nbParseNameComplex++;
 #endif
 
     /*
      * Handler for more complex cases
      */
     GROW;
     if (ctxt->instate == XML_PARSER_EOF)
-        return(NULL);
+        return(NULL);
     c = CUR_CHAR(l);
     if ((ctxt->options & XML_PARSE_OLD10) == 0) {
         /*
          * Use the new checks of production [4] [4a] amd [5] of the
          * Update 5 of XML-1.0
          */
         if ((c == ' ') || (c == '>') || (c == '/') || /* accelerators */
             (!(((c >= 'a') && (c <= 'z')) ||
                ((c >= 'A') && (c <= 'Z')) ||
                (c == '_') || (c == ':') ||
@@ skipping 28 matching lines @@
                 ((c >= 0x37F) && (c <= 0x1FFF)) ||
                 ((c >= 0x200C) && (c <= 0x200D)) ||
                 ((c >= 0x203F) && (c <= 0x2040)) || /* !start */
                 ((c >= 0x2070) && (c <= 0x218F)) ||
                 ((c >= 0x2C00) && (c <= 0x2FEF)) ||
                 ((c >= 0x3001) && (c <= 0xD7FF)) ||
                 ((c >= 0xF900) && (c <= 0xFDCF)) ||
                 ((c >= 0xFDF0) && (c <= 0xFFFD)) ||
                 ((c >= 0x10000) && (c <= 0xEFFFF))
                 )) {
-            if (count++ > 100) {
+            if (count++ > XML_PARSER_CHUNK_SIZE) {
                 count = 0;
                 GROW;
                 if (ctxt->instate == XML_PARSER_EOF)
                     return(NULL);
             }
             len += l;
             NEXTL(l);
             c = CUR_CHAR(l);
         }
     } else {
         if ((c == ' ') || (c == '>') || (c == '/') || /* accelerators */
             (!IS_LETTER(c) && (c != '_') &&
              (c != ':'))) {
             return(NULL);
         }
         len += l;
         NEXTL(l);
         c = CUR_CHAR(l);
 
         while ((c != ' ') && (c != '>') && (c != '/') && /* test bigname.xml */
                ((IS_LETTER(c)) || (IS_DIGIT(c)) ||
                 (c == '.') || (c == '-') ||
-                (c == '_') || (c == ':') || 
+                (c == '_') || (c == ':') ||
                 (IS_COMBINING(c)) ||
                 (IS_EXTENDER(c)))) {
-            if (count++ > 100) {
+            if (count++ > XML_PARSER_CHUNK_SIZE) {
                 count = 0;
                 GROW;
                 if (ctxt->instate == XML_PARSER_EOF)
                     return(NULL);
             }
             len += l;
             NEXTL(l);
             c = CUR_CHAR(l);
+            if (c == 0) {
+                count = 0;
+                GROW;
+                if (ctxt->instate == XML_PARSER_EOF)
+                    return(NULL);
+                c = CUR_CHAR(l);
+            }
         }
     }
+    if ((len > XML_MAX_NAME_LENGTH) &&
+        ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+        xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Name");
+        return(NULL);
+    }
     if ((*ctxt->input->cur == '\n') && (ctxt->input->cur[-1] == '\r'))
         return(xmlDictLookup(ctxt->dict, ctxt->input->cur - (len + 1), len));
     return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len));
 }
 
 /**
  * xmlParseName:
  * @ctxt:  an XML parser context
  *
  * parse an XML name.
@@ skipping 29 matching lines @@
         (*in == '_') || (*in == ':')) {
         in++;
         while (((*in >= 0x61) && (*in <= 0x7A)) ||
                ((*in >= 0x41) && (*in <= 0x5A)) ||
                ((*in >= 0x30) && (*in <= 0x39)) ||
                (*in == '_') || (*in == '-') ||
                (*in == ':') || (*in == '.'))
             in++;
         if ((*in > 0) && (*in < 0x80)) {
             count = in - ctxt->input->cur;
+            if ((count > XML_MAX_NAME_LENGTH) &&
+                ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+                xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Name");
+                return(NULL);
+            }
             ret = xmlDictLookup(ctxt->dict, ctxt->input->cur, count);
             ctxt->input->cur = in;
             ctxt->nbChars += count;
             ctxt->input->col += count;
             if (ret == NULL)
                 xmlErrMemory(ctxt, NULL);
             return(ret);
         }
     }
     /* accelerator for special cases */
     return(xmlParseNameComplex(ctxt));
 }
 
 static const xmlChar *
 xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) {
     int len = 0, l;
     int c;
     int count = 0;
+    const xmlChar *end; /* needed because CUR_CHAR() can move cur on \r\n */
 
 #ifdef DEBUG
     nbParseNCNameComplex++;
 #endif
 
     /*
      * Handler for more complex cases
      */
     GROW;
+    end = ctxt->input->cur;
     c = CUR_CHAR(l);
     if ((c == ' ') || (c == '>') || (c == '/') || /* accelerators */
         (!xmlIsNameStartChar(ctxt, c) || (c == ':'))) {
         return(NULL);
     }
 
     while ((c != ' ') && (c != '>') && (c != '/') && /* test bigname.xml */
            (xmlIsNameChar(ctxt, c) && (c != ':'))) {
-        if (count++ > 100) {
+        if (count++ > XML_PARSER_CHUNK_SIZE) {
+            if ((len > XML_MAX_NAME_LENGTH) &&
+                ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+                xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");
+                return(NULL);
+            }
             count = 0;
             GROW;
             if (ctxt->instate == XML_PARSER_EOF)
                 return(NULL);
         }
         len += l;
         NEXTL(l);
+        end = ctxt->input->cur;
         c = CUR_CHAR(l);
+        if (c == 0) {
+            count = 0;
+            GROW;
+            if (ctxt->instate == XML_PARSER_EOF)
+                return(NULL);
+            end = ctxt->input->cur;
+            c = CUR_CHAR(l);
+        }
     }
-    return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len));
+    if ((len > XML_MAX_NAME_LENGTH) &&
+        ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+        xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");
+        return(NULL);
+    }
+    return(xmlDictLookup(ctxt->dict, end - len, len));
 }
 
 /**
  * xmlParseNCName:
  * @ctxt:  an XML parser context
- * @len:  lenght of the string parsed
+ * @len:  length of the string parsed
  *
  * parse an XML name.
  *
  * [4NS] NCNameChar ::= Letter | Digit | '.' | '-' | '_' |
  *                      CombiningChar | Extender
  *
  * [5NS] NCName ::= (Letter | '_') (NCNameChar)*
  *
  * Returns the Name parsed or NULL
  */
@@ skipping 17 matching lines @@
         (*in == '_')) {
         in++;
         while (((*in >= 0x61) && (*in <= 0x7A)) ||
                ((*in >= 0x41) && (*in <= 0x5A)) ||
                ((*in >= 0x30) && (*in <= 0x39)) ||
                (*in == '_') || (*in == '-') ||
                (*in == '.'))
             in++;
         if ((*in > 0) && (*in < 0x80)) {
             count = in - ctxt->input->cur;
+            if ((count > XML_MAX_NAME_LENGTH) &&
+                ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+                xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");
+                return(NULL);
+            }
             ret = xmlDictLookup(ctxt->dict, ctxt->input->cur, count);
             ctxt->input->cur = in;
             ctxt->nbChars += count;
             ctxt->input->col += count;
             if (ret == NULL) {
                 xmlErrMemory(ctxt, NULL);
             }
             return(ret);
         }
     }
@@ skipping 48 matching lines @@
  *
  * parse an XML name.
  *
  * [4] NameChar ::= Letter | Digit | '.' | '-' | '_' | ':' |
  *                  CombiningChar | Extender
  *
  * [5] Name ::= (Letter | '_' | ':') (NameChar)*
  *
  * [6] Names ::= Name (#x20 Name)*
  *
- * Returns the Name parsed or NULL. The @str pointer 
+ * Returns the Name parsed or NULL. The @str pointer
  * is updated to the current location in the string.
  */
 
 static xmlChar *
 xmlParseStringName(xmlParserCtxtPtr ctxt, const xmlChar** str) {
     xmlChar buf[XML_MAX_NAMELEN + 5];
     const xmlChar *cur = *str;
     int len = 0, l;
     int c;
 
@@ skipping 23 matching lines @@
 
             buffer = (xmlChar *) xmlMallocAtomic(max * sizeof(xmlChar));
             if (buffer == NULL) {
                 xmlErrMemory(ctxt, NULL);
                 return(NULL);
             }
             memcpy(buffer, buf, len);
             while (xmlIsNameChar(ctxt, c)) {
                 if (len + 10 > max) {
                     xmlChar *tmp;
+
+                    if ((len > XML_MAX_NAME_LENGTH) &&
+                        ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+                        xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");
+                        xmlFree(buffer);
+                        return(NULL);
+                    }
                     max *= 2;
                     tmp = (xmlChar *) xmlRealloc(buffer,
                                                     max * sizeof(xmlChar));
                     if (tmp == NULL) {
                         xmlErrMemory(ctxt, NULL);
                         xmlFree(buffer);
                         return(NULL);
                     }
                     buffer = tmp;
                 }
                 COPY_BUF(l,buffer,len,c);
                 cur += l;
                 c = CUR_SCHAR(cur, l);
             }
             buffer[len] = 0;
             *str = cur;
             return(buffer);
         }
     }
+    if ((len > XML_MAX_NAME_LENGTH) &&
+        ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+        xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");
+        return(NULL);
+    }
     *str = cur;
     return(xmlStrndup(buf, len));
 }
 
 /**
  * xmlParseNmtoken:
  * @ctxt:  an XML parser context
  *
  * parse an XML Nmtoken.
  *
@@ skipping 14 matching lines @@
 #ifdef DEBUG
     nbParseNmToken++;
 #endif
 
     GROW;
     if (ctxt->instate == XML_PARSER_EOF)
         return(NULL);
     c = CUR_CHAR(l);
 
     while (xmlIsNameChar(ctxt, c)) {
-        if (count++ > 100) {
+        if (count++ > XML_PARSER_CHUNK_SIZE) {
             count = 0;
             GROW;
         }
         COPY_BUF(l,buf,len,c);
         NEXTL(l);
         c = CUR_CHAR(l);
+        if (c == 0) {
+            count = 0;
+            GROW;
+            if (ctxt->instate == XML_PARSER_EOF)
+                return(NULL);
+            c = CUR_CHAR(l);
+        }
         if (len >= XML_MAX_NAMELEN) {
             /*
              * Okay someone managed to make a huge token, so he's ready to pay
              * for the processing speed.
              */
             xmlChar *buffer;
             int max = len * 2;
 
             buffer = (xmlChar *) xmlMallocAtomic(max * sizeof(xmlChar));
             if (buffer == NULL) {
                 xmlErrMemory(ctxt, NULL);
                 return(NULL);
             }
             memcpy(buffer, buf, len);
             while (xmlIsNameChar(ctxt, c)) {
-                if (count++ > 100) {
+                if (count++ > XML_PARSER_CHUNK_SIZE) {
                     count = 0;
                     GROW;
                     if (ctxt->instate == XML_PARSER_EOF) {
                         xmlFree(buffer);
                         return(NULL);
                     }
                 }
                 if (len + 10 > max) {
                     xmlChar *tmp;
 
+                    if ((max > XML_MAX_NAME_LENGTH) &&
+                        ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+                        xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NmToken");
+                        xmlFree(buffer);
+                        return(NULL);
+                    }
                     max *= 2;
                     tmp = (xmlChar *) xmlRealloc(buffer,
                                                     max * sizeof(xmlChar));
                     if (tmp == NULL) {
                         xmlErrMemory(ctxt, NULL);
                         xmlFree(buffer);
                         return(NULL);
                     }
                     buffer = tmp;
                 }
                 COPY_BUF(l,buffer,len,c);
                 NEXTL(l);
                 c = CUR_CHAR(l);
             }
             buffer[len] = 0;
             return(buffer);
         }
     }
     if (len == 0)
         return(NULL);
+    if ((len > XML_MAX_NAME_LENGTH) &&
+        ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+        xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NmToken");
+        return(NULL);
+    }
     return(xmlStrndup(buf, len));
 }
 
 /**
  * xmlParseEntityValue:
  * @ctxt:  an XML parser context
  * @orig:  if non-NULL store a copy of the original entity value
  *
  * parse a value for ENTITY declarations
  *
@@ skipping 37 matching lines @@
         xmlFree(buf);
         return(NULL);
     }
     NEXT;
     c = CUR_CHAR(l);
     /*
      * NOTE: 4.4.5 Included in Literal
      * When a parameter entity reference appears in a literal entity
      * value, ... a single or double quote character in the replacement
      * text is always treated as a normal data character and will not
-     * terminate the literal. 
+     * terminate the literal.
      * In practice it means we stop the loop only when back at parsing
      * the initial entity and the quote is found
      */
     while (((IS_CHAR(c)) && ((c != stop) || /* checked */
             (ctxt->input != input))) && (ctxt->instate != XML_PARSER_EOF)) {
         if (len + 5 >= size) {
             xmlChar *tmp;
 
             size *= 2;
             tmp = (xmlChar *) xmlRealloc(buf, size * sizeof(xmlChar));
@@ skipping 90 matching lines @@
  * of xmlParseAttValue() when the attribute parsing requires handling
  * of non-ASCII characters, or normalization compaction.
  *
  * Returns the AttValue parsed or NULL. The value has to be freed by the caller.
  */
 static xmlChar *
 xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
     xmlChar limit = 0;
     xmlChar *buf = NULL;
     xmlChar *rep = NULL;
-    int len = 0;
-    int buf_size = 0;
+    size_t len = 0;
+    size_t buf_size = 0;
     int c, l, in_space = 0;
     xmlChar *current = NULL;
     xmlEntityPtr ent;
 
     if (NXT(0) == '"') {
         ctxt->instate = XML_PARSER_ATTRIBUTE_VALUE;
         limit = '"';
         NEXT;
     } else if (NXT(0) == '\'') {
         limit = '\'';
         ctxt->instate = XML_PARSER_ATTRIBUTE_VALUE;
         NEXT;
     } else {
         xmlFatalErr(ctxt, XML_ERR_ATTRIBUTE_NOT_STARTED, NULL);
         return(NULL);
     }
 
     /*
      * allocate a translation buffer.
      */
     buf_size = XML_PARSER_BUFFER_SIZE;
-    buf = (xmlChar *) xmlMallocAtomic(buf_size * sizeof(xmlChar));
+    buf = (xmlChar *) xmlMallocAtomic(buf_size);
     if (buf == NULL) goto mem_error;
 
     /*
      * OK loop until we reach one of the ending char or a size limit.
      */
     c = CUR_CHAR(l);
     while (((NXT(0) != limit) && /* checked */
             (IS_CHAR(c)) && (c != '<')) &&
             (ctxt->instate != XML_PARSER_EOF)) {
+        /*
+         * Impose a reasonable limit on attribute size, unless XML_PARSE_HUGE
+         * special option is given
+         */
+        if ((len > XML_MAX_TEXT_LENGTH) &&
+            ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+            xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
+                           "AttValue length too long\n");
+            goto mem_error;
+        }
         if (c == 0) break;
         if (c == '&') {
             in_space = 0;
             if (NXT(1) == '#') {
                 int val = xmlParseCharRef(ctxt);
 
                 if (val == '&') {
                     if (ctxt->replaceEntities) {
-                        if (len > buf_size - 10) {
+                        if (len + 10 > buf_size) {
                             growBuffer(buf, 10);
                         }
                         buf[len++] = '&';
                     } else {
                         /*
                          * The reparsing will be done in xmlStringGetNodeList()
                          * called by the attribute() function in SAX.c
                          */
-                        if (len > buf_size - 10) {
+                        if (len + 10 > buf_size) {
                             growBuffer(buf, 10);
                         }
                         buf[len++] = '&';
                         buf[len++] = '#';
                         buf[len++] = '3';
                         buf[len++] = '8';
                         buf[len++] = ';';
                     }
                 } else if (val != 0) {
-                    if (len > buf_size - 10) {
+                    if (len + 10 > buf_size) {
                         growBuffer(buf, 10);
                     }
                     len += xmlCopyChar(0, &buf[len], val);
                 }
             } else {
                 ent = xmlParseEntityRef(ctxt);
                 ctxt->nbentities++;
                 if (ent != NULL)
                     ctxt->nbentities += ent->owner;
                 if ((ent != NULL) &&
                     (ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
-                    if (len > buf_size - 10) {
+                    if (len + 10 > buf_size) {
                         growBuffer(buf, 10);
                     }
                     if ((ctxt->replaceEntities == 0) &&
                         (ent->content[0] == '&')) {
                         buf[len++] = '&';
                         buf[len++] = '#';
                         buf[len++] = '3';
                         buf[len++] = '8';
                         buf[len++] = ';';
                     } else {
                         buf[len++] = ent->content[0];
                     }
-                } else if ((ent != NULL) && 
+                } else if ((ent != NULL) &&
                            (ctxt->replaceEntities != 0)) {
                     if (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY) {
                         rep = xmlStringDecodeEntities(ctxt, ent->content,
                                                       XML_SUBSTITUTE_REF,
                                                       0, 0, 0);
                         if (rep != NULL) {
                             current = rep;
                             while (*current != 0) { /* non input consuming */
                                 if ((*current == 0xD) || (*current == 0xA) ||
                                     (*current == 0x9)) {
                                     buf[len++] = 0x20;
                                     current++;
                                 } else
                                     buf[len++] = *current++;
-                                if (len > buf_size - 10) {
+                                if (len + 10 > buf_size) {
                                     growBuffer(buf, 10);
                                 }
                             }
                             xmlFree(rep);
                             rep = NULL;
                         }
                     } else {
-                        if (len > buf_size - 10) {
+                        if (len + 10 > buf_size) {
                             growBuffer(buf, 10);
                         }
                         if (ent->content != NULL)
                             buf[len++] = ent->content[0];
                     }
                 } else if (ent != NULL) {
                     int i = xmlStrlen(ent->name);
                     const xmlChar *cur = ent->name;
 
                     /*
                      * This may look absurd but is needed to detect
                      * entities problems
                      */
                     if ((ent->etype != XML_INTERNAL_PREDEFINED_ENTITY) &&
-                        (ent->content != NULL)) {
+                        (ent->content != NULL) && (ent->checked == 0)) {
+                        unsigned long oldnbent = ctxt->nbentities;
+
                         rep = xmlStringDecodeEntities(ctxt, ent->content,
                                                   XML_SUBSTITUTE_REF, 0, 0, 0);
+
+                        ent->checked = (ctxt->nbentities - oldnbent + 1) * 2;
                         if (rep != NULL) {
+                            if (xmlStrchr(rep, '<'))
+                                ent->checked |= 1;
                             xmlFree(rep);
                             rep = NULL;
                         }
                     }
 
                     /*
                      * Just output the reference
                      */
                     buf[len++] = '&';
-                    while (len > buf_size - i - 10) {
+                    while (len + i + 10 > buf_size) {
                         growBuffer(buf, i + 10);
                     }
                     for (;i > 0;i--)
                         buf[len++] = *cur++;
                     buf[len++] = ';';
                 }
             }
         } else {
             if ((c == 0x20) || (c == 0xD) || (c == 0xA) || (c == 0x9)) {
                 if ((len != 0) || (!normalize)) {
                     if ((!normalize) || (!in_space)) {
                         COPY_BUF(l,buf,len,0x20);
-                        while (len > buf_size - 10) {
+                        while (len + 10 > buf_size) {
                             growBuffer(buf, 10);
                         }
                     }
                     in_space = 1;
                 }
             } else {
                 in_space = 0;
                 COPY_BUF(l,buf,len,c);
-                if (len > buf_size - 10) {
+                if (len + 10 > buf_size) {
                     growBuffer(buf, 10);
                 }
             }
             NEXTL(l);
         }
         GROW;
         c = CUR_CHAR(l);
     }
     if (ctxt->instate == XML_PARSER_EOF)
         goto error;
 
     if ((in_space) && (normalize)) {
         while ((len > 0) && (buf[len - 1] == 0x20)) len--;
     }
     buf[len] = 0;
     if (RAW == '<') {
         xmlFatalErr(ctxt, XML_ERR_LT_IN_ATTRIBUTE, NULL);
     } else if (RAW != limit) {
         if ((c != 0) && (!IS_CHAR(c))) {
             xmlFatalErrMsg(ctxt, XML_ERR_INVALID_CHAR,
                            "invalid character in attribute value\n");
         } else {
             xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
                            "AttValue: ' expected\n");
         }
     } else
         NEXT;
-    if (attlen != NULL) *attlen = len;
+
+    /*
+     * There we potentially risk an overflow, don't allow attribute value of
+     * length more than INT_MAX it is a very reasonnable assumption !
+     */
+    if (len >= INT_MAX) {
+        xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
+                       "AttValue length too long\n");
+        goto mem_error;
+    }
+
+    if (attlen != NULL) *attlen = (int) len;
     return(buf);
 
 mem_error:
     xmlErrMemory(ctxt, NULL);
 error:
     if (buf != NULL)
         xmlFree(buf);
     if (rep != NULL)
         xmlFree(rep);
     return(NULL);
 }
 
 /**
  * xmlParseAttValue:
  * @ctxt:  an XML parser context
  *
  * parse a value for an attribute
  * Note: the parser won't do substitution of entities here, this
  * will be handled later in xmlStringGetNodeList
  *
  * [10] AttValue ::= '"' ([^<&"] | Reference)* '"' |
  *                   "'" ([^<&'] | Reference)* "'"
  *
  * 3.3.3 Attribute-Value Normalization:
  * Before the value of an attribute is passed to the application or
- * checked for validity, the XML processor must normalize it as follows: 
+ * checked for validity, the XML processor must normalize it as follows:
  * - a character reference is processed by appending the referenced
  *   character to the attribute value
  * - an entity reference is processed by recursively processing the
- *   replacement text of the entity 
+ *   replacement text of the entity
  * - a whitespace character (#x20, #xD, #xA, #x9) is processed by
  *   appending #x20 to the normalized value, except that only a single
  *   #x20 is appended for a "#xD#xA" sequence that is part of an external
- *   parsed entity or the literal entity value of an internal parsed entity 
- * - other characters are processed by appending them to the normalized value 
+ *   parsed entity or the literal entity value of an internal parsed entity
+ * - other characters are processed by appending them to the normalized value
  * If the declared value is not CDATA, then the XML processor must further
  * process the normalized attribute value by discarding any leading and
  * trailing space (#x20) characters, and by replacing sequences of space
- * (#x20) characters by a single space (#x20) character.  
+ * (#x20) characters by a single space (#x20) character.
  * All attributes for which no declaration has been read should be treated
  * by a non-validating parser as if declared CDATA.
  *
  * Returns the AttValue parsed or NULL. The value has to be freed by the caller.
  */
 
 
 xmlChar *
 xmlParseAttValue(xmlParserCtxtPtr ctxt) {
     if ((ctxt == NULL) || (ctxt->input == NULL)) return(NULL);
     return(xmlParseAttValueInternal(ctxt, NULL, NULL, 0));
 }
 
 /**
  * xmlParseSystemLiteral:
  * @ctxt:  an XML parser context
- * 
+ *
  * parse an XML Literal
  *
  * [11] SystemLiteral ::= ('"' [^"]* '"') | ("'" [^']* "'")
  *
  * Returns the SystemLiteral parsed or NULL
  */
 
 xmlChar *
 xmlParseSystemLiteral(xmlParserCtxtPtr ctxt) {
     xmlChar *buf = NULL;
     int len = 0;
     int size = XML_PARSER_BUFFER_SIZE;
     int cur, l;
     xmlChar stop;
     int state = ctxt->instate;
     int count = 0;
 
     SHRINK;
     if (RAW == '"') {
         NEXT;
         stop = '"';
     } else if (RAW == '\'') {
         NEXT;
         stop = '\'';
     } else {
         xmlFatalErr(ctxt, XML_ERR_LITERAL_NOT_STARTED, NULL);
         return(NULL);
     }
-    
+
     buf = (xmlChar *) xmlMallocAtomic(size * sizeof(xmlChar));
     if (buf == NULL) {
         xmlErrMemory(ctxt, NULL);
         return(NULL);
     }
     ctxt->instate = XML_PARSER_SYSTEM_LITERAL;
     cur = CUR_CHAR(l);
     while ((IS_CHAR(cur)) && (cur != stop)) { /* checked */
         if (len + 5 >= size) {
             xmlChar *tmp;
 
+            if ((size > XML_MAX_NAME_LENGTH) &&
+                ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+                xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "SystemLiteral");
+                xmlFree(buf);
+                ctxt->instate = (xmlParserInputState) state;
+                return(NULL);
+            }
             size *= 2;
             tmp = (xmlChar *) xmlRealloc(buf, size * sizeof(xmlChar));
             if (tmp == NULL) {
                 xmlFree(buf);
                 xmlErrMemory(ctxt, NULL);
                 ctxt->instate = (xmlParserInputState) state;
                 return(NULL);
             }
             buf = tmp;
         }
@@ skipping 61 matching lines @@
     if (buf == NULL) {
         xmlErrMemory(ctxt, NULL);
         return(NULL);
     }
     ctxt->instate = XML_PARSER_PUBLIC_LITERAL;
     cur = CUR;
     while ((IS_PUBIDCHAR_CH(cur)) && (cur != stop)) { /* checked */
         if (len + 1 >= size) {
             xmlChar *tmp;
 
+            if ((size > XML_MAX_NAME_LENGTH) &&
+                ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+                xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Public ID");
+                xmlFree(buf);
+                return(NULL);
+            }
             size *= 2;
             tmp = (xmlChar *) xmlRealloc(buf, size * sizeof(xmlChar));
             if (tmp == NULL) {
                 xmlErrMemory(ctxt, NULL);
                 xmlFree(buf);
                 return(NULL);
             }
             buf = tmp;
         }
         buf[len++] = cur;
@@ skipping 68 matching lines @@
  * xmlParseCharData:
  * @ctxt:  an XML parser context
  * @cdata:  int indicating whether we are within a CDATA section
  *
  * parse a CharData section.
  * if we are within a CDATA section ']]>' marks an end of section.
  *
  * The right angle bracket (>) may be represented using the string "&gt;",
  * and must, for compatibility, be escaped using "&gt;" or a character
  * reference when it appears in the string "]]>" in content, when that
- * string is not marking the end of a CDATA section. 
+ * string is not marking the end of a CDATA section.
  *
  * [14] CharData ::= [^<&]* - ([^<&]* ']]>' [^<&]*)
  */
 
 void
 xmlParseCharData(xmlParserCtxtPtr ctxt, int cdata) {
     const xmlChar *in;
     int nbchar = 0;
     int line = ctxt->input->line;
     int col = ctxt->input->col;
@@ skipping 146 matching lines @@
 xmlParseCharDataComplex(xmlParserCtxtPtr ctxt, int cdata) {
     xmlChar buf[XML_PARSER_BIG_BUFFER_SIZE + 5];
     int nbchar = 0;
     int cur, l;
     int count = 0;
 
     SHRINK;
     GROW;
     cur = CUR_CHAR(l);
     while ((cur != '<') && /* checked */
-           (cur != '&') && 
+           (cur != '&') &&
            (IS_CHAR(cur))) /* test also done in xmlCurrentChar() */ {
         if ((cur == ']') && (NXT(1) == ']') &&
             (NXT(2) == '>')) {
             if (cdata) break;
             else {
                 xmlFatalErr(ctxt, XML_ERR_MISPLACED_CDATA_END, NULL);
             }
         }
         COPY_BUF(l,buf,nbchar,cur);
         if (nbchar >= XML_PARSER_BIG_BUFFER_SIZE) {
@@ skipping 112 matching lines @@
         if (strict) {
             /*
              * We don't handle [83] so "S SystemLiteral" is required.
              */
             if (!IS_BLANK_CH(CUR)) {
                 xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
                         "Space required after the Public Identifier\n");
             }
         } else {
             /*
-             * We handle [83] so we return immediately, if 
+             * We handle [83] so we return immediately, if
              * "S SystemLiteral" is not detected. From a purely parsing
              * point of view that's a nice mess.
              */
             const xmlChar *ptr;
             GROW;
 
             ptr = CUR_PTR;
             if (!IS_BLANK_CH(*ptr)) return(NULL);
-            
+
             while (IS_BLANK_CH(*ptr)) ptr++; /* TODO: dangerous, fix ! */
             if ((*ptr != '\'') && (*ptr != '"')) return(NULL);
         }
         SKIP_BLANKS;
         URI = xmlParseSystemLiteral(ctxt);
         if (URI == NULL) {
             xmlFatalErr(ctxt, XML_ERR_URI_REQUIRED, NULL);
         }
     }
     return(URI);
 }
 
 /**
  * xmlParseCommentComplex:
  * @ctxt:  an XML parser context
  * @buf:  the already parsed part of the buffer
  * @len:  number of bytes filles in the buffer
  * @size:  allocated size of the buffer
  *
  * Skip an XML (SGML) comment <!-- .... -->
  *  The spec says that "For compatibility, the string "--" (double-hyphen)
  *  must not occur within comments. "
  * This is the slow routine in case the accelerator for ascii didn't work
  *
  * [15] Comment ::= '<!--' ((Char - '-') | ('-' (Char - '-')))* '-->'
  */
 static void
-xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf, int len, int size) {
+xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf,
+                       size_t len, size_t size) {
     int q, ql;
     int r, rl;
     int cur, l;
-    int count = 0;
+    size_t count = 0;
     int inputid;
 
     inputid = ctxt->input->id;
 
     if (buf == NULL) {
         len = 0;
         size = XML_PARSER_BUFFER_SIZE;
         buf = (xmlChar *) xmlMallocAtomic(size * sizeof(xmlChar));
         if (buf == NULL) {
             xmlErrMemory(ctxt, NULL);
@@ skipping 25 matching lines @@
     NEXTL(rl);
     cur = CUR_CHAR(l);
     if (cur == 0)
         goto not_terminated;
     while (IS_CHAR(cur) && /* checked */
            ((cur != '>') ||
             (r != '-') || (q != '-'))) {
         if ((r == '-') && (q == '-')) {
             xmlFatalErr(ctxt, XML_ERR_HYPHEN_IN_COMMENT, NULL);
         }
+        if ((len > XML_MAX_TEXT_LENGTH) &&
+            ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+            xmlFatalErrMsgStr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
+                         "Comment too big found", NULL);
+            xmlFree (buf);
+            return;
+        }
         if (len + 5 >= size) {
             xmlChar *new_buf;
-            size *= 2;
-            new_buf = (xmlChar *) xmlRealloc(buf, size * sizeof(xmlChar));
+            size_t new_size;
+
+            new_size = size * 2;
+            new_buf = (xmlChar *) xmlRealloc(buf, new_size);
             if (new_buf == NULL) {
                 xmlFree (buf);
                 xmlErrMemory(ctxt, NULL);
                 return;
             }
             buf = new_buf;
+            size = new_size;
         }
         COPY_BUF(ql,buf,len,q);
         q = r;
         ql = rl;
         r = cur;
         rl = l;
 
         count++;
         if (count > 50) {
             GROW;
@@ skipping 44 matching lines @@
  *
  * Skip an XML (SGML) comment <!-- .... -->
  *  The spec says that "For compatibility, the string "--" (double-hyphen)
  *  must not occur within comments. "
  *
  * [15] Comment ::= '<!--' ((Char - '-') | ('-' (Char - '-')))* '-->'
  */
 void
 xmlParseComment(xmlParserCtxtPtr ctxt) {
     xmlChar *buf = NULL;
-    int size = XML_PARSER_BUFFER_SIZE;
-    int len = 0;
+    size_t size = XML_PARSER_BUFFER_SIZE;
+    size_t len = 0;
     xmlParserInputState state;
     const xmlChar *in;
-    int nbchar = 0, ccol;
+    size_t nbchar = 0;
+    int ccol;
     int inputid;
 
     /*
      * Check that there is a comment right here.
      */
     if ((RAW != '<') || (NXT(1) != '!') ||
         (NXT(2) != '-') || (NXT(3) != '-')) return;
     state = ctxt->instate;
     ctxt->instate = XML_PARSER_COMMENT;
     inputid = ctxt->input->id;
@@ skipping 59 matching lines @@
                         ctxt->instate = state;
                         return;
                     }
                     buf = new_buf;
                 }
                 memcpy(&buf[len], ctxt->input->cur, nbchar);
                 len += nbchar;
                 buf[len] = 0;
             }
         }
+        if ((len > XML_MAX_TEXT_LENGTH) &&
+            ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+            xmlFatalErrMsgStr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
+                         "Comment too big found", NULL);
+            xmlFree (buf);
+            return;
+        }
         ctxt->input->cur = in;
         if (*in == 0xA) {
             in++;
             ctxt->input->line++; ctxt->input->col = 1;
         }
         if (*in == 0xD) {
             in++;
             if (*in == 0xA) {
                 ctxt->input->cur = in;
                 in++;
                 ctxt->input->line++; ctxt->input->col = 1;
                 continue; /* while */
             }
             in--;
         }
         SHRINK;
         GROW;
         if (ctxt->instate == XML_PARSER_EOF) {
             xmlFree(buf);
             return;
-        }
+        }
         in = ctxt->input->cur;
         if (*in == '-') {
             if (in[1] == '-') {
                 if (in[2] == '>') {
                     if (ctxt->input->id != inputid) {
                         xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
                         "comment doesn't start and stop in the same entity\n");
                     }
                     SKIP(3);
                     if ((ctxt->sax != NULL) && (ctxt->sax->comment != NULL) &&
                         (!ctxt->disableSAX)) {
                         if (buf != NULL)
                             ctxt->sax->comment(ctxt->userData, buf);
                         else
                             ctxt->sax->comment(ctxt->userData, BAD_CAST "");
                     }
                     if (buf != NULL)
                         xmlFree(buf);
                     if (ctxt->instate != XML_PARSER_EOF)
                         ctxt->instate = state;
                     return;
                 }
-                if (buf != NULL)
-                    xmlFatalErrMsgStr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
-                                      "Comment not terminated \n<!--%.50s\n",
+                if (buf != NULL) {
+                    xmlFatalErrMsgStr(ctxt, XML_ERR_HYPHEN_IN_COMMENT,
+                                      "Double hyphen within comment: "
+                                      "<!--%.50s\n",
                                       buf);
-                else
-                    xmlFatalErrMsgStr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
-                                      "Comment not terminated \n", NULL);
+                } else
+                    xmlFatalErrMsgStr(ctxt, XML_ERR_HYPHEN_IN_COMMENT,
+                                      "Double hyphen within comment\n", NULL);
                 in++;
                 ctxt->input->col++;
             }
             in++;
             ctxt->input->col++;
             goto get_more;
         }
     } while (((*in >= 0x20) && (*in <= 0x7F)) || (*in == 0x09));
     xmlParseCommentComplex(ctxt, buf, len, size);
     ctxt->instate = state;
     return;
 }
 
 
 /**
  * xmlParsePITarget:
  * @ctxt:  an XML parser context
- * 
+ *
  * parse the name of a PI
  *
  * [17] PITarget ::= Name - (('X' | 'x') ('M' | 'm') ('L' | 'l'))
  *
  * Returns the PITarget name or NULL
  */
 
 const xmlChar *
 xmlParsePITarget(xmlParserCtxtPtr ctxt) {
     const xmlChar *name;
@@ skipping 16 matching lines @@
         for (i = 0;;i++) {
             if (xmlW3CPIs[i] == NULL) break;
             if (xmlStrEqual(name, (const xmlChar *)xmlW3CPIs[i]))
                 return(name);
         }
         xmlWarningMsg(ctxt, XML_ERR_RESERVED_XML_NAME,
                       "xmlParsePITarget: invalid name prefix 'xml'\n",
                       NULL, NULL);
     }
     if ((name != NULL) && (xmlStrchr(name, ':') != NULL)) {
-        xmlNsErr(ctxt, XML_NS_ERR_COLON, 
-                 "colon are forbidden from PI names '%s'\n", name, NULL, NULL);
+        xmlNsErr(ctxt, XML_NS_ERR_COLON,
+                 "colons are forbidden from PI names '%s'\n", name, NULL, NULL);
     }
     return(name);
 }
 
 #ifdef LIBXML_CATALOG_ENABLED
 /**
  * xmlParseCatalogPI:
  * @ctxt:  an XML parser context
  * @catalog:  the PI value string
- * 
+ *
  * parse an XML Catalog Processing Instruction.
  *
  * <?oasis-xml-catalog catalog="http://example.com/catalog.xml"?>
  *
  * Occurs only if allowed by the user and if happening in the Misc
  * part of the document before any doctype informations
  * This will add the given catalog to the parsing context in order
  * to be used if there is a resolution need further down in the document
  */
 
@@ skipping 39 matching lines @@
                   "Catalog PI syntax error: %s\n",
                   catalog, NULL);
     if (URL != NULL)
         xmlFree(URL);
 }
 #endif
 
 /**
  * xmlParsePI:
  * @ctxt:  an XML parser context
- * 
+ *
  * parse an XML Processing Instruction.
  *
  * [16] PI ::= '<?' PITarget (S (Char* - (Char* '?>' Char*)))? '?>'
  *
  * The processing is transfered to SAX once parsed.
  */
 
 void
 xmlParsePI(xmlParserCtxtPtr ctxt) {
     xmlChar *buf = NULL;
-    int len = 0;
-    int size = XML_PARSER_BUFFER_SIZE;
+    size_t len = 0;
+    size_t size = XML_PARSER_BUFFER_SIZE;
     int cur, l;
     const xmlChar *target;
     xmlParserInputState state;
     int count = 0;
 
     if ((RAW == '<') && (NXT(1) == '?')) {
         xmlParserInputPtr input = ctxt->input;
         state = ctxt->instate;
         ctxt->instate = XML_PARSER_PI;
         /*
@@ skipping 36 matching lines @@
             if (!IS_BLANK(cur)) {
                 xmlFatalErrMsgStr(ctxt, XML_ERR_SPACE_REQUIRED,
                           "ParsePI: PI %s space expected\n", target);
             }
             SKIP_BLANKS;
             cur = CUR_CHAR(l);
             while (IS_CHAR(cur) && /* checked */
                    ((cur != '?') || (NXT(1) != '>'))) {
                 if (len + 5 >= size) {
                     xmlChar *tmp;
-
-                    size *= 2;
-                    tmp = (xmlChar *) xmlRealloc(buf, size * sizeof(xmlChar));
+                    size_t new_size = size * 2;
+                    tmp = (xmlChar *) xmlRealloc(buf, new_size);
                     if (tmp == NULL) {
                         xmlErrMemory(ctxt, NULL);
                         xmlFree(buf);
                         ctxt->instate = state;
                         return;
                     }
                     buf = tmp;
+                    size = new_size;
                 }
                 count++;
                 if (count > 50) {
                     GROW;
                     if (ctxt->instate == XML_PARSER_EOF) {
                         xmlFree(buf);
                         return;
                     }
                     count = 0;
+                    if ((len > XML_MAX_TEXT_LENGTH) &&
+                        ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+                        xmlFatalErrMsgStr(ctxt, XML_ERR_PI_NOT_FINISHED,
+                                          "PI %s too big found", target);
+                        xmlFree(buf);
+                        ctxt->instate = state;
+                        return;
+                    }
                 }
                 COPY_BUF(l,buf,len,cur);
                 NEXTL(l);
                 cur = CUR_CHAR(l);
                 if (cur == 0) {
                     SHRINK;
                     GROW;
                     cur = CUR_CHAR(l);
                 }
             }
+            if ((len > XML_MAX_TEXT_LENGTH) &&
+                ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+                xmlFatalErrMsgStr(ctxt, XML_ERR_PI_NOT_FINISHED,
+                                  "PI %s too big found", target);
+                xmlFree(buf);
+                ctxt->instate = state;
+                return;
+            }
             buf[len] = 0;
             if (cur != '?') {
                 xmlFatalErrMsgStr(ctxt, XML_ERR_PI_NOT_FINISHED,
                       "ParsePI: PI %s never end ...\n", target);
             } else {
                 if (input != ctxt->input) {
                     xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
             "PI declaration doesn't start and stop in the same entity\n");
                 }
                 SKIP(2);
@@ skipping 41 matching lines @@
  * and 'SYSTEM' S SystemLiteral
  *
  * See the NOTE on xmlParseExternalID().
  */
 
 void
 xmlParseNotationDecl(xmlParserCtxtPtr ctxt) {
     const xmlChar *name;
     xmlChar *Pubid;
     xmlChar *Systemid;
-    
+
     if (CMP10(CUR_PTR, '<', '!', 'N', 'O', 'T', 'A', 'T', 'I', 'O', 'N')) {
         xmlParserInputPtr input = ctxt->input;
         SHRINK;
         SKIP(10);
         if (!IS_BLANK_CH(CUR)) {
             xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
                            "Space required after '<!NOTATION'\n");
             return;
         }
         SKIP_BLANKS;
 
         name = xmlParseName(ctxt);
         if (name == NULL) {
             xmlFatalErr(ctxt, XML_ERR_NOTATION_NOT_STARTED, NULL);
             return;
         }
         if (!IS_BLANK_CH(CUR)) {
             xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
                      "Space required after the NOTATION name'\n");
             return;
         }
         if (xmlStrchr(name, ':') != NULL) {
-            xmlNsErr(ctxt, XML_NS_ERR_COLON, 
-                     "colon are forbidden from notation names '%s'\n",
+            xmlNsErr(ctxt, XML_NS_ERR_COLON,
+                     "colons are forbidden from notation names '%s'\n",
                      name, NULL, NULL);
         }
         SKIP_BLANKS;
 
         /*
          * Parse the IDs.
          */
         Systemid = xmlParseExternalID(ctxt, &Pubid, 0);
         SKIP_BLANKS;
 
@@ skipping 38 matching lines @@
 
 void
 xmlParseEntityDecl(xmlParserCtxtPtr ctxt) {
     const xmlChar *name = NULL;
     xmlChar *value = NULL;
     xmlChar *URI = NULL, *literal = NULL;
     const xmlChar *ndata = NULL;
     int isParameter = 0;
     xmlChar *orig = NULL;
     int skipped;
-    
+
     /* GROW; done in the caller */
     if (CMP8(CUR_PTR, '<', '!', 'E', 'N', 'T', 'I', 'T', 'Y')) {
         xmlParserInputPtr input = ctxt->input;
         SHRINK;
         SKIP(8);
         skipped = SKIP_BLANKS;
         if (skipped == 0) {
             xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
                            "Space required after '<!ENTITY'\n");
         }
 
         if (RAW == '%') {
             NEXT;
             skipped = SKIP_BLANKS;
             if (skipped == 0) {
                 xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
                                "Space required after '%'\n");
             }
             isParameter = 1;
         }
 
         name = xmlParseName(ctxt);
         if (name == NULL) {
             xmlFatalErrMsg(ctxt, XML_ERR_NAME_REQUIRED,
                            "xmlParseEntityDecl: no name\n");
             return;
         }
         if (xmlStrchr(name, ':') != NULL) {
-            xmlNsErr(ctxt, XML_NS_ERR_COLON, 
-                     "colon are forbidden from entities names '%s'\n",
+            xmlNsErr(ctxt, XML_NS_ERR_COLON,
+                     "colons are forbidden from entities names '%s'\n",
                      name, NULL, NULL);
         }
         skipped = SKIP_BLANKS;
         if (skipped == 0) {
             xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
                            "Space required after the entity name\n");
         }
 
         ctxt->instate = XML_PARSER_ENTITY_DECL;
         /*
@@ skipping 149 matching lines @@
                     }
                 }
             }
         }
         if (ctxt->instate == XML_PARSER_EOF)
             return;
         SKIP_BLANKS;
         if (RAW != '>') {
             xmlFatalErrMsgStr(ctxt, XML_ERR_ENTITY_NOT_FINISHED,
                     "xmlParseEntityDecl: entity %s not terminated\n", name);
+            xmlStopParser(ctxt);
         } else {
             if (input != ctxt->input) {
                 xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
         "Entity declaration doesn't start and stop in the same entity\n");
             }
             NEXT;
         }
         if (orig != NULL) {
             /*
              * Ugly mechanism to save the raw entity value.
@@ skipping 39 matching lines @@
  * if the default declaration is the keyword #REQUIRED, then the
  * attribute must be specified for all elements of the type in the
  * attribute-list declaration.
  *
  * [ VC: Attribute Default Legal ]
  * The declared default value must meet the lexical constraints of
  * the declared attribute type c.f. xmlValidateAttributeDecl()
  *
  * [ VC: Fixed Attribute Default ]
  * if an attribute has a default value declared with the #FIXED
- * keyword, instances of that attribute must match the default value. 
+ * keyword, instances of that attribute must match the default value.
  *
  * [ WFC: No < in Attribute Values ]
  * handled in xmlParseAttValue()
  *
  * returns: XML_ATTRIBUTE_NONE, XML_ATTRIBUTE_REQUIRED, XML_ATTRIBUTE_IMPLIED
- *          or XML_ATTRIBUTE_FIXED. 
+ *          or XML_ATTRIBUTE_FIXED.
  */
 
 int
 xmlParseDefaultDecl(xmlParserCtxtPtr ctxt, xmlChar **value) {
     int val;
     xmlChar *ret;
 
     *value = NULL;
     if (CMP9(CUR_PTR, '#', 'R', 'E', 'Q', 'U', 'I', 'R', 'E', 'D')) {
         SKIP(9);
@@ skipping 28 matching lines @@
  * @ctxt:  an XML parser context
  *
  * parse an Notation attribute type.
  *
  * Note: the leading 'NOTATION' S part has already being parsed...
  *
  * [58] NotationType ::= 'NOTATION' S '(' S? Name (S? '|' S? Name)* S? ')'
  *
  * [ VC: Notation Attributes ]
  * Values of this type must match one of the notation names included
- * in the declaration; all notation names in the declaration must be declared. 
+ * in the declaration; all notation names in the declaration must be declared.
  *
  * Returns: the notation attribute tree built while parsing
  */
 
 xmlEnumerationPtr
 xmlParseNotationType(xmlParserCtxtPtr ctxt) {
     const xmlChar *name;
     xmlEnumerationPtr ret = NULL, last = NULL, cur, tmp;
 
     if (RAW != '(') {
@@ skipping 179 matching lines @@
  *
  * [ VC: IDREF ]
  * Values of type IDREF must match the Name production, and values
  * of type IDREFS must match Names; each IDREF Name must match the value
  * of an ID attribute on some element in the XML document; i.e. IDREF
  * values must match the value of some ID attribute.
  *
  * [ VC: Entity Name ]
  * Values of type ENTITY must match the Name production, values
  * of type ENTITIES must match Names; each Entity Name must match the
- * name of an unparsed entity declared in the DTD.  
+ * name of an unparsed entity declared in the DTD.
  *
  * [ VC: Name Token ]
  * Values of type NMTOKEN must match the Nmtoken production; values
- * of type NMTOKENS must match Nmtokens. 
+ * of type NMTOKENS must match Nmtokens.
  *
  * Returns the attribute type
  */
-int 
+int
 xmlParseAttributeType(xmlParserCtxtPtr ctxt, xmlEnumerationPtr *tree) {
     SHRINK;
     if (CMP5(CUR_PTR, 'C', 'D', 'A', 'T', 'A')) {
         SKIP(5);
         return(XML_ATTRIBUTE_CDATA);
      } else if (CMP6(CUR_PTR, 'I', 'D', 'R', 'E', 'F', 'S')) {
         SKIP(6);
         return(XML_ATTRIBUTE_IDREFS);
      } else if (CMP5(CUR_PTR, 'I', 'D', 'R', 'E', 'F')) {
         SKIP(5);
@@ skipping 122 matching lines @@
                 break;
             }
             if ((ctxt->sax != NULL) && (!ctxt->disableSAX) &&
                 (ctxt->sax->attributeDecl != NULL))
                 ctxt->sax->attributeDecl(ctxt->userData, elemName, attrName,
                                 type, def, defaultValue, tree);
             else if (tree != NULL)
                 xmlFreeEnumeration(tree);
 
             if ((ctxt->sax2) && (defaultValue != NULL) &&
-                (def != XML_ATTRIBUTE_IMPLIED) && 
+                (def != XML_ATTRIBUTE_IMPLIED) &&
                 (def != XML_ATTRIBUTE_REQUIRED)) {
                 xmlAddDefAttrs(ctxt, elemName, attrName, defaultValue);
             }
             if (ctxt->sax2) {
                 xmlAddSpecialAttr(ctxt, elemName, attrName, type);
             }
             if (defaultValue != NULL)
                 xmlFree(defaultValue);
             GROW;
         }
         if (RAW == '>') {
             if (input != ctxt->input) {
                 xmlValidityError(ctxt, XML_ERR_ENTITY_BOUNDARY,
     "Attribute list declaration doesn't start and stop in the same entity\n",
                                  NULL, NULL);
             }
             NEXT;
         }
     }
 }
 
 /**
  * xmlParseElementMixedContentDecl:
  * @ctxt:  an XML parser context
  * @inputchk:  the input used for the current entity, needed for boundary checks
  *
  * parse the declaration for a Mixed Element content
  * The leading '(' and spaces have been skipped in xmlParseElementContentDecl
- * 
+ *
  * [51] Mixed ::= '(' S? '#PCDATA' (S? '|' S? Name)* S? ')*' |
  *                '(' S? '#PCDATA' S? ')'
  *
  * [ VC: Proper Group/PE Nesting ] applies to [51] too (see [49])
  *
  * [ VC: No Duplicate Types ]
  * The same name must not appear more than once in a single
- * mixed-content declaration. 
+ * mixed-content declaration.
  *
  * returns: the list of the xmlElementContentPtr describing the element choices
  */
 xmlElementContentPtr
 xmlParseElementMixedContentDecl(xmlParserCtxtPtr ctxt, int inputchk) {
     xmlElementContentPtr ret = NULL, cur = NULL, n;
     const xmlChar *elem = NULL;
 
     GROW;
     if (CMP7(CUR_PTR, '#', 'P', 'C', 'D', 'A', 'T', 'A')) {
@@ skipping 79 matching lines @@
 }
 
 /**
  * xmlParseElementChildrenContentDeclPriv:
  * @ctxt:  an XML parser context
  * @inputchk:  the input used for the current entity, needed for boundary checks
  * @depth: the level of recursion
  *
  * parse the declaration for a Mixed Element content
  * The leading '(' and spaces have been skipped in xmlParseElementContentDecl
- * 
+ *
  *
  * [47] children ::= (choice | seq) ('?' | '*' | '+')?
  *
  * [48] cp ::= (Name | choice | seq) ('?' | '*' | '+')?
  *
  * [49] choice ::= '(' S? cp ( S? '|' S? cp )* S? ')'
  *
  * [50] seq ::= '(' S? cp ( S? ',' S? cp )* S? ')'
  *
  * [ VC: Proper Group/PE Nesting ] applies to [49] and [50]
  * TODO Parameter-entity replacement text must be properly nested
  *      with parenthesized groups. That is to say, if either of the
  *      opening or closing parentheses in a choice, seq, or Mixed
  *      construct is contained in the replacement text for a parameter
  *      entity, both must be contained in the same replacement text. For
  *      interoperability, if a parameter-entity reference appears in a
  *      choice, seq, or Mixed construct, its replacement text should not
  *      be empty, and neither the first nor last non-blank character of
  *      the replacement text should be a connector (| or ,).
  *
- * Returns the tree of xmlElementContentPtr describing the element 
+ * Returns the tree of xmlElementContentPtr describing the element
  *          hierarchy.
  */
 static xmlElementContentPtr
 xmlParseElementChildrenContentDeclPriv(xmlParserCtxtPtr ctxt, int inputchk,
                                        int depth) {
     xmlElementContentPtr ret = NULL, cur = NULL, last = NULL, op = NULL;
     const xmlChar *elem;
     xmlChar type = 0;
 
     if (((depth > 128) && ((ctxt->options & XML_PARSE_HUGE) == 0)) ||
@@ skipping 292 matching lines @@
 }
 
 /**
  * xmlParseElementContentDecl:
  * @ctxt:  an XML parser context
  * @name:  the name of the element being defined.
  * @result:  the Element Content pointer will be stored here if any
  *
  * parse the declaration for an Element content either Mixed or Children,
  * the cases EMPTY and ANY are handled directly in xmlParseElementDecl
- * 
+ *
  * [46] contentspec ::= 'EMPTY' | 'ANY' | Mixed | children
  *
  * returns: the type of element content XML_ELEMENT_TYPE_xxx
  */
 
 int
 xmlParseElementContentDecl(xmlParserCtxtPtr ctxt, const xmlChar *name,
                            xmlElementContentPtr *result) {
 
     xmlElementContentPtr tree = NULL;
@@ skipping 107 matching lines @@
         if (RAW != '>') {
             xmlFatalErr(ctxt, XML_ERR_GT_REQUIRED, NULL);
             if (content != NULL) {
                 xmlFreeDocElementContent(ctxt->myDoc, content);
             }
         } else {
             if (input != ctxt->input) {
                 xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
     "Element declaration doesn't start and stop in the same entity\n");
             }
-                
+
             NEXT;
             if ((ctxt->sax != NULL) && (!ctxt->disableSAX) &&
                 (ctxt->sax->elementDecl != NULL)) {
                 if (content != NULL)
                     content->parent = NULL;
                 ctxt->sax->elementDecl(ctxt->userData, name, ret,
                                        content);
                 if ((content != NULL) && (content->parent == NULL)) {
                     /*
                      * this is a trick: if xmlAddElementDecl is called,
                      * instead of copying the full tree it is plugged directly
-                     * if called from the parser. Avoid duplicating the 
+                     * if called from the parser. Avoid duplicating the
                      * interfaces or change the API/ABI
                      */
                     xmlFreeDocElementContent(ctxt->myDoc, content);
                 }
             } else if (content != NULL) {
                 xmlFreeDocElementContent(ctxt->myDoc, content);
             }
         }
     }
     return(ret);
 }
 
 /**
  * xmlParseConditionalSections
  * @ctxt:  an XML parser context
  *
- * [61] conditionalSect ::= includeSect | ignoreSect 
- * [62] includeSect ::= '<![' S? 'INCLUDE' S? '[' extSubsetDecl ']]>' 
+ * [61] conditionalSect ::= includeSect | ignoreSect
+ * [62] includeSect ::= '<![' S? 'INCLUDE' S? '[' extSubsetDecl ']]>'
  * [63] ignoreSect ::= '<![' S? 'IGNORE' S? '[' ignoreSectContents* ']]>'
  * [64] ignoreSectContents ::= Ignore ('<![' ignoreSectContents ']]>' Ignore)*
  * [65] Ignore ::= Char* - (Char* ('<![' | ']]>') Char*)
  */
 
 static void
 xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
     int id = ctxt->input->id;
 
     SKIP(3);
     SKIP_BLANKS;
     if (CMP7(CUR_PTR, 'I', 'N', 'C', 'L', 'U', 'D', 'E')) {
         SKIP(7);
         SKIP_BLANKS;
         if (RAW != '[') {
             xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
+            xmlStopParser(ctxt);
+            return;
         } else {
             if (ctxt->input->id != id) {
                 xmlValidityError(ctxt, XML_ERR_ENTITY_BOUNDARY,
             "All markup of the conditional section is not in the same entity\n",
                                      NULL, NULL);
             }
             NEXT;
         }
         if (xmlParserDebugEntities) {
             if ((ctxt->input != NULL) && (ctxt->input->filename))
@@ skipping 40 matching lines @@
 
     } else if (CMP6(CUR_PTR, 'I', 'G', 'N', 'O', 'R', 'E')) {
         int state;
         xmlParserInputState instate;
         int depth = 0;
 
         SKIP(6);
         SKIP_BLANKS;
         if (RAW != '[') {
             xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
+            xmlStopParser(ctxt);
+            return;
         } else {
             if (ctxt->input->id != id) {
                 xmlValidityError(ctxt, XML_ERR_ENTITY_BOUNDARY,
             "All markup of the conditional section is not in the same entity\n",
                                      NULL, NULL);
             }
             NEXT;
         }
         if (xmlParserDebugEntities) {
             if ((ctxt->input != NULL) && (ctxt->input->filename))
@@ skipping 35 matching lines @@
             if ((ctxt->input != NULL) && (ctxt->input->filename))
                 xmlGenericError(xmlGenericErrorContext,
                         "%s(%d): ", ctxt->input->filename,
                         ctxt->input->line);
             xmlGenericError(xmlGenericErrorContext,
                     "Leaving IGNORE Conditional Section\n");
         }
 
     } else {
         xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID_KEYWORD, NULL);
+        xmlStopParser(ctxt);
+        return;
     }
 
     if (RAW == 0)
         SHRINK;
 
     if (RAW == 0) {
         xmlFatalErr(ctxt, XML_ERR_CONDSEC_NOT_FINISHED, NULL);
     } else {
         if (ctxt->input->id != id) {
             xmlValidityError(ctxt, XML_ERR_ENTITY_BOUNDARY,
         "All markup of the conditional section is not in the same entity\n",
                                  NULL, NULL);
         }
         SKIP(3);
     }
 }
 
 /**
  * xmlParseMarkupDecl:
  * @ctxt:  an XML parser context
- * 
+ *
  * parse Markup declarations
  *
  * [29] markupdecl ::= elementdecl | AttlistDecl | EntityDecl |
  *                     NotationDecl | PI | Comment
  *
  * [ VC: Proper Declaration/PE Nesting ]
  * Parameter-entity replacement text must be properly nested with
  * markup declarations. That is to say, if either the first character
  * or the last character of a markup declaration (markupdecl above) is
  * contained in the replacement text for a parameter-entity reference,
  * both must be contained in the same replacement text.
  *
  * [ WFC: PEs in Internal Subset ]
  * In the internal DTD subset, parameter-entity references can occur
  * only where markup declarations can occur, not within markup declarations.
  * (This does not apply to references that occur in external parameter
- * entities or to the external subset.) 
+ * entities or to the external subset.)
  */
 void
 xmlParseMarkupDecl(xmlParserCtxtPtr ctxt) {
     GROW;
     if (CUR == '<') {
         if (NXT(1) == '!') {
             switch (NXT(2)) {
                 case 'E':
                     if (NXT(3) == 'L')
                         xmlParseElementDecl(ctxt);
@@ skipping 108 matching lines @@
         MOVETO_ENDTAG(CUR_PTR);
         NEXT;
     }
 }
 
 /**
  * xmlParseExternalSubset:
  * @ctxt:  an XML parser context
  * @ExternalID: the external identifier
  * @SystemID: the system identifier (or URL)
- * 
+ *
  * parse Markup declarations from an external subset
  *
  * [30] extSubset ::= textDecl? extSubsetDecl
  *
  * [31] extSubsetDecl ::= (markupdecl | conditionalSect | PEReference | S) *
  */
 void
 xmlParseExternalSubset(xmlParserCtxtPtr ctxt, const xmlChar *ExternalID,
                        const xmlChar *SystemID) {
     xmlDetectSAX2(ctxt);
     GROW;
 
-    if ((ctxt->encoding == (const xmlChar *)XML_CHAR_ENCODING_NONE) &&
+    if ((ctxt->encoding == NULL) &&
         (ctxt->input->end - ctxt->input->cur >= 4)) {
         xmlChar start[4];
         xmlCharEncoding enc;
 
         start[0] = RAW;
         start[1] = NXT(1);
         start[2] = NXT(2);
         start[3] = NXT(3);
         enc = xmlDetectCharEncoding(start, 4);
         if (enc != XML_CHAR_ENCODING_NONE)
@@ skipping 145 matching lines @@
         if ((ctxt->sax != NULL) && (ctxt->sax->characters != NULL) &&
             (!ctxt->disableSAX))
             ctxt->sax->characters(ctxt->userData, val, xmlStrlen(val));
         return;
     }
 
     /*
      * The first reference to the entity trigger a parsing phase
      * where the ent->children is filled with the result from
      * the parsing.
+     * Note: external parsed entities will not be loaded, it is not
+     * required for a non-validating parser, unless the parsing option
+     * of validating, or substituting entities were given. Doing so is
+     * far more secure as the parser will only process data coming from
+     * the document entity by default.
      */
-    if (ent->checked == 0) {
+    if (((ent->checked == 0) ||
+         ((ent->children == NULL) && (ctxt->options & XML_PARSE_NOENT))) &&
+        ((ent->etype != XML_EXTERNAL_GENERAL_PARSED_ENTITY) ||
+         (ctxt->options & (XML_PARSE_NOENT | XML_PARSE_DTDVALID)))) {
         unsigned long oldnbent = ctxt->nbentities;
 
         /*
          * This is a bit hackish but this seems the best
          * way to make sure both SAX and DOM entity support
          * behaves okay.
          */
         void *user_data;
         if (ctxt->userData == ctxt)
             user_data = NULL;
@@ skipping 21 matching lines @@
         } else {
             ret = XML_ERR_ENTITY_PE_INTERNAL;
             xmlErrMsgStr(ctxt, XML_ERR_INTERNAL_ERROR,
                          "invalid entity type found\n", NULL);
         }
 
         /*
          * Store the number of entities needing parsing for this entity
          * content and do checkings
          */
-        ent->checked = ctxt->nbentities - oldnbent;
+        ent->checked = (ctxt->nbentities - oldnbent + 1) * 2;
+        if ((ent->content != NULL) && (xmlStrchr(ent->content, '<')))
+            ent->checked |= 1;
         if (ret == XML_ERR_ENTITY_LOOP) {
             xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
             xmlFreeNodeList(list);
             return;
         }
-        if (xmlParserEntityCheck(ctxt, 0, ent)) {
+        if (xmlParserEntityCheck(ctxt, 0, ent, 0)) {
             xmlFreeNodeList(list);
             return;
         }
 
         if ((ret == XML_ERR_OK) && (list != NULL)) {
             if (((ent->etype == XML_INTERNAL_GENERAL_ENTITY) ||
              (ent->etype == XML_EXTERNAL_GENERAL_PARSED_ENTITY))&&
                 (ent->children == NULL)) {
                 ent->children = list;
                 if (ctxt->replaceEntities) {
@@ skipping 19 matching lines @@
                         list = ent->children;
 #ifdef LIBXML_LEGACY_ENABLED
                         if (ent->etype == XML_EXTERNAL_GENERAL_PARSED_ENTITY)
                           xmlAddEntityReference(ent, list, NULL);
 #endif /* LIBXML_LEGACY_ENABLED */
                     }
                 } else {
                     ent->owner = 1;
                     while (list != NULL) {
                         list->parent = (xmlNodePtr) ent;
+                        xmlSetTreeDoc(list, ent->doc);
                         if (list->next == NULL)
                             ent->last = list;
                         list = list->next;
                     }
                 }
             } else {
                 xmlFreeNodeList(list);
                 list = NULL;
             }
         } else if ((ret != XML_ERR_OK) &&
                    (ret != XML_WAR_UNDECLARED_ENTITY)) {
             xmlFatalErrMsgStr(ctxt, XML_ERR_UNDECLARED_ENTITY,
                      "Entity '%s' failed to parse\n", ent->name);
+            xmlParserEntityCheck(ctxt, 0, ent, 0);
         } else if (list != NULL) {
             xmlFreeNodeList(list);
             list = NULL;
         }
         if (ent->checked == 0)
-            ent->checked = 1;
+            ent->checked = 2;
     } else if (ent->checked != 1) {
-        ctxt->nbentities += ent->checked;
+        ctxt->nbentities += ent->checked / 2;
     }
 
     /*
      * Now that the entity content has been gathered
      * provide it to the application, this can take different forms based
      * on the parsing modes.
      */
     if (ent->children == NULL) {
         /*
          * Probably running in SAX mode and the callbacks don't
@@ skipping 70 matching lines @@
          * and, if it's NULL, we copy in whatever was in the entity.
          * If it's not NULL we leave it alone.  This is somewhat of a
          * hack - maybe we should have further tests to determine
          * what to do.
          */
         if ((ctxt->node != NULL) && (ent->children != NULL)) {
             /*
              * Seems we are generating the DOM content, do
              * a simple tree copy for all references except the first
              * In the first occurrence list contains the replacement.
-             * progressive == 2 means we are operating on the Reader
-             * and since nodes are discarded we must copy all the time.
              */
             if (((list == NULL) && (ent->owner == 0)) ||
                 (ctxt->parseMode == XML_PARSE_READER)) {
                 xmlNodePtr nw = NULL, cur, firstChild = NULL;
 
                 /*
+                 * We are copying here, make sure there is no abuse
+                 */
+                ctxt->sizeentcopy += ent->length + 5;
+                if (xmlParserEntityCheck(ctxt, 0, ent, ctxt->sizeentcopy))
+                    return;
+
+                /*
                  * when operating on a reader, the entities definitions
                  * are always owning the entities subtree.
                 if (ctxt->parseMode == XML_PARSE_READER)
                     ent->owner = 1;
                  */
 
                 cur = ent->children;
                 while (cur != NULL) {
                     nw = xmlDocCopyNode(cur, ctxt->myDoc, 1);
                     if (nw != NULL) {
@@ skipping 16 matching lines @@
                             nw->extra = 1;
 
                         break;
                     }
                     cur = cur->next;
                 }
 #ifdef LIBXML_LEGACY_ENABLED
                 if (ent->etype == XML_EXTERNAL_GENERAL_PARSED_ENTITY)
                   xmlAddEntityReference(ent, firstChild, nw);
 #endif /* LIBXML_LEGACY_ENABLED */
-            } else if (list == NULL) {
+            } else if ((list == NULL) || (ctxt->inputNr > 0)) {
                 xmlNodePtr nw = NULL, cur, next, last,
                            firstChild = NULL;
+
+                /*
+                 * We are copying here, make sure there is no abuse
+                 */
+                ctxt->sizeentcopy += ent->length + 5;
+                if (xmlParserEntityCheck(ctxt, 0, ent, ctxt->sizeentcopy))
+                    return;
+
                 /*
                  * Copy the entity child list and make it the new
                  * entity child list. The goal is to make sure any
                  * ID or REF referenced will be the one from the
                  * document content and not the entity copy.
                  */
                 cur = ent->children;
                 ent->children = NULL;
                 last = ent->last;
                 ent->last = NULL;
@@ skipping 96 matching lines @@
                        "xmlParseEntityRef: no name\n");
         return(NULL);
     }
     if (RAW != ';') {
         xmlFatalErr(ctxt, XML_ERR_ENTITYREF_SEMICOL_MISSING, NULL);
         return(NULL);
     }
     NEXT;
 
     /*
-     * Predefined entites override any extra definition
+     * Predefined entities override any extra definition
      */
     if ((ctxt->options & XML_PARSE_OLDSAX) == 0) {
         ent = xmlGetPredefinedEntity(name);
         if (ent != NULL)
             return(ent);
     }
 
     /*
-     * Increate the number of entity references parsed
+     * Increase the number of entity references parsed
      */
     ctxt->nbentities++;
 
     /*
      * Ask first SAX for entity resolution, otherwise try the
      * entities which may have stored in the parser context.
      */
     if (ctxt->sax != NULL) {
         if (ctxt->sax->getEntity != NULL)
             ent = ctxt->sax->getEntity(ctxt->userData, name);
-        if ((ctxt->wellFormed == 1 ) && (ent == NULL) && 
+        if ((ctxt->wellFormed == 1 ) && (ent == NULL) &&
             (ctxt->options & XML_PARSE_OLDSAX))
             ent = xmlGetPredefinedEntity(name);
         if ((ctxt->wellFormed == 1 ) && (ent == NULL) &&
             (ctxt->userData==ctxt)) {
             ent = xmlSAX2GetEntity(ctxt, name);
         }
     }
     if (ctxt->instate == XML_PARSER_EOF)
         return(NULL);
     /*
@@ skipping 25 matching lines @@
                      "Entity '%s' not defined\n", name);
         } else {
             xmlErrMsgStr(ctxt, XML_WAR_UNDECLARED_ENTITY,
                      "Entity '%s' not defined\n", name);
             if ((ctxt->inSubset == 0) &&
                 (ctxt->sax != NULL) &&
                 (ctxt->sax->reference != NULL)) {
                 ctxt->sax->reference(ctxt->userData, name);
             }
         }
+        xmlParserEntityCheck(ctxt, 0, ent, 0);
         ctxt->valid = 0;
     }
 
     /*
      * [ WFC: Parsed Entity ]
      * An entity reference must not contain the name of an
      * unparsed entity
      */
     else if (ent->etype == XML_EXTERNAL_GENERAL_UNPARSED_ENTITY) {
         xmlFatalErrMsgStr(ctxt, XML_ERR_UNPARSED_ENTITY,
                  "Entity reference to unparsed entity %s\n", name);
     }
 
     /*
      * [ WFC: No External Entity References ]
      * Attribute values cannot contain direct or indirect
      * entity references to external entities.
      */
     else if ((ctxt->instate == XML_PARSER_ATTRIBUTE_VALUE) &&
              (ent->etype == XML_EXTERNAL_GENERAL_PARSED_ENTITY)) {
         xmlFatalErrMsgStr(ctxt, XML_ERR_ENTITY_IS_EXTERNAL,
              "Attribute references external entity '%s'\n", name);
     }
     /*
      * [ WFC: No < in Attribute Values ]
      * The replacement text of any entity referred to directly or
      * indirectly in an attribute value (other than "&lt;") must
-     * not contain a <. 
+     * not contain a <.
      */
     else if ((ctxt->instate == XML_PARSER_ATTRIBUTE_VALUE) &&
-             (ent != NULL) && (ent->content != NULL) &&
-             (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY) &&
-             (xmlStrchr(ent->content, '<'))) {
-        xmlFatalErrMsgStr(ctxt, XML_ERR_LT_IN_ATTRIBUTE,
-    "'<' in entity '%s' is not allowed in attributes values\n", name);
+             (ent != NULL) && 
+             (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY)) {
+        if (((ent->checked & 1) || (ent->checked == 0)) &&
+             (ent->content != NULL) && (xmlStrchr(ent->content, '<'))) {
+            xmlFatalErrMsgStr(ctxt, XML_ERR_LT_IN_ATTRIBUTE,
+        "'<' in entity '%s' is not allowed in attributes values\n", name);
+        }
     }
 
     /*
      * Internal check, no parameter entities here ...
      */
     else {
         switch (ent->etype) {
             case XML_INTERNAL_PARAMETER_ENTITY:
             case XML_EXTERNAL_PARAMETER_ENTITY:
             xmlFatalErrMsgStr(ctxt, XML_ERR_ENTITY_IS_PARAMETER,
              "Attempt to reference the parameter entity '%s'\n",
                               name);
             break;
             default:
             break;
         }
     }
 
     /*
      * [ WFC: No Recursion ]
      * A parsed entity must not contain a recursive reference
-     * to itself, either directly or indirectly. 
+     * to itself, either directly or indirectly.
      * Done somewhere else
      */
     return(ent);
 }
 
 /**
  * xmlParseStringEntityRef:
  * @ctxt:  an XML parser context
  * @str:  a pointer to an index in the string
  *
@@ skipping 48 matching lines @@
     if (*ptr != ';') {
         xmlFatalErr(ctxt, XML_ERR_ENTITYREF_SEMICOL_MISSING, NULL);
         xmlFree(name);
         *str = ptr;
         return(NULL);
     }
     ptr++;
 
 
     /*
-     * Predefined entites override any extra definition
+     * Predefined entities override any extra definition
      */
     if ((ctxt->options & XML_PARSE_OLDSAX) == 0) {
         ent = xmlGetPredefinedEntity(name);
         if (ent != NULL) {
             xmlFree(name);
             *str = ptr;
             return(ent);
         }
     }
 
@@ skipping 32 matching lines @@
      * The declaration of a parameter entity must precede any
      * reference to it.
      * Similarly, the declaration of a general entity must
      * precede any reference to it which appears in a default
      * value in an attribute-list declaration. Note that if
      * entities are declared in the external subset or in
      * external parameter entities, a non-validating processor
      * is not obligated to read and process their declarations;
      * for such documents, the rule that an entity must be
      * declared is a well-formedness constraint only if
-     * standalone='yes'. 
+     * standalone='yes'.
      */
     if (ent == NULL) {
         if ((ctxt->standalone == 1) ||
             ((ctxt->hasExternalSubset == 0) &&
              (ctxt->hasPErefs == 0))) {
             xmlFatalErrMsgStr(ctxt, XML_ERR_UNDECLARED_ENTITY,
                      "Entity '%s' not defined\n", name);
         } else {
             xmlErrMsgStr(ctxt, XML_WAR_UNDECLARED_ENTITY,
                           "Entity '%s' not defined\n",
                           name);
         }
+        xmlParserEntityCheck(ctxt, 0, ent, 0);
         /* TODO ? check regressions ctxt->valid = 0; */
     }
 
     /*
      * [ WFC: Parsed Entity ]
      * An entity reference must not contain the name of an
      * unparsed entity
      */
     else if (ent->etype == XML_EXTERNAL_GENERAL_UNPARSED_ENTITY) {
         xmlFatalErrMsgStr(ctxt, XML_ERR_UNPARSED_ENTITY,
@@ skipping 58 matching lines @@
  * @ctxt:  an XML parser context
  *
  * parse PEReference declarations
  * The entity content is handled directly by pushing it's content as
  * a new input stream.
  *
  * [69] PEReference ::= '%' Name ';'
  *
  * [ WFC: No Recursion ]
  * A parsed entity must not contain a recursive
- * reference to itself, either directly or indirectly. 
+ * reference to itself, either directly or indirectly.
  *
  * [ WFC: Entity Declared ]
  * In a document without any DTD, a document with only an internal DTD
  * subset which contains no parameter entity references, or a document
  * with "standalone='yes'", ...  ... The declaration of a parameter
  * entity must precede any reference to it...
  *
  * [ VC: Entity Declared ]
  * In a document with an external subset or external parameter entities
  * with "standalone='no'", ...  ... The declaration of a parameter entity
@@ skipping 60 matching lines @@
              * In a document with an external subset or external
              * parameter entities with "standalone='no'", ...
              * ... The declaration of a parameter entity must
              * precede any reference to it...
              */
             xmlWarningMsg(ctxt, XML_WAR_UNDECLARED_ENTITY,
                           "PEReference: %%%s; not found\n",
                           name, NULL);
             ctxt->valid = 0;
         }
+        xmlParserEntityCheck(ctxt, 0, NULL, 0);
     } else {
         /*
          * Internal checking in case the entity quest barfed
          */
         if ((entity->etype != XML_INTERNAL_PARAMETER_ENTITY) &&
             (entity->etype != XML_EXTERNAL_PARAMETER_ENTITY)) {
             xmlWarningMsg(ctxt, XML_WAR_UNDECLARED_ENTITY,
                   "Internal: %%%s; is not a parameter entity\n",
                           name, NULL);
         } else if (ctxt->input->free != deallocblankswrapper) {
@@ skipping 81 matching lines @@
     if (xmlPushInput(ctxt, input) < 0) {
         xmlBufferFree(buf);
         return(-1);
     }
 
     GROW;
     c = CUR_CHAR(l);
     while ((ctxt->input == input) && (ctxt->input->cur < ctxt->input->end) &&
            (IS_CHAR(c))) {
         xmlBufferAdd(buf, ctxt->input->cur, l);
-        if (count++ > 100) {
+        if (count++ > XML_PARSER_CHUNK_SIZE) {
             count = 0;
             GROW;
             if (ctxt->instate == XML_PARSER_EOF) {
                 xmlBufferFree(buf);
                 return(-1);
             }
         }
         NEXTL(l);
         c = CUR_CHAR(l);
+        if (c == 0) {
+            count = 0;
+            GROW;
+            if (ctxt->instate == XML_PARSER_EOF) {
+                xmlBufferFree(buf);
+                return(-1);
+            }
+            c = CUR_CHAR(l);
+        }
     }
 
     if ((ctxt->input == input) && (ctxt->input->cur >= ctxt->input->end)) {
         xmlPopInput(ctxt);
     } else if (!IS_CHAR(c)) {
         xmlFatalErrMsgInt(ctxt, XML_ERR_INVALID_CHAR,
                           "xmlLoadEntityContent: invalid char value %d\n",
                           c);
         xmlBufferFree(buf);
         return(-1);
@@ skipping 99 matching lines @@
              * In a document with an external subset or external
              * parameter entities with "standalone='no'", ...
              * ... The declaration of a parameter entity must
              * precede any reference to it...
              */
             xmlWarningMsg(ctxt, XML_WAR_UNDECLARED_ENTITY,
                           "PEReference: %%%s; not found\n",
                           name, NULL);
             ctxt->valid = 0;
         }
+        xmlParserEntityCheck(ctxt, 0, NULL, 0);
     } else {
         /*
          * Internal checking in case the entity quest barfed
          */
         if ((entity->etype != XML_INTERNAL_PARAMETER_ENTITY) &&
             (entity->etype != XML_EXTERNAL_PARAMETER_ENTITY)) {
             xmlWarningMsg(ctxt, XML_WAR_UNDECLARED_ENTITY,
                           "%%%s; is not a parameter entity\n",
                           name, NULL);
         }
     }
     ctxt->hasPErefs = 1;
     xmlFree(name);
     *str = ptr;
     return(entity);
 }
 
 /**
  * xmlParseDocTypeDecl:
  * @ctxt:  an XML parser context
  *
  * parse a DOCTYPE declaration
  *
- * [28] doctypedecl ::= '<!DOCTYPE' S Name (S ExternalID)? S? 
+ * [28] doctypedecl ::= '<!DOCTYPE' S Name (S ExternalID)? S?
  *                      ('[' (markupdecl | PEReference | S)* ']' S?)? '>'
  *
  * [ VC: Root Element Type ]
  * The Name in the document type declaration must match the element
- * type of the root element. 
+ * type of the root element.
  */
 
 void
 xmlParseDocTypeDecl(xmlParserCtxtPtr ctxt) {
     const xmlChar *name = NULL;
     xmlChar *ExternalID = NULL;
     xmlChar *URI = NULL;
 
     /*
      * We know that '<!DOCTYPE' has been detected.
@@ skipping 63 matching lines @@
 
 static void
 xmlParseInternalSubset(xmlParserCtxtPtr ctxt) {
     /*
      * Is there any DTD definition ?
      */
     if (RAW == '[') {
         ctxt->instate = XML_PARSER_DTD;
         NEXT;
         /*
-         * Parse the succession of Markup declarations and 
+         * Parse the succession of Markup declarations and
          * PEReferences.
          * Subsequence (markupdecl | PEReference | S)*
          */
         while ((RAW != ']') && (ctxt->instate != XML_PARSER_EOF)) {
             const xmlChar *check = CUR_PTR;
             unsigned int cons = ctxt->input->consumed;
 
             SKIP_BLANKS;
             xmlParseMarkupDecl(ctxt);
             xmlParsePEReference(ctxt);
 
             /*
              * Pop-up of finished entities.
              */
             while ((RAW == 0) && (ctxt->inputNr > 1))
                 xmlPopInput(ctxt);
 
             if ((CUR_PTR == check) && (cons == ctxt->input->consumed)) {
                 xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR,
              "xmlParseInternalSubset: error detected in Markup declaration\n");
                 break;
             }
         }
-        if (RAW == ']') { 
+        if (RAW == ']') {
             NEXT;
             SKIP_BLANKS;
         }
     }
 
     /*
      * We should be at the end of the DOCTYPE declaration.
      */
     if (RAW != '>') {
         xmlFatalErr(ctxt, XML_ERR_DOCTYPE_NOT_FINISHED, NULL);
@@ skipping 10 matching lines @@
  * parse an attribute
  *
  * [41] Attribute ::= Name Eq AttValue
  *
  * [ WFC: No External Entity References ]
  * Attribute values cannot contain direct or indirect entity references
  * to external entities.
  *
  * [ WFC: No < in Attribute Values ]
  * The replacement text of any entity referred to directly or indirectly in
- * an attribute value (other than "&lt;") must not contain a <. 
- * 
+ * an attribute value (other than "&lt;") must not contain a <.
+ *
  * [ VC: Attribute Value Type ]
  * The attribute must have been declared; the value must be of the type
  * declared for it.
  *
  * [25] Eq ::= S? '=' S?
  *
  * With namespace:
  *
  * [NS 11] Attribute ::= QName Eq AttValue
  *
@@ skipping 60 matching lines @@
         }
     }
 
     *value = val;
     return(name);
 }
 
 /**
  * xmlParseStartTag:
  * @ctxt:  an XML parser context
- * 
+ *
  * parse a start of tag either for rule element or
  * EmptyElement. In both case we don't parse the tag closing chars.
  *
  * [40] STag ::= '<' Name (S Attribute)* S? '>'
  *
  * [ WFC: Unique Att Spec ]
  * No attribute name may appear more than once in the same start-tag or
- * empty-element tag. 
+ * empty-element tag.
  *
  * [44] EmptyElemTag ::= '<' Name (S Attribute)* S? '/>'
  *
  * [ WFC: Unique Att Spec ]
  * No attribute name may appear more than once in the same start-tag or
- * empty-element tag. 
+ * empty-element tag.
  *
  * With namespace:
  *
  * [NS 8] STag ::= '<' QName (S Attribute)* S? '>'
  *
  * [NS 10] EmptyElement ::= '<' QName (S Attribute)* S? '/>'
  *
  * Returns the element name parsed
  */
 
@@ skipping 18 matching lines @@
     }
 
     /*
      * Now parse the attributes, it ends up with the ending
      *
      * (S Attribute)* S?
      */
     SKIP_BLANKS;
     GROW;
 
-    while (((RAW != '>') && 
+    while (((RAW != '>') &&
            ((RAW != '/') || (NXT(1) != '>')) &&
            (IS_BYTE_CHAR(RAW))) && (ctxt->instate != XML_PARSER_EOF)) {
         const xmlChar *q = CUR_PTR;
         unsigned int cons = ctxt->input->consumed;
 
         attname = xmlParseAttribute(ctxt, &attvalue);
         if ((attname != NULL) && (attvalue != NULL)) {
             /*
              * [ WFC: Unique Att Spec ]
              * No attribute name may appear more than once in the same
-             * start-tag or empty-element tag. 
+             * start-tag or empty-element tag.
              */
             for (i = 0; i < nbatts;i += 2) {
                 if (xmlStrEqual(atts[i], attname)) {
                     xmlErrAttributeDup(ctxt, NULL, attname);
                     xmlFree(attvalue);
                     goto failed;
                 }
             }
             /*
              * Add the pair to atts
@@ skipping 28 matching lines @@
             }
             atts[nbatts++] = attname;
             atts[nbatts++] = attvalue;
             atts[nbatts] = NULL;
             atts[nbatts + 1] = NULL;
         } else {
             if (attvalue != NULL)
                 xmlFree(attvalue);
         }
 
-failed:     
+failed:
 
         GROW
         if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
             break;
         if (!IS_BLANK_CH(RAW)) {
             xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
                            "attributes construct error\n");
         }
         SKIP_BLANKS;
         if ((cons == ctxt->input->consumed) && (q == CUR_PTR) &&
@@ skipping 61 matching lines @@
     GROW;
     SKIP_BLANKS;
     if ((!IS_BYTE_CHAR(RAW)) || (RAW != '>')) {
         xmlFatalErr(ctxt, XML_ERR_GT_REQUIRED, NULL);
     } else
         NEXT1;
 
     /*
      * [ WFC: Element Type Match ]
      * The Name in an element's end-tag must match the element type in the
-     * start-tag. 
+     * start-tag.
      *
      */
     if (name != (xmlChar*)1) {
         if (name == NULL) name = BAD_CAST "unparseable";
         xmlFatalErrMsgStrIntStr(ctxt, XML_ERR_TAG_NAME_MISMATCH,
                      "Opening and ending tag mismatch: %s line %d and %s\n",
                                 ctxt->name, line, name);
     }
 
     /*
@@ skipping 75 matching lines @@
 xmlParseQName(xmlParserCtxtPtr ctxt, const xmlChar **prefix) {
     const xmlChar *l, *p;
 
     GROW;
 
     l = xmlParseNCName(ctxt);
     if (l == NULL) {
         if (CUR == ':') {
             l = xmlParseName(ctxt);
             if (l != NULL) {
-                xmlNsErr(ctxt, XML_NS_ERR_QNAME, 
+                xmlNsErr(ctxt, XML_NS_ERR_QNAME,
                          "Failed to parse QName '%s'\n", l, NULL, NULL);
                 *prefix = NULL;
                 return(l);
             }
         }
         return(NULL);
     }
     if (CUR == ':') {
         NEXT;
         p = l;
@@ skipping 62 matching lines @@
     const xmlChar *ret;
     const xmlChar *prefix2;
 
     if (prefix == NULL) return(xmlParseNameAndCompare(ctxt, name));
 
     GROW;
     in = ctxt->input->cur;
 
     cmp = prefix;
     while (*in != 0 && *in == *cmp) {
-        ++in;
+        ++in;
         ++cmp;
     }
     if ((*cmp == 0) && (*in == ':')) {
         in++;
         cmp = name;
         while (*in != 0 && *in == *cmp) {
             ++in;
             ++cmp;
         }
         if (*cmp == 0 && (*in == '>' || IS_BLANK_CH (*in))) {
@@ skipping 17 matching lines @@
  * @len:  attribute len result
  * @alloc:  whether the attribute was reallocated as a new string
  * @normalize:  if 1 then further non-CDATA normalization must be done
  *
  * parse a value for an attribute.
  * NOTE: if no normalization is needed, the routine will return pointers
  *       directly from the data buffer.
  *
  * 3.3.3 Attribute-Value Normalization:
  * Before the value of an attribute is passed to the application or
- * checked for validity, the XML processor must normalize it as follows: 
+ * checked for validity, the XML processor must normalize it as follows:
  * - a character reference is processed by appending the referenced
  *   character to the attribute value
  * - an entity reference is processed by recursively processing the
- *   replacement text of the entity 
+ *   replacement text of the entity
  * - a whitespace character (#x20, #xD, #xA, #x9) is processed by
  *   appending #x20 to the normalized value, except that only a single
  *   #x20 is appended for a "#xD#xA" sequence that is part of an external
- *   parsed entity or the literal entity value of an internal parsed entity 
- * - other characters are processed by appending them to the normalized value 
+ *   parsed entity or the literal entity value of an internal parsed entity
+ * - other characters are processed by appending them to the normalized value
  * If the declared value is not CDATA, then the XML processor must further
  * process the normalized attribute value by discarding any leading and
  * trailing space (#x20) characters, and by replacing sequences of space
- * (#x20) characters by a single space (#x20) character.  
+ * (#x20) characters by a single space (#x20) character.
  * All attributes for which no declaration has been read should be treated
  * by a non-validating parser as if declared CDATA.
  *
  * Returns the AttValue parsed or NULL. The value has to be freed by the
  *     caller if it was copied, this can be detected by val[*len] == 0.
  */
 
 static xmlChar *
 xmlParseAttValueInternal(xmlParserCtxtPtr ctxt, int *len, int *alloc,
                          int normalize)
 {
     xmlChar limit = 0;
     const xmlChar *in = NULL, *start, *end, *last;
     xmlChar *ret = NULL;
+    int line, col;
 
     GROW;
     in = (xmlChar *) CUR_PTR;
+    line = ctxt->input->line;
+    col = ctxt->input->col;
     if (*in != '"' && *in != '\'') {
         xmlFatalErr(ctxt, XML_ERR_ATTRIBUTE_NOT_STARTED, NULL);
         return (NULL);
     }
     ctxt->instate = XML_PARSER_ATTRIBUTE_VALUE;
 
     /*
      * try to handle in this routine the most common case where no
      * allocation of a new string is required and where content is
      * pure ASCII.
      */
     limit = *in++;
+    col++;
     end = ctxt->input->end;
     start = in;
     if (in >= end) {
         const xmlChar *oldbase = ctxt->input->base;
         GROW;
         if (oldbase != ctxt->input->base) {
             long delta = ctxt->input->base - oldbase;
             start = start + delta;
             in = in + delta;
         }
         end = ctxt->input->end;
     }
     if (normalize) {
         /*
          * Skip any leading spaces
          */
-        while ((in < end) && (*in != limit) && 
+        while ((in < end) && (*in != limit) &&
                ((*in == 0x20) || (*in == 0x9) ||
                 (*in == 0xA) || (*in == 0xD))) {
+            if (*in == 0xA) {
+                line++; col = 1;
+            } else {
+                col++;
+            }
             in++;
             start = in;
             if (in >= end) {
                 const xmlChar *oldbase = ctxt->input->base;
                 GROW;
                 if (ctxt->instate == XML_PARSER_EOF)
                     return(NULL);
                 if (oldbase != ctxt->input->base) {
                     long delta = ctxt->input->base - oldbase;
                     start = start + delta;
                     in = in + delta;
                 }
                 end = ctxt->input->end;
+                if (((in - start) > XML_MAX_TEXT_LENGTH) &&
+                    ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+                    xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
+                                   "AttValue length too long\n");
+                    return(NULL);
+                }
             }
         }
         while ((in < end) && (*in != limit) && (*in >= 0x20) &&
                (*in <= 0x7f) && (*in != '&') && (*in != '<')) {
+            col++;
             if ((*in++ == 0x20) && (*in == 0x20)) break;
             if (in >= end) {
                 const xmlChar *oldbase = ctxt->input->base;
                 GROW;
                 if (ctxt->instate == XML_PARSER_EOF)
                     return(NULL);
                 if (oldbase != ctxt->input->base) {
                     long delta = ctxt->input->base - oldbase;
                     start = start + delta;
                     in = in + delta;
                 }
                 end = ctxt->input->end;
+                if (((in - start) > XML_MAX_TEXT_LENGTH) &&
+                    ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+                    xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
+                                   "AttValue length too long\n");
+                    return(NULL);
+                }
             }
         }
         last = in;
         /*
          * skip the trailing blanks
          */
         while ((last[-1] == 0x20) && (last > start)) last--;
-        while ((in < end) && (*in != limit) && 
+        while ((in < end) && (*in != limit) &&
                ((*in == 0x20) || (*in == 0x9) ||
                 (*in == 0xA) || (*in == 0xD))) {
+            if (*in == 0xA) {
+                line++, col = 1;
+            } else {
+                col++;
+            }
             in++;
             if (in >= end) {
                 const xmlChar *oldbase = ctxt->input->base;
                 GROW;
                 if (ctxt->instate == XML_PARSER_EOF)
                     return(NULL);
                 if (oldbase != ctxt->input->base) {
                     long delta = ctxt->input->base - oldbase;
                     start = start + delta;
                     in = in + delta;
                     last = last + delta;
                 }
                 end = ctxt->input->end;
+                if (((in - start) > XML_MAX_TEXT_LENGTH) &&
+                    ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+                    xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
+                                   "AttValue length too long\n");
+                    return(NULL);
+                }
             }
         }
+        if (((in - start) > XML_MAX_TEXT_LENGTH) &&
+            ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+            xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
+                           "AttValue length too long\n");
+            return(NULL);
+        }
         if (*in != limit) goto need_complex;
     } else {
         while ((in < end) && (*in != limit) && (*in >= 0x20) &&
                (*in <= 0x7f) && (*in != '&') && (*in != '<')) {
             in++;
+            col++;
             if (in >= end) {
                 const xmlChar *oldbase = ctxt->input->base;
                 GROW;
                 if (ctxt->instate == XML_PARSER_EOF)
                     return(NULL);
                 if (oldbase != ctxt->input->base) {
                     long delta = ctxt->input->base - oldbase;
                     start = start + delta;
                     in = in + delta;
                 }
                 end = ctxt->input->end;
+                if (((in - start) > XML_MAX_TEXT_LENGTH) &&
+                    ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+                    xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
+                                   "AttValue length too long\n");
+                    return(NULL);
+                }
             }
         }
         last = in;
+        if (((in - start) > XML_MAX_TEXT_LENGTH) &&
+            ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+            xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
+                           "AttValue length too long\n");
+            return(NULL);
+        }
         if (*in != limit) goto need_complex;
     }
     in++;
+    col++;
     if (len != NULL) {
         *len = last - start;
         ret = (xmlChar *) start;
     } else {
         if (alloc) *alloc = 1;
         ret = xmlStrndup(start, last - start);
     }
     CUR_PTR = in;
+    ctxt->input->line = line;
+    ctxt->input->col = col;
     if (alloc) *alloc = 0;
     return ret;
 need_complex:
     if (alloc) *alloc = 1;
     return xmlParseAttValueComplex(ctxt, len, normalize);
 }
 
 /**
  * xmlParseAttribute2:
  * @ctxt:  an XML parser context
@@ skipping 107 matching lines @@
             xmlFree(internal_val);
         }
     }
 
     *value = val;
     return (name);
 }
 /**
  * xmlParseStartTag2:
  * @ctxt:  an XML parser context
- * 
+ *
  * parse a start of tag either for rule element or
  * EmptyElement. In both case we don't parse the tag closing chars.
  * This routine is called when running SAX2 parsing
  *
  * [40] STag ::= '<' Name (S Attribute)* S? '>'
  *
  * [ WFC: Unique Att Spec ]
  * No attribute name may appear more than once in the same start-tag or
- * empty-element tag. 
+ * empty-element tag.
  *
  * [44] EmptyElemTag ::= '<' Name (S Attribute)* S? '/>'
  *
  * [ WFC: Unique Att Spec ]
  * No attribute name may appear more than once in the same start-tag or
- * empty-element tag. 
+ * empty-element tag.
  *
  * With namespace:
  *
  * [NS 8] STag ::= '<' QName (S Attribute)* S? '>'
  *
  * [NS 10] EmptyElement ::= '<' QName (S Attribute)* S? '/>'
  *
  * Returns the element name parsed
  */
 
@@ skipping 48 matching lines @@
 
     /*
      * Now parse the attributes, it ends up with the ending
      *
      * (S Attribute)* S?
      */
     SKIP_BLANKS;
     GROW;
     if (ctxt->input->base != base) goto base_changed;
 
-    while (((RAW != '>') && 
+    while (((RAW != '>') &&
            ((RAW != '/') || (NXT(1) != '>')) &&
            (IS_BYTE_CHAR(RAW))) && (ctxt->instate != XML_PARSER_EOF)) {
         const xmlChar *q = CUR_PTR;
         unsigned int cons = ctxt->input->consumed;
         int len = -1, alloc = 0;
 
         attname = xmlParseAttribute2(ctxt, prefix, localname,
                                      &aprefix, &attvalue, &len, &alloc);
         if (ctxt->input->base != base) {
             if ((attvalue != NULL) && (alloc != 0))
                 xmlFree(attvalue);
             attvalue = NULL;
             goto base_changed;
         }
         if ((attname != NULL) && (attvalue != NULL)) {
             if (len < 0) len = xmlStrlen(attvalue);
             if ((attname == ctxt->str_xmlns) && (aprefix == NULL)) {
                 const xmlChar *URL = xmlDictLookup(ctxt->dict, attvalue, len);
                 xmlURIPtr uri;
 
+                if (URL == NULL) {
+                    xmlErrMemory(ctxt, "dictionary allocation failure");
+                    if ((attvalue != NULL) && (alloc != 0))
+                        xmlFree(attvalue);
+                    return(NULL);
+                }
                 if (*URL != 0) {
                     uri = xmlParseURI((const char *) URL);
                     if (uri == NULL) {
                         xmlNsErr(ctxt, XML_WAR_NS_URI,
                                  "xmlns: '%s' is not a valid URI\n",
                                            URL, NULL, NULL);
                     } else {
                         if (uri->scheme == NULL) {
                             xmlNsWarn(ctxt, XML_WAR_NS_URI_RELATIVE,
                                       "xmlns: URI %s is not absolute\n",
@@ skipping 23 matching lines @@
                  */
                 for (j = 1;j <= nbNs;j++)
                     if (ctxt->nsTab[ctxt->nsNr - 2 * j] == NULL)
                         break;
                 if (j <= nbNs)
                     xmlErrAttributeDup(ctxt, NULL, attname);
                 else
                     if (nsPush(ctxt, NULL, URL) > 0) nbNs++;
 skip_default_ns:
                 if (alloc != 0) xmlFree(attvalue);
+                if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
+                    break;
+                if (!IS_BLANK_CH(RAW)) {
+                    xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
+                                   "attributes construct error\n");
+                    break;
+                }
                 SKIP_BLANKS;
                 continue;
             }
             if (aprefix == ctxt->str_xmlns) {
                 const xmlChar *URL = xmlDictLookup(ctxt->dict, attvalue, len);
                 xmlURIPtr uri;
 
                 if (attname == ctxt->str_xml) {
                     if (URL != ctxt->str_xml_ns) {
                         xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
@@ skipping 53 matching lines @@
                  */
                 for (j = 1;j <= nbNs;j++)
                     if (ctxt->nsTab[ctxt->nsNr - 2 * j] == attname)
                         break;
                 if (j <= nbNs)
                     xmlErrAttributeDup(ctxt, aprefix, attname);
                 else
                     if (nsPush(ctxt, attname, URL) > 0) nbNs++;
 skip_ns:
                 if (alloc != 0) xmlFree(attvalue);
+                if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
+                    break;
+                if (!IS_BLANK_CH(RAW)) {
+                    xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
+                                   "attributes construct error\n");
+                    break;
+                }
                 SKIP_BLANKS;
                 if (ctxt->input->base != base) goto base_changed;
                 continue;
             }
 
             /*
              * Add the pair to atts
              */
             if ((atts == NULL) || (nbatts + 5 > maxatts)) {
                 if (xmlCtxtGrowAttrs(ctxt, nbatts + 5) < 0) {
@@ skipping 109 matching lines @@
                     atts[nbatts++] = attname;
                     atts[nbatts++] = aprefix;
                     if (aprefix == NULL)
                         atts[nbatts++] = NULL;
                     else
                         atts[nbatts++] = xmlGetNamespace(ctxt, aprefix);
                     atts[nbatts++] = defaults->values[5 * i + 2];
                     atts[nbatts++] = defaults->values[5 * i + 3];
                     if ((ctxt->standalone == 1) &&
                         (defaults->values[5 * i + 4] != NULL)) {
-                        xmlValidityError(ctxt, XML_DTD_STANDALONE_DEFAULTED, 
+                        xmlValidityError(ctxt, XML_DTD_STANDALONE_DEFAULTED,
           "standalone: attribute %s on %s defaulted from external subset\n",
                                          attname, localname);
                     }
                     nbdef++;
                 }
             }
         }
     }
 
     /*
      * The attributes checkings
      */
     for (i = 0; i < nbatts;i += 5) {
         /*
         * The default namespace does not apply to attribute names.
         */
         if (atts[i + 1] != NULL) {
             nsname = xmlGetNamespace(ctxt, atts[i + 1]);
             if (nsname == NULL) {
                 xmlNsErr(ctxt, XML_NS_ERR_UNDEFINED_NAMESPACE,
                     "Namespace prefix %s for %s on %s is not defined\n",
                     atts[i + 1], atts[i], localname);
             }
             atts[i + 2] = nsname;
         } else
             nsname = NULL;
         /*
          * [ WFC: Unique Att Spec ]
          * No attribute name may appear more than once in the same
-         * start-tag or empty-element tag. 
+         * start-tag or empty-element tag.
          * As extended by the Namespace in XML REC.
          */
         for (j = 0; j < i;j += 5) {
             if (atts[i] == atts[j]) {
                 if (atts[i+1] == atts[j+1]) {
                     xmlErrAttributeDup(ctxt, atts[i+1], atts[i]);
                     break;
                 }
                 if ((nsname != NULL) && (atts[j + 2] == nsname)) {
                     xmlNsErr(ctxt, XML_NS_ERR_ATTRIBUTE_REDEFINED,
@@ skipping 80 matching lines @@
     GROW;
     if ((RAW != '<') || (NXT(1) != '/')) {
         xmlFatalErr(ctxt, XML_ERR_LTSLASH_REQUIRED, NULL);
         return;
     }
     SKIP(2);
 
     if ((tlen > 0) && (xmlStrncmp(ctxt->input->cur, ctxt->name, tlen) == 0)) {
         if (ctxt->input->cur[tlen] == '>') {
             ctxt->input->cur += tlen + 1;
+            ctxt->input->col += tlen + 1;
             goto done;
         }
         ctxt->input->cur += tlen;
+        ctxt->input->col += tlen;
         name = (xmlChar*)1;
     } else {
         if (prefix == NULL)
             name = xmlParseNameAndCompare(ctxt, ctxt->name);
         else
             name = xmlParseQNameAndCompare(ctxt, ctxt->name, prefix);
     }
 
     /*
      * We should definitely be at the ending "S? '>'" part
      */
     GROW;
     if (ctxt->instate == XML_PARSER_EOF)
         return;
     SKIP_BLANKS;
     if ((!IS_BYTE_CHAR(RAW)) || (RAW != '>')) {
         xmlFatalErr(ctxt, XML_ERR_GT_REQUIRED, NULL);
     } else
         NEXT1;
 
     /*
      * [ WFC: Element Type Match ]
      * The Name in an element's end-tag must match the element type in the
-     * start-tag. 
+     * start-tag.
      *
      */
     if (name != (xmlChar*)1) {
         if (name == NULL) name = BAD_CAST "unparseable";
         if ((line == 0) && (ctxt->node != NULL))
             line = ctxt->node->line;
         xmlFatalErrMsgStrIntStr(ctxt, XML_ERR_TAG_NAME_MISMATCH,
                      "Opening and ending tag mismatch: %s line %d and %s\n",
                                 ctxt->name, line, name);
     }
 
     /*
      * SAX: End of Tag
      */
 done:
     if ((ctxt->sax != NULL) && (ctxt->sax->endElementNs != NULL) &&
         (!ctxt->disableSAX))
         ctxt->sax->endElementNs(ctxt->userData, ctxt->name, prefix, URI);
 
     spacePop(ctxt);
     if (nsNr != 0)
         nsPop(ctxt, nsNr);
     return;
 }
 
 /**
  * xmlParseCDSect:
  * @ctxt:  an XML parser context
- * 
+ *
  * Parse escaped pure raw content.
  *
  * [18] CDSect ::= CDStart CData CDEnd
  *
  * [19] CDStart ::= '<![CDATA['
  *
  * [20] Data ::= (Char* - (Char* ']]>' Char*))
  *
  * [21] CDEnd ::= ']]>'
  */
@@ skipping 32 matching lines @@
     buf = (xmlChar *) xmlMallocAtomic(size * sizeof(xmlChar));
     if (buf == NULL) {
         xmlErrMemory(ctxt, NULL);
         return;
     }
     while (IS_CHAR(cur) &&
            ((r != ']') || (s != ']') || (cur != '>'))) {
         if (len + 5 >= size) {
             xmlChar *tmp;
 
-            size *= 2;
-            tmp = (xmlChar *) xmlRealloc(buf, size * sizeof(xmlChar));
+            if ((size > XML_MAX_TEXT_LENGTH) &&
+                ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+                xmlFatalErrMsgStr(ctxt, XML_ERR_CDATA_NOT_FINISHED,
+                             "CData section too big found", NULL);
+                xmlFree (buf);
+                return;
+            }
+            tmp = (xmlChar *) xmlRealloc(buf, size * 2 * sizeof(xmlChar));
             if (tmp == NULL) {
                 xmlFree(buf);
                 xmlErrMemory(ctxt, NULL);
                 return;
             }
             buf = tmp;
+            size *= 2;
         }
         COPY_BUF(rl,buf,len,r);
         r = s;
         rl = sl;
         s = cur;
         sl = l;
         count++;
         if (count > 50) {
             GROW;
             if (ctxt->instate == XML_PARSER_EOF) {
@@ skipping 72 matching lines @@
 
         /*
          * Fourth case :  a sub-element.
          */
         else if (*cur == '<') {
             xmlParseElement(ctxt);
         }
 
         /*
          * Fifth case : a reference. If if has not been resolved,
-         *    parsing returns it's Name, create the node 
+         *    parsing returns it's Name, create the node
          */
 
         else if (*cur == '&') {
             xmlParseReference(ctxt);
         }
 
         /*
          * Last case, text. Note that References are handled directly.
          */
         else {
@@ skipping 20 matching lines @@
 /**
  * xmlParseElement:
  * @ctxt:  an XML parser context
  *
  * parse an XML element, this is highly recursive
  *
  * [39] element ::= EmptyElemTag | STag content ETag
  *
  * [ WFC: Element Type Match ]
  * The Name in an element's end-tag must match the element type in the
- * start-tag. 
+ * start-tag.
  *
  */
 
 void
 xmlParseElement(xmlParserCtxtPtr ctxt) {
     const xmlChar *name;
     const xmlChar *prefix = NULL;
     const xmlChar *URI = NULL;
     xmlParserNodeInfo node_info;
-    int line, tlen;
+    int line, tlen = 0;
     xmlNodePtr ret;
     int nsNr = ctxt->nsNr;
 
     if (((unsigned int) ctxt->nameNr > xmlParserMaxDepth) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErrMsgInt(ctxt, XML_ERR_INTERNAL_ERROR,
                  "Excessive depth in document: %d use XML_PARSE_HUGE option\n",
                           xmlParserMaxDepth);
         ctxt->instate = XML_PARSER_EOF;
         return;
@@ skipping 28 matching lines @@
         spacePop(ctxt);
         return;
     }
     namePush(ctxt, name);
     ret = ctxt->node;
 
 #ifdef LIBXML_VALID_ENABLED
     /*
      * [ VC: Root Element Type ]
      * The Name in the document type declaration must match the element
-     * type of the root element. 
+     * type of the root element.
      */
     if (ctxt->validate && ctxt->wellFormed && ctxt->myDoc &&
         ctxt->node && (ctxt->node == ctxt->myDoc->children))
         ctxt->valid &= xmlValidateRoot(&ctxt->vctxt, ctxt->myDoc);
 #endif /* LIBXML_VALID_ENABLED */
 
     /*
      * Check for an Empty Element.
      */
     if ((RAW == '/') && (NXT(1) == '>')) {
@@ skipping 262 matching lines @@
         buf[len] = 0;
     } else {
         xmlFatalErr(ctxt, XML_ERR_ENCODING_NAME, NULL);
     }
     return(buf);
 }
 
 /**
  * xmlParseEncodingDecl:
  * @ctxt:  an XML parser context
- * 
+ *
  * parse the XML encoding declaration
  *
  * [80] EncodingDecl ::= S 'encoding' Eq ('"' EncName '"' |  "'" EncName "'")
  *
  * this setups the conversion filters.
  *
  * Returns the encoding value or NULL
  */
 
 const xmlChar *
@@ skipping 20 matching lines @@
         } else if (RAW == '\''){
             NEXT;
             encoding = xmlParseEncName(ctxt);
             if (RAW != '\'') {
                 xmlFatalErr(ctxt, XML_ERR_STRING_NOT_CLOSED, NULL);
             } else
                 NEXT;
         } else {
             xmlFatalErr(ctxt, XML_ERR_STRING_NOT_STARTED, NULL);
         }
+
+        /*
+         * Non standard parsing, allowing the user to ignore encoding
+         */
+        if (ctxt->options & XML_PARSE_IGNORE_ENC) {
+            xmlFree((xmlChar *) encoding);
+            return(NULL);
+        }
+
         /*
          * UTF-16 encoding stwich has already taken place at this stage,
          * more over the little-endian/big-endian selection is already done
          */
         if ((encoding != NULL) &&
             ((!xmlStrcasecmp(encoding, BAD_CAST "UTF-16")) ||
              (!xmlStrcasecmp(encoding, BAD_CAST "UTF16")))) {
             /*
              * If no encoding was passed to the parser, that we are
-             * using UTF-16 and no decoder is present i.e. the 
+             * using UTF-16 and no decoder is present i.e. the
              * document is apparently UTF-8 compatible, then raise an
              * encoding mismatch fatal error
              */
             if ((ctxt->encoding == NULL) &&
                 (ctxt->input->buf != NULL) &&
                 (ctxt->input->buf->encoder == NULL)) {
                 xmlFatalErrMsg(ctxt, XML_ERR_INVALID_ENCODING,
                   "Document labelled UTF-16 but has UTF-8 content\n");
             }
             if (ctxt->encoding != NULL)
@@ skipping 30 matching lines @@
     return(encoding);
 }
 
 /**
  * xmlParseSDDecl:
  * @ctxt:  an XML parser context
  *
  * parse the XML standalone declaration
  *
  * [32] SDDecl ::= S 'standalone' Eq
- *                 (("'" ('yes' | 'no') "'") | ('"' ('yes' | 'no')'"')) 
+ *                 (("'" ('yes' | 'no') "'") | ('"' ('yes' | 'no')'"'))
  *
  * [ VC: Standalone Document Declaration ]
  * TODO The standalone document declaration must have the value "no"
  * if any external markup declarations contain declarations of:
  *  - attributes with default values, if elements to which these
  *    attributes apply appear in the document without specifications
  *    of values for these attributes, or
  *  - entities (other than amp, lt, gt, apos, quot), if references
  *    to those entities appear in the document, or
  *  - attributes with values subject to normalization, where the
@@ skipping 59 matching lines @@
         } else {
             xmlFatalErr(ctxt, XML_ERR_STRING_NOT_STARTED, NULL);
         }
     }
     return(standalone);
 }
 
 /**
  * xmlParseXMLDecl:
  * @ctxt:  an XML parser context
- * 
+ *
  * parse an XML declaration header
  *
  * [23] XMLDecl ::= '<?xml' VersionInfo EncodingDecl? SDDecl? S? '?>'
  */
 
 void
 xmlParseXMLDecl(xmlParserCtxtPtr ctxt) {
     xmlChar *version;
 
     /*
@@ skipping 93 matching lines @@
     } else {
         xmlFatalErr(ctxt, XML_ERR_XMLDECL_NOT_FINISHED, NULL);
         MOVETO_ENDTAG(CUR_PTR);
         NEXT;
     }
 }
 
 /**
  * xmlParseMisc:
  * @ctxt:  an XML parser context
- * 
+ *
  * parse an XML Misc* optional field.
  *
  * [27] Misc ::= Comment | PI |  S
  */
 
 void
 xmlParseMisc(xmlParserCtxtPtr ctxt) {
     while ((ctxt->instate != XML_PARSER_EOF) &&
            (((RAW == '<') && (NXT(1) == '?')) ||
             (CMP4(CUR_PTR, '<', '!', '-', '-')) ||
             IS_BLANK_CH(CUR))) {
         if ((RAW == '<') && (NXT(1) == '?')) {
             xmlParsePI(ctxt);
         } else if (IS_BLANK_CH(CUR)) {
             NEXT;
         } else
             xmlParseComment(ctxt);
     }
 }
 
 /**
  * xmlParseDocument:
  * @ctxt:  an XML parser context
- * 
+ *
  * parse an XML document (and build a tree if using the standard SAX
  * interface).
  *
  * [1] document ::= prolog element Misc*
  *
  * [22] prolog ::= XMLDecl? Misc* (doctypedecl Misc*)?
  *
  * Returns 0, -1 in case of error. the parser context is augmented
  *                as a result of the parsing.
  */
@@ skipping 16 matching lines @@
     xmlDetectSAX2(ctxt);
 
     /*
      * SAX: beginning of the document processing.
      */
     if ((ctxt->sax) && (ctxt->sax->setDocumentLocator))
         ctxt->sax->setDocumentLocator(ctxt->userData, &xmlDefaultSAXLocator);
     if (ctxt->instate == XML_PARSER_EOF)
         return(-1);
 
-    if ((ctxt->encoding == (const xmlChar *)XML_CHAR_ENCODING_NONE) &&
+    if ((ctxt->encoding == NULL) &&
         ((ctxt->input->end - ctxt->input->cur) >= 4)) {
-        /* 
+        /*
          * Get the 4 first bytes and decode the charset
          * if enc != XML_CHAR_ENCODING_NONE
          * plug some encoding conversion routines.
          */
         start[0] = RAW;
         start[1] = NXT(1);
         start[2] = NXT(2);
         start[3] = NXT(3);
         enc = xmlDetectCharEncoding(&start[0], 4);
         if (enc != XML_CHAR_ENCODING_NONE) {
@@ skipping 29 matching lines @@
         }
         ctxt->standalone = ctxt->input->standalone;
         SKIP_BLANKS;
     } else {
         ctxt->version = xmlCharStrdup(XML_DEFAULT_VERSION);
     }
     if ((ctxt->sax) && (ctxt->sax->startDocument) && (!ctxt->disableSAX))
         ctxt->sax->startDocument(ctxt->userData);
     if (ctxt->instate == XML_PARSER_EOF)
         return(-1);
+    if ((ctxt->myDoc != NULL) && (ctxt->input != NULL) &&
+        (ctxt->input->buf != NULL) && (ctxt->input->buf->compressed >= 0)) {
+        ctxt->myDoc->compression = ctxt->input->buf->compressed;
+    }
 
     /*
      * The Misc part of the Prolog
      */
     GROW;
     xmlParseMisc(ctxt);
 
     /*
      * Then possibly doc type declaration(s) and more Misc
      * (doctypedecl Misc*)?
@@ skipping 79 matching lines @@
     if (! ctxt->wellFormed) {
         ctxt->valid = 0;
         return(-1);
     }
     return(0);
 }
 
 /**
  * xmlParseExtParsedEnt:
  * @ctxt:  an XML parser context
- * 
+ *
  * parse a general parsed entity
  * An external general parsed entity is well-formed if it matches the
  * production labeled extParsedEnt.
  *
  * [78] extParsedEnt ::= TextDecl? content
  *
  * Returns 0, -1 in case of error. the parser context is augmented
  *                as a result of the parsing.
  */
 
@@ skipping 10 matching lines @@
     xmlDetectSAX2(ctxt);
 
     GROW;
 
     /*
      * SAX: beginning of the document processing.
      */
     if ((ctxt->sax) && (ctxt->sax->setDocumentLocator))
         ctxt->sax->setDocumentLocator(ctxt->userData, &xmlDefaultSAXLocator);
 
-    /* 
+    /*
      * Get the 4 first bytes and decode the charset
      * if enc != XML_CHAR_ENCODING_NONE
      * plug some encoding conversion routines.
      */
     if ((ctxt->input->end - ctxt->input->cur) >= 4) {
         start[0] = RAW;
         start[1] = NXT(1);
         start[2] = NXT(2);
         start[3] = NXT(3);
         enc = xmlDetectCharEncoding(start, 4);
@@ skipping 36 matching lines @@
      * Doing validity checking on chunk doesn't make sense
      */
     ctxt->instate = XML_PARSER_CONTENT;
     ctxt->validate = 0;
     ctxt->loadsubset = 0;
     ctxt->depth = 0;
 
     xmlParseContent(ctxt);
     if (ctxt->instate == XML_PARSER_EOF)
         return(-1);
-   
+
     if ((RAW == '<') && (NXT(1) == '/')) {
         xmlFatalErr(ctxt, XML_ERR_NOT_WELL_BALANCED, NULL);
     } else if (RAW != 0) {
         xmlFatalErr(ctxt, XML_ERR_EXTRA_CONTENT, NULL);
     }
 
     /*
      * SAX: end of the document processing.
      */
     if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
         ctxt->sax->endDocument(ctxt->userData);
 
     if (! ctxt->wellFormed) return(-1);
     return(0);
 }
 
 #ifdef LIBXML_PUSH_ENABLED
 /************************************************************************
  *                                                                      *
- *              Progressive parsing interfaces                          *
+ *              Progressive parsing interfaces                          *
  *                                                                      *
  ************************************************************************/
 
 /**
  * xmlParseLookupSequence:
  * @ctxt:  an XML parser context
  * @first:  the first char to lookup
  * @next:  the next char to lookup or zero
  * @third:  the next char to lookup or zero
  *
@@ skipping 16 matching lines @@
     in = ctxt->input;
     if (in == NULL) return(-1);
     base = in->cur - in->base;
     if (base < 0) return(-1);
     if (ctxt->checkIndex > base)
         base = ctxt->checkIndex;
     if (in->buf == NULL) {
         buf = in->base;
         len = in->length;
     } else {
-        buf = in->buf->buffer->content;
-        len = in->buf->buffer->use;
+        buf = xmlBufContent(in->buf->buffer);
+        len = xmlBufUse(in->buf->buffer);
     }
     /* take into account the sequence length */
     if (third) len -= 2;
     else if (next) len --;
     for (;base < len;base++) {
         if (buf[base] == first) {
             if (third != 0) {
                 if ((buf[base + 1] != next) ||
                     (buf[base + 2] != third)) continue;
             } else if (next != 0) {
                 if (buf[base + 1] != next) continue;
             }
             ctxt->checkIndex = 0;
 #ifdef DEBUG_PUSH
             if (next == 0)
                 xmlGenericError(xmlGenericErrorContext,
                         "PP: lookup '%c' found at %d\n",
                         first, base);
             else if (third == 0)
                 xmlGenericError(xmlGenericErrorContext,
                         "PP: lookup '%c%c' found at %d\n",
                         first, next, base);
-            else 
+            else
                 xmlGenericError(xmlGenericErrorContext,
                         "PP: lookup '%c%c%c' found at %d\n",
                         first, next, third, base);
 #endif
             return(base - (in->cur - in->base));
         }
     }
     ctxt->checkIndex = base;
 #ifdef DEBUG_PUSH
     if (next == 0)
         xmlGenericError(xmlGenericErrorContext,
                 "PP: lookup '%c' failed\n", first);
     else if (third == 0)
         xmlGenericError(xmlGenericErrorContext,
                 "PP: lookup '%c%c' failed\n", first, next);
-    else        
+    else
         xmlGenericError(xmlGenericErrorContext,
                 "PP: lookup '%c%c%c' failed\n", first, next, third);
 #endif
     return(-1);
 }
 
 /**
  * xmlParseGetLasts:
  * @ctxt:  an XML parser context
  * @lastlt:  pointer to store the last '<' from the input
@@ skipping 61 matching lines @@
  *         UTF-8 error occured otherwise
  */
 static int
 xmlCheckCdataPush(const xmlChar *utf, int len) {
     int ix;
     unsigned char c;
     int codepoint;
 
     if ((utf == NULL) || (len <= 0))
         return(0);
-    
+
     for (ix = 0; ix < len;) {      /* string is 0-terminated */
         c = utf[ix];
         if ((c & 0x80) == 0x00) {       /* 1-byte code, starts with 10 */
             if (c >= 0x20)
                 ix++;
             else if ((c == 0xA) || (c == 0xD) || (c == 0x9))
                 ix++;
             else
                 return(-ix);
         } else if ((c & 0xe0) == 0xc0) {/* 2-byte code, starts with 110 */
@@ skipping 111 matching lines @@
         (ctxt->input->cur - ctxt->input->base > 4096)) {
         xmlSHRINK(ctxt);
         ctxt->checkIndex = 0;
     }
     xmlParseGetLasts(ctxt, &lastlt, &lastgt);
 
     while (ctxt->instate != XML_PARSER_EOF) {
         if ((ctxt->errNo != XML_ERR_OK) && (ctxt->disableSAX == 1))
             return(0);
 
-        
+
         /*
          * Pop-up of finished entities.
          */
         while ((RAW == 0) && (ctxt->inputNr > 1))
             xmlPopInput(ctxt);
 
         if (ctxt->input == NULL) break;
         if (ctxt->input->buf == NULL)
             avail = ctxt->input->length -
                     (ctxt->input->cur - ctxt->input->base);
         else {
             /*
              * If we are operating on converted input, try to flush
              * remainng chars to avoid them stalling in the non-converted
-             * buffer.
+             * buffer. But do not do this in document start where
+             * encoding="..." may not have been read and we work on a
+             * guessed encoding.
              */
-            if ((ctxt->input->buf->raw != NULL) &&
-                (ctxt->input->buf->raw->use > 0)) {
-                int base = ctxt->input->base -
-                           ctxt->input->buf->buffer->content;
-                int current = ctxt->input->cur - ctxt->input->base;
+            if ((ctxt->instate != XML_PARSER_START) &&
+                (ctxt->input->buf->raw != NULL) &&
+                (xmlBufIsEmpty(ctxt->input->buf->raw) == 0)) {
+                size_t base = xmlBufGetInputBase(ctxt->input->buf->buffer,
+                                                 ctxt->input);
+                size_t current = ctxt->input->cur - ctxt->input->base;
 
                 xmlParserInputBufferPush(ctxt->input->buf, 0, "");
-                ctxt->input->base = ctxt->input->buf->buffer->content + base;
-                ctxt->input->cur = ctxt->input->base + current;
-                ctxt->input->end =
-                    &ctxt->input->buf->buffer->content[
-                                       ctxt->input->buf->buffer->use];
+                xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input,
+                                      base, current);
             }
-            avail = ctxt->input->buf->buffer->use -
+            avail = xmlBufUse(ctxt->input->buf->buffer) -
                     (ctxt->input->cur - ctxt->input->base);
         }
         if (avail < 1)
             goto done;
         switch (ctxt->instate) {
             case XML_PARSER_EOF:
                 /*
                  * Document parsing is done !
                  */
                 goto done;
             case XML_PARSER_START:
                 if (ctxt->charset == XML_CHAR_ENCODING_NONE) {
                     xmlChar start[4];
                     xmlCharEncoding enc;
 
                     /*
                      * Very first chars read from the document flow.
                      */
                     if (avail < 4)
                         goto done;
 
-                    /* 
+                    /*
                      * Get the 4 first bytes and decode the charset
                      * if enc != XML_CHAR_ENCODING_NONE
                      * plug some encoding conversion routines,
                      * else xmlSwitchEncoding will set to (default)
                      * UTF8.
                      */
                     start[0] = RAW;
                     start[1] = NXT(1);
                     start[2] = NXT(2);
                     start[3] = NXT(3);
@@ skipping 134 matching lines @@
                     spacePop(ctxt);
                     ctxt->instate = XML_PARSER_EOF;
                     if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
                         ctxt->sax->endDocument(ctxt->userData);
                     goto done;
                 }
 #ifdef LIBXML_VALID_ENABLED
                 /*
                  * [ VC: Root Element Type ]
                  * The Name in the document type declaration must match
-                 * the element type of the root element. 
+                 * the element type of the root element.
                  */
                 if (ctxt->validate && ctxt->wellFormed && ctxt->myDoc &&
                     ctxt->node && (ctxt->node == ctxt->myDoc->children))
                     ctxt->valid &= xmlValidateRoot(&ctxt->vctxt, ctxt->myDoc);
 #endif /* LIBXML_VALID_ENABLED */
 
                 /*
                  * Check for an Empty Element.
                  */
                 if ((RAW == '/') && (NXT(1) == '>')) {
@@ skipping 16 matching lines @@
 #endif /* LIBXML_SAX1_ENABLED */
                     }
                     if (ctxt->instate == XML_PARSER_EOF)
                         goto done;
                     spacePop(ctxt);
                     if (ctxt->nameNr == 0) {
                         ctxt->instate = XML_PARSER_EPILOG;
                     } else {
                         ctxt->instate = XML_PARSER_CONTENT;
                     }
+                    ctxt->progressive = 1;
                     break;
                 }
                 if (RAW == '>') {
                     NEXT;
                 } else {
                     xmlFatalErrMsgStr(ctxt, XML_ERR_GT_REQUIRED,
                                          "Couldn't find end of Start Tag %s\n",
                                          name);
                     nodePop(ctxt);
                     spacePop(ctxt);
                 }
                 if (ctxt->sax2)
                     nameNsPush(ctxt, name, prefix, URI, ctxt->nsNr - nsNr);
 #ifdef LIBXML_SAX1_ENABLED
                 else
                     namePush(ctxt, name);
 #endif /* LIBXML_SAX1_ENABLED */
 
                 ctxt->instate = XML_PARSER_CONTENT;
+                ctxt->progressive = 1;
                 break;
             }
             case XML_PARSER_CONTENT: {
                 const xmlChar *test;
                 unsigned int cons;
                 if ((avail < 2) && (ctxt->inputNr == 1))
                     goto done;
                 cur = ctxt->input->cur[0];
                 next = ctxt->input->cur[1];
 
                 test = CUR_PTR;
                 cons = ctxt->input->consumed;
                 if ((cur == '<') && (next == '/')) {
                     ctxt->instate = XML_PARSER_END_TAG;
                     break;
                 } else if ((cur == '<') && (next == '?')) {
                     if ((!terminate) &&
-                        (xmlParseLookupSequence(ctxt, '?', '>', 0) < 0))
+                        (xmlParseLookupSequence(ctxt, '?', '>', 0) < 0)) {
+                        ctxt->progressive = XML_PARSER_PI;
                         goto done;
+                    }
                     xmlParsePI(ctxt);
+                    ctxt->instate = XML_PARSER_CONTENT;
+                    ctxt->progressive = 1;
                 } else if ((cur == '<') && (next != '!')) {
                     ctxt->instate = XML_PARSER_START_TAG;
                     break;
                 } else if ((cur == '<') && (next == '!') &&
                            (ctxt->input->cur[2] == '-') &&
                            (ctxt->input->cur[3] == '-')) {
                     int term;
 
                     if (avail < 4)
                         goto done;
                     ctxt->input->cur += 4;
                     term = xmlParseLookupSequence(ctxt, '-', '-', '>');
                     ctxt->input->cur -= 4;
-                    if ((!terminate) && (term < 0))
+                    if ((!terminate) && (term < 0)) {
+                        ctxt->progressive = XML_PARSER_COMMENT;
                         goto done;
+                    }
                     xmlParseComment(ctxt);
                     ctxt->instate = XML_PARSER_CONTENT;
+                    ctxt->progressive = 1;
                 } else if ((cur == '<') && (ctxt->input->cur[1] == '!') &&
                     (ctxt->input->cur[2] == '[') &&
                     (ctxt->input->cur[3] == 'C') &&
                     (ctxt->input->cur[4] == 'D') &&
                     (ctxt->input->cur[5] == 'A') &&
                     (ctxt->input->cur[6] == 'T') &&
                     (ctxt->input->cur[7] == 'A') &&
                     (ctxt->input->cur[8] == '[')) {
                     SKIP(9);
                     ctxt->instate = XML_PARSER_CDATA_SECTION;
@@ skipping 74 matching lines @@
                 if (ctxt->instate == XML_PARSER_EOF) {
                     /* Nothing */
                 } else if (ctxt->nameNr == 0) {
                     ctxt->instate = XML_PARSER_EPILOG;
                 } else {
                     ctxt->instate = XML_PARSER_CONTENT;
                 }
                 break;
             case XML_PARSER_CDATA_SECTION: {
                 /*
-                 * The Push mode need to have the SAX callback for 
+                 * The Push mode need to have the SAX callback for
                  * cdataBlock merge back contiguous callbacks.
                  */
                 int base;
 
                 base = xmlParseLookupSequence(ctxt, ']', ']', '>');
                 if (base < 0) {
                     if (avail >= XML_PARSER_BIG_BUFFER_SIZE + 2) {
                         int tmp;
 
-                        tmp = xmlCheckCdataPush(ctxt->input->cur, 
+                        tmp = xmlCheckCdataPush(ctxt->input->cur,
                                                 XML_PARSER_BIG_BUFFER_SIZE);
                         if (tmp < 0) {
                             tmp = -tmp;
                             ctxt->input->cur += tmp;
                             goto encoding_error;
                         }
                         if ((ctxt->sax != NULL) && (!ctxt->disableSAX)) {
                             if (ctxt->sax->cdataBlock != NULL)
                                 ctxt->sax->cdataBlock(ctxt->userData,
                                                       ctxt->input->cur, tmp);
@@ skipping 49 matching lines @@
 #endif
                 }
                 break;
             }
             case XML_PARSER_MISC:
                 SKIP_BLANKS;
                 if (ctxt->input->buf == NULL)
                     avail = ctxt->input->length -
                             (ctxt->input->cur - ctxt->input->base);
                 else
-                    avail = ctxt->input->buf->buffer->use -
+                    avail = xmlBufUse(ctxt->input->buf->buffer) -
                             (ctxt->input->cur - ctxt->input->base);
                 if (avail < 2)
                     goto done;
                 cur = ctxt->input->cur[0];
                 next = ctxt->input->cur[1];
                 if ((cur == '<') && (next == '?')) {
                     if ((!terminate) &&
-                        (xmlParseLookupSequence(ctxt, '?', '>', 0) < 0))
+                        (xmlParseLookupSequence(ctxt, '?', '>', 0) < 0)) {
+                        ctxt->progressive = XML_PARSER_PI;
                         goto done;
+                    }
 #ifdef DEBUG_PUSH
                     xmlGenericError(xmlGenericErrorContext,
                             "PP: Parsing PI\n");
 #endif
                     xmlParsePI(ctxt);
                     if (ctxt->instate == XML_PARSER_EOF)
                         goto done;
+                    ctxt->instate = XML_PARSER_MISC;
+                    ctxt->progressive = 1;
                     ctxt->checkIndex = 0;
                 } else if ((cur == '<') && (next == '!') &&
                     (ctxt->input->cur[2] == '-') &&
                     (ctxt->input->cur[3] == '-')) {
                     if ((!terminate) &&
-                        (xmlParseLookupSequence(ctxt, '-', '-', '>') < 0))
+                        (xmlParseLookupSequence(ctxt, '-', '-', '>') < 0)) {
+                        ctxt->progressive = XML_PARSER_COMMENT;
                         goto done;
+                    }
 #ifdef DEBUG_PUSH
                     xmlGenericError(xmlGenericErrorContext,
                             "PP: Parsing Comment\n");
 #endif
                     xmlParseComment(ctxt);
                     if (ctxt->instate == XML_PARSER_EOF)
                         goto done;
                     ctxt->instate = XML_PARSER_MISC;
+                    ctxt->progressive = 1;
                     ctxt->checkIndex = 0;
                 } else if ((cur == '<') && (next == '!') &&
                     (ctxt->input->cur[2] == 'D') &&
                     (ctxt->input->cur[3] == 'O') &&
                     (ctxt->input->cur[4] == 'C') &&
                     (ctxt->input->cur[5] == 'T') &&
                     (ctxt->input->cur[6] == 'Y') &&
                     (ctxt->input->cur[7] == 'P') &&
                     (ctxt->input->cur[8] == 'E')) {
                     if ((!terminate) &&
-                        (xmlParseLookupSequence(ctxt, '>', 0, 0) < 0))
+                        (xmlParseLookupSequence(ctxt, '>', 0, 0) < 0)) {
+                        ctxt->progressive = XML_PARSER_DTD;
                         goto done;
+                    }
 #ifdef DEBUG_PUSH
                     xmlGenericError(xmlGenericErrorContext,
                             "PP: Parsing internal subset\n");
 #endif
                     ctxt->inSubset = 1;
+                    ctxt->progressive = 0;
+                    ctxt->checkIndex = 0;
                     xmlParseDocTypeDecl(ctxt);
                     if (ctxt->instate == XML_PARSER_EOF)
                         goto done;
                     if (RAW == '[') {
                         ctxt->instate = XML_PARSER_DTD;
 #ifdef DEBUG_PUSH
                         xmlGenericError(xmlGenericErrorContext,
                                 "PP: entering DTD\n");
 #endif
                     } else {
@@ skipping 12 matching lines @@
 #ifdef DEBUG_PUSH
                         xmlGenericError(xmlGenericErrorContext,
                                 "PP: entering PROLOG\n");
 #endif
                     }
                 } else if ((cur == '<') && (next == '!') &&
                            (avail < 9)) {
                     goto done;
                 } else {
                     ctxt->instate = XML_PARSER_START_TAG;
-                    ctxt->progressive = 1;
+                    ctxt->progressive = XML_PARSER_START_TAG;
                     xmlParseGetLasts(ctxt, &lastlt, &lastgt);
 #ifdef DEBUG_PUSH
                     xmlGenericError(xmlGenericErrorContext,
                             "PP: entering START_TAG\n");
 #endif
                 }
                 break;
             case XML_PARSER_PROLOG:
                 SKIP_BLANKS;
                 if (ctxt->input->buf == NULL)
                     avail = ctxt->input->length - (ctxt->input->cur - ctxt->input->base);
                 else
-                    avail = ctxt->input->buf->buffer->use - (ctxt->input->cur - ctxt->input->base);
-                if (avail < 2) 
+                    avail = xmlBufUse(ctxt->input->buf->buffer) -
+                            (ctxt->input->cur - ctxt->input->base);
+                if (avail < 2)
                     goto done;
                 cur = ctxt->input->cur[0];
                 next = ctxt->input->cur[1];
                 if ((cur == '<') && (next == '?')) {
                     if ((!terminate) &&
-                        (xmlParseLookupSequence(ctxt, '?', '>', 0) < 0))
+                        (xmlParseLookupSequence(ctxt, '?', '>', 0) < 0)) {
+                        ctxt->progressive = XML_PARSER_PI;
                         goto done;
+                    }
 #ifdef DEBUG_PUSH
                     xmlGenericError(xmlGenericErrorContext,
                             "PP: Parsing PI\n");
 #endif
                     xmlParsePI(ctxt);
                     if (ctxt->instate == XML_PARSER_EOF)
                         goto done;
+                    ctxt->instate = XML_PARSER_PROLOG;
+                    ctxt->progressive = 1;
                 } else if ((cur == '<') && (next == '!') &&
                     (ctxt->input->cur[2] == '-') && (ctxt->input->cur[3] == '-')) {
                     if ((!terminate) &&
-                        (xmlParseLookupSequence(ctxt, '-', '-', '>') < 0))
+                        (xmlParseLookupSequence(ctxt, '-', '-', '>') < 0)) {
+                        ctxt->progressive = XML_PARSER_COMMENT;
                         goto done;
+                    }
 #ifdef DEBUG_PUSH
                     xmlGenericError(xmlGenericErrorContext,
                             "PP: Parsing Comment\n");
 #endif
                     xmlParseComment(ctxt);
                     if (ctxt->instate == XML_PARSER_EOF)
                         goto done;
                     ctxt->instate = XML_PARSER_PROLOG;
+                    ctxt->progressive = 1;
                 } else if ((cur == '<') && (next == '!') &&
                            (avail < 4)) {
                     goto done;
                 } else {
                     ctxt->instate = XML_PARSER_START_TAG;
                     if (ctxt->progressive == 0)
-                        ctxt->progressive = 1;
+                        ctxt->progressive = XML_PARSER_START_TAG;
                     xmlParseGetLasts(ctxt, &lastlt, &lastgt);
 #ifdef DEBUG_PUSH
                     xmlGenericError(xmlGenericErrorContext,
                             "PP: entering START_TAG\n");
 #endif
                 }
                 break;
             case XML_PARSER_EPILOG:
                 SKIP_BLANKS;
                 if (ctxt->input->buf == NULL)
                     avail = ctxt->input->length - (ctxt->input->cur - ctxt->input->base);
                 else
-                    avail = ctxt->input->buf->buffer->use - (ctxt->input->cur - ctxt->input->base);
+                    avail = xmlBufUse(ctxt->input->buf->buffer) -
+                            (ctxt->input->cur - ctxt->input->base);
                 if (avail < 2)
                     goto done;
                 cur = ctxt->input->cur[0];
                 next = ctxt->input->cur[1];
                 if ((cur == '<') && (next == '?')) {
                     if ((!terminate) &&
-                        (xmlParseLookupSequence(ctxt, '?', '>', 0) < 0))
+                        (xmlParseLookupSequence(ctxt, '?', '>', 0) < 0)) {
+                        ctxt->progressive = XML_PARSER_PI;
                         goto done;
+                    }
 #ifdef DEBUG_PUSH
                     xmlGenericError(xmlGenericErrorContext,
                             "PP: Parsing PI\n");
 #endif
                     xmlParsePI(ctxt);
                     if (ctxt->instate == XML_PARSER_EOF)
                         goto done;
                     ctxt->instate = XML_PARSER_EPILOG;
+                    ctxt->progressive = 1;
                 } else if ((cur == '<') && (next == '!') &&
                     (ctxt->input->cur[2] == '-') && (ctxt->input->cur[3] == '-')) {
                     if ((!terminate) &&
-                        (xmlParseLookupSequence(ctxt, '-', '-', '>') < 0))
+                        (xmlParseLookupSequence(ctxt, '-', '-', '>') < 0)) {
+                        ctxt->progressive = XML_PARSER_COMMENT;
                         goto done;
+                    }
 #ifdef DEBUG_PUSH
                     xmlGenericError(xmlGenericErrorContext,
                             "PP: Parsing Comment\n");
 #endif
                     xmlParseComment(ctxt);
                     if (ctxt->instate == XML_PARSER_EOF)
                         goto done;
                     ctxt->instate = XML_PARSER_EPILOG;
+                    ctxt->progressive = 1;
                 } else if ((cur == '<') && (next == '!') &&
                            (avail < 4)) {
                     goto done;
                 } else {
                     xmlFatalErr(ctxt, XML_ERR_DOCUMENT_END, NULL);
                     ctxt->instate = XML_PARSER_EOF;
 #ifdef DEBUG_PUSH
                     xmlGenericError(xmlGenericErrorContext,
                             "PP: entering EOF\n");
 #endif
                     if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
                         ctxt->sax->endDocument(ctxt->userData);
                     goto done;
                 }
                 break;
             case XML_PARSER_DTD: {
                 /*
                  * Sorry but progressive parsing of the internal subset
                  * is not expected to be supported. We first check that
                  * the full content of the internal subset is available and
                  * the parsing is launched only at that point.
                  * Internal subset ends up with "']' S? '>'" in an unescaped
                  * section and not in a ']]>' sequence which are conditional
                  * sections (whoever argued to keep that crap in XML deserve
                  * a place in hell !).
                  */
                 int base, i;
                 xmlChar *buf;
                 xmlChar quote = 0;
+                size_t use;
 
                 base = ctxt->input->cur - ctxt->input->base;
                 if (base < 0) return(0);
                 if (ctxt->checkIndex > base)
                     base = ctxt->checkIndex;
-                buf = ctxt->input->buf->buffer->content;
-                for (;(unsigned int) base < ctxt->input->buf->buffer->use;
-                     base++) {
+                buf = xmlBufContent(ctxt->input->buf->buffer);
+                use = xmlBufUse(ctxt->input->buf->buffer);
+                for (;(unsigned int) base < use; base++) {
                     if (quote != 0) {
                         if (buf[base] == quote)
                             quote = 0;
-                        continue;    
+                        continue;
                     }
                     if ((quote == 0) && (buf[base] == '<')) {
                         int found  = 0;
                         /* special handling of comments */
-                        if (((unsigned int) base + 4 <
-                             ctxt->input->buf->buffer->use) &&
+                        if (((unsigned int) base + 4 < use) &&
                             (buf[base + 1] == '!') &&
                             (buf[base + 2] == '-') &&
                             (buf[base + 3] == '-')) {
-                            for (;(unsigned int) base + 3 <
-                                  ctxt->input->buf->buffer->use; base++) {
+                            for (;(unsigned int) base + 3 < use; base++) {
                                 if ((buf[base] == '-') &&
                                     (buf[base + 1] == '-') &&
                                     (buf[base + 2] == '>')) {
                                     found = 1;
                                     base += 2;
                                     break;
                                 }
                             }
                             if (!found) {
 #if 0
@@ skipping 10 matching lines @@
                     }
                     if (buf[base] == '\'') {
                         quote = '\'';
                         continue;
                     }
                     if (buf[base] == ']') {
 #if 0
                         fprintf(stderr, "%c%c%c%c: ", buf[base],
                                 buf[base + 1], buf[base + 2], buf[base + 3]);
 #endif
-                        if ((unsigned int) base +1 >=
-                            ctxt->input->buf->buffer->use)
+                        if ((unsigned int) base +1 >= use)
                             break;
                         if (buf[base + 1] == ']') {
                             /* conditional crap, skip both ']' ! */
                             base++;
                             continue;
                         }
-                        for (i = 1;
-                     (unsigned int) base + i < ctxt->input->buf->buffer->use;
-                             i++) {
+                        for (i = 1; (unsigned int) base + i < use; i++) {
                             if (buf[base + i] == '>') {
 #if 0
                                 fprintf(stderr, "found\n");
 #endif
                                 goto found_end_int_subset;
                             }
                             if (!IS_BLANK_CH(buf[base + i])) {
 #if 0
                                 fprintf(stderr, "not found\n");
 #endif
                                 goto not_end_of_int_subset;
                             }
                         }
 #if 0
                         fprintf(stderr, "end of stream\n");
 #endif
                         break;
-                        
+
                     }
 not_end_of_int_subset:
                     continue; /* for */
                 }
                 /*
                  * We didn't found the end of the Internal subset
                  */
+                if (quote == 0)
+                    ctxt->checkIndex = base;
+                else
+                    ctxt->checkIndex = 0;
 #ifdef DEBUG_PUSH
                 if (next == 0)
                     xmlGenericError(xmlGenericErrorContext,
                             "PP: lookup of int subset end filed\n");
 #endif
                 goto done;
 
 found_end_int_subset:
+                ctxt->checkIndex = 0;
                 xmlParseInternalSubset(ctxt);
                 if (ctxt->instate == XML_PARSER_EOF)
                     goto done;
                 ctxt->inSubset = 2;
                 if ((ctxt->sax != NULL) && (!ctxt->disableSAX) &&
                     (ctxt->sax->externalSubset != NULL))
                     ctxt->sax->externalSubset(ctxt->userData, ctxt->intSubName,
                             ctxt->extSubSystem, ctxt->extSubURI);
                 ctxt->inSubset = 0;
                 xmlCleanSpecialAttr(ctxt);
@@ skipping 74 matching lines @@
                 xmlGenericError(xmlGenericErrorContext,
                         "PP: internal error, state == PUBLIC_LITERAL\n");
                 ctxt->instate = XML_PARSER_START_TAG;
 #ifdef DEBUG_PUSH
                 xmlGenericError(xmlGenericErrorContext,
                         "PP: entering START_TAG\n");
 #endif
                 break;
         }
     }
-done:    
+done:
 #ifdef DEBUG_PUSH
     xmlGenericError(xmlGenericErrorContext, "PP: done %d\n", ret);
 #endif
     return(ret);
 encoding_error:
     {
         char buffer[150];
 
         snprintf(buffer, 149, "Bytes: 0x%02X 0x%02X 0x%02X 0x%02X\n",
                         ctxt->input->cur[0], ctxt->input->cur[1],
                         ctxt->input->cur[2], ctxt->input->cur[3]);
         __xmlErrEncoding(ctxt, XML_ERR_INVALID_CHAR,
                      "Input is not proper UTF-8, indicate encoding !\n%s",
                      BAD_CAST buffer, NULL);
     }
     return(0);
 }
 
 /**
+ * xmlParseCheckTransition:
+ * @ctxt:  an XML parser context
+ * @chunk:  a char array
+ * @size:  the size in byte of the chunk
+ *
+ * Check depending on the current parser state if the chunk given must be
+ * processed immediately or one need more data to advance on parsing.
+ *
+ * Returns -1 in case of error, 0 if the push is not needed and 1 if needed
+ */
+static int
+xmlParseCheckTransition(xmlParserCtxtPtr ctxt, const char *chunk, int size) {
+    if ((ctxt == NULL) || (chunk == NULL) || (size < 0))
+        return(-1);
+    if (ctxt->instate == XML_PARSER_START_TAG) {
+        if (memchr(chunk, '>', size) != NULL)
+            return(1);
+        return(0);
+    }
+    if (ctxt->progressive == XML_PARSER_COMMENT) {
+        if (memchr(chunk, '>', size) != NULL)
+            return(1);
+        return(0);
+    }
+    if (ctxt->instate == XML_PARSER_CDATA_SECTION) {
+        if (memchr(chunk, '>', size) != NULL)
+            return(1);
+        return(0);
+    }
+    if (ctxt->progressive == XML_PARSER_PI) {
+        if (memchr(chunk, '>', size) != NULL)
+            return(1);
+        return(0);
+    }
+    if (ctxt->instate == XML_PARSER_END_TAG) {
+        if (memchr(chunk, '>', size) != NULL)
+            return(1);
+        return(0);
+    }
+    if ((ctxt->progressive == XML_PARSER_DTD) ||
+        (ctxt->instate == XML_PARSER_DTD)) {
+        if (memchr(chunk, '>', size) != NULL)
+            return(1);
+        return(0);
+    }
+    return(1);
+}
+
+/**
  * xmlParseChunk:
  * @ctxt:  an XML parser context
  * @chunk:  an char array
  * @size:  the size in byte of the chunk
  * @terminate:  last chunk indicator
  *
  * Parse a Chunk of memory
  *
  * Returns zero if no error, the xmlParserErrors otherwise.
  */
 int
 xmlParseChunk(xmlParserCtxtPtr ctxt, const char *chunk, int size,
               int terminate) {
     int end_in_lf = 0;
     int remain = 0;
+    size_t old_avail = 0;
+    size_t avail = 0;
 
     if (ctxt == NULL)
         return(XML_ERR_INTERNAL_ERROR);
     if ((ctxt->errNo != XML_ERR_OK) && (ctxt->disableSAX == 1))
         return(ctxt->errNo);
     if (ctxt->instate == XML_PARSER_EOF)
         return(-1);
     if (ctxt->instate == XML_PARSER_START)
         xmlDetectSAX2(ctxt);
     if ((size > 0) && (chunk != NULL) && (!terminate) &&
         (chunk[size - 1] == '\r')) {
         end_in_lf = 1;
         size--;
     }
 
 xmldecl_done:
 
     if ((size > 0) && (chunk != NULL) && (ctxt->input != NULL) &&
         (ctxt->input->buf != NULL) && (ctxt->instate != XML_PARSER_EOF))  {
-        int base = ctxt->input->base - ctxt->input->buf->buffer->content;
-        int cur = ctxt->input->cur - ctxt->input->base;
+        size_t base = xmlBufGetInputBase(ctxt->input->buf->buffer, ctxt->input);
+        size_t cur = ctxt->input->cur - ctxt->input->base;
         int res;
 
+        old_avail = xmlBufUse(ctxt->input->buf->buffer);
         /*
          * Specific handling if we autodetected an encoding, we should not
          * push more than the first line ... which depend on the encoding
          * And only push the rest once the final encoding was detected
          */
         if ((ctxt->instate == XML_PARSER_START) && (ctxt->input != NULL) &&
             (ctxt->input->buf != NULL) && (ctxt->input->buf->encoder != NULL)) {
             unsigned int len = 45;
 
             if ((xmlStrcasestr(BAD_CAST ctxt->input->buf->encoder->name,
                                BAD_CAST "UTF-16")) ||
                 (xmlStrcasestr(BAD_CAST ctxt->input->buf->encoder->name,
                                BAD_CAST "UTF16")))
                 len = 90;
             else if ((xmlStrcasestr(BAD_CAST ctxt->input->buf->encoder->name,
                                     BAD_CAST "UCS-4")) ||
                      (xmlStrcasestr(BAD_CAST ctxt->input->buf->encoder->name,
                                     BAD_CAST "UCS4")))
                 len = 180;
 
             if (ctxt->input->buf->rawconsumed < len)
                 len -= ctxt->input->buf->rawconsumed;
 
             /*
              * Change size for reading the initial declaration only
              * if size is greater than len. Otherwise, memmove in xmlBufferAdd
              * will blindly copy extra bytes from memory.
              */
-            if (size > len) {
+            if ((unsigned int) size > len) {
                 remain = size - len;
                 size = len;
             } else {
                 remain = 0;
             }
         }
-        res =xmlParserInputBufferPush(ctxt->input->buf, size, chunk);
+        res = xmlParserInputBufferPush(ctxt->input->buf, size, chunk);
         if (res < 0) {
             ctxt->errNo = XML_PARSER_EOF;
             ctxt->disableSAX = 1;
             return (XML_PARSER_EOF);
         }
-        ctxt->input->base = ctxt->input->buf->buffer->content + base;
-        ctxt->input->cur = ctxt->input->base + cur;
-        ctxt->input->end =
-            &ctxt->input->buf->buffer->content[ctxt->input->buf->buffer->use];
+        xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input, base, cur);
 #ifdef DEBUG_PUSH
         xmlGenericError(xmlGenericErrorContext, "PP: pushed %d\n", size);
 #endif
 
     } else if (ctxt->instate != XML_PARSER_EOF) {
         if ((ctxt->input != NULL) && ctxt->input->buf != NULL) {
             xmlParserInputBufferPtr in = ctxt->input->buf;
             if ((in->encoder != NULL) && (in->buffer != NULL) &&
                     (in->raw != NULL)) {
                 int nbchars;
+                size_t base = xmlBufGetInputBase(in->buffer, ctxt->input);
+                size_t current = ctxt->input->cur - ctxt->input->base;
 
-                nbchars = xmlCharEncInFunc(in->encoder, in->buffer, in->raw);
+                nbchars = xmlCharEncInput(in, terminate);
                 if (nbchars < 0) {
                     /* TODO 2.6.0 */
                     xmlGenericError(xmlGenericErrorContext,
                                     "xmlParseChunk: encoder error\n");
                     return(XML_ERR_INVALID_ENCODING);
                 }
+                xmlBufSetInputBaseCur(in->buffer, ctxt->input, base, current);
             }
         }
     }
-    if (remain != 0)
+    if (remain != 0) {
         xmlParseTryOrFinish(ctxt, 0);
-    else
-        xmlParseTryOrFinish(ctxt, terminate);
+    } else {
+        if ((ctxt->input != NULL) && (ctxt->input->buf != NULL))
+            avail = xmlBufUse(ctxt->input->buf->buffer);
+        /*
+         * Depending on the current state it may not be such
+         * a good idea to try parsing if there is nothing in the chunk
+         * which would be worth doing a parser state transition and we
+         * need to wait for more data
+         */
+        if ((terminate) || (avail > XML_MAX_TEXT_LENGTH) ||
+            (old_avail == 0) || (avail == 0) ||
+            (xmlParseCheckTransition(ctxt,
+                       (const char *)&ctxt->input->base[old_avail],
+                                     avail - old_avail)))
+            xmlParseTryOrFinish(ctxt, terminate);
+    }
     if (ctxt->instate == XML_PARSER_EOF)
         return(ctxt->errNo);
+
+    if ((ctxt->input != NULL) &&
+         (((ctxt->input->end - ctxt->input->cur) > XML_MAX_LOOKUP_LIMIT) ||
+         ((ctxt->input->cur - ctxt->input->base) > XML_MAX_LOOKUP_LIMIT)) &&
+        ((ctxt->options & XML_PARSE_HUGE) == 0)) {
+        xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
+        ctxt->instate = XML_PARSER_EOF;
+    }
     if ((ctxt->errNo != XML_ERR_OK) && (ctxt->disableSAX == 1))
         return(ctxt->errNo);
 
     if (remain != 0) {
         chunk += size;
         size = remain;
         remain = 0;
         goto xmldecl_done;
     }
     if ((end_in_lf == 1) && (ctxt->input != NULL) &&
         (ctxt->input->buf != NULL)) {
+        size_t base = xmlBufGetInputBase(ctxt->input->buf->buffer,
+                                         ctxt->input);
+        size_t current = ctxt->input->cur - ctxt->input->base;
+
         xmlParserInputBufferPush(ctxt->input->buf, 1, "\r");
+
+        xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input,
+                              base, current);
     }
     if (terminate) {
         /*
          * Check for termination
          */
-        int avail = 0;
+        int cur_avail = 0;
 
         if (ctxt->input != NULL) {
             if (ctxt->input->buf == NULL)
-                avail = ctxt->input->length -
-                        (ctxt->input->cur - ctxt->input->base);
+                cur_avail = ctxt->input->length -
+                            (ctxt->input->cur - ctxt->input->base);
             else
-                avail = ctxt->input->buf->buffer->use -
-                        (ctxt->input->cur - ctxt->input->base);
+                cur_avail = xmlBufUse(ctxt->input->buf->buffer) -
+                                      (ctxt->input->cur - ctxt->input->base);
         }
-                            
+
         if ((ctxt->instate != XML_PARSER_EOF) &&
             (ctxt->instate != XML_PARSER_EPILOG)) {
             xmlFatalErr(ctxt, XML_ERR_DOCUMENT_END, NULL);
-        } 
-        if ((ctxt->instate == XML_PARSER_EPILOG) && (avail > 0)) {
+        }
+        if ((ctxt->instate == XML_PARSER_EPILOG) && (cur_avail > 0)) {
             xmlFatalErr(ctxt, XML_ERR_DOCUMENT_END, NULL);
         }
         if (ctxt->instate != XML_PARSER_EOF) {
             if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
                 ctxt->sax->endDocument(ctxt->userData);
         }
         ctxt->instate = XML_PARSER_EOF;
     }
-    return((xmlParserErrors) ctxt->errNo);            
+    if (ctxt->wellFormed == 0)
+        return((xmlParserErrors) ctxt->errNo);
+    else
+        return(0);
 }
 
 /************************************************************************
  *                                                                      *
- *              I/O front end functions to the parser                   *
+ *              I/O front end functions to the parser                   *
  *                                                                      *
  ************************************************************************/
 
 /**
  * xmlCreatePushParserCtxt:
  * @sax:  a SAX handler
  * @user_data:  The user data returned on SAX callbacks
  * @chunk:  a pointer to an array of chars
  * @size:  number of chars in the array
  * @filename:  an optional file name or URI
  *
  * Create a parser context for using the XML parser in push mode.
  * If @buffer and @size are non-NULL, the data is used to detect
  * the encoding.  The remaining characters will be parsed so they
  * don't need to be fed in again through xmlParseChunk.
  * To allow content encoding detection, @size should be >= 4
  * The value of @filename is used for fetching external entities
  * and error/warning reports.
  *
  * Returns the new parser context or NULL
  */
 
 xmlParserCtxtPtr
-xmlCreatePushParserCtxt(xmlSAXHandlerPtr sax, void *user_data, 
+xmlCreatePushParserCtxt(xmlSAXHandlerPtr sax, void *user_data,
                         const char *chunk, int size, const char *filename) {
     xmlParserCtxtPtr ctxt;
     xmlParserInputPtr inputStream;
     xmlParserInputBufferPtr buf;
     xmlCharEncoding enc = XML_CHAR_ENCODING_NONE;
 
     /*
      * plug some encoding conversion routines
      */
     if ((chunk != NULL) && (size >= 4))
@@ skipping 28 matching lines @@
             xmlFreeParserCtxt(ctxt);
             return(NULL);
         }
         memset(ctxt->sax, 0, sizeof(xmlSAXHandler));
         if (sax->initialized == XML_SAX2_MAGIC)
             memcpy(ctxt->sax, sax, sizeof(xmlSAXHandler));
         else
             memcpy(ctxt->sax, sax, sizeof(xmlSAXHandlerV1));
         if (user_data != NULL)
             ctxt->userData = user_data;
-    }   
+    }
     if (filename == NULL) {
         ctxt->directory = NULL;
     } else {
         ctxt->directory = xmlParserGetDirectory(filename);
     }
 
     inputStream = xmlNewInputStream(ctxt);
     if (inputStream == NULL) {
         xmlFreeParserCtxt(ctxt);
         xmlFreeParserInputBuffer(buf);
         return(NULL);
     }
 
     if (filename == NULL)
         inputStream->filename = NULL;
     else {
         inputStream->filename = (char *)
             xmlCanonicPath((const xmlChar *) filename);
         if (inputStream->filename == NULL) {
             xmlFreeParserCtxt(ctxt);
             xmlFreeParserInputBuffer(buf);
             return(NULL);
         }
     }
     inputStream->buf = buf;
-    inputStream->base = inputStream->buf->buffer->content;
-    inputStream->cur = inputStream->buf->buffer->content;
-    inputStream->end = 
-        &inputStream->buf->buffer->content[inputStream->buf->buffer->use];
-
+    xmlBufResetInput(inputStream->buf->buffer, inputStream);
     inputPush(ctxt, inputStream);
 
     /*
      * If the caller didn't provide an initial 'chunk' for determining
      * the encoding, we set the context to XML_CHAR_ENCODING_NONE so
      * that it can be automatically determined later
      */
     if ((size == 0) || (chunk == NULL)) {
         ctxt->charset = XML_CHAR_ENCODING_NONE;
     } else if ((ctxt->input != NULL) && (ctxt->input->buf != NULL)) {
-        int base = ctxt->input->base - ctxt->input->buf->buffer->content;
-        int cur = ctxt->input->cur - ctxt->input->base;
+        size_t base = xmlBufGetInputBase(ctxt->input->buf->buffer, ctxt->input);
+        size_t cur = ctxt->input->cur - ctxt->input->base;
 
-        xmlParserInputBufferPush(ctxt->input->buf, size, chunk);              
+        xmlParserInputBufferPush(ctxt->input->buf, size, chunk);
 
-        ctxt->input->base = ctxt->input->buf->buffer->content + base;
-        ctxt->input->cur = ctxt->input->base + cur;
-        ctxt->input->end =
-            &ctxt->input->buf->buffer->content[ctxt->input->buf->buffer->use];
+        xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input, base, cur);
 #ifdef DEBUG_PUSH
         xmlGenericError(xmlGenericErrorContext, "PP: pushed %d\n", size);
 #endif
     }
 
     if (enc != XML_CHAR_ENCODING_NONE) {
         xmlSwitchEncoding(ctxt, enc);
     }
 
     return(ctxt);
 }
 #endif /* LIBXML_PUSH_ENABLED */
 
 /**
  * xmlStopParser:
  * @ctxt:  an XML parser context
  *
  * Blocks further parser processing
  */
-void           
+void
 xmlStopParser(xmlParserCtxtPtr ctxt) {
     if (ctxt == NULL)
         return;
     ctxt->instate = XML_PARSER_EOF;
     ctxt->errNo = XML_ERR_USER_STOP;
     ctxt->disableSAX = 1;
     if (ctxt->input != NULL) {
         ctxt->input->cur = BAD_CAST"";
         ctxt->input->base = ctxt->input->cur;
     }
@@ skipping 13 matching lines @@
  *
  * Returns the new parser context or NULL
  */
 xmlParserCtxtPtr
 xmlCreateIOParserCtxt(xmlSAXHandlerPtr sax, void *user_data,
         xmlInputReadCallback   ioread, xmlInputCloseCallback  ioclose,
         void *ioctx, xmlCharEncoding enc) {
     xmlParserCtxtPtr ctxt;
     xmlParserInputPtr inputStream;
     xmlParserInputBufferPtr buf;
-    
+
     if (ioread == NULL) return(NULL);
 
     buf = xmlParserInputBufferCreateIO(ioread, ioclose, ioctx, enc);
-    if (buf == NULL) return(NULL);
+    if (buf == NULL) {
+        if (ioclose != NULL)
+            ioclose(ioctx);
+        return (NULL);
+    }
 
     ctxt = xmlNewParserCtxt();
     if (ctxt == NULL) {
         xmlFreeParserInputBuffer(buf);
         return(NULL);
     }
     if (sax != NULL) {
 #ifdef LIBXML_SAX1_ENABLED
         if (ctxt->sax != (xmlSAXHandlerPtr) &xmlDefaultSAXHandler)
 #endif /* LIBXML_SAX1_ENABLED */
             xmlFree(ctxt->sax);
         ctxt->sax = (xmlSAXHandlerPtr) xmlMalloc(sizeof(xmlSAXHandler));
         if (ctxt->sax == NULL) {
             xmlErrMemory(ctxt, NULL);
             xmlFreeParserCtxt(ctxt);
             return(NULL);
         }
         memset(ctxt->sax, 0, sizeof(xmlSAXHandler));
         if (sax->initialized == XML_SAX2_MAGIC)
             memcpy(ctxt->sax, sax, sizeof(xmlSAXHandler));
         else
             memcpy(ctxt->sax, sax, sizeof(xmlSAXHandlerV1));
         if (user_data != NULL)
             ctxt->userData = user_data;
-    }   
+    }
 
     inputStream = xmlNewIOInputStream(ctxt, buf, enc);
     if (inputStream == NULL) {
         xmlFreeParserCtxt(ctxt);
         return(NULL);
     }
     inputPush(ctxt, inputStream);
 
     return(ctxt);
 }
 
 #ifdef LIBXML_VALID_ENABLED
 /************************************************************************
  *                                                                      *
- *              Front ends when parsing a DTD                           *
+ *              Front ends when parsing a DTD                           *
  *                                                                      *
  ************************************************************************/
 
 /**
  * xmlIOParseDTD:
  * @sax:  the SAX handler block or NULL
  * @input:  an Input Buffer
  * @enc:  the charset encoding if known
  *
  * Load and parse a DTD
- * 
+ *
  * Returns the resulting xmlDtdPtr or NULL in case of error.
  * @input will be freed by the function in any case.
  */
 
 xmlDtdPtr
 xmlIOParseDTD(xmlSAXHandlerPtr sax, xmlParserInputBufferPtr input,
               xmlCharEncoding enc) {
     xmlDtdPtr ret = NULL;
     xmlParserCtxtPtr ctxt;
     xmlParserInputPtr pinput = NULL;
     xmlChar start[4];
 
     if (input == NULL)
         return(NULL);
 
     ctxt = xmlNewParserCtxt();
     if (ctxt == NULL) {
         xmlFreeParserInputBuffer(input);
         return(NULL);
     }
 
+    /* We are loading a DTD */
+    ctxt->options |= XML_PARSE_DTDLOAD;
+
     /*
      * Set-up the SAX context
      */
-    if (sax != NULL) { 
+    if (sax != NULL) {
         if (ctxt->sax != NULL)
             xmlFree(ctxt->sax);
         ctxt->sax = sax;
         ctxt->userData = ctxt;
     }
     xmlDetectSAX2(ctxt);
 
     /*
      * generate a parser input from the I/O handler
      */
@@ skipping 33 matching lines @@
     if (ctxt->myDoc == NULL) {
         xmlErrMemory(ctxt, "New Doc failed");
         return(NULL);
     }
     ctxt->myDoc->properties = XML_DOC_INTERNAL;
     ctxt->myDoc->extSubset = xmlNewDtd(ctxt->myDoc, BAD_CAST "none",
                                        BAD_CAST "none", BAD_CAST "none");
 
     if ((enc == XML_CHAR_ENCODING_NONE) &&
         ((ctxt->input->end - ctxt->input->cur) >= 4)) {
-        /* 
+        /*
          * Get the 4 first bytes and decode the charset
          * if enc != XML_CHAR_ENCODING_NONE
          * plug some encoding conversion routines.
          */
         start[0] = RAW;
         start[1] = NXT(1);
         start[2] = NXT(2);
         start[3] = NXT(3);
         enc = xmlDetectCharEncoding(start, 4);
         if (enc != XML_CHAR_ENCODING_NONE) {
@@ skipping 18 matching lines @@
                 }
             }
         } else {
             ret = NULL;
         }
         xmlFreeDoc(ctxt->myDoc);
         ctxt->myDoc = NULL;
     }
     if (sax != NULL) ctxt->sax = NULL;
     xmlFreeParserCtxt(ctxt);
-    
+
     return(ret);
 }
 
 /**
  * xmlSAXParseDTD:
  * @sax:  the SAX handler block
  * @ExternalID:  a NAME* containing the External ID of the DTD
  * @SystemID:  a NAME* containing the URL to the DTD
  *
  * Load and parse an external subset.
- * 
+ *
  * Returns the resulting xmlDtdPtr or NULL in case of error.
  */
 
 xmlDtdPtr
 xmlSAXParseDTD(xmlSAXHandlerPtr sax, const xmlChar *ExternalID,
                           const xmlChar *SystemID) {
     xmlDtdPtr ret = NULL;
     xmlParserCtxtPtr ctxt;
     xmlParserInputPtr input = NULL;
     xmlCharEncoding enc;
     xmlChar* systemIdCanonic;
 
     if ((ExternalID == NULL) && (SystemID == NULL)) return(NULL);
 
     ctxt = xmlNewParserCtxt();
     if (ctxt == NULL) {
         return(NULL);
     }
 
+    /* We are loading a DTD */
+    ctxt->options |= XML_PARSE_DTDLOAD;
+
     /*
      * Set-up the SAX context
      */
-    if (sax != NULL) { 
+    if (sax != NULL) {
         if (ctxt->sax != NULL)
             xmlFree(ctxt->sax);
         ctxt->sax = sax;
         ctxt->userData = ctxt;
     }
-    
+
     /*
      * Canonicalise the system ID
      */
     systemIdCanonic = xmlCanonicPath(SystemID);
     if ((SystemID != NULL) && (systemIdCanonic == NULL)) {
         xmlFreeParserCtxt(ctxt);
         return(NULL);
     }
 
     /*
@@ skipping 90 matching lines @@
  */
 
 xmlDtdPtr
 xmlParseDTD(const xmlChar *ExternalID, const xmlChar *SystemID) {
     return(xmlSAXParseDTD(NULL, ExternalID, SystemID));
 }
 #endif /* LIBXML_VALID_ENABLED */
 
 /************************************************************************
  *                                                                      *
- *              Front ends when parsing an Entity                       *
+ *              Front ends when parsing an Entity                       *
  *                                                                      *
  ************************************************************************/
 
 /**
  * xmlParseCtxtExternalEntity:
  * @ctx:  the existing parsing context
  * @URL:  the URL for the entity to load
  * @ID:  the System ID for the entity to load
  * @lst:  the return value for the set of parsed nodes
  *
@@ skipping 95 matching lines @@
     /*
      * Parse a possible text declaration first
      */
     if ((CMP5(CUR_PTR, '<', '?', 'x', 'm', 'l')) && (IS_BLANK_CH(NXT(5)))) {
         xmlParseTextDecl(ctxt);
         /*
          * An XML-1.0 document can't reference an entity not XML-1.0
          */
         if ((xmlStrEqual(ctx->version, BAD_CAST "1.0")) &&
             (!xmlStrEqual(ctxt->input->version, BAD_CAST "1.0"))) {
-            xmlFatalErrMsg(ctxt, XML_ERR_VERSION_MISMATCH, 
+            xmlFatalErrMsg(ctxt, XML_ERR_VERSION_MISMATCH,
                            "Version mismatch between document and entity\n");
         }
     }
 
     /*
+     * If the user provided its own SAX callbacks then reuse the
+     * useData callback field, otherwise the expected setup in a
+     * DOM builder is to have userData == ctxt
+     */
+    if (ctx->userData == ctx)
+        ctxt->userData = ctxt;
+    else
+        ctxt->userData = ctx->userData;
+
+    /*
      * Doing validity checking on chunk doesn't make sense
      */
     ctxt->instate = XML_PARSER_CONTENT;
     ctxt->validate = ctx->validate;
     ctxt->valid = ctx->valid;
     ctxt->loadsubset = ctx->loadsubset;
     ctxt->depth = ctx->depth + 1;
     ctxt->replaceEntities = ctx->replaceEntities;
     if (ctxt->validate) {
         ctxt->vctxt.error = ctx->vctxt.error;
@@ skipping 247 matching lines @@
     if (ctxt->input != NULL) {
         oldctxt->sizeentities += ctxt->input->consumed;
         oldctxt->sizeentities += (ctxt->input->cur - ctxt->input->base);
     }
     /*
      * And record the last error if any
      */
     if (ctxt->lastError.code != XML_ERR_OK)
         xmlCopyError(&ctxt->lastError, &oldctxt->lastError);
 
-    if (sax != NULL) 
+    if (sax != NULL)
         ctxt->sax = oldsax;
     oldctxt->node_seq.maximum = ctxt->node_seq.maximum;
     oldctxt->node_seq.length = ctxt->node_seq.length;
     oldctxt->node_seq.buffer = ctxt->node_seq.buffer;
     ctxt->node_seq.maximum = 0;
     ctxt->node_seq.length = 0;
     ctxt->node_seq.buffer = NULL;
     xmlFreeParserCtxt(ctxt);
     newDoc->intSubset = NULL;
     newDoc->extSubset = NULL;
@@ skipping 349 matching lines @@
     } else
         options |= XML_PARSE_NODICT;
 
     if (doc->encoding != NULL) {
         xmlCharEncodingHandlerPtr hdlr;
 
         if (ctxt->encoding != NULL)
             xmlFree((xmlChar *) ctxt->encoding);
         ctxt->encoding = xmlStrdup((const xmlChar *) doc->encoding);
 
-        hdlr = xmlFindCharEncodingHandler(doc->encoding);
+        hdlr = xmlFindCharEncodingHandler((const char *) doc->encoding);
         if (hdlr != NULL) {
             xmlSwitchToEncoding(ctxt, hdlr);
         } else {
             return(XML_ERR_UNSUPPORTED_ENCODING);
         }
     }
 
     xmlCtxtUseOptionsInternal(ctxt, options, NULL);
     xmlDetectSAX2(ctxt);
     ctxt->myDoc = doc;
+    /* parsing in context, i.e. as within existing content */
+    ctxt->instate = XML_PARSER_CONTENT;
 
     fake = xmlNewComment(NULL);
     if (fake == NULL) {
         xmlFreeParserCtxt(ctxt);
         return(XML_ERR_NO_MEMORY);
     }
     xmlAddChild(node, fake);
 
     if (node->type == XML_ELEMENT_NODE) {
         nodePush(ctxt, node);
@@ skipping 15 matching lines @@
                 }
 
                 if (xmlGetNamespace(ctxt, iprefix) == NULL) {
                     nsPush(ctxt, iprefix, ihref);
                     nsnr++;
                 }
                 ns = ns->next;
             }
             cur = cur->parent;
         }
-        ctxt->instate = XML_PARSER_CONTENT;
     }
 
     if ((ctxt->validate) || (ctxt->replaceEntities != 0)) {
         /*
          * ID/IDREF registration will be done in xmlValidateElement below
          */
         ctxt->loadsubset |= XML_SKIP_IDS;
     }
 
 #ifdef LIBXML_HTML_ENABLED
@@ skipping 382 matching lines @@
  *                                                                      *
  *              Front ends when parsing from a file                     *
  *                                                                      *
  ************************************************************************/
 
 /**
  * xmlCreateURLParserCtxt:
  * @filename:  the filename or URL
  * @options:  a combination of xmlParserOption
  *
- * Create a parser context for a file or URL content. 
+ * Create a parser context for a file or URL content.
  * Automatic support for ZLIB/Compress compressed document is provided
  * by default if found at compile-time and for file accesses
  *
  * Returns the new parser context or NULL
  */
 xmlParserCtxtPtr
 xmlCreateURLParserCtxt(const char *filename, int options)
 {
     xmlParserCtxtPtr ctxt;
     xmlParserInputPtr inputStream;
@@ skipping 21 matching lines @@
     if ((ctxt->directory == NULL) && (directory != NULL))
         ctxt->directory = directory;
 
     return(ctxt);
 }
 
 /**
  * xmlCreateFileParserCtxt:
  * @filename:  the filename
  *
- * Create a parser context for a file content. 
+ * Create a parser context for a file content.
  * Automatic support for ZLIB/Compress compressed document is provided
  * by default if found at compile-time.
  *
  * Returns the new parser context or NULL
  */
 xmlParserCtxtPtr
 xmlCreateFileParserCtxt(const char *filename)
 {
     return(xmlCreateURLParserCtxt(filename, 0));
 }
@@ skipping 57 matching lines @@
         }
     }
     else {
        ret = NULL;
        xmlFreeDoc(ctxt->myDoc);
        ctxt->myDoc = NULL;
     }
     if (sax != NULL)
         ctxt->sax = NULL;
     xmlFreeParserCtxt(ctxt);
-    
+
     return(ret);
 }
 
 /**
  * xmlSAXParseFile:
  * @sax:  the SAX handler block
  * @filename:  the filename
  * @recovery:  work in recovery mode, i.e. tries to read no Well Formed
  *             documents
  *
@@ skipping 79 matching lines @@
 
     if ((ctxt == NULL) || (buffer == NULL))
         return;
 
     input = xmlNewInputStream(ctxt);
     if (input == NULL) {
         xmlErrMemory(NULL, "parsing new buffer: out of memory\n");
         xmlClearParserCtxt(ctxt);
         return;
     }
-  
+
     xmlClearParserCtxt(ctxt);
     if (filename != NULL)
         input->filename = (char *) xmlCanonicPath((const xmlChar *)filename);
     input->base = buffer;
     input->cur = buffer;
     input->end = &buffer[xmlStrlen(buffer)];
     inputPush(ctxt, input);
 }
 
 /**
  * xmlSAXUserParseFile:
  * @sax:  a SAX handler
  * @user_data:  The user data returned on SAX callbacks
  * @filename:  a file name
  *
  * parse an XML file and call the given SAX handler routines.
  * Automatic support for ZLIB/Compress compressed document is provided
- * 
+ *
  * Returns 0 in case of success or a error number otherwise
  */
 int
 xmlSAXUserParseFile(xmlSAXHandlerPtr sax, void *user_data,
                     const char *filename) {
     int ret = 0;
     xmlParserCtxtPtr ctxt;
-    
+
     ctxt = xmlCreateFileParserCtxt(filename);
     if (ctxt == NULL) return -1;
     if (ctxt->sax != (xmlSAXHandlerPtr) &xmlDefaultSAXHandler)
         xmlFree(ctxt->sax);
     ctxt->sax = sax;
     xmlDetectSAX2(ctxt);
 
     if (user_data != NULL)
         ctxt->userData = user_data;
-    
+
     xmlParseDocument(ctxt);
-    
+
     if (ctxt->wellFormed)
         ret = 0;
     else {
         if (ctxt->errNo != 0)
             ret = ctxt->errNo;
         else
             ret = -1;
     }
     if (sax != NULL)
         ctxt->sax = NULL;
     if (ctxt->myDoc != NULL) {
         xmlFreeDoc(ctxt->myDoc);
         ctxt->myDoc = NULL;
     }
     xmlFreeParserCtxt(ctxt);
-    
+
     return ret;
 }
 #endif /* LIBXML_SAX1_ENABLED */
 
 /************************************************************************
  *                                                                      *
- *              Front ends when parsing from memory                     *
+ *              Front ends when parsing from memory                     *
  *                                                                      *
  ************************************************************************/
 
 /**
  * xmlCreateMemoryParserCtxt:
  * @buffer:  a pointer to a char array
  * @size:  the size of the array
  *
  * Create a parser context for an XML in-memory document.
  *
@@ skipping 23 matching lines @@
 
     input = xmlNewInputStream(ctxt);
     if (input == NULL) {
         xmlFreeParserInputBuffer(buf);
         xmlFreeParserCtxt(ctxt);
         return(NULL);
     }
 
     input->filename = NULL;
     input->buf = buf;
-    input->base = input->buf->buffer->content;
-    input->cur = input->buf->buffer->content;
-    input->end = &input->buf->buffer->content[input->buf->buffer->use];
+    xmlBufResetInput(input->buf->buffer, input);
 
     inputPush(ctxt, input);
     return(ctxt);
 }
 
 #ifdef LIBXML_SAX1_ENABLED
 /**
  * xmlSAXParseMemoryWithData:
  * @sax:  the SAX handler block
  * @buffer:  an pointer to a char array
@@ skipping 35 matching lines @@
     ctxt->recovery = recovery;
 
     xmlParseDocument(ctxt);
 
     if ((ctxt->wellFormed) || recovery) ret = ctxt->myDoc;
     else {
        ret = NULL;
        xmlFreeDoc(ctxt->myDoc);
        ctxt->myDoc = NULL;
     }
-    if (sax != NULL) 
+    if (sax != NULL)
         ctxt->sax = NULL;
     xmlFreeParserCtxt(ctxt);
 
     return(ret);
 }
 
 /**
  * xmlSAXParseMemory:
  * @sax:  the SAX handler block
  * @buffer:  an pointer to a char array
  * @size:  the size of the array
  * @recovery:  work in recovery mode, i.e. tries to read not Well Formed
  *             documents
  *
  * parse an XML in-memory block and use the given SAX function block
  * to handle the parsing callback. If sax is NULL, fallback to the default
  * DOM tree building routines.
- * 
+ *
  * Returns the resulting document tree
  */
 xmlDocPtr
 xmlSAXParseMemory(xmlSAXHandlerPtr sax, const char *buffer,
                   int size, int recovery) {
     return xmlSAXParseMemoryWithData(sax, buffer, size, recovery, NULL);
 }
 
 /**
  * xmlParseMemory:
  * @buffer:  an pointer to a char array
  * @size:  the size of the array
  *
  * parse an XML in-memory block and build a tree.
- * 
+ *
  * Returns the resulting document tree
  */
 
 xmlDocPtr xmlParseMemory(const char *buffer, int size) {
    return(xmlSAXParseMemory(NULL, buffer, size, 0));
 }
 
 /**
  * xmlRecoverMemory:
  * @buffer:  an pointer to a char array
@@ skipping 33 matching lines @@
     if (ctxt == NULL) return -1;
     if (ctxt->sax != (xmlSAXHandlerPtr) &xmlDefaultSAXHandler)
         xmlFree(ctxt->sax);
     ctxt->sax = sax;
     xmlDetectSAX2(ctxt);
 
     if (user_data != NULL)
         ctxt->userData = user_data;
 
     xmlParseDocument(ctxt);
-    
+
     if (ctxt->wellFormed)
         ret = 0;
     else {
         if (ctxt->errNo != 0)
             ret = ctxt->errNo;
         else
             ret = -1;
     }
     if (sax != NULL)
         ctxt->sax = NULL;
     if (ctxt->myDoc != NULL) {
         xmlFreeDoc(ctxt->myDoc);
         ctxt->myDoc = NULL;
     }
     xmlFreeParserCtxt(ctxt);
-    
+
     return ret;
 }
 #endif /* LIBXML_SAX1_ENABLED */
 
 /**
  * xmlCreateDocParserCtxt:
  * @cur:  a pointer to an array of xmlChar
  *
  * Creates a parser context for an XML in-memory document.
  *
@@ skipping 13 matching lines @@
 /**
  * xmlSAXParseDoc:
  * @sax:  the SAX handler block
  * @cur:  a pointer to an array of xmlChar
  * @recovery:  work in recovery mode, i.e. tries to read no Well Formed
  *             documents
  *
  * parse an XML in-memory document and build a tree.
  * It use the given SAX function block to handle the parsing callback.
  * If sax is NULL, fallback to the default DOM tree building routines.
- * 
+ *
  * Returns the resulting document tree
  */
 
 xmlDocPtr
 xmlSAXParseDoc(xmlSAXHandlerPtr sax, const xmlChar *cur, int recovery) {
     xmlDocPtr ret;
     xmlParserCtxtPtr ctxt;
     xmlSAXHandlerPtr oldsax = NULL;
 
     if (cur == NULL) return(NULL);
 
 
     ctxt = xmlCreateDocParserCtxt(cur);
     if (ctxt == NULL) return(NULL);
-    if (sax != NULL) { 
+    if (sax != NULL) {
         oldsax = ctxt->sax;
         ctxt->sax = sax;
         ctxt->userData = NULL;
     }
     xmlDetectSAX2(ctxt);
 
     xmlParseDocument(ctxt);
     if ((ctxt->wellFormed) || recovery) ret = ctxt->myDoc;
     else {
        ret = NULL;
        xmlFreeDoc(ctxt->myDoc);
        ctxt->myDoc = NULL;
     }
     if (sax != NULL)
         ctxt->sax = oldsax;
     xmlFreeParserCtxt(ctxt);
-    
+
     return(ret);
 }
 
 /**
  * xmlParseDoc:
  * @cur:  a pointer to an array of xmlChar
  *
  * parse an XML in-memory document and build a tree.
- * 
+ *
  * Returns the resulting document tree
  */
 
 xmlDocPtr
 xmlParseDoc(const xmlChar *cur) {
     return(xmlSAXParseDoc(NULL, cur, 0));
 }
 #endif /* LIBXML_SAX1_ENABLED */
 
 #ifdef LIBXML_LEGACY_ENABLED
 /************************************************************************
  *                                                                      *
- *      Specific function to keep track of entities references          *
- *      and used by the XSLT debugger                                   *
+ *      Specific function to keep track of entities references          *
+ *      and used by the XSLT debugger                                   *
  *                                                                      *
  ************************************************************************/
 
 static xmlEntityReferenceFunc xmlEntityRefFunc = NULL;
 
 /**
  * xmlAddEntityReference:
  * @ent : A valid entity
  * @firstNode : A valid first node for children of entity
- * @lastNode : A valid last node of children entity 
+ * @lastNode : A valid last node of children entity
  *
  * Notify of a reference to an entity of type XML_EXTERNAL_GENERAL_PARSED_ENTITY
  */
 static void
 xmlAddEntityReference(xmlEntityPtr ent, xmlNodePtr firstNode,
                       xmlNodePtr lastNode)
 {
     if (xmlEntityRefFunc != NULL) {
         (*xmlEntityRefFunc) (ent, firstNode, lastNode);
     }
 }
 
 
 /**
  * xmlSetEntityReferenceFunc:
  * @func: A valid function
  *
  * Set the function to call call back when a xml reference has been made
  */
 void
 xmlSetEntityReferenceFunc(xmlEntityReferenceFunc func)
 {
     xmlEntityRefFunc = func;
 }
 #endif /* LIBXML_LEGACY_ENABLED */
 
 /************************************************************************
  *                                                                      *
- *                              Miscellaneous                           *
+ *                              Miscellaneous                           *
  *                                                                      *
  ************************************************************************/
 
 #ifdef LIBXML_XPATH_ENABLED
 #include <libxml/xpath.h>
 #endif
 
 extern void XMLCDECL xmlGenericErrorDefaultFunc(void *ctx, const char *msg, ...);
 static int xmlParserInitialized = 0;
 
 /**
  * xmlInitParser:
  *
  * Initialization function for the XML parser.
  * This is not reentrant. Call once before processing in case of
  * use in multithreaded programs.
  */
 
 void
 xmlInitParser(void) {
     if (xmlParserInitialized != 0)
         return;
 
 #ifdef LIBXML_THREAD_ENABLED
     __xmlGlobalInitMutexLock();
     if (xmlParserInitialized == 0) {
 #endif
+        xmlInitThreads();
         xmlInitGlobals();
-        xmlInitThreads();
         if ((xmlGenericError == xmlGenericErrorDefaultFunc) ||
             (xmlGenericError == NULL))
             initGenericErrorDefaultFunc(NULL);
         xmlInitMemory();
+        xmlInitializeDict();
         xmlInitCharEncodingHandlers();
         xmlDefaultSAXHandlerInit();
         xmlRegisterDefaultInputCallbacks();
 #ifdef LIBXML_OUTPUT_ENABLED
         xmlRegisterDefaultOutputCallbacks();
 #endif /* LIBXML_OUTPUT_ENABLED */
 #ifdef LIBXML_HTML_ENABLED
         htmlInitAutoClose();
         htmlDefaultSAXHandlerInit();
 #endif
@@ skipping 40 matching lines @@
 #endif
     xmlDictCleanup();
     xmlCleanupInputCallbacks();
 #ifdef LIBXML_OUTPUT_ENABLED
     xmlCleanupOutputCallbacks();
 #endif
 #ifdef LIBXML_SCHEMAS_ENABLED
     xmlSchemaCleanupTypes();
     xmlRelaxNGCleanupTypes();
 #endif
+    xmlResetLastError();
     xmlCleanupGlobals();
-    xmlResetLastError();
     xmlCleanupThreads(); /* must be last if called not from the main thread */
     xmlCleanupMemory();
     xmlParserInitialized = 0;
 }
 
 /************************************************************************
  *                                                                      *
  *      New set (2.6.0) of simpler and more flexible APIs               *
  *                                                                      *
  ************************************************************************/
 
 /**
  * DICT_FREE:
  * @str:  a string
  *
  * Free a string if it is not owned by the "dict" dictionnary in the
  * current scope
  */
 #define DICT_FREE(str)                                          \
-        if ((str) && ((!dict) ||                                \
+        if ((str) && ((!dict) ||                                \
             (xmlDictOwns(dict, (const xmlChar *)(str)) == 0)))  \
             xmlFree((char *)(str));
 
 /**
  * xmlCtxtReset:
  * @ctxt: an XML parser context
  *
  * Reset a parser context
  */
 void
 xmlCtxtReset(xmlParserCtxtPtr ctxt)
 {
     xmlParserInputPtr input;
     xmlDictPtr dict;
-    
+
     if (ctxt == NULL)
         return;
 
     dict = ctxt->dict;
 
     while ((input = inputPop(ctxt)) != NULL) { /* Non consuming */
         xmlFreeInputStream(input);
     }
     ctxt->inputNr = 0;
     ctxt->input = NULL;
@@ skipping 47 matching lines @@
     ctxt->record_info = 0;
     ctxt->nbChars = 0;
     ctxt->checkIndex = 0;
     ctxt->inSubset = 0;
     ctxt->errNo = XML_ERR_OK;
     ctxt->depth = 0;
     ctxt->charset = XML_CHAR_ENCODING_UTF8;
     ctxt->catalogs = NULL;
     ctxt->nbentities = 0;
     ctxt->sizeentities = 0;
+    ctxt->sizeentcopy = 0;
     xmlInitNodeInfoSeq(&ctxt->node_seq);
 
     if (ctxt->attsDefault != NULL) {
         xmlHashFree(ctxt->attsDefault, (xmlHashDeallocator) xmlFree);
         ctxt->attsDefault = NULL;
     }
     if (ctxt->attsSpecial != NULL) {
         xmlHashFree(ctxt->attsSpecial, NULL);
         ctxt->attsSpecial = NULL;
     }
@@ skipping 64 matching lines @@
         xmlFreeParserInputBuffer(buf);
         return(1);
     }
 
     if (filename == NULL)
         inputStream->filename = NULL;
     else
         inputStream->filename = (char *)
             xmlCanonicPath((const xmlChar *) filename);
     inputStream->buf = buf;
-    inputStream->base = inputStream->buf->buffer->content;
-    inputStream->cur = inputStream->buf->buffer->content;
-    inputStream->end =
-        &inputStream->buf->buffer->content[inputStream->buf->buffer->use];
+    xmlBufResetInput(buf->buffer, inputStream);
 
     inputPush(ctxt, inputStream);
 
     if ((size > 0) && (chunk != NULL) && (ctxt->input != NULL) &&
         (ctxt->input->buf != NULL)) {
-        int base = ctxt->input->base - ctxt->input->buf->buffer->content;
-        int cur = ctxt->input->cur - ctxt->input->base;
+        size_t base = xmlBufGetInputBase(ctxt->input->buf->buffer, ctxt->input);
+        size_t cur = ctxt->input->cur - ctxt->input->base;
 
         xmlParserInputBufferPush(ctxt->input->buf, size, chunk);
 
-        ctxt->input->base = ctxt->input->buf->buffer->content + base;
-        ctxt->input->cur = ctxt->input->base + cur;
-        ctxt->input->end =
-            &ctxt->input->buf->buffer->content[ctxt->input->buf->buffer->
-                                               use];
+        xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input, base, cur);
 #ifdef DEBUG_PUSH
         xmlGenericError(xmlGenericErrorContext, "PP: pushed %d\n", size);
 #endif
     }
 
     if (encoding != NULL) {
         xmlCharEncodingHandlerPtr hdlr;
 
         if (ctxt->encoding != NULL)
             xmlFree((xmlChar *) ctxt->encoding);
@@ skipping 130 matching lines @@
         ctxt->options |= XML_PARSE_OLD10;
         options -= XML_PARSE_OLD10;
     }
     if (options & XML_PARSE_NOBASEFIX) {
         ctxt->options |= XML_PARSE_NOBASEFIX;
         options -= XML_PARSE_NOBASEFIX;
     }
     if (options & XML_PARSE_HUGE) {
         ctxt->options |= XML_PARSE_HUGE;
         options -= XML_PARSE_HUGE;
+        if (ctxt->dict != NULL)
+            xmlDictSetLimit(ctxt->dict, 0);
     }
     if (options & XML_PARSE_OLDSAX) {
         ctxt->options |= XML_PARSE_OLDSAX;
         options -= XML_PARSE_OLDSAX;
     }
+    if (options & XML_PARSE_IGNORE_ENC) {
+        ctxt->options |= XML_PARSE_IGNORE_ENC;
+        options -= XML_PARSE_IGNORE_ENC;
+    }
+    if (options & XML_PARSE_BIG_LINES) {
+        ctxt->options |= XML_PARSE_BIG_LINES;
+        options -= XML_PARSE_BIG_LINES;
+    }
     ctxt->linenumbers = 1;
     return (options);
 }
 
 /**
  * xmlCtxtUseOptions:
  * @ctxt: an XML parser context
  * @options:  a combination of xmlParserOption
  *
  * Applies the options to the parser context
@@ skipping 54 matching lines @@
 }
 
 /**
  * xmlReadDoc:
  * @cur:  a pointer to a zero terminated string
  * @URL:  the base URL to use for the document
  * @encoding:  the document encoding, or NULL
  * @options:  a combination of xmlParserOption
  *
  * parse an XML in-memory document and build a tree.
- * 
+ *
  * Returns the resulting document tree
  */
 xmlDocPtr
 xmlReadDoc(const xmlChar * cur, const char *URL, const char *encoding, int options)
 {
     xmlParserCtxtPtr ctxt;
 
     if (cur == NULL)
         return (NULL);
+    xmlInitParser();
 
     ctxt = xmlCreateDocParserCtxt(cur);
     if (ctxt == NULL)
         return (NULL);
     return (xmlDoRead(ctxt, URL, encoding, options, 0));
 }
 
 /**
  * xmlReadFile:
  * @filename:  a file or URL
  * @encoding:  the document encoding, or NULL
  * @options:  a combination of xmlParserOption
  *
  * parse an XML file from the filesystem or the network.
- * 
+ *
  * Returns the resulting document tree
  */
 xmlDocPtr
 xmlReadFile(const char *filename, const char *encoding, int options)
 {
     xmlParserCtxtPtr ctxt;
 
+    xmlInitParser();
     ctxt = xmlCreateURLParserCtxt(filename, options);
     if (ctxt == NULL)
         return (NULL);
     return (xmlDoRead(ctxt, NULL, encoding, options, 0));
 }
 
 /**
  * xmlReadMemory:
  * @buffer:  a pointer to a char array
  * @size:  the size of the array
  * @URL:  the base URL to use for the document
  * @encoding:  the document encoding, or NULL
  * @options:  a combination of xmlParserOption
  *
  * parse an XML in-memory document and build a tree.
- * 
+ *
  * Returns the resulting document tree
  */
 xmlDocPtr
 xmlReadMemory(const char *buffer, int size, const char *URL, const char *encoding, int options)
 {
     xmlParserCtxtPtr ctxt;
 
+    xmlInitParser();
     ctxt = xmlCreateMemoryParserCtxt(buffer, size);
     if (ctxt == NULL)
         return (NULL);
     return (xmlDoRead(ctxt, URL, encoding, options, 0));
 }
 
 /**
  * xmlReadFd:
  * @fd:  an open file descriptor
  * @URL:  the base URL to use for the document
  * @encoding:  the document encoding, or NULL
  * @options:  a combination of xmlParserOption
  *
  * parse an XML from a file descriptor and build a tree.
  * NOTE that the file descriptor will not be closed when the
  *      reader is closed or reset.
- * 
+ *
  * Returns the resulting document tree
  */
 xmlDocPtr
 xmlReadFd(int fd, const char *URL, const char *encoding, int options)
 {
     xmlParserCtxtPtr ctxt;
     xmlParserInputBufferPtr input;
     xmlParserInputPtr stream;
 
     if (fd < 0)
         return (NULL);
+    xmlInitParser();
 
     input = xmlParserInputBufferCreateFd(fd, XML_CHAR_ENCODING_NONE);
     if (input == NULL)
         return (NULL);
     input->closecallback = NULL;
     ctxt = xmlNewParserCtxt();
     if (ctxt == NULL) {
         xmlFreeParserInputBuffer(input);
         return (NULL);
     }
@@ skipping 10 matching lines @@
 /**
  * xmlReadIO:
  * @ioread:  an I/O read function
  * @ioclose:  an I/O close function
  * @ioctx:  an I/O handler
  * @URL:  the base URL to use for the document
  * @encoding:  the document encoding, or NULL
  * @options:  a combination of xmlParserOption
  *
  * parse an XML document from I/O functions and source and build a tree.
- * 
+ *
  * Returns the resulting document tree
  */
 xmlDocPtr
 xmlReadIO(xmlInputReadCallback ioread, xmlInputCloseCallback ioclose,
           void *ioctx, const char *URL, const char *encoding, int options)
 {
     xmlParserCtxtPtr ctxt;
     xmlParserInputBufferPtr input;
     xmlParserInputPtr stream;
 
     if (ioread == NULL)
         return (NULL);
+    xmlInitParser();
 
     input = xmlParserInputBufferCreateIO(ioread, ioclose, ioctx,
                                          XML_CHAR_ENCODING_NONE);
-    if (input == NULL)
+    if (input == NULL) {
+        if (ioclose != NULL)
+            ioclose(ioctx);
         return (NULL);
+    }
     ctxt = xmlNewParserCtxt();
     if (ctxt == NULL) {
         xmlFreeParserInputBuffer(input);
         return (NULL);
     }
     stream = xmlNewIOInputStream(ctxt, input, XML_CHAR_ENCODING_NONE);
     if (stream == NULL) {
         xmlFreeParserInputBuffer(input);
         xmlFreeParserCtxt(ctxt);
         return (NULL);
     }
     inputPush(ctxt, stream);
     return (xmlDoRead(ctxt, URL, encoding, options, 0));
 }
 
 /**
  * xmlCtxtReadDoc:
  * @ctxt:  an XML parser context
  * @cur:  a pointer to a zero terminated string
  * @URL:  the base URL to use for the document
  * @encoding:  the document encoding, or NULL
  * @options:  a combination of xmlParserOption
  *
  * parse an XML in-memory document and build a tree.
  * This reuses the existing @ctxt parser context
- * 
+ *
  * Returns the resulting document tree
  */
 xmlDocPtr
 xmlCtxtReadDoc(xmlParserCtxtPtr ctxt, const xmlChar * cur,
                const char *URL, const char *encoding, int options)
 {
     xmlParserInputPtr stream;
 
     if (cur == NULL)
         return (NULL);
     if (ctxt == NULL)
         return (NULL);
+    xmlInitParser();
 
     xmlCtxtReset(ctxt);
 
     stream = xmlNewStringInputStream(ctxt, cur);
     if (stream == NULL) {
         return (NULL);
     }
     inputPush(ctxt, stream);
     return (xmlDoRead(ctxt, URL, encoding, options, 1));
 }
 
 /**
  * xmlCtxtReadFile:
  * @ctxt:  an XML parser context
  * @filename:  a file or URL
  * @encoding:  the document encoding, or NULL
  * @options:  a combination of xmlParserOption
  *
  * parse an XML file from the filesystem or the network.
  * This reuses the existing @ctxt parser context
- * 
+ *
  * Returns the resulting document tree
  */
 xmlDocPtr
 xmlCtxtReadFile(xmlParserCtxtPtr ctxt, const char *filename,
                 const char *encoding, int options)
 {
     xmlParserInputPtr stream;
 
     if (filename == NULL)
         return (NULL);
     if (ctxt == NULL)
         return (NULL);
+    xmlInitParser();
 
     xmlCtxtReset(ctxt);
 
     stream = xmlLoadExternalEntity(filename, NULL, ctxt);
     if (stream == NULL) {
         return (NULL);
     }
     inputPush(ctxt, stream);
     return (xmlDoRead(ctxt, NULL, encoding, options, 1));
 }
 
 /**
  * xmlCtxtReadMemory:
  * @ctxt:  an XML parser context
  * @buffer:  a pointer to a char array
  * @size:  the size of the array
  * @URL:  the base URL to use for the document
  * @encoding:  the document encoding, or NULL
  * @options:  a combination of xmlParserOption
  *
  * parse an XML in-memory document and build a tree.
  * This reuses the existing @ctxt parser context
- * 
+ *
  * Returns the resulting document tree
  */
 xmlDocPtr
 xmlCtxtReadMemory(xmlParserCtxtPtr ctxt, const char *buffer, int size,
                   const char *URL, const char *encoding, int options)
 {
     xmlParserInputBufferPtr input;
     xmlParserInputPtr stream;
 
     if (ctxt == NULL)
         return (NULL);
     if (buffer == NULL)
         return (NULL);
+    xmlInitParser();
 
     xmlCtxtReset(ctxt);
 
     input = xmlParserInputBufferCreateMem(buffer, size, XML_CHAR_ENCODING_NONE);
     if (input == NULL) {
         return(NULL);
     }
 
     stream = xmlNewIOInputStream(ctxt, input, XML_CHAR_ENCODING_NONE);
     if (stream == NULL) {
@@ skipping 10 matching lines @@
  * @ctxt:  an XML parser context
  * @fd:  an open file descriptor
  * @URL:  the base URL to use for the document
  * @encoding:  the document encoding, or NULL
  * @options:  a combination of xmlParserOption
  *
  * parse an XML from a file descriptor and build a tree.
  * This reuses the existing @ctxt parser context
  * NOTE that the file descriptor will not be closed when the
  *      reader is closed or reset.
- * 
+ *
  * Returns the resulting document tree
  */
 xmlDocPtr
 xmlCtxtReadFd(xmlParserCtxtPtr ctxt, int fd,
               const char *URL, const char *encoding, int options)
 {
     xmlParserInputBufferPtr input;
     xmlParserInputPtr stream;
 
     if (fd < 0)
         return (NULL);
     if (ctxt == NULL)
         return (NULL);
+    xmlInitParser();
 
     xmlCtxtReset(ctxt);
 
 
     input = xmlParserInputBufferCreateFd(fd, XML_CHAR_ENCODING_NONE);
     if (input == NULL)
         return (NULL);
     input->closecallback = NULL;
     stream = xmlNewIOInputStream(ctxt, input, XML_CHAR_ENCODING_NONE);
     if (stream == NULL) {
         xmlFreeParserInputBuffer(input);
         return (NULL);
     }
     inputPush(ctxt, stream);
     return (xmlDoRead(ctxt, URL, encoding, options, 1));
 }
 
 /**
  * xmlCtxtReadIO:
  * @ctxt:  an XML parser context
  * @ioread:  an I/O read function
  * @ioclose:  an I/O close function
  * @ioctx:  an I/O handler
  * @URL:  the base URL to use for the document
  * @encoding:  the document encoding, or NULL
  * @options:  a combination of xmlParserOption
  *
  * parse an XML document from I/O functions and source and build a tree.
  * This reuses the existing @ctxt parser context
- * 
+ *
  * Returns the resulting document tree
  */
 xmlDocPtr
 xmlCtxtReadIO(xmlParserCtxtPtr ctxt, xmlInputReadCallback ioread,
               xmlInputCloseCallback ioclose, void *ioctx,
               const char *URL,
               const char *encoding, int options)
 {
     xmlParserInputBufferPtr input;
     xmlParserInputPtr stream;
 
     if (ioread == NULL)
         return (NULL);
     if (ctxt == NULL)
         return (NULL);
+    xmlInitParser();
 
     xmlCtxtReset(ctxt);
 
     input = xmlParserInputBufferCreateIO(ioread, ioclose, ioctx,
                                          XML_CHAR_ENCODING_NONE);
-    if (input == NULL)
+    if (input == NULL) {
+        if (ioclose != NULL)
+            ioclose(ioctx);
         return (NULL);
+    }
     stream = xmlNewIOInputStream(ctxt, input, XML_CHAR_ENCODING_NONE);
     if (stream == NULL) {
         xmlFreeParserInputBuffer(input);
         return (NULL);
     }
     inputPush(ctxt, stream);
     return (xmlDoRead(ctxt, URL, encoding, options, 1));
 }
 
 #define bottom_parser
 #include "elfgcchack.h"