Upgrade to libxml 2.9.2 and libxslt 1.1.28

third_party/libxml/src/xmlregexp.c

 /*
  * regexp.c: generic and extensible Regular Expression engine
  *
- * Basically designed with the purpose of compiling regexps for 
+ * Basically designed with the purpose of compiling regexps for
  * the variety of validation/shemas mechanisms now available in
  * XML related specifications these include:
  *    - XML-1.0 DTD validation
  *    - XML Schemas structure part 1
  *    - XML Schemas Datatypes part 2 especially Appendix F
  *    - RELAX-NG/TREX i.e. the counter proposal
  *
  * See Copyright for the status of this software.
  *
  * Daniel Veillard <veillard@redhat.com>
@@ skipping 22 matching lines @@
 #define INT_MAX 123456789 /* easy to flag and big enough for our needs */
 #endif
 
 /* #define DEBUG_REGEXP_GRAPH */
 /* #define DEBUG_REGEXP_EXEC */
 /* #define DEBUG_PUSH */
 /* #define DEBUG_COMPACTION */
 
 #define MAX_PUSH 10000000
 
+#ifdef ERROR
+#undef ERROR
+#endif
 #define ERROR(str)                                                      \
     ctxt->error = XML_REGEXP_COMPILE_ERROR;                             \
     xmlRegexpErrCompile(ctxt, str);
 #define NEXT ctxt->cur++
 #define CUR (*(ctxt->cur))
 #define NXT(index) (ctxt->cur[index])
 
 #define CUR_SCHAR(s, l) xmlStringCurrentChar(NULL, s, &l)
 #define NEXTL(l) ctxt->cur += l;
 #define XML_REG_STRING_SEPARATOR '|'
 /*
  * Need PREV to check on a '-' within a Character Group. May only be used
  * when it's guaranteed that cur is not at the beginning of ctxt->string!
  */
 #define PREV (ctxt->cur[-1])
 
 /**
  * TODO:
  *
  * macro to flag unimplemented blocks
  */
-#define TODO                                                            \
+#define TODO                                                            \
     xmlGenericError(xmlGenericErrorContext,                             \
             "Unimplemented block at %s:%d\n",                           \
             __FILE__, __LINE__);
 
 /************************************************************************
- *                                                                      *
- *                      Datatypes and structures                        *
- *                                                                      *
+ *                                                                      *
+ *                      Datatypes and structures                        *
+ *                                                                      *
  ************************************************************************/
 
 /*
  * Note: the order of the enums below is significant, do not shuffle
  */
 typedef enum {
     XML_REGEXP_EPSILON = 1,
     XML_REGEXP_CHARVAL,
     XML_REGEXP_RANGES,
     XML_REGEXP_SUBREG,  /* used for () sub regexps */
@@ skipping 125 matching lines @@
     xmlRegAtomPtr atom;
     int to;
     int counter;
     int count;
     int nd;
 };
 
 struct _xmlAutomataState {
     xmlRegStateType type;
     xmlRegMarkedType mark;
+    xmlRegMarkedType markd;
     xmlRegMarkedType reached;
     int no;
     int maxTrans;
     int nbTrans;
     xmlRegTrans *trans;
     /*  knowing states ponting to us can speed things up */
     int maxTransTo;
     int nbTransTo;
     int *transTo;
 };
@@ skipping 122 matching lines @@
 static void xmlRegFreeAtom(xmlRegAtomPtr atom);
 static int xmlRegStrEqualWildcard(const xmlChar *expStr, const xmlChar *valStr);
 static int xmlRegCheckCharacter(xmlRegAtomPtr atom, int codepoint);
 static int xmlRegCheckCharacterRange(xmlRegAtomType type, int codepoint,
                   int neg, int start, int end, const xmlChar *blockName);
 
 void xmlAutomataSetFlags(xmlAutomataPtr am, int flags);
 
 /************************************************************************
  *                                                                      *
- *              Regexp memory error handler                             *
+ *              Regexp memory error handler                             *
  *                                                                      *
  ************************************************************************/
 /**
  * xmlRegexpErrMemory:
  * @extra:  extra information
  *
  * Handle an out of memory condition
  */
 static void
 xmlRegexpErrMemory(xmlRegParserCtxtPtr ctxt, const char *extra)
@@ skipping 26 matching lines @@
         idx = ctxt->cur - ctxt->string;
         ctxt->error = XML_REGEXP_COMPILE_ERROR;
     }
     __xmlRaiseError(NULL, NULL, NULL, NULL, NULL, XML_FROM_REGEXP,
                     XML_REGEXP_COMPILE_ERROR, XML_ERR_FATAL, NULL, 0, extra,
                     regexp, NULL, idx, 0,
                     "failed to compile: %s\n", extra);
 }
 
 /************************************************************************
- *                                                                      *
- *                      Allocation/Deallocation                         *
- *                                                                      *
+ *                                                                      *
+ *                      Allocation/Deallocation                         *
+ *                                                                      *
  ************************************************************************/
 
 static int xmlFAComputesDeterminism(xmlRegParserCtxtPtr ctxt);
 /**
  * xmlRegEpxFromParse:
  * @ctxt:  the parser context used to build it
  *
  * Allocate a new regexp and fill it with the result from the parser
  *
  * Returns the new regexp or NULL in case of error
@@ skipping 500 matching lines @@
         for (i = 0;i < ctxt->nbAtoms;i++)
             xmlRegFreeAtom(ctxt->atoms[i]);
         xmlFree(ctxt->atoms);
     }
     if (ctxt->counters != NULL)
         xmlFree(ctxt->counters);
     xmlFree(ctxt);
 }
 
 /************************************************************************
- *                                                                      *
- *                      Display of Data structures                      *
- *                                                                      *
+ *                                                                      *
+ *                      Display of Data structures                      *
+ *                                                                      *
  ************************************************************************/
 
 static void
 xmlRegPrintAtomType(FILE *output, xmlRegAtomType type) {
     switch (type) {
         case XML_REGEXP_EPSILON:
             fprintf(output, "epsilon "); break;
         case XML_REGEXP_CHARVAL:
             fprintf(output, "charval "); break;
         case XML_REGEXP_RANGES:
@@ skipping 186 matching lines @@
         fprintf(output, "count based %d, ", trans->count);
     }
     if (trans->atom == NULL) {
         fprintf(output, "epsilon to %d\n", trans->to);
         return;
     }
     if (trans->atom->type == XML_REGEXP_CHARVAL)
         fprintf(output, "char %c ", trans->atom->codepoint);
     fprintf(output, "atom %d, to %d\n", trans->atom->no, trans->to);
 }
-    
+
 static void
 xmlRegPrintState(FILE *output, xmlRegStatePtr state) {
     int i;
 
     fprintf(output, " state: ");
     if (state == NULL) {
         fprintf(output, "NULL\n");
         return;
     }
     if (state->type == XML_REGEXP_START_STATE)
         fprintf(output, "START ");
     if (state->type == XML_REGEXP_FINAL_STATE)
         fprintf(output, "FINAL ");
-    
+
     fprintf(output, "%d, %d transitions:\n", state->no, state->nbTrans);
     for (i = 0;i < state->nbTrans; i++) {
         xmlRegPrintTrans(output, &(state->trans[i]));
     }
 }
 
 #ifdef DEBUG_REGEXP_GRAPH
 static void
 xmlRegPrintCtxt(FILE *output, xmlRegParserCtxtPtr ctxt) {
     int i;
@@ skipping 29 matching lines @@
     }
     fprintf(output, "%d counters:\n", ctxt->nbCounters);
     for (i = 0;i < ctxt->nbCounters; i++) {
         fprintf(output, " %d: min %d max %d\n", i, ctxt->counters[i].min,
                                                 ctxt->counters[i].max);
     }
 }
 #endif
 
 /************************************************************************
- *                                                                      *
+ *                                                                      *
  *               Finite Automata structures manipulations               *
- *                                                                      *
+ *                                                                      *
  ************************************************************************/
 
-static void 
+static void
 xmlRegAtomAddRange(xmlRegParserCtxtPtr ctxt, xmlRegAtomPtr atom,
                    int neg, xmlRegAtomType type, int start, int end,
                    xmlChar *blockName) {
     xmlRegRangePtr range;
 
     if (atom == NULL) {
         ERROR("add range: atom is NULL");
         return;
     }
     if (atom->type != XML_REGEXP_RANGES) {
@@ skipping 19 matching lines @@
             atom->maxRanges /= 2;
             return;
         }
         atom->ranges = tmp;
     }
     range = xmlRegNewRange(ctxt, neg, type, start, end);
     if (range == NULL)
         return;
     range->blockName = blockName;
     atom->ranges[atom->nbRanges++] = range;
-    
+
 }
 
 static int
 xmlRegGetCounter(xmlRegParserCtxtPtr ctxt) {
     if (ctxt->maxCounters == 0) {
         ctxt->maxCounters = 4;
         ctxt->counters = (xmlRegCounter *) xmlMalloc(ctxt->maxCounters *
                                              sizeof(xmlRegCounter));
         if (ctxt->counters == NULL) {
             xmlRegexpErrMemory(ctxt, "allocating counter");
@@ skipping 10 matching lines @@
             ctxt->maxCounters /= 2;
             return(-1);
         }
         ctxt->counters = tmp;
     }
     ctxt->counters[ctxt->nbCounters].min = -1;
     ctxt->counters[ctxt->nbCounters].max = -1;
     return(ctxt->nbCounters++);
 }
 
-static int 
+static int
 xmlRegAtomPush(xmlRegParserCtxtPtr ctxt, xmlRegAtomPtr atom) {
     if (atom == NULL) {
         ERROR("atom push: atom is NULL");
         return(-1);
     }
     if (ctxt->maxAtoms == 0) {
         ctxt->maxAtoms = 4;
         ctxt->atoms = (xmlRegAtomPtr *) xmlMalloc(ctxt->maxAtoms *
                                              sizeof(xmlRegAtomPtr));
         if (ctxt->atoms == NULL) {
@@ skipping 11 matching lines @@
             ctxt->maxAtoms /= 2;
             return(-1);
         }
         ctxt->atoms = tmp;
     }
     atom->no = ctxt->nbAtoms;
     ctxt->atoms[ctxt->nbAtoms++] = atom;
     return(0);
 }
 
-static void 
+static void
 xmlRegStateAddTransTo(xmlRegParserCtxtPtr ctxt, xmlRegStatePtr target,
                       int from) {
     if (target->maxTransTo == 0) {
         target->maxTransTo = 8;
         target->transTo = (int *) xmlMalloc(target->maxTransTo *
                                              sizeof(int));
         if (target->transTo == NULL) {
             xmlRegexpErrMemory(ctxt, "adding transition");
             target->maxTransTo = 0;
             return;
         }
     } else if (target->nbTransTo >= target->maxTransTo) {
         int *tmp;
         target->maxTransTo *= 2;
         tmp = (int *) xmlRealloc(target->transTo, target->maxTransTo *
                                              sizeof(int));
         if (tmp == NULL) {
             xmlRegexpErrMemory(ctxt, "adding transition");
             target->maxTransTo /= 2;
             return;
         }
         target->transTo = tmp;
     }
     target->transTo[target->nbTransTo] = from;
     target->nbTransTo++;
 }
 
-static void 
+static void
 xmlRegStateAddTrans(xmlRegParserCtxtPtr ctxt, xmlRegStatePtr state,
                     xmlRegAtomPtr atom, xmlRegStatePtr target,
                     int counter, int count) {
 
     int nrtrans;
 
     if (state == NULL) {
         ERROR("add state: state is NULL");
         return;
     }
@@ skipping 45 matching lines @@
 #ifdef DEBUG_REGEXP_GRAPH
     printf("Add trans from %d to %d ", state->no, target->no);
     if (count == REGEXP_ALL_COUNTER)
         printf("all transition\n");
     else if (count >= 0)
         printf("count based %d\n", count);
     else if (counter >= 0)
         printf("counted %d\n", counter);
     else if (atom == NULL)
         printf("epsilon transition\n");
-    else if (atom != NULL) 
+    else if (atom != NULL)
         xmlRegPrintAtom(stdout, atom);
 #endif
 
     state->trans[state->nbTrans].atom = atom;
     state->trans[state->nbTrans].to = target->no;
     state->trans[state->nbTrans].counter = counter;
     state->trans[state->nbTrans].count = count;
     state->trans[state->nbTrans].nd = 0;
     state->nbTrans++;
     xmlRegStateAddTransTo(ctxt, target, state->no);
@@ skipping 133 matching lines @@
         if (xmlRegAtomPush(ctxt, atom) < 0) {
             return(-1);
         }
         if ((to != NULL) && (atom->stop != to) &&
             (atom->quant != XML_REGEXP_QUANT_RANGE)) {
             /*
              * Generate an epsilon transition to link to the target
              */
             xmlFAGenerateEpsilonTransition(ctxt, atom->stop, to);
 #ifdef DV
-        } else if ((to == NULL) && (atom->quant != XML_REGEXP_QUANT_RANGE) && 
+        } else if ((to == NULL) && (atom->quant != XML_REGEXP_QUANT_RANGE) &&
                    (atom->quant != XML_REGEXP_QUANT_ONCE)) {
             to = xmlRegNewState(ctxt);
             xmlRegStatePush(ctxt, to);
             ctxt->state = to;
             xmlFAGenerateEpsilonTransition(ctxt, atom->stop, to);
 #endif
         }
         switch (atom->quant) {
             case XML_REGEXP_QUANT_OPT:
                 atom->quant = XML_REGEXP_QUANT_ONCE;
                 /*
                  * transition done to the state after end of atom.
                  *      1. set transition from atom start to new state
-                 *      2. set transition from atom end to this state. 
+                 *      2. set transition from atom end to this state.
                  */
                 if (to == NULL) {
                     xmlFAGenerateEpsilonTransition(ctxt, atom->start, 0);
                     xmlFAGenerateEpsilonTransition(ctxt, atom->stop,
                                                    ctxt->state);
                 } else {
                     xmlFAGenerateEpsilonTransition(ctxt, atom->start, to);
                 }
                 break;
             case XML_REGEXP_QUANT_MULT:
@@ skipping 23 matching lines @@
                  * The principle here is to use counted transition
                  * to avoid explosion in the number of states in the
                  * graph. This is clearly more complex but should not
                  * be exploitable at runtime.
                  */
                 if ((atom->min == 0) && (atom->start0 == NULL)) {
                     xmlRegAtomPtr copy;
                     /*
                      * duplicate a transition based on atom to count next
                      * occurences after 1. We cannot loop to atom->start
-                     * directly because we need an epsilon transition to 
+                     * directly because we need an epsilon transition to
                      * newstate.
                      */
                      /* ???? For some reason it seems we never reach that
                         case, I suppose this got optimized out before when
                         building the automata */
                     copy = xmlRegCopyAtom(ctxt, atom);
                     if (copy == NULL)
                         return(-1);
                     copy->quant = XML_REGEXP_QUANT_ONCE;
                     copy->min = 0;
@@ skipping 38 matching lines @@
                 }
                 atom->min = 0;
                 atom->max = 0;
                 atom->quant = XML_REGEXP_QUANT_ONCE;
                 ctxt->state = newstate;
             }
             default:
                 break;
         }
         return(0);
-    } 
+    }
     if ((atom->min == 0) && (atom->max == 0) &&
                (atom->quant == XML_REGEXP_QUANT_RANGE)) {
         /*
          * we can discard the atom and generate an epsilon transition instead
          */
         if (to == NULL) {
             to = xmlRegNewState(ctxt);
             if (to != NULL)
                 xmlRegStatePush(ctxt, to);
             else {
                 return(-1);
             }
         }
         xmlFAGenerateEpsilonTransition(ctxt, from, to);
         ctxt->state = to;
         xmlRegFreeAtom(atom);
         return(0);
     }
     if (to == NULL) {
         to = xmlRegNewState(ctxt);
         if (to != NULL)
             xmlRegStatePush(ctxt, to);
         else {
             return(-1);
         }
-    } 
+    }
     end = to;
-    if ((atom->quant == XML_REGEXP_QUANT_MULT) || 
+    if ((atom->quant == XML_REGEXP_QUANT_MULT) ||
         (atom->quant == XML_REGEXP_QUANT_PLUS)) {
         /*
          * Do not pollute the target state by adding transitions from
          * it as it is likely to be the shared target of multiple branches.
          * So isolate with an epsilon transition.
          */
         xmlRegStatePtr tmp;
-        
+
         tmp = xmlRegNewState(ctxt);
         if (tmp != NULL)
             xmlRegStatePush(ctxt, tmp);
         else {
             return(-1);
         }
         xmlFAGenerateEpsilonTransition(ctxt, tmp, to);
         to = tmp;
     }
     if (xmlRegAtomPush(ctxt, atom) < 0) {
         return(-1);
     }
     xmlRegStateAddTrans(ctxt, from, atom, to, -1, -1);
     ctxt->state = end;
     switch (atom->quant) {
         case XML_REGEXP_QUANT_OPT:
             atom->quant = XML_REGEXP_QUANT_ONCE;
             xmlFAGenerateEpsilonTransition(ctxt, from, to);
             break;
         case XML_REGEXP_QUANT_MULT:
             atom->quant = XML_REGEXP_QUANT_ONCE;
             xmlFAGenerateEpsilonTransition(ctxt, from, to);
             xmlRegStateAddTrans(ctxt, to, atom, to, -1, -1);
             break;
         case XML_REGEXP_QUANT_PLUS:
             atom->quant = XML_REGEXP_QUANT_ONCE;
             xmlRegStateAddTrans(ctxt, to, atom, to, -1, -1);
             break;
-        case XML_REGEXP_QUANT_RANGE: 
+        case XML_REGEXP_QUANT_RANGE:
 #if DV_test
             if (atom->min == 0) {
                 xmlFAGenerateEpsilonTransition(ctxt, from, to);
             }
 #endif
             break;
         default:
             break;
     }
     return(0);
 }
 
 /**
  * xmlFAReduceEpsilonTransitions:
  * @ctxt:  a regexp parser context
  * @fromnr:  the from state
- * @tonr:  the to state 
+ * @tonr:  the to state
  * @counter:  should that transition be associated to a counted
  *
  */
 static void
 xmlFAReduceEpsilonTransitions(xmlRegParserCtxtPtr ctxt, int fromnr,
                               int tonr, int counter) {
     int transnr;
     xmlRegStatePtr from;
     xmlRegStatePtr to;
 
@@ skipping 23 matching lines @@
         if (to->trans[transnr].atom == NULL) {
             /*
              * Don't remove counted transitions
              * Don't loop either
              */
             if (to->trans[transnr].to != fromnr) {
                 if (to->trans[transnr].count >= 0) {
                     int newto = to->trans[transnr].to;
 
                     xmlRegStateAddTrans(ctxt, from, NULL,
-                                        ctxt->states[newto], 
+                                        ctxt->states[newto],
                                         -1, to->trans[transnr].count);
                 } else {
 #ifdef DEBUG_REGEXP_GRAPH
                     printf("Found epsilon trans %d from %d to %d\n",
                            transnr, tonr, to->trans[transnr].to);
 #endif
                     if (to->trans[transnr].counter >= 0) {
                         xmlFAReduceEpsilonTransitions(ctxt, fromnr,
                                               to->trans[transnr].to,
                                               to->trans[transnr].counter);
                     } else {
                         xmlFAReduceEpsilonTransitions(ctxt, fromnr,
                                               to->trans[transnr].to,
                                               counter);
                     }
                 }
             }
         } else {
             int newto = to->trans[transnr].to;
 
             if (to->trans[transnr].counter >= 0) {
-                xmlRegStateAddTrans(ctxt, from, to->trans[transnr].atom, 
-                                    ctxt->states[newto], 
+                xmlRegStateAddTrans(ctxt, from, to->trans[transnr].atom,
+                                    ctxt->states[newto],
                                     to->trans[transnr].counter, -1);
             } else {
-                xmlRegStateAddTrans(ctxt, from, to->trans[transnr].atom, 
+                xmlRegStateAddTrans(ctxt, from, to->trans[transnr].atom,
                                     ctxt->states[newto], counter, -1);
             }
         }
     }
     to->mark = XML_REGEXP_MARK_NORMAL;
 }
 
 /**
  * xmlFAEliminateSimpleEpsilonTransitions:
  * @ctxt:  a regexp parser context
  *
- * Eliminating general epsilon transitions can get costly in the general 
+ * Eliminating general epsilon transitions can get costly in the general
  * algorithm due to the large amount of generated new transitions and
  * associated comparisons. However for simple epsilon transition used just
  * to separate building blocks when generating the automata this can be
  * reduced to state elimination:
  *    - if there exists an epsilon from X to Y
  *    - if there is no other transition from X
  * then X and Y are semantically equivalent and X can be eliminated
  * If X is the start state then make Y the start state, else replace the
  * target of all transitions to X by transitions to Y.
  */
@@ skipping 15 matching lines @@
             (state->trans[0].to >= 0) &&
             (state->trans[0].to != statenr) &&
             (state->trans[0].counter < 0) &&
             (state->trans[0].count < 0)) {
             newto = state->trans[0].to;
 
             if (state->type == XML_REGEXP_START_STATE) {
 #ifdef DEBUG_REGEXP_GRAPH
                 printf("Found simple epsilon trans from start %d to %d\n",
                        statenr, newto);
-#endif     
+#endif
             } else {
 #ifdef DEBUG_REGEXP_GRAPH
                 printf("Found simple epsilon trans from %d to %d\n",
                        statenr, newto);
-#endif     
+#endif
                 for (i = 0;i < state->nbTransTo;i++) {
                     tmp = ctxt->states[state->transTo[i]];
                     for (j = 0;j < tmp->nbTrans;j++) {
                         if (tmp->trans[j].to == statenr) {
 #ifdef DEBUG_REGEXP_GRAPH
                             printf("Changed transition %d on %d to go to %d\n",
                                    j, tmp->no, newto);
-#endif     
+#endif
                             tmp->trans[j].to = -1;
                             xmlRegStateAddTrans(ctxt, tmp, tmp->trans[j].atom,
-                                                ctxt->states[newto],
+                                                ctxt->states[newto],
                                                 tmp->trans[j].counter,
                                                 tmp->trans[j].count);
                         }
                     }
                 }
                 if (state->type == XML_REGEXP_FINAL_STATE)
                     ctxt->states[newto]->type = XML_REGEXP_FINAL_STATE;
                 /* eliminate the transition completely */
                 state->nbTrans = 0;
 
                 state->type = XML_REGEXP_UNREACH_STATE;
 
             }
-            
+
         }
     }
 }
 /**
  * xmlFAEliminateEpsilonTransitions:
  * @ctxt:  a regexp parser context
  *
  */
 static void
 xmlFAEliminateEpsilonTransitions(xmlRegParserCtxtPtr ctxt) {
@@ skipping 181 matching lines @@
             ret = 0;
         else
             ret = 1;
     } else if (range1->type == XML_REGEXP_CHARVAL) {
         int codepoint;
         int neg = 0;
 
         /*
          * just check all codepoints in the range for acceptance,
          * this is usually way cheaper since done only once at
-         * compilation than testing over and over at runtime or 
+         * compilation than testing over and over at runtime or
          * pushing too many states when evaluating.
          */
         if (((range1->neg == 0) && (range2->neg != 0)) ||
             ((range1->neg != 0) && (range2->neg == 0)))
             neg = 1;
 
         for (codepoint = range1->start;codepoint <= range1->end ;codepoint++) {
             ret = xmlRegCheckCharacterRange(range2->type, codepoint,
                                             0, range2->start, range2->end,
                                             range2->blockName);
@@ skipping 456 matching lines @@
 xmlFARecurseDeterminism(xmlRegParserCtxtPtr ctxt, xmlRegStatePtr state,
                          int to, xmlRegAtomPtr atom) {
     int ret = 1;
     int res;
     int transnr, nbTrans;
     xmlRegTransPtr t1;
     int deep = 1;
 
     if (state == NULL)
         return(ret);
+    if (state->markd == XML_REGEXP_MARK_VISITED)
+        return(ret);
 
     if (ctxt->flags & AM_AUTOMATA_RNG)
         deep = 0;
 
     /*
      * don't recurse on transitions potentially added in the course of
      * the elimination.
      */
     nbTrans = state->nbTrans;
     for (transnr = 0;transnr < nbTrans;transnr++) {
         t1 = &(state->trans[transnr]);
         /*
          * check transitions conflicting with the one looked at
          */
         if (t1->atom == NULL) {
             if (t1->to < 0)
                 continue;
+            state->markd = XML_REGEXP_MARK_VISITED;
             res = xmlFARecurseDeterminism(ctxt, ctxt->states[t1->to],
                                            to, atom);
+            state->markd = 0;
             if (res == 0) {
                 ret = 0;
                 /* t1->nd = 1; */
             }
             continue;
         }
         if (t1->to != to)
             continue;
         if (xmlFACompareAtoms(t1->atom, atom, deep)) {
             ret = 0;
@@ skipping 148 matching lines @@
            transition get marked down
         if (ret == 0)
             break; */
     }
 
     ctxt->determinist = ret;
     return(ret);
 }
 
 /************************************************************************
- *                                                                      *
+ *                                                                      *
  *      Routines to check input against transition atoms                *
- *                                                                      *
+ *                                                                      *
  ************************************************************************/
 
 static int
 xmlRegCheckCharacterRange(xmlRegAtomType type, int codepoint, int neg,
                           int start, int end, const xmlChar *blockName) {
     int ret = 0;
 
     switch (type) {
         case XML_REGEXP_STRING:
         case XML_REGEXP_SUBREG:
         case XML_REGEXP_RANGES:
         case XML_REGEXP_EPSILON:
             return(-1);
         case XML_REGEXP_ANYCHAR:
             ret = ((codepoint != '\n') && (codepoint != '\r'));
             break;
         case XML_REGEXP_CHARVAL:
             ret = ((codepoint >= start) && (codepoint <= end));
             break;
         case XML_REGEXP_NOTSPACE:
             neg = !neg;
         case XML_REGEXP_ANYSPACE:
             ret = ((codepoint == '\n') || (codepoint == '\r') ||
                    (codepoint == '\t') || (codepoint == ' '));
             break;
         case XML_REGEXP_NOTINITNAME:
             neg = !neg;
         case XML_REGEXP_INITNAME:
-            ret = (IS_LETTER(codepoint) || 
+            ret = (IS_LETTER(codepoint) ||
                    (codepoint == '_') || (codepoint == ':'));
             break;
         case XML_REGEXP_NOTNAMECHAR:
             neg = !neg;
         case XML_REGEXP_NAMECHAR:
             ret = (IS_LETTER(codepoint) || IS_DIGIT(codepoint) ||
                    (codepoint == '.') || (codepoint == '-') ||
                    (codepoint == '_') || (codepoint == ':') ||
                    IS_COMBINING(codepoint) || IS_EXTENDER(codepoint));
             break;
@@ skipping 227 matching lines @@
             ret = xmlRegCheckCharacterRange(atom->type, codepoint, 0, 0, 0,
                                             (const xmlChar *)atom->valuep);
             if (atom->neg)
                 ret = !ret;
             break;
     }
     return(ret);
 }
 
 /************************************************************************
- *                                                                      *
+ *                                                                      *
  *      Saving and restoring state of an execution context              *
- *                                                                      *
+ *                                                                      *
  ************************************************************************/
 
 #ifdef DEBUG_REGEXP_EXEC
 static void
 xmlFARegDebugExec(xmlRegExecCtxtPtr exec) {
     printf("state: %d:%d:idx %d", exec->state->no, exec->transno, exec->index);
     if (exec->inputStack != NULL) {
         int i;
         printf(": ");
         for (i = 0;(i < 3) && (i < exec->inputStackNr);i++)
@@ skipping 79 matching lines @@
     exec->nbRollbacks--;
     exec->state = exec->rollbacks[exec->nbRollbacks].state;
     exec->index = exec->rollbacks[exec->nbRollbacks].index;
     exec->transno = exec->rollbacks[exec->nbRollbacks].nextbranch;
     if (exec->comp->nbCounters > 0) {
         if (exec->rollbacks[exec->nbRollbacks].counts == NULL) {
             fprintf(stderr, "exec save: allocation failed");
             exec->status = -6;
             return;
         }
-        memcpy(exec->counts, exec->rollbacks[exec->nbRollbacks].counts,
+        if (exec->counts) {
+            memcpy(exec->counts, exec->rollbacks[exec->nbRollbacks].counts,
                exec->comp->nbCounters * sizeof(int));
+        }
     }
 
 #ifdef DEBUG_REGEXP_EXEC
     printf("restored ");
     xmlFARegDebugExec(exec);
 #endif
 }
 
 /************************************************************************
- *                                                                      *
+ *                                                                      *
  *      Verifier, running an input against a compiled regexp            *
- *                                                                      *
+ *                                                                      *
  ************************************************************************/
 
 static int
 xmlFARegExec(xmlRegexpPtr comp, const xmlChar *content) {
     xmlRegExecCtxt execval;
     xmlRegExecCtxtPtr exec = &execval;
     int ret, codepoint = 0, len, deter;
 
     exec->inputString = content;
     exec->index = 0;
@@ skipping 11 matching lines @@
     exec->inputStackMax = 0;
     if (comp->nbCounters > 0) {
         exec->counts = (int *) xmlMalloc(comp->nbCounters * sizeof(int));
         if (exec->counts == NULL) {
             xmlRegexpErrMemory(NULL, "running regexp");
             return(-1);
         }
         memset(exec->counts, 0, comp->nbCounters * sizeof(int));
     } else
         exec->counts = NULL;
-    while ((exec->status == 0) &&
+    while ((exec->status == 0) && (exec->state != NULL) &&
            ((exec->inputString[exec->index] != 0) ||
             ((exec->state != NULL) &&
              (exec->state->type != XML_REGEXP_FINAL_STATE)))) {
         xmlRegTransPtr trans;
         xmlRegAtomPtr atom;
 
         /*
          * If end of input on non-terminal state, rollback, however we may
          * still have epsilon like transition for counted transitions
          * on counters, in that case don't break too early.  Additionally,
@@ skipping 233 matching lines @@
     if (exec->rollbacks != NULL) {
         if (exec->counts != NULL) {
             int i;
 
             for (i = 0;i < exec->maxRollbacks;i++)
                 if (exec->rollbacks[i].counts != NULL)
                     xmlFree(exec->rollbacks[i].counts);
         }
         xmlFree(exec->rollbacks);
     }
+    if (exec->state == NULL)
+        return(-1);
     if (exec->counts != NULL)
         xmlFree(exec->counts);
     if (exec->status == 0)
         return(1);
     if (exec->status == -1) {
         if (exec->nbPush > MAX_PUSH)
             return(-1);
         return(0);
     }
     return(exec->status);
 }
 
 /************************************************************************
- *                                                                      *
+ *                                                                      *
  *      Progressive interface to the verifier one atom at a time        *
- *                                                                      *
+ *                                                                      *
  ************************************************************************/
 #ifdef DEBUG_ERR
 static void testerr(xmlRegExecCtxtPtr exec);
 #endif
 
 /**
  * xmlRegNewExecCtxt:
  * @comp: a precompiled regular expression
  * @callback: a callback function used for handling progresses in the
  *            automata matching phase
@@ skipping 96 matching lines @@
 }
 
 static void
 xmlFARegExecSaveInputString(xmlRegExecCtxtPtr exec, const xmlChar *value,
                             void *data) {
 #ifdef DEBUG_PUSH
     printf("saving value: %d:%s\n", exec->inputStackNr, value);
 #endif
     if (exec->inputStackMax == 0) {
         exec->inputStackMax = 4;
-        exec->inputStack = (xmlRegInputTokenPtr) 
+        exec->inputStack = (xmlRegInputTokenPtr)
             xmlMalloc(exec->inputStackMax * sizeof(xmlRegInputToken));
         if (exec->inputStack == NULL) {
             xmlRegexpErrMemory(NULL, "pushing input string");
             exec->inputStackMax = 0;
             return;
         }
     } else if (exec->inputStackNr + 1 >= exec->inputStackMax) {
         xmlRegInputTokenPtr tmp;
 
         exec->inputStackMax *= 2;
         tmp = (xmlRegInputTokenPtr) xmlRealloc(exec->inputStack,
                         exec->inputStackMax * sizeof(xmlRegInputToken));
         if (tmp == NULL) {
             xmlRegexpErrMemory(NULL, "pushing input string");
             exec->inputStackMax /= 2;
             return;
         }
         exec->inputStack = tmp;
     }
     exec->inputStack[exec->inputStackNr].value = xmlStrdup(value);
     exec->inputStack[exec->inputStackNr].data = data;
     exec->inputStackNr++;
     exec->inputStack[exec->inputStackNr].value = NULL;
     exec->inputStack[exec->inputStackNr].data = NULL;
 }
 
 /**
  * xmlRegStrEqualWildcard:
- * @expStr:  the string to be evaluated 
+ * @expStr:  the string to be evaluated
  * @valStr:  the validation string
  *
  * Checks if both strings are equal or have the same content. "*"
- * can be used as a wildcard in @valStr; "|" is used as a seperator of 
+ * can be used as a wildcard in @valStr; "|" is used as a seperator of
  * substrings in both @expStr and @valStr.
  *
  * Returns 1 if the comparison is satisfied and the number of substrings
  * is equal, 0 otherwise.
  */
 
 static int
 xmlRegStrEqualWildcard(const xmlChar *expStr, const xmlChar *valStr) {
     if (expStr == valStr) return(1);
     if (expStr == NULL) return(0);
@@ skipping 45 matching lines @@
 static int
 xmlRegCompactPushString(xmlRegExecCtxtPtr exec,
                         xmlRegexpPtr comp,
                         const xmlChar *value,
                         void *data) {
     int state = exec->index;
     int i, target;
 
     if ((comp == NULL) || (comp->compact == NULL) || (comp->stringMap == NULL))
         return(-1);
-    
+
     if (value == NULL) {
         /*
          * are we at a final state ?
          */
         if (comp->compact[state * (comp->nbstrings + 1)] ==
             XML_REGEXP_FINAL_STATE)
             return(1);
         return(0);
     }
 
 #ifdef DEBUG_PUSH
     printf("value pushed: %s\n", value);
 #endif
 
     /*
      * Examine all outside transitions from current state
      */
     for (i = 0;i < comp->nbstrings;i++) {
         target = comp->compact[state * (comp->nbstrings + 1) + i + 1];
         if ((target > 0) && (target <= comp->nbstates)) {
-            target--; /* to avoid 0 */    
+            target--; /* to avoid 0 */
             if (xmlRegStrEqualWildcard(comp->stringMap[i], value)) {
-                exec->index = target;           
+                exec->index = target;
                 if ((exec->callback != NULL) && (comp->transdata != NULL)) {
                     exec->callback(exec->data, value,
                           comp->transdata[state * comp->nbstrings + i], data);
                 }
 #ifdef DEBUG_PUSH
                 printf("entering state %d\n", target);
 #endif
                 if (comp->compact[target * (comp->nbstrings + 1)] ==
                     XML_REGEXP_SINK_STATE)
                     goto error;
@@ skipping 113 matching lines @@
                  */
                 if ((value == NULL) && (final)) {
                     ret = 1;
                 } else if (value != NULL) {
                     for (i = 0;i < exec->state->nbTrans;i++) {
                         t = &exec->state->trans[i];
                         if ((t->counter < 0) || (t == trans))
                             continue;
                         counter = &exec->comp->counters[t->counter];
                         count = exec->counts[t->counter];
-                        if ((count < counter->max) && 
+                        if ((count < counter->max) &&
                             (t->atom != NULL) &&
                             (xmlStrEqual(value, t->atom->valuep))) {
                             ret = 0;
                             break;
                         }
                         if ((count >= counter->min) &&
                             (count < counter->max) &&
                             (t->atom != NULL) &&
                             (xmlStrEqual(value, t->atom->valuep))) {
                             ret = 1;
@@ skipping 219 matching lines @@
                 exec->errState = exec->state;
                 memcpy(exec->errCounts, exec->counts,
                        exec->comp->nbCounters * sizeof(int));
             }
 
             /*
              * Failed to find a way out
              */
             exec->determinist = 0;
             xmlFARegExecRollBack(exec);
-            if (exec->status == 0) {
+            if ((exec->inputStack != NULL ) && (exec->status == 0)) {
                 value = exec->inputStack[exec->index].value;
                 data = exec->inputStack[exec->index].data;
 #ifdef DEBUG_PUSH
                 printf("value loaded: %s\n", value);
 #endif
             }
         }
         continue;
 progress:
         progress = 1;
@@ skipping 97 matching lines @@
  *
  * Returns: 0 in case of success or -1 in case of error.
  */
 static int
 xmlRegExecGetValues(xmlRegExecCtxtPtr exec, int err,
                     int *nbval, int *nbneg,
                     xmlChar **values, int *terminal) {
     int maxval;
     int nb = 0;
 
-    if ((exec == NULL) || (nbval == NULL) || (nbneg == NULL) || 
+    if ((exec == NULL) || (nbval == NULL) || (nbneg == NULL) ||
         (values == NULL) || (*nbval <= 0))
         return(-1);
 
     maxval = *nbval;
     *nbval = 0;
     *nbneg = 0;
     if ((exec->comp != NULL) && (exec->comp->compact != NULL)) {
         xmlRegexpPtr comp;
         int target, i, state;
 
@@ skipping 76 matching lines @@
                 if (exec->comp != NULL)
                     counter = &exec->comp->counters[trans->counter];
                 if ((counter == NULL) || (count < counter->max)) {
                     if (atom->neg)
                         values[nb++] = (xmlChar *) atom->valuep2;
                     else
                         values[nb++] = (xmlChar *) atom->valuep;
                     (*nbval)++;
                 }
             } else {
-                if ((exec->comp->states[trans->to] != NULL) &&
+                if ((exec->comp != NULL) && (exec->comp->states[trans->to] != NULL) &&
                     (exec->comp->states[trans->to]->type !=
                      XML_REGEXP_SINK_STATE)) {
                     if (atom->neg)
                         values[nb++] = (xmlChar *) atom->valuep2;
                     else
                         values[nb++] = (xmlChar *) atom->valuep;
                     (*nbval)++;
                 }
-            } 
+            }
         }
         for (transno = 0;
              (transno < state->nbTrans) && (nb < maxval);
              transno++) {
             trans = &state->trans[transno];
             if (trans->to < 0)
                 continue;
             atom = trans->atom;
             if ((atom == NULL) || (atom->valuep == NULL))
                 continue;
             if (trans->count == REGEXP_ALL_LAX_COUNTER) {
                 continue;
             } else if (trans->count == REGEXP_ALL_COUNTER) {
                 continue;
             } else if (trans->counter >= 0) {
                 continue;
             } else {
                 if ((exec->comp->states[trans->to] != NULL) &&
                     (exec->comp->states[trans->to]->type ==
                      XML_REGEXP_SINK_STATE)) {
                     if (atom->neg)
                         values[nb++] = (xmlChar *) atom->valuep2;
                     else
                         values[nb++] = (xmlChar *) atom->valuep;
                     (*nbneg)++;
                 }
-            } 
+            }
         }
     }
     return(0);
 }
 
 /**
  * xmlRegExecNextValues:
  * @exec: a regexp execution context
  * @nbval: pointer to the number of accepted values IN/OUT
  * @nbneg: return number of negative transitions
@@ skipping 210 matching lines @@
              */
             exec->determinist = 0;
             xmlFARegExecRollBack(exec);
         }
 progress:
         continue;
     }
 }
 #endif
 /************************************************************************
- *                                                                      *
+ *                                                                      *
  *      Parser for the Schemas Datatype Regular Expressions             *
  *      http://www.w3.org/TR/2001/REC-xmlschema-2-20010502/#regexs      *
- *                                                                      *
+ *                                                                      *
  ************************************************************************/
 
 /**
  * xmlFAIsChar:
  * @ctxt:  a regexp parser context
  *
  * [10]   Char   ::=   [^.\?*+()|#x5B#x5D]
  */
 static int
 xmlFAIsChar(xmlRegParserCtxtPtr ctxt) {
     int cur;
     int len;
 
     cur = CUR_SCHAR(ctxt->cur, len);
     if ((cur == '.') || (cur == '\\') || (cur == '?') ||
         (cur == '*') || (cur == '+') || (cur == '(') ||
         (cur == ')') || (cur == '|') || (cur == 0x5B) ||
         (cur == 0x5D) || (cur == 0))
         return(-1);
     return(cur);
 }
 
 /**
  * xmlFAParseCharProp:
  * @ctxt:  a regexp parser context
  *
  * [27]   charProp   ::=   IsCategory | IsBlock
  * [28]   IsCategory ::= Letters | Marks | Numbers | Punctuation |
- *                       Separators | Symbols | Others 
+ *                       Separators | Symbols | Others
  * [29]   Letters   ::=   'L' [ultmo]?
  * [30]   Marks   ::=   'M' [nce]?
  * [31]   Numbers   ::=   'N' [dlo]?
  * [32]   Punctuation   ::=   'P' [cdseifo]?
  * [33]   Separators   ::=   'Z' [slp]?
  * [34]   Symbols   ::=   'S' [mcko]?
  * [35]   Others   ::=   'C' [cfon]?
  * [36]   IsBlock   ::=   'Is' [a-zA-Z0-9#x2D]+
  */
 static void
 xmlFAParseCharProp(xmlRegParserCtxtPtr ctxt) {
     int cur;
     xmlRegAtomType type = (xmlRegAtomType) 0;
     xmlChar *blockName = NULL;
-    
+
     cur = CUR;
     if (cur == 'L') {
         NEXT;
         cur = CUR;
         if (cur == 'u') {
             NEXT;
             type = XML_REGEXP_LETTER_UPPERCASE;
         } else if (cur == 'l') {
             NEXT;
             type = XML_REGEXP_LETTER_LOWERCASE;
@@ skipping 151 matching lines @@
         const xmlChar *start;
         NEXT;
         cur = CUR;
         if (cur != 's') {
             ERROR("IsXXXX expected");
             return;
         }
         NEXT;
         start = ctxt->cur;
         cur = CUR;
-        if (((cur >= 'a') && (cur <= 'z')) || 
-            ((cur >= 'A') && (cur <= 'Z')) || 
-            ((cur >= '0') && (cur <= '9')) || 
+        if (((cur >= 'a') && (cur <= 'z')) ||
+            ((cur >= 'A') && (cur <= 'Z')) ||
+            ((cur >= '0') && (cur <= '9')) ||
             (cur == 0x2D)) {
             NEXT;
             cur = CUR;
-            while (((cur >= 'a') && (cur <= 'z')) || 
-                ((cur >= 'A') && (cur <= 'Z')) || 
-                ((cur >= '0') && (cur <= '9')) || 
+            while (((cur >= 'a') && (cur <= 'z')) ||
+                ((cur >= 'A') && (cur <= 'Z')) ||
+                ((cur >= '0') && (cur <= '9')) ||
                 (cur == 0x2D)) {
                 NEXT;
                 cur = CUR;
             }
         }
         type = XML_REGEXP_BLOCK_NAME;
         blockName = xmlStrndup(start, ctxt->cur - start);
     } else {
         ERROR("Unknown char property");
         return;
     }
     if (ctxt->atom == NULL) {
         ctxt->atom = xmlRegNewAtom(ctxt, type);
         if (ctxt->atom != NULL)
             ctxt->atom->valuep = blockName;
     } else if (ctxt->atom->type == XML_REGEXP_RANGES) {
         xmlRegAtomAddRange(ctxt, ctxt->atom, ctxt->neg,
                            type, 0, 0, blockName);
     }
 }
 
 /**
  * xmlFAParseCharClassEsc:
  * @ctxt:  a regexp parser context
  *
- * [23] charClassEsc ::= ( SingleCharEsc | MultiCharEsc | catEsc | complEsc ) 
+ * [23] charClassEsc ::= ( SingleCharEsc | MultiCharEsc | catEsc | complEsc )
  * [24] SingleCharEsc ::= '\' [nrt\|.?*+(){}#x2D#x5B#x5D#x5E]
  * [25] catEsc   ::=   '\p{' charProp '}'
  * [26] complEsc ::=   '\P{' charProp '}'
  * [37] MultiCharEsc ::= '.' | ('\' [sSiIcCdDwW])
  */
 static void
 xmlFAParseCharClassEsc(xmlRegParserCtxtPtr ctxt) {
     int cur;
 
     if (CUR == '.') {
@@ skipping 76 matching lines @@
             xmlRegAtomAddRange(ctxt, ctxt->atom, ctxt->neg,
                                XML_REGEXP_CHARVAL, cur, cur, NULL);
         }
         NEXT;
     } else if ((cur == 's') || (cur == 'S') || (cur == 'i') || (cur == 'I') ||
         (cur == 'c') || (cur == 'C') || (cur == 'd') || (cur == 'D') ||
         (cur == 'w') || (cur == 'W')) {
         xmlRegAtomType type = XML_REGEXP_ANYSPACE;
 
         switch (cur) {
-            case 's': 
+            case 's':
                 type = XML_REGEXP_ANYSPACE;
                 break;
-            case 'S': 
+            case 'S':
                 type = XML_REGEXP_NOTSPACE;
                 break;
-            case 'i': 
+            case 'i':
                 type = XML_REGEXP_INITNAME;
                 break;
-            case 'I': 
+            case 'I':
                 type = XML_REGEXP_NOTINITNAME;
                 break;
-            case 'c': 
+            case 'c':
                 type = XML_REGEXP_NAMECHAR;
                 break;
-            case 'C': 
+            case 'C':
                 type = XML_REGEXP_NOTNAMECHAR;
                 break;
-            case 'd': 
+            case 'd':
                 type = XML_REGEXP_DECIMAL;
                 break;
-            case 'D': 
+            case 'D':
                 type = XML_REGEXP_NOTDECIMAL;
                 break;
-            case 'w': 
+            case 'w':
                 type = XML_REGEXP_REALCHAR;
                 break;
-            case 'W': 
+            case 'W':
                 type = XML_REGEXP_NOTREALCHAR;
                 break;
         }
         NEXT;
         if (ctxt->atom == NULL) {
             ctxt->atom = xmlRegNewAtom(ctxt, type);
         } else if (ctxt->atom->type == XML_REGEXP_RANGES) {
             xmlRegAtomAddRange(ctxt, ctxt->atom, ctxt->neg,
                                type, 0, 0, NULL);
         }
     } else {
         ERROR("Wrong escape sequence, misuse of character '\\'");
     }
 }
 
 /**
  * xmlFAParseCharRange:
  * @ctxt:  a regexp parser context
  *
- * [17]   charRange   ::=     seRange | XmlCharRef | XmlCharIncDash 
+ * [17]   charRange   ::=     seRange | XmlCharRef | XmlCharIncDash
  * [18]   seRange   ::=   charOrEsc '-' charOrEsc
  * [20]   charOrEsc   ::=   XmlChar | SingleCharEsc
  * [21]   XmlChar   ::=   [^\#x2D#x5B#x5D]
  * [22]   XmlCharIncDash   ::=   [^\#x5B#x5D]
  */
 static void
 xmlFAParseCharRange(xmlRegParserCtxtPtr ctxt) {
     int cur, len;
     int start = -1;
     int end = -1;
@@ skipping 94 matching lines @@
     } while ((CUR != ']') && (CUR != '^') && (CUR != '-') &&
              (CUR != 0) && (ctxt->error == 0));
 }
 
 /**
  * xmlFAParseCharGroup:
  * @ctxt:  a regexp parser context
  *
  * [13]   charGroup    ::= posCharGroup | negCharGroup | charClassSub
  * [15]   negCharGroup ::= '^' posCharGroup
- * [16]   charClassSub ::= ( posCharGroup | negCharGroup ) '-' charClassExpr  
+ * [16]   charClassSub ::= ( posCharGroup | negCharGroup ) '-' charClassExpr
  * [12]   charClassExpr ::= '[' charGroup ']'
  */
 static void
 xmlFAParseCharGroup(xmlRegParserCtxtPtr ctxt) {
     int n = ctxt->neg;
     while ((CUR != ']') && (ctxt->error == 0)) {
         if (CUR == '^') {
             int neg = ctxt->neg;
 
             NEXT;
@@ skipping 227 matching lines @@
  * [2]   branch   ::=   piece*
  */
 static int
 xmlFAParseBranch(xmlRegParserCtxtPtr ctxt, xmlRegStatePtr to) {
     xmlRegStatePtr previous;
     int ret;
 
     previous = ctxt->state;
     ret = xmlFAParsePiece(ctxt);
     if (ret != 0) {
-        if (xmlFAGenerateTransitions(ctxt, previous, 
+        if (xmlFAGenerateTransitions(ctxt, previous,
                 (CUR=='|' || CUR==')') ? to : NULL, ctxt->atom) < 0)
             return(-1);
         previous = ctxt->state;
         ctxt->atom = NULL;
     }
     while ((ret != 0) && (ctxt->error == 0)) {
         ret = xmlFAParsePiece(ctxt);
         if (ret != 0) {
-            if (xmlFAGenerateTransitions(ctxt, previous, 
+            if (xmlFAGenerateTransitions(ctxt, previous,
                     (CUR=='|' || CUR==')') ? to : NULL, ctxt->atom) < 0)
                     return(-1);
             previous = ctxt->state;
             ctxt->atom = NULL;
         }
     }
     return(0);
 }
 
 /**
@@ skipping 17 matching lines @@
 #endif
         ctxt->state->type = XML_REGEXP_FINAL_STATE;
     }
     if (CUR != '|') {
         ctxt->end = ctxt->state;
         return;
     }
     end = ctxt->state;
     while ((CUR == '|') && (ctxt->error == 0)) {
         NEXT;
+        if (CUR == 0) {
+            ERROR("expecting a branch after |")
+            return;
+        }
         ctxt->state = start;
         ctxt->end = NULL;
         xmlFAParseBranch(ctxt, end);
     }
     if (!top) {
         ctxt->state = end;
         ctxt->end = end;
     }
 }
 
 /************************************************************************
- *                                                                      *
- *                      The basic API                                   *
- *                                                                      *
+ *                                                                      *
+ *                      The basic API                                   *
+ *                                                                      *
  ************************************************************************/
 
 /**
  * xmlRegexpPrint:
  * @output: the file for the output debug
  * @regexp: the compiled regexp
  *
  * Print the content of the compiled regular expression
  */
 void
@@ skipping 166 matching lines @@
         for (i = 0; i < regexp->nbstrings;i++)
             xmlFree(regexp->stringMap[i]);
         xmlFree(regexp->stringMap);
     }
 
     xmlFree(regexp);
 }
 
 #ifdef LIBXML_AUTOMATA_ENABLED
 /************************************************************************
- *                                                                      *
- *                      The Automata interface                          *
- *                                                                      *
+ *                                                                      *
+ *                      The Automata interface                          *
+ *                                                                      *
  ************************************************************************/
 
 /**
  * xmlNewAutomata:
  *
  * Create a new automata
  *
  * Returns the new object or NULL in case of failure
  */
 xmlAutomataPtr
@@ skipping 100 matching lines @@
                          xmlAutomataStatePtr to, const xmlChar *token,
                          void *data) {
     xmlRegAtomPtr atom;
 
     if ((am == NULL) || (from == NULL) || (token == NULL))
         return(NULL);
     atom = xmlRegNewAtom(am, XML_REGEXP_STRING);
     if (atom == NULL)
         return(NULL);
     atom->data = data;
-    if (atom == NULL)
-        return(NULL);
     atom->valuep = xmlStrdup(token);
 
     if (xmlFAGenerateTransitions(am, from, to, atom) < 0) {
         xmlRegFreeAtom(atom);
         return(NULL);
     }
     if (to == NULL)
         return(am->state);
     return(to);
 }
@@ skipping 128 matching lines @@
  * @from: the starting point of the transition
  * @to: the target point of the transition or NULL
  * @token: the input string associated to that transition
  * @token2: the second input string associated to that transition
  * @min:  the minimum successive occurences of token
  * @max:  the maximum successive occurences of token
  * @data:  data associated to the transition
  *
  * If @to is NULL, this creates first a new target state in the automata
  * and then adds a transition from the @from state to the target state
- * activated by a succession of input of value @token and @token2 and 
+ * activated by a succession of input of value @token and @token2 and
  * whose number is between @min and @max
  *
  * Returns the target state or NULL in case of error
  */
 xmlAutomataStatePtr
 xmlAutomataNewCountTrans2(xmlAutomataPtr am, xmlAutomataStatePtr from,
                          xmlAutomataStatePtr to, const xmlChar *token,
                          const xmlChar *token2,
                          int min, int max, void *data) {
     xmlRegAtomPtr atom;
@@ skipping 133 matching lines @@
  * @from: the starting point of the transition
  * @to: the target point of the transition or NULL
  * @token: the input string associated to that transition
  * @token2: the second input string associated to that transition
  * @min:  the minimum successive occurences of token
  * @max:  the maximum successive occurences of token
  * @data:  data associated to the transition
  *
  * If @to is NULL, this creates first a new target state in the automata
  * and then adds a transition from the @from state to the target state
- * activated by a succession of input of value @token and @token2 and whose 
- * number is between @min and @max, moreover that transition can only be 
+ * activated by a succession of input of value @token and @token2 and whose
+ * number is between @min and @max, moreover that transition can only be
  * crossed once.
  *
  * Returns the target state or NULL in case of error
  */
 xmlAutomataStatePtr
 xmlAutomataNewOnceTrans2(xmlAutomataPtr am, xmlAutomataStatePtr from,
                          xmlAutomataStatePtr to, const xmlChar *token,
                          const xmlChar *token2,
                          int min, int max, void *data) {
     xmlRegAtomPtr atom;
@@ skipping 21 matching lines @@
         if (str == NULL) {
             xmlRegFreeAtom(atom);
             return(NULL);
         }
         memcpy(&str[0], token, lenp);
         str[lenp] = '|';
         memcpy(&str[lenp + 1], token2, lenn);
         str[lenn + lenp + 1] = 0;
 
         atom->valuep = str;
-    }    
+    }
     atom->data = data;
     atom->quant = XML_REGEXP_QUANT_ONCEONLY;
     atom->min = min;
     atom->max = max;
     /*
      * associate a counter to the transition.
      */
     counter = xmlRegGetCounter(am);
     am->counters[counter].min = 1;
     am->counters[counter].max = 1;
 
     /* xmlFAGenerateTransitions(am, from, to, atom); */
     if (to == NULL) {
         to = xmlRegNewState(am);
         xmlRegStatePush(am, to);
     }
     xmlRegStateAddTrans(am, from, atom, to, counter, -1);
     xmlRegAtomPush(am, atom);
     am->state = to;
     return(to);
 }
 
-    
+
 
 /**
  * xmlAutomataNewOnceTrans:
  * @am: an automata
  * @from: the starting point of the transition
  * @to: the target point of the transition or NULL
  * @token: the input string associated to that transition
  * @min:  the minimum successive occurences of token
  * @max:  the maximum successive occurences of token
  * @data:  data associated to the transition
@@ skipping 48 matching lines @@
 /**
  * xmlAutomataNewState:
  * @am: an automata
  *
  * Create a new disconnected state in the automata
  *
  * Returns the new state or NULL in case of error
  */
 xmlAutomataStatePtr
 xmlAutomataNewState(xmlAutomataPtr am) {
-    xmlAutomataStatePtr to; 
+    xmlAutomataStatePtr to;
 
     if (am == NULL)
         return(NULL);
     to = xmlRegNewState(am);
     xmlRegStatePush(am, to);
     return(to);
 }
 
 /**
  * xmlAutomataNewEpsilon:
@@ skipping 46 matching lines @@
 /**
  * xmlAutomataNewCounter:
  * @am: an automata
  * @min:  the minimal value on the counter
  * @max:  the maximal value on the counter
  *
  * Create a new counter
  *
  * Returns the counter number or -1 in case of error
  */
-int             
+int
 xmlAutomataNewCounter(xmlAutomataPtr am, int min, int max) {
     int ret;
 
     if (am == NULL)
         return(-1);
 
     ret = xmlRegGetCounter(am);
     if (ret < 0)
         return(-1);
     am->counters[ret].min = min;
@@ skipping 51 matching lines @@
 
 /**
  * xmlAutomataCompile:
  * @am: an automata
  *
  * Compile the automata into a Reg Exp ready for being executed.
  * The automata should be free after this point.
  *
  * Returns the compiled regexp or NULL in case of error
  */
-xmlRegexpPtr          
+xmlRegexpPtr
 xmlAutomataCompile(xmlAutomataPtr am) {
     xmlRegexpPtr ret;
 
     if ((am == NULL) || (am->error != 0)) return(NULL);
     xmlFAEliminateEpsilonTransitions(am);
     /* xmlFAComputesDeterminism(am); */
     ret = xmlRegEpxFromParse(am);
 
     return(ret);
 }
 
 /**
  * xmlAutomataIsDeterminist:
  * @am: an automata
  *
  * Checks if an automata is determinist.
  *
  * Returns 1 if true, 0 if not, and -1 in case of error
  */
-int          
+int
 xmlAutomataIsDeterminist(xmlAutomataPtr am) {
     int ret;
 
     if (am == NULL)
         return(-1);
 
     ret = xmlFAComputesDeterminism(am);
     return(ret);
 }
 #endif /* LIBXML_AUTOMATA_ENABLED */
@@ skipping 32 matching lines @@
  *
  * Returns the context or NULL in case of error
  */
 xmlExpCtxtPtr
 xmlExpNewCtxt(int maxNodes, xmlDictPtr dict) {
     xmlExpCtxtPtr ret;
     int size = 256;
 
     if (maxNodes <= 4096)
         maxNodes = 4096;
-    
+
     ret = (xmlExpCtxtPtr) xmlMalloc(sizeof(xmlExpCtxt));
     if (ret == NULL)
         return(NULL);
     memset(ret, 0, sizeof(xmlExpCtxt));
     ret->size = size;
     ret->nbElems = 0;
     ret->maxNodes = maxNodes;
     ret->table = xmlMalloc(size * sizeof(xmlExpNodePtr));
     if (ret->table == NULL) {
         xmlFree(ret);
@@ skipping 33 matching lines @@
 /************************************************************************
  *                                                                      *
  *              Structure associated to an expression node              *
  *                                                                      *
  ************************************************************************/
 #define MAX_NODES 10000
 
 /* #define DEBUG_DERIV */
 
 /*
- * TODO: 
+ * TODO:
  * - Wildcards
  * - public API for creation
  *
  * Started
  * - regression testing
  *
  * Done
  * - split into module and test tool
  * - memleaks
  */
@@ skipping 47 matching lines @@
  *                                                                      *
  ************************************************************************/
 /*
  * xmlExpHashNameComputeKey:
  * Calculate the hash key for a token
  */
 static unsigned short
 xmlExpHashNameComputeKey(const xmlChar *name) {
     unsigned short value = 0L;
     char ch;
-    
+
     if (name != NULL) {
         value += 30 * (*name);
         while ((ch = *name++) != 0) {
-            value = value ^ ((value << 5) + (value >> 3) + (unsigned short)ch);
+            value = value ^ ((value << 5) + (value >> 3) + (unsigned long)ch);
         }
     }
     return (value);
 }
 
 /*
  * xmlExpHashComputeKey:
  * Calculate the hash key for a compound expression
  */
 static unsigned short
 xmlExpHashComputeKey(xmlExpNodeType type, xmlExpNodePtr left,
                      xmlExpNodePtr right) {
     unsigned long value;
     unsigned short ret;
-    
+
     switch (type) {
         case XML_EXP_SEQ:
             value = left->key;
             value += right->key;
             value *= 3;
             ret = (unsigned short) value;
             break;
         case XML_EXP_OR:
             value = left->key;
             value += right->key;
@@ skipping 120 matching lines @@
                 tmp = left->exp_right;
                 left->exp_right = left->exp_left;
                 left->exp_left = tmp;
             }
             left->exp_right->ref++;
             tmp = xmlExpHashGetEntry(ctxt, XML_EXP_OR, left->exp_right, right,
                                      NULL, 0, 0);
             left->exp_left->ref++;
             tmp = xmlExpHashGetEntry(ctxt, XML_EXP_OR, left->exp_left, tmp,
                                      NULL, 0, 0);
-        
+
             xmlExpFree(ctxt, left);
             return(tmp);
         }
         if (right->type == XML_EXP_OR) {
             /* Ordering in the tree */
             /* C | (A | B) -> A | (B | C) */
             if (left->key > right->exp_right->key) {
                 xmlExpNodePtr tmp;
                 right->exp_right->ref++;
                 tmp = xmlExpHashGetEntry(ctxt, XML_EXP_OR, right->exp_right,
@@ skipping 36 matching lines @@
             return(right);
         }
         /* Empty reduction rules */
         if (right->type == XML_EXP_EMPTY) {
             return(left);
         }
         if (left->type == XML_EXP_EMPTY) {
             return(right);
         }
         kbase = xmlExpHashComputeKey(type, left, right);
-    } else 
+    } else
         return(NULL);
 
     key = kbase % ctxt->size;
     if (ctxt->table[key] != NULL) {
         for (insert = ctxt->table[key]; insert != NULL;
              insert = insert->next) {
             if ((insert->key == kbase) &&
                 (insert->type == type)) {
                 if (type == XML_EXP_ATOM) {
                     if (name == insert->exp_str) {
@@ skipping 120 matching lines @@
 void
 xmlExpRef(xmlExpNodePtr exp) {
     if (exp != NULL)
         exp->ref++;
 }
 
 /**
  * xmlExpNewAtom:
  * @ctxt: the expression context
  * @name: the atom name
- * @len: the atom name lenght in byte (or -1);
+ * @len: the atom name length in byte (or -1);
  *
  * Get the atom associated to this name from that context
  *
  * Returns the node or NULL in case of error
  */
 xmlExpNodePtr
 xmlExpNewAtom(xmlExpCtxtPtr ctxt, const xmlChar *name, int len) {
     if ((ctxt == NULL) || (name == NULL))
         return(NULL);
     name = xmlDictLookup(ctxt->dict, name, len);
@@ skipping 79 matching lines @@
                               NULL, NULL, min, max));
 }
 
 /************************************************************************
  *                                                                      *
  *              Public API for operations on expressions                *
  *                                                                      *
  ************************************************************************/
 
 static int
-xmlExpGetLanguageInt(xmlExpCtxtPtr ctxt, xmlExpNodePtr exp, 
+xmlExpGetLanguageInt(xmlExpCtxtPtr ctxt, xmlExpNodePtr exp,
                      const xmlChar**list, int len, int nb) {
     int tmp, tmp2;
 tail:
     switch (exp->type) {
         case XML_EXP_EMPTY:
             return(0);
         case XML_EXP_ATOM:
             for (tmp = 0;tmp < nb;tmp++)
                 if (list[tmp] == exp->exp_str)
                     return(0);
@@ skipping 16 matching lines @@
             return(tmp + tmp2);
     }
     return(-1);
 }
 
 /**
  * xmlExpGetLanguage:
  * @ctxt: the expression context
  * @exp: the expression
  * @langList: where to store the tokens
- * @len: the allocated lenght of @list
+ * @len: the allocated length of @list
  *
  * Find all the strings used in @exp and store them in @list
  *
  * Returns the number of unique strings found, -1 in case of errors and
  *         -2 if there is more than @len strings
  */
 int
-xmlExpGetLanguage(xmlExpCtxtPtr ctxt, xmlExpNodePtr exp, 
+xmlExpGetLanguage(xmlExpCtxtPtr ctxt, xmlExpNodePtr exp,
                   const xmlChar**langList, int len) {
     if ((ctxt == NULL) || (exp == NULL) || (langList == NULL) || (len <= 0))
         return(-1);
     return(xmlExpGetLanguageInt(ctxt, exp, langList, len, 0));
 }
 
 static int
-xmlExpGetStartInt(xmlExpCtxtPtr ctxt, xmlExpNodePtr exp, 
+xmlExpGetStartInt(xmlExpCtxtPtr ctxt, xmlExpNodePtr exp,
                   const xmlChar**list, int len, int nb) {
     int tmp, tmp2;
 tail:
     switch (exp->type) {
         case XML_EXP_FORBID:
             return(0);
         case XML_EXP_EMPTY:
             return(0);
         case XML_EXP_ATOM:
             for (tmp = 0;tmp < nb;tmp++)
@@ skipping 29 matching lines @@
             return(tmp + tmp2);
     }
     return(-1);
 }
 
 /**
  * xmlExpGetStart:
  * @ctxt: the expression context
  * @exp: the expression
  * @tokList: where to store the tokens
- * @len: the allocated lenght of @list
+ * @len: the allocated length of @list
  *
  * Find all the strings that appears at the start of the languages
  * accepted by @exp and store them in @list. E.g. for (a, b) | c
  * it will return the list [a, c]
  *
  * Returns the number of unique strings found, -1 in case of errors and
  *         -2 if there is more than @len strings
  */
 int
-xmlExpGetStart(xmlExpCtxtPtr ctxt, xmlExpNodePtr exp, 
+xmlExpGetStart(xmlExpCtxtPtr ctxt, xmlExpNodePtr exp,
                const xmlChar**tokList, int len) {
     if ((ctxt == NULL) || (exp == NULL) || (tokList == NULL) || (len <= 0))
         return(-1);
     return(xmlExpGetStartInt(ctxt, exp, tokList, len, 0));
 }
 
 /**
  * xmlExpIsNillable:
  * @exp: the expression
  *
@@ skipping 676 matching lines @@
             ret = xmlExpHashGetEntry(ctxt, XML_EXP_OR, ret, tmp3, NULL, 0, 0);
             if (ret == NULL) {
                 xmlFree((xmlChar **) tab);
                 return(NULL);
             }
         }
     }
     xmlFree((xmlChar **) tab);
     return(ret);
 }
-    
+
 /**
  * xmlExpExpDerive:
  * @ctxt: the expressions context
  * @exp: the englobing expression
  * @sub: the subexpression
  *
  * Evaluates the expression resulting from @exp consuming a sub expression @sub
  * Based on algebraic derivation and sometimes direct Brzozowski derivation
  * it usually tatkes less than linear time and can handle expressions generating
  * infinite languages.
@@ skipping 31 matching lines @@
  * @sub: the subexpression
  *
  * Check whether @exp accepts all the languages accexpted by @sub
  * the input being a subexpression.
  *
  * Returns 1 if true 0 if false and -1 in case of failure.
  */
 int
 xmlExpSubsume(xmlExpCtxtPtr ctxt, xmlExpNodePtr exp, xmlExpNodePtr sub) {
     xmlExpNodePtr tmp;
-    
+
     if ((exp == NULL) || (ctxt == NULL) || (sub == NULL))
         return(-1);
 
     /*
      * TODO: speedup by checking the language of sub is a subset of the
      *       language of exp
      */
     /*
      * O(1) speedups
      */
@@ skipping 23 matching lines @@
     if ((tmp != NULL) && (IS_NILLABLE(tmp))) {
         xmlExpFree(ctxt, tmp);
         return(1);
     }
     xmlExpFree(ctxt, tmp);
     return(0);
 }
 
 /************************************************************************
  *                                                                      *
- *                      Parsing expression                              *
+ *                      Parsing expression                              *
  *                                                                      *
  ************************************************************************/
 
 static xmlExpNodePtr xmlExpParseExpr(xmlExpCtxtPtr ctxt);
 
 #undef CUR
 #define CUR (*ctxt->cur)
 #undef NEXT
 #define NEXT ctxt->cur++;
 #undef IS_BLANK
@@ skipping 83 matching lines @@
     } else if (CUR == '+') {
         NEXT
         ret = xmlExpHashGetEntry(ctxt, XML_EXP_COUNT, ret, NULL, NULL,
                                  1, -1);
         SKIP_BLANKS
     } else if (CUR == '*') {
         NEXT
         ret = xmlExpHashGetEntry(ctxt, XML_EXP_COUNT, ret, NULL, NULL,
                                  0, -1);
         SKIP_BLANKS
-    } 
+    }
     return(ret);
 }
 
 
 static xmlExpNodePtr
 xmlExpParseSeq(xmlExpCtxtPtr ctxt) {
     xmlExpNodePtr ret, right;
 
     ret = xmlExpParseOr(ctxt);
     SKIP_BLANKS
@@ skipping 101 matching lines @@
                 xmlExpDumpInt(buf, c, 0);
             xmlBufferWriteChar(buf, " | ");
             c = expr->exp_right;
             if ((c->type == XML_EXP_SEQ) || (c->type == XML_EXP_OR))
                 xmlExpDumpInt(buf, c, 1);
             else
                 xmlExpDumpInt(buf, c, 0);
             break;
         case XML_EXP_COUNT: {
             char rep[40];
-            
+
             c = expr->exp_left;
             if ((c->type == XML_EXP_SEQ) || (c->type == XML_EXP_OR))
                 xmlExpDumpInt(buf, c, 1);
             else
                 xmlExpDumpInt(buf, c, 0);
             if ((expr->exp_min == 0) && (expr->exp_max == 1)) {
                 rep[0] = '?';
                 rep[1] = 0;
             } else if ((expr->exp_min == 0) && (expr->exp_max == -1)) {
                 rep[0] = '*';
@@ skipping 74 matching lines @@
 xmlExpCtxtNbCons(xmlExpCtxtPtr ctxt) {
     if (ctxt == NULL)
         return(-1);
     return(ctxt->nb_cons);
 }
 
 #endif /* LIBXML_EXPR_ENABLED */
 #define bottom_xmlregexp
 #include "elfgcchack.h"
 #endif /* LIBXML_REGEXP_ENABLED */