Roll libxml to 2.9.3

third_party/libxml/src/parser.c

 /*
  * parser.c : an XML 1.0 parser, namespaces and validity support are mostly
  *            implemented on top of the SAX interfaces
  *
  * References:
  *   The XML specification:
  *     http://www.w3.org/TR/REC-xml
  *   Original 1.0 version:
  *     http://www.w3.org/TR/1998/REC-xml-19980210
  *   XML second edition working draft
@@ skipping 76 matching lines @@
 #include "buf.h"
 #include "enc.h"
 
 static void
 xmlFatalErr(xmlParserCtxtPtr ctxt, xmlParserErrors error, const char *info);
 
 static xmlParserCtxtPtr
 xmlCreateEntityParserCtxtInternal(const xmlChar *URL, const xmlChar *ID,
                           const xmlChar *base, xmlParserCtxtPtr pctx);
 
+static void xmlHaltParser(xmlParserCtxtPtr ctxt);
+
 /************************************************************************
  *                                                                      *
  *      Arbitrary limits set in the parser. See XML_PARSE_HUGE          *
  *                                                                      *
  ************************************************************************/
 
 #define XML_PARSER_BIG_ENTITY 1000
 #define XML_PARSER_LOT_ENTITY 5000
 
 /*
@@ skipping 1657 matching lines @@
             return (-1);
         }
         ctxt->nodeTab = tmp;
         ctxt->nodeMax *= 2;
     }
     if ((((unsigned int) ctxt->nodeNr) > xmlParserMaxDepth) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErrMsgInt(ctxt, XML_ERR_INTERNAL_ERROR,
                  "Excessive depth in document: %d use XML_PARSE_HUGE option\n",
                           xmlParserMaxDepth);
-        ctxt->instate = XML_PARSER_EOF;
+        xmlHaltParser(ctxt);
         return(-1);
     }
     ctxt->nodeTab[ctxt->nodeNr] = value;
     ctxt->node = value;
     return (ctxt->nodeNr++);
 }
 
 /**
  * nodePop:
  * @ctxt: an XML parser context
@@ skipping 281 matching lines @@
 
 static void xmlGROW (xmlParserCtxtPtr ctxt) {
     unsigned long curEnd = ctxt->input->end - ctxt->input->cur;
     unsigned long curBase = ctxt->input->cur - ctxt->input->base;
 
     if (((curEnd > (unsigned long) XML_MAX_LOOKUP_LIMIT) ||
          (curBase > (unsigned long) XML_MAX_LOOKUP_LIMIT)) &&
          ((ctxt->input->buf) && (ctxt->input->buf->readcallback != (xmlInputReadCallback) xmlNop)) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
-        ctxt->instate = XML_PARSER_EOF;
+        xmlHaltParser(ctxt);
+        return;
     }
     xmlParserInputGrow(ctxt->input, INPUT_CHUNK);
+    if ((ctxt->input->cur > ctxt->input->end) ||
+        (ctxt->input->cur < ctxt->input->base)) {
+        xmlHaltParser(ctxt);
+        xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "cur index out of bound");
+        return;
+    }
     if ((ctxt->input->cur != NULL) && (*ctxt->input->cur == 0) &&
         (xmlParserInputGrow(ctxt->input, INPUT_CHUNK) <= 0))
             xmlPopInput(ctxt);
 }
 
 #define SKIP_BLANKS xmlSkipBlankChars(ctxt)
 
 #define NEXT xmlNextChar(ctxt)
 
 #define NEXT1 {                                                         \
@@ skipping 55 matching lines @@
                 ctxt->input->cur = cur;
                 xmlParserInputGrow(ctxt->input, INPUT_CHUNK);
                 cur = ctxt->input->cur;
             }
         }
         ctxt->input->cur = cur;
     } else {
         int cur;
         do {
             cur = CUR;
-            while (IS_BLANK_CH(cur)) { /* CHECKED tstblanks.xml */
+            while ((IS_BLANK_CH(cur) && /* CHECKED tstblanks.xml */
+                   (ctxt->instate != XML_PARSER_EOF))) {
                 NEXT;
                 cur = CUR;
                 res++;
             }
             while ((cur == 0) && (ctxt->inputNr > 1) &&
                    (ctxt->instate != XML_PARSER_COMMENT)) {
                 xmlPopInput(ctxt);
                 cur = CUR;
             }
             /*
              * Need to handle support of entities branching here
              */
             if (*ctxt->input->cur == '%') xmlParserHandlePEReference(ctxt);
-        } while (IS_BLANK(cur)); /* CHECKED tstblanks.xml */
+        } while ((IS_BLANK(cur)) && /* CHECKED tstblanks.xml */
+                 (ctxt->instate != XML_PARSER_EOF));
     }
     return(res);
 }
 
 /************************************************************************
  *                                                                      *
  *              Commodity functions to handle entities                  *
  *                                                                      *
  ************************************************************************/
 
@@ skipping 620 matching lines @@
                 } else {
                     xmlFatalErrMsg(ctxt, XML_ERR_INTERNAL_ERROR,
                             "predefined entity has no content\n");
                 }
             } else if ((ent != NULL) && (ent->content != NULL)) {
                 ctxt->depth++;
                 rep = xmlStringDecodeEntities(ctxt, ent->content, what,
                                               0, 0, 0);
                 ctxt->depth--;
 
+                if ((ctxt->lastError.code == XML_ERR_ENTITY_LOOP) ||
+                    (ctxt->lastError.code == XML_ERR_INTERNAL_ERROR))
+                    goto int_error;
+
                 if (rep != NULL) {
                     current = rep;
                     while (*current != 0) { /* non input consuming loop */
                         buffer[nbchars++] = *current++;
                         if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
                             if (xmlParserEntityCheck(ctxt, nbchars, ent, 0))
                                 goto int_error;
                             growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
                         }
                     }
@@ skipping 665 matching lines @@
             GROW;
             if (ctxt->instate == XML_PARSER_EOF)
                 return(NULL);
         }
         len += l;
         NEXTL(l);
         end = ctxt->input->cur;
         c = CUR_CHAR(l);
         if (c == 0) {
             count = 0;
+            /*
+             * when shrinking to extend the buffer we really need to preserve
+             * the part of the name we already parsed. Hence rolling back
+             * by current lenght.
+             */
+            ctxt->input->cur -= l;
             GROW;
+            ctxt->input->cur += l;
             if (ctxt->instate == XML_PARSER_EOF)
                 return(NULL);
             end = ctxt->input->cur;
             c = CUR_CHAR(l);
         }
     }
     if ((len > XML_MAX_NAME_LENGTH) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");
         return(NULL);
@@ skipping 11 matching lines @@
  * [4NS] NCNameChar ::= Letter | Digit | '.' | '-' | '_' |
  *                      CombiningChar | Extender
  *
  * [5NS] NCName ::= (Letter | '_') (NCNameChar)*
  *
  * Returns the Name parsed or NULL
  */
 
 static const xmlChar *
 xmlParseNCName(xmlParserCtxtPtr ctxt) {
-    const xmlChar *in;
+    const xmlChar *in, *e;
     const xmlChar *ret;
     int count = 0;
 
 #ifdef DEBUG
     nbParseNCName++;
 #endif
 
     /*
      * Accelerator for simple ASCII names
      */
     in = ctxt->input->cur;
-    if (((*in >= 0x61) && (*in <= 0x7A)) ||
-        ((*in >= 0x41) && (*in <= 0x5A)) ||
-        (*in == '_')) {
+    e = ctxt->input->end;
+    if ((((*in >= 0x61) && (*in <= 0x7A)) ||
+         ((*in >= 0x41) && (*in <= 0x5A)) ||
+         (*in == '_')) && (in < e)) {
         in++;
-        while (((*in >= 0x61) && (*in <= 0x7A)) ||
-               ((*in >= 0x41) && (*in <= 0x5A)) ||
-               ((*in >= 0x30) && (*in <= 0x39)) ||
-               (*in == '_') || (*in == '-') ||
-               (*in == '.'))
+        while ((((*in >= 0x61) && (*in <= 0x7A)) ||
+                ((*in >= 0x41) && (*in <= 0x5A)) ||
+                ((*in >= 0x30) && (*in <= 0x39)) ||
+                (*in == '_') || (*in == '-') ||
+                (*in == '.')) && (in < e))
             in++;
+        if (in >= e)
+            goto complex;
         if ((*in > 0) && (*in < 0x80)) {
             count = in - ctxt->input->cur;
             if ((count > XML_MAX_NAME_LENGTH) &&
                 ((ctxt->options & XML_PARSE_HUGE) == 0)) {
                 xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");
                 return(NULL);
             }
             ret = xmlDictLookup(ctxt->dict, ctxt->input->cur, count);
             ctxt->input->cur = in;
             ctxt->nbChars += count;
             ctxt->input->col += count;
             if (ret == NULL) {
                 xmlErrMemory(ctxt, NULL);
             }
             return(ret);
         }
     }
+complex:
     return(xmlParseNCNameComplex(ctxt));
 }
 
 /**
  * xmlParseNameAndCompare:
  * @ctxt:  an XML parser context
  *
  * parse an XML name and compares for match
  * (specialized for endtag parsing)
  *
@@ skipping 2076 matching lines @@
                     }
                 }
             }
         }
         if (ctxt->instate == XML_PARSER_EOF)
             return;
         SKIP_BLANKS;
         if (RAW != '>') {
             xmlFatalErrMsgStr(ctxt, XML_ERR_ENTITY_NOT_FINISHED,
                     "xmlParseEntityDecl: entity %s not terminated\n", name);
+            xmlHaltParser(ctxt);
         } else {
             if (input != ctxt->input) {
                 xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
         "Entity declaration doesn't start and stop in the same entity\n");
             }
             NEXT;
         }
         if (orig != NULL) {
             /*
              * Ugly mechanism to save the raw entity value.
@@ skipping 1091 matching lines @@
 xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
     int id = ctxt->input->id;
 
     SKIP(3);
     SKIP_BLANKS;
     if (CMP7(CUR_PTR, 'I', 'N', 'C', 'L', 'U', 'D', 'E')) {
         SKIP(7);
         SKIP_BLANKS;
         if (RAW != '[') {
             xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
+            xmlHaltParser(ctxt);
+            return;
         } else {
             if (ctxt->input->id != id) {
                 xmlValidityError(ctxt, XML_ERR_ENTITY_BOUNDARY,
             "All markup of the conditional section is not in the same entity\n",
                                      NULL, NULL);
             }
             NEXT;
         }
         if (xmlParserDebugEntities) {
             if ((ctxt->input != NULL) && (ctxt->input->filename))
@@ skipping 40 matching lines @@
 
     } else if (CMP6(CUR_PTR, 'I', 'G', 'N', 'O', 'R', 'E')) {
         int state;
         xmlParserInputState instate;
         int depth = 0;
 
         SKIP(6);
         SKIP_BLANKS;
         if (RAW != '[') {
             xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
+            xmlHaltParser(ctxt);
+            return;
         } else {
             if (ctxt->input->id != id) {
                 xmlValidityError(ctxt, XML_ERR_ENTITY_BOUNDARY,
             "All markup of the conditional section is not in the same entity\n",
                                      NULL, NULL);
             }
             NEXT;
         }
         if (xmlParserDebugEntities) {
             if ((ctxt->input != NULL) && (ctxt->input->filename))
@@ skipping 35 matching lines @@
             if ((ctxt->input != NULL) && (ctxt->input->filename))
                 xmlGenericError(xmlGenericErrorContext,
                         "%s(%d): ", ctxt->input->filename,
                         ctxt->input->line);
             xmlGenericError(xmlGenericErrorContext,
                     "Leaving IGNORE Conditional Section\n");
         }
 
     } else {
         xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID_KEYWORD, NULL);
+        xmlHaltParser(ctxt);
+        return;
     }
 
     if (RAW == 0)
         SHRINK;
 
     if (RAW == 0) {
         xmlFatalErr(ctxt, XML_ERR_CONDSEC_NOT_FINISHED, NULL);
     } else {
         if (ctxt->input->id != id) {
             xmlValidityError(ctxt, XML_ERR_ENTITY_BOUNDARY,
         "All markup of the conditional section is not in the same entity\n",
                                  NULL, NULL);
         }
-        SKIP(3);
+        if ((ctxt-> instate != XML_PARSER_EOF) &&
+            ((ctxt->input->cur + 3) <= ctxt->input->end))
+            SKIP(3);
     }
 }
 
 /**
  * xmlParseMarkupDecl:
  * @ctxt:  an XML parser context
  *
  * parse Markup declarations
  *
  * [29] markupdecl ::= elementdecl | AttlistDecl | EntityDecl |
@@ skipping 34 matching lines @@
                     xmlParseComment(ctxt);
                     break;
                 default:
                     /* there is an error but it will be detected later */
                     break;
             }
         } else if (NXT(1) == '?') {
             xmlParsePI(ctxt);
         }
     }
+
+    /*
+     * detect requirement to exit there and act accordingly
+     * and avoid having instate overriden later on
+     */
+    if (ctxt->instate == XML_PARSER_EOF)
+        return;
+
     /*
      * This is only for internal subset. On external entities,
      * the replacement is done before parsing stage
      */
     if ((ctxt->external == 0) && (ctxt->inputNr == 1))
         xmlParsePEReference(ctxt);
 
     /*
      * Conditional sections are allowed from entities included
      * by PE References in the internal subset.
@@ skipping 111 matching lines @@
         if (enc != XML_CHAR_ENCODING_NONE)
             xmlSwitchEncoding(ctxt, enc);
     }
 
     if (CMP5(CUR_PTR, '<', '?', 'x', 'm', 'l')) {
         xmlParseTextDecl(ctxt);
         if (ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) {
             /*
              * The XML REC instructs us to stop parsing right here
              */
-            ctxt->instate = XML_PARSER_EOF;
+            xmlHaltParser(ctxt);
             return;
         }
     }
     if (ctxt->myDoc == NULL) {
         ctxt->myDoc = xmlNewDoc(BAD_CAST "1.0");
         if (ctxt->myDoc == NULL) {
             xmlErrMemory(ctxt, "New Doc failed");
             return;
         }
         ctxt->myDoc->properties = XML_DOC_INTERNAL;
@@ skipping 131 matching lines @@
     /*
      * The first reference to the entity trigger a parsing phase
      * where the ent->children is filled with the result from
      * the parsing.
      * Note: external parsed entities will not be loaded, it is not
      * required for a non-validating parser, unless the parsing option
      * of validating, or substituting entities were given. Doing so is
      * far more secure as the parser will only process data coming from
      * the document entity by default.
      */
-    if ((ent->checked == 0) &&
+    if (((ent->checked == 0) ||
+         ((ent->children == NULL) && (ctxt->options & XML_PARSE_NOENT))) &&
         ((ent->etype != XML_EXTERNAL_GENERAL_PARSED_ENTITY) ||
          (ctxt->options & (XML_PARSE_NOENT | XML_PARSE_DTDVALID)))) {
         unsigned long oldnbent = ctxt->nbentities;
 
         /*
          * This is a bit hackish but this seems the best
          * way to make sure both SAX and DOM entity support
          * behaves okay.
          */
         void *user_data;
@@ skipping 813 matching lines @@
             if ((entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) &&
                 (CMP5(CUR_PTR, '<', '?', 'x', 'm', 'l')) &&
                 (IS_BLANK_CH(NXT(5)))) {
                 xmlParseTextDecl(ctxt);
                 if (ctxt->errNo ==
                     XML_ERR_UNSUPPORTED_ENCODING) {
                     /*
                      * The XML REC instructs us to stop parsing
                      * right here
                      */
-                    ctxt->instate = XML_PARSER_EOF;
+                    xmlHaltParser(ctxt);
                     return;
                 }
             }
         }
     }
     ctxt->hasPErefs = 1;
 }
 
 /**
  * xmlLoadEntityContent:
@@ skipping 334 matching lines @@
             NEXT;
             SKIP_BLANKS;
         }
     }
 
     /*
      * We should be at the end of the DOCTYPE declaration.
      */
     if (RAW != '>') {
         xmlFatalErr(ctxt, XML_ERR_DOCTYPE_NOT_FINISHED, NULL);
+        return;
     }
     NEXT;
 }
 
 #ifdef LIBXML_SAX1_ENABLED
 /**
  * xmlParseAttribute:
  * @ctxt:  an XML parser context
  * @value:  a xmlChar ** used to store the value of the attribute
  *
@@ skipping 860 matching lines @@
                   const xmlChar **URI, int *tlen) {
     const xmlChar *localname;
     const xmlChar *prefix;
     const xmlChar *attname;
     const xmlChar *aprefix;
     const xmlChar *nsname;
     xmlChar *attvalue;
     const xmlChar **atts = ctxt->atts;
     int maxatts = ctxt->maxatts;
     int nratts, nbatts, nbdef;
-    int i, j, nbNs, attval, oldline, oldcol;
+    int i, j, nbNs, attval, oldline, oldcol, inputNr;
     const xmlChar *base;
     unsigned long cur;
     int nsNr = ctxt->nsNr;
 
     if (RAW != '<') return(NULL);
     NEXT1;
 
     /*
      * NOTE: it is crucial with the SAX2 API to never call SHRINK beyond that
      *       point since the attribute values may be stored as pointers to
      *       the buffer and calling SHRINK would destroy them !
      *       The Shrinking is only possible once the full set of attribute
      *       callbacks have been done.
      */
 reparse:
     SHRINK;
     base = ctxt->input->base;
     cur = ctxt->input->cur - ctxt->input->base;
+    inputNr = ctxt->inputNr;
     oldline = ctxt->input->line;
     oldcol = ctxt->input->col;
     nbatts = 0;
     nratts = 0;
     nbdef = 0;
     nbNs = 0;
     attval = 0;
     /* Forget any namespaces added during an earlier parse of this element. */
     ctxt->nsNr = nsNr;
 
     localname = xmlParseQName(ctxt, &prefix);
     if (localname == NULL) {
         xmlFatalErrMsg(ctxt, XML_ERR_NAME_REQUIRED,
                        "StartTag: invalid element name\n");
         return(NULL);
     }
     *tlen = ctxt->input->cur - ctxt->input->base - cur;
 
     /*
      * Now parse the attributes, it ends up with the ending
      *
      * (S Attribute)* S?
      */
     SKIP_BLANKS;
     GROW;
-    if (ctxt->input->base != base) goto base_changed;
+    if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+        goto base_changed;
 
     while (((RAW != '>') &&
            ((RAW != '/') || (NXT(1) != '>')) &&
            (IS_BYTE_CHAR(RAW))) && (ctxt->instate != XML_PARSER_EOF)) {
         const xmlChar *q = CUR_PTR;
         unsigned int cons = ctxt->input->consumed;
         int len = -1, alloc = 0;
 
         attname = xmlParseAttribute2(ctxt, prefix, localname,
                                      &aprefix, &attvalue, &len, &alloc);
-        if (ctxt->input->base != base) {
+        if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr)) {
             if ((attvalue != NULL) && (alloc != 0))
                 xmlFree(attvalue);
             attvalue = NULL;
             goto base_changed;
         }
         if ((attname != NULL) && (attvalue != NULL)) {
             if (len < 0) len = xmlStrlen(attvalue);
             if ((attname == ctxt->str_xmlns) && (aprefix == NULL)) {
                 const xmlChar *URL = xmlDictLookup(ctxt->dict, attvalue, len);
                 xmlURIPtr uri;
@@ skipping 128 matching lines @@
 skip_ns:
                 if (alloc != 0) xmlFree(attvalue);
                 if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
                     break;
                 if (!IS_BLANK_CH(RAW)) {
                     xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
                                    "attributes construct error\n");
                     break;
                 }
                 SKIP_BLANKS;
-                if (ctxt->input->base != base) goto base_changed;
+                if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+                    goto base_changed;
                 continue;
             }
 
             /*
              * Add the pair to atts
              */
             if ((atts == NULL) || (nbatts + 5 > maxatts)) {
                 if (xmlCtxtGrowAttrs(ctxt, nbatts + 5) < 0) {
                     if (attvalue[len] == 0)
                         xmlFree(attvalue);
@@ skipping 16 matching lines @@
         } else {
             if ((attvalue != NULL) && (attvalue[len] == 0))
                 xmlFree(attvalue);
         }
 
 failed:
 
         GROW
         if (ctxt->instate == XML_PARSER_EOF)
             break;
-        if (ctxt->input->base != base) goto base_changed;
+        if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+            goto base_changed;
         if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
             break;
         if (!IS_BLANK_CH(RAW)) {
             xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
                            "attributes construct error\n");
             break;
         }
         SKIP_BLANKS;
         if ((cons == ctxt->input->consumed) && (q == CUR_PTR) &&
             (attname == NULL) && (attvalue == NULL)) {
             xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR,
                  "xmlParseStartTag: problem parsing attributes\n");
             break;
         }
         GROW;
-        if (ctxt->input->base != base) goto base_changed;
+        if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+            goto base_changed;
     }
 
     /*
      * The attributes defaulting
      */
     if (ctxt->attsDefault != NULL) {
         xmlDefAttrsPtr defaults;
 
         defaults = xmlHashLookup2(ctxt->attsDefault, localname, prefix);
         if (defaults != NULL) {
@@ skipping 146 matching lines @@
 
 base_changed:
     /*
      * the attribute strings are valid iif the base didn't changed
      */
     if (attval != 0) {
         for (i = 3,j = 0; j < nratts;i += 5,j++)
             if ((ctxt->attallocs[j] != 0) && (atts[i] != NULL))
                 xmlFree((xmlChar *) atts[i]);
     }
+
+    /*
+     * We can't switch from one entity to another in the middle
+     * of a start tag
+     */
+    if (inputNr != ctxt->inputNr) {
+        xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
+                    "Start tag doesn't start and stop in the same entity\n");
+        return(NULL);
+    }
+
     ctxt->input->cur = ctxt->input->base + cur;
     ctxt->input->line = oldline;
     ctxt->input->col = oldcol;
     if (ctxt->wellFormed == 1) {
         goto reparse;
     }
     return(NULL);
 }
 
 /**
@@ skipping 261 matching lines @@
         /*
          * Pop-up of finished entities.
          */
         while ((RAW == 0) && (ctxt->inputNr > 1))
             xmlPopInput(ctxt);
         SHRINK;
 
         if ((cons == ctxt->input->consumed) && (test == CUR_PTR)) {
             xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR,
                         "detected an error in element content\n");
-            ctxt->instate = XML_PARSER_EOF;
+            xmlHaltParser(ctxt);
             break;
         }
     }
 }
 
 /**
  * xmlParseElement:
  * @ctxt:  an XML parser context
  *
  * parse an XML element, this is highly recursive
@@ skipping 14 matching lines @@
     xmlParserNodeInfo node_info;
     int line, tlen = 0;
     xmlNodePtr ret;
     int nsNr = ctxt->nsNr;
 
     if (((unsigned int) ctxt->nameNr > xmlParserMaxDepth) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErrMsgInt(ctxt, XML_ERR_INTERNAL_ERROR,
                  "Excessive depth in document: %d use XML_PARSE_HUGE option\n",
                           xmlParserMaxDepth);
-        ctxt->instate = XML_PARSER_EOF;
+        xmlHaltParser(ctxt);
         return;
     }
 
     /* Capture start position */
     if (ctxt->record_info) {
         node_info.begin_pos = ctxt->input->consumed +
                           (CUR_PTR - ctxt->input->base);
         node_info.begin_line = ctxt->input->line;
     }
 
@@ skipping 331 matching lines @@
             xmlFatalErr(ctxt, XML_ERR_EQUAL_REQUIRED, NULL);
             return(NULL);
         }
         NEXT;
         SKIP_BLANKS;
         if (RAW == '"') {
             NEXT;
             encoding = xmlParseEncName(ctxt);
             if (RAW != '"') {
                 xmlFatalErr(ctxt, XML_ERR_STRING_NOT_CLOSED, NULL);
+                xmlFree((xmlChar *) encoding);
+                return(NULL);
             } else
                 NEXT;
         } else if (RAW == '\''){
             NEXT;
             encoding = xmlParseEncName(ctxt);
             if (RAW != '\'') {
                 xmlFatalErr(ctxt, XML_ERR_STRING_NOT_CLOSED, NULL);
+                xmlFree((xmlChar *) encoding);
+                return(NULL);
             } else
                 NEXT;
         } else {
             xmlFatalErr(ctxt, XML_ERR_STRING_NOT_STARTED, NULL);
         }
 
         /*
          * Non standard parsing, allowing the user to ignore encoding
          */
         if (ctxt->options & XML_PARSE_IGNORE_ENC) {
@@ skipping 36 matching lines @@
         }
         else if (encoding != NULL) {
             xmlCharEncodingHandlerPtr handler;
 
             if (ctxt->input->encoding != NULL)
                 xmlFree((xmlChar *) ctxt->input->encoding);
             ctxt->input->encoding = encoding;
 
             handler = xmlFindCharEncodingHandler((const char *) encoding);
             if (handler != NULL) {
-                xmlSwitchToEncoding(ctxt, handler);
+                if (xmlSwitchToEncoding(ctxt, handler) < 0) {
+                    /* failed to convert */
+                    ctxt->errNo = XML_ERR_UNSUPPORTED_ENCODING;
+                    return(NULL);
+                }
             } else {
                 xmlFatalErrMsgStr(ctxt, XML_ERR_UNSUPPORTED_ENCODING,
                         "Unsupported encoding %s\n", encoding);
                 return(NULL);
             }
         }
     }
     return(encoding);
 }
 
@@ skipping 148 matching lines @@
      * We may have the encoding declaration
      */
     if (!IS_BLANK_CH(RAW)) {
         if ((RAW == '?') && (NXT(1) == '>')) {
             SKIP(2);
             return;
         }
         xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED, "Blank needed here\n");
     }
     xmlParseEncodingDecl(ctxt);
-    if (ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) {
+    if ((ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) ||
+         (ctxt->instate == XML_PARSER_EOF)) {
         /*
          * The XML REC instructs us to stop parsing right here
          */
         return;
     }
 
     /*
      * We may have the standalone status.
      */
     if ((ctxt->input->encoding != NULL) && (!IS_BLANK_CH(RAW))) {
@@ skipping 103 matching lines @@
         start[3] = NXT(3);
         enc = xmlDetectCharEncoding(&start[0], 4);
         if (enc != XML_CHAR_ENCODING_NONE) {
             xmlSwitchEncoding(ctxt, enc);
         }
     }
 
 
     if (CUR == 0) {
         xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
+        return(-1);
     }
 
     /*
      * Check for the XMLDecl in the Prolog.
      * do not GROW here to avoid the detected encoder to decode more
      * than just the first line, unless the amount of data is really
      * too small to hold "<?xml version="1.0" encoding="foo"
      */
     if ((ctxt->input->end - ctxt->input->cur) < 35) {
        GROW;
     }
     if ((CMP5(CUR_PTR, '<', '?', 'x', 'm', 'l')) && (IS_BLANK_CH(NXT(5)))) {
 
         /*
          * Note that we will switch encoding on the fly.
          */
         xmlParseXMLDecl(ctxt);
-        if (ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) {
+        if ((ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) ||
+            (ctxt->instate == XML_PARSER_EOF)) {
             /*
              * The XML REC instructs us to stop parsing right here
              */
             return(-1);
         }
         ctxt->standalone = ctxt->input->standalone;
         SKIP_BLANKS;
     } else {
         ctxt->version = xmlCharStrdup(XML_DEFAULT_VERSION);
     }
@@ skipping 375 matching lines @@
     for (ix = 0; ix < len;) {      /* string is 0-terminated */
         c = utf[ix];
         if ((c & 0x80) == 0x00) {       /* 1-byte code, starts with 10 */
             if (c >= 0x20)
                 ix++;
             else if ((c == 0xA) || (c == 0xD) || (c == 0x9))
                 ix++;
             else
                 return(-ix);
         } else if ((c & 0xe0) == 0xc0) {/* 2-byte code, starts with 110 */
-            if (ix + 2 > len) return(ix);
+            if (ix + 2 > len) return(-ix);
             if ((utf[ix+1] & 0xc0 ) != 0x80)
                 return(-ix);
             codepoint = (utf[ix] & 0x1f) << 6;
             codepoint |= utf[ix+1] & 0x3f;
             if (!xmlIsCharQ(codepoint))
                 return(-ix);
             ix += 2;
         } else if ((c & 0xf0) == 0xe0) {/* 3-byte code, starts with 1110 */
-            if (ix + 3 > len) return(ix);
+            if (ix + 3 > len) return(-ix);
             if (((utf[ix+1] & 0xc0) != 0x80) ||
                 ((utf[ix+2] & 0xc0) != 0x80))
                     return(-ix);
             codepoint = (utf[ix] & 0xf) << 12;
             codepoint |= (utf[ix+1] & 0x3f) << 6;
             codepoint |= utf[ix+2] & 0x3f;
             if (!xmlIsCharQ(codepoint))
                 return(-ix);
             ix += 3;
         } else if ((c & 0xf8) == 0xf0) {/* 4-byte code, starts with 11110 */
-            if (ix + 4 > len) return(ix);
+            if (ix + 4 > len) return(-ix);
             if (((utf[ix+1] & 0xc0) != 0x80) ||
                 ((utf[ix+2] & 0xc0) != 0x80) ||
                 ((utf[ix+3] & 0xc0) != 0x80))
                     return(-ix);
             codepoint = (utf[ix] & 0x7) << 18;
             codepoint |= (utf[ix+1] & 0x3f) << 12;
             codepoint |= (utf[ix+2] & 0x3f) << 6;
             codepoint |= utf[ix+3] & 0x3f;
             if (!xmlIsCharQ(codepoint))
                 return(-ix);
@@ skipping 157 matching lines @@
 
                 if (avail < 2)
                     goto done;
                 cur = ctxt->input->cur[0];
                 next = ctxt->input->cur[1];
                 if (cur == 0) {
                     if ((ctxt->sax) && (ctxt->sax->setDocumentLocator))
                         ctxt->sax->setDocumentLocator(ctxt->userData,
                                                       &xmlDefaultSAXLocator);
                     xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
-                    ctxt->instate = XML_PARSER_EOF;
+                    xmlHaltParser(ctxt);
 #ifdef DEBUG_PUSH
                     xmlGenericError(xmlGenericErrorContext,
                             "PP: entering EOF\n");
 #endif
                     if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
                         ctxt->sax->endDocument(ctxt->userData);
                     goto done;
                 }
                 if ((cur == '<') && (next == '?')) {
                     /* PI or XML decl */
@@ skipping 12 matching lines @@
 #ifdef DEBUG_PUSH
                         xmlGenericError(xmlGenericErrorContext,
                                 "PP: Parsing XML Decl\n");
 #endif
                         xmlParseXMLDecl(ctxt);
                         if (ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) {
                             /*
                              * The XML REC instructs us to stop parsing right
                              * here
                              */
-                            ctxt->instate = XML_PARSER_EOF;
+                            xmlHaltParser(ctxt);
                             return(0);
                         }
                         ctxt->standalone = ctxt->input->standalone;
                         if ((ctxt->encoding == NULL) &&
                             (ctxt->input->encoding != NULL))
                             ctxt->encoding = xmlStrdup(ctxt->input->encoding);
                         if ((ctxt->sax) && (ctxt->sax->startDocument) &&
                             (!ctxt->disableSAX))
                             ctxt->sax->startDocument(ctxt->userData);
                         ctxt->instate = XML_PARSER_MISC;
@@ skipping 35 matching lines @@
                 const xmlChar *name;
                 const xmlChar *prefix = NULL;
                 const xmlChar *URI = NULL;
                 int nsNr = ctxt->nsNr;
 
                 if ((avail < 2) && (ctxt->inputNr == 1))
                     goto done;
                 cur = ctxt->input->cur[0];
                 if (cur != '<') {
                     xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
-                    ctxt->instate = XML_PARSER_EOF;
+                    xmlHaltParser(ctxt);
                     if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
                         ctxt->sax->endDocument(ctxt->userData);
                     goto done;
                 }
                 if (!terminate) {
                     if (ctxt->progressive) {
                         /* > can be found unescaped in attribute values */
                         if ((lastgt == NULL) || (ctxt->input->cur >= lastgt))
                             goto done;
                     } else if (xmlParseLookupSequence(ctxt, '>', 0, 0) < 0) {
@@ skipping 11 matching lines @@
 #endif /* LIBXML_SAX1_ENABLED */
                     name = xmlParseStartTag2(ctxt, &prefix, &URI, &tlen);
 #ifdef LIBXML_SAX1_ENABLED
                 else
                     name = xmlParseStartTag(ctxt);
 #endif /* LIBXML_SAX1_ENABLED */
                 if (ctxt->instate == XML_PARSER_EOF)
                     goto done;
                 if (name == NULL) {
                     spacePop(ctxt);
-                    ctxt->instate = XML_PARSER_EOF;
+                    xmlHaltParser(ctxt);
                     if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
                         ctxt->sax->endDocument(ctxt->userData);
                     goto done;
                 }
 #ifdef LIBXML_VALID_ENABLED
                 /*
                  * [ VC: Root Element Type ]
                  * The Name in the document type declaration must match
                  * the element type of the root element.
                  */
@@ skipping 146 matching lines @@
                     xmlParseCharData(ctxt, 0);
                 }
                 /*
                  * Pop-up of finished entities.
                  */
                 while ((RAW == 0) && (ctxt->inputNr > 1))
                     xmlPopInput(ctxt);
                 if ((cons == ctxt->input->consumed) && (test == CUR_PTR)) {
                     xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR,
                                 "detected an error in element content\n");
-                    ctxt->instate = XML_PARSER_EOF;
+                    xmlHaltParser(ctxt);
                     break;
                 }
                 break;
             }
             case XML_PARSER_END_TAG:
                 if (avail < 2)
                     goto done;
                 if (!terminate) {
                     if (ctxt->progressive) {
                         /* > can be found unescaped in attribute values */
@@ skipping 300 matching lines @@
                     xmlParseComment(ctxt);
                     if (ctxt->instate == XML_PARSER_EOF)
                         goto done;
                     ctxt->instate = XML_PARSER_EPILOG;
                     ctxt->progressive = 1;
                 } else if ((cur == '<') && (next == '!') &&
                            (avail < 4)) {
                     goto done;
                 } else {
                     xmlFatalErr(ctxt, XML_ERR_DOCUMENT_END, NULL);
-                    ctxt->instate = XML_PARSER_EOF;
+                    xmlHaltParser(ctxt);
 #ifdef DEBUG_PUSH
                     xmlGenericError(xmlGenericErrorContext,
                             "PP: entering EOF\n");
 #endif
                     if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
                         ctxt->sax->endDocument(ctxt->userData);
                     goto done;
                 }
                 break;
             case XML_PARSER_DTD: {
@@ skipping 343 matching lines @@
             if ((unsigned int) size > len) {
                 remain = size - len;
                 size = len;
             } else {
                 remain = 0;
             }
         }
         res = xmlParserInputBufferPush(ctxt->input->buf, size, chunk);
         if (res < 0) {
             ctxt->errNo = XML_PARSER_EOF;
-            ctxt->disableSAX = 1;
+            xmlHaltParser(ctxt);
             return (XML_PARSER_EOF);
         }
         xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input, base, cur);
 #ifdef DEBUG_PUSH
         xmlGenericError(xmlGenericErrorContext, "PP: pushed %d\n", size);
 #endif
 
     } else if (ctxt->instate != XML_PARSER_EOF) {
         if ((ctxt->input != NULL) && ctxt->input->buf != NULL) {
             xmlParserInputBufferPtr in = ctxt->input->buf;
@@ skipping 33 matching lines @@
             xmlParseTryOrFinish(ctxt, terminate);
     }
     if (ctxt->instate == XML_PARSER_EOF)
         return(ctxt->errNo);
 
     if ((ctxt->input != NULL) &&
          (((ctxt->input->end - ctxt->input->cur) > XML_MAX_LOOKUP_LIMIT) ||
          ((ctxt->input->cur - ctxt->input->base) > XML_MAX_LOOKUP_LIMIT)) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
-        ctxt->instate = XML_PARSER_EOF;
+        xmlHaltParser(ctxt);
     }
     if ((ctxt->errNo != XML_ERR_OK) && (ctxt->disableSAX == 1))
         return(ctxt->errNo);
 
     if (remain != 0) {
         chunk += size;
         size = remain;
         remain = 0;
         goto xmldecl_done;
     }
@@ skipping 167 matching lines @@
 
     if (enc != XML_CHAR_ENCODING_NONE) {
         xmlSwitchEncoding(ctxt, enc);
     }
 
     return(ctxt);
 }
 #endif /* LIBXML_PUSH_ENABLED */
 
 /**
+ * xmlHaltParser:
+ * @ctxt:  an XML parser context
+ *
+ * Blocks further parser processing don't override error
+ * for internal use
+ */
+static void
+xmlHaltParser(xmlParserCtxtPtr ctxt) {
+    if (ctxt == NULL)
+        return;
+    ctxt->instate = XML_PARSER_EOF;
+    ctxt->disableSAX = 1;
+    if (ctxt->input != NULL) {
+        /*
+         * in case there was a specific allocation deallocate before
+         * overriding base
+         */
+        if (ctxt->input->free != NULL) {
+            ctxt->input->free((xmlChar *) ctxt->input->base);
+            ctxt->input->free = NULL;
+        }
+        ctxt->input->cur = BAD_CAST"";
+        ctxt->input->base = ctxt->input->cur;
+    }
+}
+
+/**
  * xmlStopParser:
  * @ctxt:  an XML parser context
  *
  * Blocks further parser processing
  */
 void
 xmlStopParser(xmlParserCtxtPtr ctxt) {
     if (ctxt == NULL)
         return;
-    ctxt->instate = XML_PARSER_EOF;
+    xmlHaltParser(ctxt);
     ctxt->errNo = XML_ERR_USER_STOP;
-    ctxt->disableSAX = 1;
-    if (ctxt->input != NULL) {
-        ctxt->input->cur = BAD_CAST"";
-        ctxt->input->base = ctxt->input->cur;
-    }
 }
 
 /**
  * xmlCreateIOParserCtxt:
  * @sax:  a SAX handler
  * @user_data:  The user data returned on SAX callbacks
  * @ioread:  an I/O read function
  * @ioclose:  an I/O close function
  * @ioctx:  an I/O handler
  * @enc:  the charset encoding if known
@@ skipping 726 matching lines @@
     /*
      * Record in the parent context the number of entities replacement
      * done when parsing that reference.
      */
     if (oldctxt != NULL)
         oldctxt->nbentities += ctxt->nbentities;
 
     /*
      * Also record the size of the entity parsed
      */
-    if (ctxt->input != NULL) {
+    if (ctxt->input != NULL && oldctxt != NULL) {
         oldctxt->sizeentities += ctxt->input->consumed;
         oldctxt->sizeentities += (ctxt->input->cur - ctxt->input->base);
     }
     /*
      * And record the last error if any
      */
     if (ctxt->lastError.code != XML_ERR_OK)
         xmlCopyError(&ctxt->lastError, &oldctxt->lastError);
 
     if (sax != NULL)
         ctxt->sax = oldsax;
-    oldctxt->node_seq.maximum = ctxt->node_seq.maximum;
-    oldctxt->node_seq.length = ctxt->node_seq.length;
-    oldctxt->node_seq.buffer = ctxt->node_seq.buffer;
+    if (oldctxt != NULL) {
+        oldctxt->node_seq.maximum = ctxt->node_seq.maximum;
+        oldctxt->node_seq.length = ctxt->node_seq.length;
+        oldctxt->node_seq.buffer = ctxt->node_seq.buffer;
+    }
     ctxt->node_seq.maximum = 0;
     ctxt->node_seq.length = 0;
     ctxt->node_seq.buffer = NULL;
     xmlFreeParserCtxt(ctxt);
     newDoc->intSubset = NULL;
     newDoc->extSubset = NULL;
     xmlFreeDoc(newDoc);
 
     return(ret);
 }
@@ skipping 1455 matching lines @@
 #ifdef LIBXML_OUTPUT_ENABLED
         xmlRegisterDefaultOutputCallbacks();
 #endif /* LIBXML_OUTPUT_ENABLED */
 #ifdef LIBXML_HTML_ENABLED
         htmlInitAutoClose();
         htmlDefaultSAXHandlerInit();
 #endif
 #ifdef LIBXML_XPATH_ENABLED
         xmlXPathInit();
 #endif
-#ifdef LIBXML_CATALOG_ENABLED
-        xmlInitializeCatalog();
-#endif
         xmlParserInitialized = 1;
 #ifdef LIBXML_THREAD_ENABLED
     }
     __xmlGlobalInitMutexUnlock();
 #endif
 }
 
 /**
  * xmlCleanupParser:
  *
@@ skipping 828 matching lines @@
     if (stream == NULL) {
         xmlFreeParserInputBuffer(input);
         return (NULL);
     }
     inputPush(ctxt, stream);
     return (xmlDoRead(ctxt, URL, encoding, options, 1));
 }
 
 #define bottom_parser
 #include "elfgcchack.h"