Roll libxml to bdec2183f34b37ee89ae1d330c6ad2bb4d76605f

third_party/libxml/src/parser.c

 /*
  * parser.c : an XML 1.0 parser, namespaces and validity support are mostly
  *            implemented on top of the SAX interfaces
  *
  * References:
  *   The XML specification:
  *     http://www.w3.org/TR/REC-xml
  *   Original 1.0 version:
  *     http://www.w3.org/TR/1998/REC-xml-19980210
  *   XML second edition working draft
@@ skipping 120 matching lines @@
     if ((ctxt == NULL) || (ctxt->options & XML_PARSE_HUGE))
         return (0);
     if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
         return (1);
 
     /*
      * This may look absurd but is needed to detect
      * entities problems
      */
     if ((ent != NULL) && (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY) &&
-        (ent->content != NULL) && (ent->checked == 0)) {
+        (ent->content != NULL) && (ent->checked == 0) &&
+        (ctxt->errNo != XML_ERR_ENTITY_LOOP)) {
         unsigned long oldnbent = ctxt->nbentities;
         xmlChar *rep;
 
         ent->checked = 1;
 
+        ++ctxt->depth;
         rep = xmlStringDecodeEntities(ctxt, ent->content,
                                   XML_SUBSTITUTE_REF, 0, 0, 0);
+        --ctxt->depth;
+        if (ctxt->errNo == XML_ERR_ENTITY_LOOP) {
+            ent->content[0] = 0;
+        }
 
         ent->checked = (ctxt->nbentities - oldnbent + 1) * 2;
         if (rep != NULL) {
             if (xmlStrchr(rep, '<'))
                 ent->checked |= 1;
             xmlFree(rep);
             rep = NULL;
         }
     }
     if (replacement != 0) {
@@ skipping 178 matching lines @@
  * @ctxt:  an XML parser context
  * @error:  the error number
  * @extra:  extra information string
  *
  * Handle a fatal parser error, i.e. violating Well-Formedness constraints
  */
 static void
 xmlFatalErr(xmlParserCtxtPtr ctxt, xmlParserErrors error, const char *info)
 {
     const char *errmsg;
-    char errstr[129] = "";
 
     if ((ctxt != NULL) && (ctxt->disableSAX != 0) &&
         (ctxt->instate == XML_PARSER_EOF))
         return;
     switch (error) {
         case XML_ERR_INVALID_HEX_CHARREF:
             errmsg = "CharRef: invalid hexadecimal value";
             break;
         case XML_ERR_INVALID_DEC_CHARREF:
             errmsg = "CharRef: invalid decimal value";
@@ skipping 166 matching lines @@
             errmsg = "Name too long use XML_PARSE_HUGE option";
             break;
 #if 0
         case:
             errmsg = "";
             break;
 #endif
         default:
             errmsg = "Unregistered error message";
     }
-    if (info == NULL)
-        snprintf(errstr, 128, "%s\n", errmsg);
-    else
-        snprintf(errstr, 128, "%s: %%s\n", errmsg);
     if (ctxt != NULL)
         ctxt->errNo = error;
-    __xmlRaiseError(NULL, NULL, NULL, ctxt, NULL, XML_FROM_PARSER, error,
-                    XML_ERR_FATAL, NULL, 0, info, NULL, NULL, 0, 0, &errstr[0],
-                    info);
+    if (info == NULL) {
+        __xmlRaiseError(NULL, NULL, NULL, ctxt, NULL, XML_FROM_PARSER, error,
+                        XML_ERR_FATAL, NULL, 0, info, NULL, NULL, 0, 0, "%s\n",
+                        errmsg);
+    } else {
+        __xmlRaiseError(NULL, NULL, NULL, ctxt, NULL, XML_FROM_PARSER, error,
+                        XML_ERR_FATAL, NULL, 0, info, NULL, NULL, 0, 0, "%s: %s\n",
+                        errmsg, info);
+    }
     if (ctxt != NULL) {
         ctxt->wellFormed = 0;
         if (ctxt->recovery == 0)
             ctxt->disableSAX = 1;
     }
 }
 
 /**
  * xmlFatalErrMsg:
  * @ctxt:  an XML parser context
  * @error:  the error number
  * @msg:  the error message
  *
  * Handle a fatal parser error, i.e. violating Well-Formedness constraints
  */
-static void
+static void LIBXML_ATTR_FORMAT(3,0)
 xmlFatalErrMsg(xmlParserCtxtPtr ctxt, xmlParserErrors error,
                const char *msg)
 {
     if ((ctxt != NULL) && (ctxt->disableSAX != 0) &&
         (ctxt->instate == XML_PARSER_EOF))
         return;
     if (ctxt != NULL)
         ctxt->errNo = error;
     __xmlRaiseError(NULL, NULL, NULL, ctxt, NULL, XML_FROM_PARSER, error,
                     XML_ERR_FATAL, NULL, 0, NULL, NULL, NULL, 0, 0, "%s", msg);
     if (ctxt != NULL) {
         ctxt->wellFormed = 0;
         if (ctxt->recovery == 0)
             ctxt->disableSAX = 1;
     }
 }
 
 /**
  * xmlWarningMsg:
  * @ctxt:  an XML parser context
  * @error:  the error number
  * @msg:  the error message
  * @str1:  extra data
  * @str2:  extra data
  *
  * Handle a warning.
  */
-static void
+static void LIBXML_ATTR_FORMAT(3,0)
 xmlWarningMsg(xmlParserCtxtPtr ctxt, xmlParserErrors error,
               const char *msg, const xmlChar *str1, const xmlChar *str2)
 {
     xmlStructuredErrorFunc schannel = NULL;
 
     if ((ctxt != NULL) && (ctxt->disableSAX != 0) &&
         (ctxt->instate == XML_PARSER_EOF))
         return;
     if ((ctxt != NULL) && (ctxt->sax != NULL) &&
         (ctxt->sax->initialized == XML_SAX2_MAGIC))
@@ skipping 17 matching lines @@
 
 /**
  * xmlValidityError:
  * @ctxt:  an XML parser context
  * @error:  the error number
  * @msg:  the error message
  * @str1:  extra data
  *
  * Handle a validity error.
  */
-static void
+static void LIBXML_ATTR_FORMAT(3,0)
 xmlValidityError(xmlParserCtxtPtr ctxt, xmlParserErrors error,
               const char *msg, const xmlChar *str1, const xmlChar *str2)
 {
     xmlStructuredErrorFunc schannel = NULL;
 
     if ((ctxt != NULL) && (ctxt->disableSAX != 0) &&
         (ctxt->instate == XML_PARSER_EOF))
         return;
     if (ctxt != NULL) {
         ctxt->errNo = error;
@@ skipping 19 matching lines @@
 
 /**
  * xmlFatalErrMsgInt:
  * @ctxt:  an XML parser context
  * @error:  the error number
  * @msg:  the error message
  * @val:  an integer value
  *
  * Handle a fatal parser error, i.e. violating Well-Formedness constraints
  */
-static void
+static void LIBXML_ATTR_FORMAT(3,0)
 xmlFatalErrMsgInt(xmlParserCtxtPtr ctxt, xmlParserErrors error,
                   const char *msg, int val)
 {
     if ((ctxt != NULL) && (ctxt->disableSAX != 0) &&
         (ctxt->instate == XML_PARSER_EOF))
         return;
     if (ctxt != NULL)
         ctxt->errNo = error;
     __xmlRaiseError(NULL, NULL, NULL,
                     ctxt, NULL, XML_FROM_PARSER, error, XML_ERR_FATAL,
                     NULL, 0, NULL, NULL, NULL, val, 0, msg, val);
     if (ctxt != NULL) {
         ctxt->wellFormed = 0;
         if (ctxt->recovery == 0)
             ctxt->disableSAX = 1;
     }
 }
 
 /**
  * xmlFatalErrMsgStrIntStr:
  * @ctxt:  an XML parser context
  * @error:  the error number
  * @msg:  the error message
  * @str1:  an string info
  * @val:  an integer value
  * @str2:  an string info
  *
  * Handle a fatal parser error, i.e. violating Well-Formedness constraints
  */
-static void
+static void LIBXML_ATTR_FORMAT(3,0)
 xmlFatalErrMsgStrIntStr(xmlParserCtxtPtr ctxt, xmlParserErrors error,
                   const char *msg, const xmlChar *str1, int val,
                   const xmlChar *str2)
 {
     if ((ctxt != NULL) && (ctxt->disableSAX != 0) &&
         (ctxt->instate == XML_PARSER_EOF))
         return;
     if (ctxt != NULL)
         ctxt->errNo = error;
     __xmlRaiseError(NULL, NULL, NULL,
                     ctxt, NULL, XML_FROM_PARSER, error, XML_ERR_FATAL,
                     NULL, 0, (const char *) str1, (const char *) str2,
                     NULL, val, 0, msg, str1, val, str2);
     if (ctxt != NULL) {
         ctxt->wellFormed = 0;
         if (ctxt->recovery == 0)
             ctxt->disableSAX = 1;
     }
 }
 
 /**
  * xmlFatalErrMsgStr:
  * @ctxt:  an XML parser context
  * @error:  the error number
  * @msg:  the error message
  * @val:  a string value
  *
  * Handle a fatal parser error, i.e. violating Well-Formedness constraints
  */
-static void
+static void LIBXML_ATTR_FORMAT(3,0)
 xmlFatalErrMsgStr(xmlParserCtxtPtr ctxt, xmlParserErrors error,
                   const char *msg, const xmlChar * val)
 {
     if ((ctxt != NULL) && (ctxt->disableSAX != 0) &&
         (ctxt->instate == XML_PARSER_EOF))
         return;
     if (ctxt != NULL)
         ctxt->errNo = error;
     __xmlRaiseError(NULL, NULL, NULL, ctxt, NULL,
                     XML_FROM_PARSER, error, XML_ERR_FATAL,
                     NULL, 0, (const char *) val, NULL, NULL, 0, 0, msg,
                     val);
     if (ctxt != NULL) {
         ctxt->wellFormed = 0;
         if (ctxt->recovery == 0)
             ctxt->disableSAX = 1;
     }
 }
 
 /**
  * xmlErrMsgStr:
  * @ctxt:  an XML parser context
  * @error:  the error number
  * @msg:  the error message
  * @val:  a string value
  *
  * Handle a non fatal parser error
  */
-static void
+static void LIBXML_ATTR_FORMAT(3,0)
 xmlErrMsgStr(xmlParserCtxtPtr ctxt, xmlParserErrors error,
                   const char *msg, const xmlChar * val)
 {
     if ((ctxt != NULL) && (ctxt->disableSAX != 0) &&
         (ctxt->instate == XML_PARSER_EOF))
         return;
     if (ctxt != NULL)
         ctxt->errNo = error;
     __xmlRaiseError(NULL, NULL, NULL, ctxt, NULL,
                     XML_FROM_PARSER, error, XML_ERR_ERROR,
                     NULL, 0, (const char *) val, NULL, NULL, 0, 0, msg,
                     val);
 }
 
 /**
  * xmlNsErr:
  * @ctxt:  an XML parser context
  * @error:  the error number
  * @msg:  the message
  * @info1:  extra information string
  * @info2:  extra information string
  *
  * Handle a fatal parser error, i.e. violating Well-Formedness constraints
  */
-static void
+static void LIBXML_ATTR_FORMAT(3,0)
 xmlNsErr(xmlParserCtxtPtr ctxt, xmlParserErrors error,
          const char *msg,
          const xmlChar * info1, const xmlChar * info2,
          const xmlChar * info3)
 {
     if ((ctxt != NULL) && (ctxt->disableSAX != 0) &&
         (ctxt->instate == XML_PARSER_EOF))
         return;
     if (ctxt != NULL)
         ctxt->errNo = error;
     __xmlRaiseError(NULL, NULL, NULL, ctxt, NULL, XML_FROM_NAMESPACE, error,
                     XML_ERR_ERROR, NULL, 0, (const char *) info1,
                     (const char *) info2, (const char *) info3, 0, 0, msg,
                     info1, info2, info3);
     if (ctxt != NULL)
         ctxt->nsWellFormed = 0;
 }
 
 /**
  * xmlNsWarn
  * @ctxt:  an XML parser context
  * @error:  the error number
  * @msg:  the message
  * @info1:  extra information string
  * @info2:  extra information string
  *
  * Handle a namespace warning error
  */
-static void
+static void LIBXML_ATTR_FORMAT(3,0)
 xmlNsWarn(xmlParserCtxtPtr ctxt, xmlParserErrors error,
          const char *msg,
          const xmlChar * info1, const xmlChar * info2,
          const xmlChar * info3)
 {
     if ((ctxt != NULL) && (ctxt->disableSAX != 0) &&
         (ctxt->instate == XML_PARSER_EOF))
         return;
     __xmlRaiseError(NULL, NULL, NULL, ctxt, NULL, XML_FROM_NAMESPACE, error,
                     XML_ERR_WARNING, NULL, 0, (const char *) info1,
@@ skipping 1183 matching lines @@
  *   CUR_SCHAR  same but operate on a string instead of the context
  *   COPY_BUF  copy the current unicode char to the target buffer, increment
  *            the index
  *   GROW, SHRINK  handling of input buffers
  */
 
 #define RAW (*ctxt->input->cur)
 #define CUR (*ctxt->input->cur)
 #define NXT(val) ctxt->input->cur[(val)]
 #define CUR_PTR ctxt->input->cur
+#define BASE_PTR ctxt->input->base
 
 #define CMP4( s, c1, c2, c3, c4 ) \
   ( ((unsigned char *) s)[ 0 ] == c1 && ((unsigned char *) s)[ 1 ] == c2 && \
     ((unsigned char *) s)[ 2 ] == c3 && ((unsigned char *) s)[ 3 ] == c4 )
 #define CMP5( s, c1, c2, c3, c4, c5 ) \
   ( CMP4( s, c1, c2, c3, c4 ) && ((unsigned char *) s)[ 4 ] == c5 )
 #define CMP6( s, c1, c2, c3, c4, c5, c6 ) \
   ( CMP5( s, c1, c2, c3, c4, c5 ) && ((unsigned char *) s)[ 5 ] == c6 )
 #define CMP7( s, c1, c2, c3, c4, c5, c6, c7 ) \
   ( CMP6( s, c1, c2, c3, c4, c5, c6 ) && ((unsigned char *) s)[ 6 ] == c7 )
@@ skipping 830 matching lines @@
                 xmlGenericError(xmlGenericErrorContext,
                         "String decoding PE Reference: %.30s\n", str);
             ent = xmlParseStringPEReference(ctxt, &str);
             if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
                 goto int_error;
             xmlParserEntityCheck(ctxt, 0, ent, 0);
             if (ent != NULL)
                 ctxt->nbentities += ent->checked / 2;
             if (ent != NULL) {
                 if (ent->content == NULL) {
-                    xmlLoadEntityContent(ctxt, ent);
+                    /*
+                     * Note: external parsed entities will not be loaded,
+                     * it is not required for a non-validating parser to
+                     * complete external PEreferences coming from the
+                     * internal subset
+                     */
+                    if (((ctxt->options & XML_PARSE_NOENT) != 0) ||
+                        ((ctxt->options & XML_PARSE_DTDVALID) != 0) ||
+                        (ctxt->validate != 0)) {
+                        xmlLoadEntityContent(ctxt, ent);
+                    } else {
+                        xmlWarningMsg(ctxt, XML_ERR_ENTITY_PROCESSING,
+                  "not validating will not read content for PE entity %s\n",
+                                      ent->name, NULL);
+                    }
                 }
                 ctxt->depth++;
                 rep = xmlStringDecodeEntities(ctxt, ent->content, what,
                                               0, 0, 0);
                 ctxt->depth--;
                 if (rep != NULL) {
                     current = rep;
                     while (*current != 0) { /* non input consuming loop */
                         buffer[nbchars++] = *current++;
                         if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
@@ skipping 591 matching lines @@
     }
     /* accelerator for special cases */
     return(xmlParseNameComplex(ctxt));
 }
 
 static const xmlChar *
 xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) {
     int len = 0, l;
     int c;
     int count = 0;
-    const xmlChar *end; /* needed because CUR_CHAR() can move cur on \r\n */
+    size_t startPosition = 0;
 
 #ifdef DEBUG
     nbParseNCNameComplex++;
 #endif
 
     /*
      * Handler for more complex cases
      */
     GROW;
-    end = ctxt->input->cur;
+    startPosition = CUR_PTR - BASE_PTR;
     c = CUR_CHAR(l);
     if ((c == ' ') || (c == '>') || (c == '/') || /* accelerators */
         (!xmlIsNameStartChar(ctxt, c) || (c == ':'))) {
         return(NULL);
     }
 
     while ((c != ' ') && (c != '>') && (c != '/') && /* test bigname.xml */
            (xmlIsNameChar(ctxt, c) && (c != ':'))) {
         if (count++ > XML_PARSER_CHUNK_SIZE) {
             if ((len > XML_MAX_NAME_LENGTH) &&
                 ((ctxt->options & XML_PARSE_HUGE) == 0)) {
                 xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");
                 return(NULL);
             }
             count = 0;
             GROW;
             if (ctxt->instate == XML_PARSER_EOF)
                 return(NULL);
         }
         len += l;
         NEXTL(l);
-        end = ctxt->input->cur;
         c = CUR_CHAR(l);
         if (c == 0) {
             count = 0;
             /*
              * when shrinking to extend the buffer we really need to preserve
              * the part of the name we already parsed. Hence rolling back
              * by current lenght.
              */
             ctxt->input->cur -= l;
             GROW;
             ctxt->input->cur += l;
             if (ctxt->instate == XML_PARSER_EOF)
                 return(NULL);
-            end = ctxt->input->cur;
             c = CUR_CHAR(l);
         }
     }
     if ((len > XML_MAX_NAME_LENGTH) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "NCName");
         return(NULL);
     }
-    return(xmlDictLookup(ctxt->dict, end - len, len));
+    return(xmlDictLookup(ctxt->dict, (BASE_PTR + startPosition), len));
 }
 
 /**
  * xmlParseNCName:
  * @ctxt:  an XML parser context
  * @len:  length of the string parsed
  *
  * parse an XML name.
  *
  * [4NS] NCNameChar ::= Letter | Digit | '.' | '-' | '_' |
@@ skipping 420 matching lines @@
         xmlFatalErr(ctxt, XML_ERR_ENTITY_NOT_FINISHED, NULL);
         xmlFree(buf);
     } else {
         NEXT;
         /*
          * NOTE: 4.4.7 Bypassed
          * When a general entity reference appears in the EntityValue in
          * an entity declaration, it is bypassed and left as is.
          * so XML_SUBSTITUTE_REF is not set here.
          */
+        ++ctxt->depth;
         ret = xmlStringDecodeEntities(ctxt, buf, XML_SUBSTITUTE_PEREF,
                                       0, 0, 0);
+        --ctxt->depth;
         if (orig != NULL)
             *orig = buf;
         else
             xmlFree(buf);
     }
 
     return(ret);
 }
 
 /**
@@ skipping 104 matching lines @@
                         buf[len++] = '#';
                         buf[len++] = '3';
                         buf[len++] = '8';
                         buf[len++] = ';';
                     } else {
                         buf[len++] = ent->content[0];
                     }
                 } else if ((ent != NULL) &&
                            (ctxt->replaceEntities != 0)) {
                     if (ent->etype != XML_INTERNAL_PREDEFINED_ENTITY) {
+                        ++ctxt->depth;
                         rep = xmlStringDecodeEntities(ctxt, ent->content,
                                                       XML_SUBSTITUTE_REF,
                                                       0, 0, 0);
+                        --ctxt->depth;
                         if (rep != NULL) {
                             current = rep;
                             while (*current != 0) { /* non input consuming */
                                 if ((*current == 0xD) || (*current == 0xA) ||
                                     (*current == 0x9)) {
                                     buf[len++] = 0x20;
                                     current++;
                                 } else
                                     buf[len++] = *current++;
                                 if (len + 10 > buf_size) {
@@ skipping 15 matching lines @@
                     const xmlChar *cur = ent->name;
 
                     /*
                      * This may look absurd but is needed to detect
                      * entities problems
                      */
                     if ((ent->etype != XML_INTERNAL_PREDEFINED_ENTITY) &&
                         (ent->content != NULL) && (ent->checked == 0)) {
                         unsigned long oldnbent = ctxt->nbentities;
 
+                        ++ctxt->depth;
                         rep = xmlStringDecodeEntities(ctxt, ent->content,
                                                   XML_SUBSTITUTE_REF, 0, 0, 0);
+                        --ctxt->depth;
 
                         ent->checked = (ctxt->nbentities - oldnbent + 1) * 2;
                         if (rep != NULL) {
                             if (xmlStrchr(rep, '<'))
                                 ent->checked |= 1;
                             xmlFree(rep);
                             rep = NULL;
                         }
                     }
 
@@ skipping 1349 matching lines @@
         if (skipped == 0) {
             xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
                            "Space required after '<!ENTITY'\n");
         }
 
         if (RAW == '%') {
             NEXT;
             skipped = SKIP_BLANKS;
             if (skipped == 0) {
                 xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
-                               "Space required after '%'\n");
+                               "Space required after '%%'\n");
             }
             isParameter = 1;
         }
 
         name = xmlParseName(ctxt);
         if (name == NULL) {
             xmlFatalErrMsg(ctxt, XML_ERR_NAME_REQUIRED,
                            "xmlParseEntityDecl: no name\n");
             return;
         }
@@ skipping 1164 matching lines @@
     xmlElementContentPtr content  = NULL;
 
     /* GROW; done in the caller */
     if (CMP9(CUR_PTR, '<', '!', 'E', 'L', 'E', 'M', 'E', 'N', 'T')) {
         xmlParserInputPtr input = ctxt->input;
 
         SKIP(9);
         if (!IS_BLANK_CH(CUR)) {
             xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
                            "Space required after 'ELEMENT'\n");
+            return(-1);
         }
         SKIP_BLANKS;
         name = xmlParseName(ctxt);
         if (name == NULL) {
             xmlFatalErrMsg(ctxt, XML_ERR_NAME_REQUIRED,
                            "xmlParseElementDecl: no name for Element\n");
             return(-1);
         }
         while ((RAW == 0) && (ctxt->inputNr > 1))
             xmlPopInput(ctxt);
@@ skipping 131 matching lines @@
                 xmlParseMarkupDecl(ctxt);
 
             /*
              * Pop-up of finished entities.
              */
             while ((RAW == 0) && (ctxt->inputNr > 1))
                 xmlPopInput(ctxt);
 
             if ((CUR_PTR == check) && (cons == ctxt->input->consumed)) {
                 xmlFatalErr(ctxt, XML_ERR_EXT_SUBSET_NOT_FINISHED, NULL);
+                xmlHaltParser(ctxt);
                 break;
             }
         }
         if (xmlParserDebugEntities) {
             if ((ctxt->input != NULL) && (ctxt->input->filename))
                 xmlGenericError(xmlGenericErrorContext,
                         "%s(%d): ", ctxt->input->filename,
                         ctxt->input->line);
             xmlGenericError(xmlGenericErrorContext,
                     "Leaving INCLUDE Conditional Section\n");
@@ skipping 2609 matching lines @@
                  * check that it's not a defined namespace
                  */
                 for (j = 1;j <= nbNs;j++)
                     if (ctxt->nsTab[ctxt->nsNr - 2 * j] == NULL)
                         break;
                 if (j <= nbNs)
                     xmlErrAttributeDup(ctxt, NULL, attname);
                 else
                     if (nsPush(ctxt, NULL, URL) > 0) nbNs++;
 skip_default_ns:
-                if (alloc != 0) xmlFree(attvalue);
+                if ((attvalue != NULL) && (alloc != 0)) {
+                    xmlFree(attvalue);
+                    attvalue = NULL;
+                }
                 if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
                     break;
                 if (!IS_BLANK_CH(RAW)) {
                     xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
                                    "attributes construct error\n");
                     break;
                 }
                 SKIP_BLANKS;
+                if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+                    goto base_changed;
                 continue;
             }
             if (aprefix == ctxt->str_xmlns) {
                 const xmlChar *URL = xmlDictLookup(ctxt->dict, attvalue, len);
                 xmlURIPtr uri;
 
                 if (attname == ctxt->str_xml) {
                     if (URL != ctxt->str_xml_ns) {
                         xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,
                                  "xml namespace prefix mapped to wrong URI\n",
@@ skipping 51 matching lines @@
                  * check that it's not a defined namespace
                  */
                 for (j = 1;j <= nbNs;j++)
                     if (ctxt->nsTab[ctxt->nsNr - 2 * j] == attname)
                         break;
                 if (j <= nbNs)
                     xmlErrAttributeDup(ctxt, aprefix, attname);
                 else
                     if (nsPush(ctxt, attname, URL) > 0) nbNs++;
 skip_ns:
-                if (alloc != 0) xmlFree(attvalue);
+                if ((attvalue != NULL) && (alloc != 0)) {
+                    xmlFree(attvalue);
+                    attvalue = NULL;
+                }
                 if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
                     break;
                 if (!IS_BLANK_CH(RAW)) {
                     xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,
                                    "attributes construct error\n");
                     break;
                 }
                 SKIP_BLANKS;
                 if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
                     goto base_changed;
@@ skipping 250 matching lines @@
  *
  * With namespace
  *
  * [NS 9] ETag ::= '</' QName S? '>'
  */
 
 static void
 xmlParseEndTag2(xmlParserCtxtPtr ctxt, const xmlChar *prefix,
                 const xmlChar *URI, int line, int nsNr, int tlen) {
     const xmlChar *name;
+    size_t curLength;
 
     GROW;
     if ((RAW != '<') || (NXT(1) != '/')) {
         xmlFatalErr(ctxt, XML_ERR_LTSLASH_REQUIRED, NULL);
         return;
     }
     SKIP(2);
 
-    size_t curLength = ctxt->input->end - ctxt->input->cur;
-    if ((tlen > 0) && (curLength >= (size_t)tlen) && (xmlStrncmp(ctxt->input->cur, ctxt->name, tlen) == 0)) {
-      if ((curLength >= (size_t)(tlen + 1)) && (ctxt->input->cur[tlen] == '>')) {
+    curLength = ctxt->input->end - ctxt->input->cur;
+    if ((tlen > 0) && (curLength >= (size_t)tlen) &&
+        (xmlStrncmp(ctxt->input->cur, ctxt->name, tlen) == 0)) {
+        if ((curLength >= (size_t)(tlen + 1)) &&
+            (ctxt->input->cur[tlen] == '>')) {
             ctxt->input->cur += tlen + 1;
             ctxt->input->col += tlen + 1;
             goto done;
         }
         ctxt->input->cur += tlen;
         ctxt->input->col += tlen;
         name = (xmlChar*)1;
     } else {
         if (prefix == NULL)
             name = xmlParseNameAndCompare(ctxt, ctxt->name);
@@ skipping 5928 matching lines @@
     if (stream == NULL) {
         xmlFreeParserInputBuffer(input);
         return (NULL);
     }
     inputPush(ctxt, stream);
     return (xmlDoRead(ctxt, URL, encoding, options, 1));
 }
 
 #define bottom_parser
 #include "elfgcchack.h"