Make the XML entity recursion check more precise.

third_party/libxml/src/include/libxml/entities.h

Index: third_party/libxml/src/include/libxml/entities.h
diff --git a/third_party/libxml/src/include/libxml/entities.h b/third_party/libxml/src/include/libxml/entities.h
index 47b4573eba656f2bef00ea4b4e9a3d8613101636..012efab294cbaaf04736da0fefd6343c843abb88 100644
--- a/third_party/libxml/src/include/libxml/entities.h
+++ b/third_party/libxml/src/include/libxml/entities.h
@@ -35,8 +35,13 @@ typedef enum {
  * and the linkind data needed for the linking in the hash table.
  */
 
+typedef enum {
+  XML_ENTITY_NOT_BEING_CHECKED,
+  XML_ENTITY_BEING_CHECKED              /* entity check is in progress */
+} xmlEntityRecursionGuard;
+
 struct _xmlEntity {
-    void           *_private;	        /* application data */
+    void               *_private;	/* application data */
     xmlElementType          type;       /* XML_ENTITY_DECL, must be second ! */
     const xmlChar          *name;	/* Entity name */
     struct _xmlNode    *children;	/* First child link */
@@ -56,10 +61,11 @@ struct _xmlEntity {
     struct _xmlEntity     *nexte;	/* unused */
     const xmlChar           *URI;	/* the full URI as computed */
     int                    owner;	/* does the entity own the childrens */
-    int			 checked;	/* was the entity content checked */
-					/* this is also used to count entities
-					 * references done from that entity
-					 * and if it contains '<' */
+    int                  checked;	/* was the entity content checked and */
+					/* l.o. bit: replacement contains '<' */
+					/* remaining bits: one plus count of */
+                                        /* entity references from this entity */
+    xmlEntityRecursionGuard guard;

[ddkilzer, 2016/11/30 23:30:22]

FYI, changing struct _xmlEntity (which is vended as typedef 'xmlEntity' in
libxml2 public headers) will cause binary compatibility issues for platforms
that ship libxml2 as a public library.

Obviously this isn't an issue for Chrome if it uses its own copy of libxml2
internally, but it means that this fix can't be upstreamed as-is, and if this
bug is fixed upstream, it will use a different approach.

 };
 
 /*