Changeset 39921 in vbox

Timestamp:

Jan 31, 2012 3:22:08 PM (13 years ago)

Author:

vboxsync

Message:

libxml-2.6.31 upstream fixes

Location:

trunk/src/libs/libxml2-2.6.31

Files:

• SAX2.c (modified) (2 diffs)
• encoding.c (modified) (2 diffs)
• entities.c (modified) (1 diff)
• error.c (modified) (1 diff)
• include/libxml/parser.h (modified) (1 diff)
• libxml.h (modified) (1 diff)
• nanohttp.c (modified) (1 diff)
• parser.c (modified) (49 diffs)
• parserInternals.c (modified) (2 diffs)
• tree.c (modified) (2 diffs)
• xmllint.c (modified) (3 diffs)
• xpath.c (modified) (19 diffs)

trunk/src/libs/libxml2-2.6.31/SAX2.c

@@ -12 +12 @@
 #include <stdlib.h>
 #include <string.h>
+#include <limits.h>
 #include <libxml/xmlmemory.h>
 #include <libxml/tree.h>
@@ -2443 +2444 @@
                        (xmlDictOwns(ctxt->dict, lastChild->content))) {
                 lastChild->content = xmlStrdup(lastChild->content);
+            }
+            if (ctxt->nodelen > UINT_MAX - len ||
+                ctxt->nodemem + len > UINT_MAX / 2) {
+                    xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters overflow prevented");
+                    return;
             }
             if (ctxt->nodelen + len >= ctxt->nodemem) {

trunk/src/libs/libxml2-2.6.31/encoding.c

@@ -1763 +1763 @@
 
     /* calculate space available */
-    written = out->size - out->use;
+    written = out->size - out->use - 1; /* count '\0' */
     toconv = in->use;
     /*
@@ -1856 +1856 @@
     if (toconv == 0)
         return (0);
-    written = out->size - out->use;
+    written = out->size - out->use -1; /* count '\0' */
     if (toconv * 2 >= written) {
         xmlBufferGrow(out, out->size + toconv * 2);

trunk/src/libs/libxml2-2.6.31/entities.c

@@ -103 +103 @@
 
 
-    if ((entity->children) && (entity->owner == 1) &&
+    if ((entity->children) && (entity->owner != 0) &&
         (entity == (xmlEntityPtr) entity->children->parent))
         xmlFreeNodeList(entity->children);

trunk/src/libs/libxml2-2.6.31/error.c

@@ -46 +46 @@
             size += chars + 1;                                  \
         else                                                    \
-            size += 100;                                        \
+            break;                                              \
         if ((larger = (char *) xmlRealloc(str, size)) == NULL) {\
             break;                                              \

trunk/src/libs/libxml2-2.6.31/include/libxml/parser.h

@@ -298 +298 @@
     xmlError          lastError;
     xmlParserMode     parseMode;    /* the parser mode */
+    unsigned long    nbentities;    /* number of entities references */
+    unsigned long  sizeentities;    /* size of parsed entities */
 };
 

trunk/src/libs/libxml2-2.6.31/libxml.h

@@ -13 +13 @@
 #ifndef _LARGEFILE_SOURCE
 #define _LARGEFILE_SOURCE
+#endif
+#ifndef _LARGEFILE64_SOURCE
+#define _LARGEFILE64_SOURCE
 #endif
 #ifndef _FILE_OFFSET_BITS

trunk/src/libs/libxml2-2.6.31/nanohttp.c

@@ -1333 +1333 @@
         blen += strlen(headers) + 2;
     if (contentType && *contentType)
+        /* reserve for string plus 'Content-Type: \r\n" */
         blen += strlen(*contentType) + 16;
     if (ctxt->query != NULL)
+        /* 1 for '?' */
         blen += strlen(ctxt->query) + 1;
     blen += strlen(method) + strlen(ctxt->path) + 24;
 #ifdef HAVE_ZLIB_H
+    /* reserve for possible 'Accept-Encoding: gzip' string */
     blen += 23;
 #endif
+    if (ctxt->port != 80) {
+        /* reserve space for ':xxxxx', incl. potential proxy */
+        if (proxy)
+            blen += 12;
+        else
+            blen += 6;
+    }
     bp = (char*)xmlMallocAtomic(blen);
     if ( bp == NULL ) {

trunk/src/libs/libxml2-2.6.31/parser.c

@@ -80 +80 @@
 #include <zlib.h>
 #endif
+
+static void
+xmlFatalErr(xmlParserCtxtPtr ctxt, xmlParserErrors error, const char *info);
+
+/************************************************************************
+ *                                                                      *
+ *      Arbitrary limits set in the parser.                             *
+ *                                                                      *
+ ************************************************************************/
+
+#define XML_PARSER_BIG_ENTITY 1000
+#define XML_PARSER_LOT_ENTITY 5000
+
+/*
+ * XML_PARSER_NON_LINEAR is the threshold where the ratio of parsed entity
+ *    replacement over the size in byte of the input indicates that you have
+ *    and eponential behaviour. A value of 10 correspond to at least 3 entity
+ *    replacement per byte of input.
+ */
+#define XML_PARSER_NON_LINEAR 10
+
+/*
+ * xmlParserEntityCheck
+ *
+ * Function to check non-linear entity expansion behaviour
+ * This is here to detect and stop exponential linear entity expansion
+ * This is not a limitation of the parser but a safety
+ * boundary feature.
+ */
+static int
+xmlParserEntityCheck(xmlParserCtxtPtr ctxt, unsigned long size,
+                     xmlEntityPtr ent)
+{
+    unsigned long consumed = 0;
+
+    if (ctxt == NULL)
+        return (0);
+    if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
+        return (1);
+    if (size != 0) {
+        /*
+         * Do the check based on the replacement size of the entity
+         */
+        if (size < XML_PARSER_BIG_ENTITY)
+            return(0);
+
+        /*
+         * A limit on the amount of text data reasonably used
+         */
+        if (ctxt->input != NULL) {
+            consumed = ctxt->input->consumed +
+                (ctxt->input->cur - ctxt->input->base);
+        }
+        consumed += ctxt->sizeentities;
+
+        if ((size < XML_PARSER_NON_LINEAR * consumed) &&
+            (ctxt->nbentities * 3 < XML_PARSER_NON_LINEAR * consumed))
+            return (0);
+    } else if (ent != NULL) {
+        /*
+         * use the number of parsed entities in the replacement
+         */
+        size = ent->owner;
+
+        /*
+         * The amount of data parsed counting entities size only once
+         */
+        if (ctxt->input != NULL) {
+            consumed = ctxt->input->consumed +
+                (ctxt->input->cur - ctxt->input->base);
+        }
+        consumed += ctxt->sizeentities;
+
+        /*
+         * Check the density of entities for the amount of data
+         * knowing an entity reference will take at least 3 bytes
+         */
+        if (size * 3 < consumed * XML_PARSER_NON_LINEAR)
+            return (0);
+    } else {
+        /*
+         * strange we got no data for checking just return
+         */
+        return (0);
+    }
+
+    xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
+    return (1);
+}
 
 /**
@@ -2179 +2268 @@
  * Macro used to grow the current buffer.
  */
-#define growBuffer(buffer) {                                            \
-    xmlChar *tmp;                                                       \
-    buffer##_size *= 2;                                                 \
-    tmp = (xmlChar *)                                                   \
-                xmlRealloc(buffer, buffer##_size * sizeof(xmlChar));    \
-    if (tmp == NULL) goto mem_error;                                    \
-    buffer = tmp;                                                       \
+#define growBuffer(buffer, n) {                                         \
+    xmlChar *tmp;                                                       \
+    buffer##_size *= 2;                                                 \
+    buffer##_size += n;                                                 \
+    tmp = (xmlChar *)                                                   \
+                xmlRealloc(buffer, buffer##_size * sizeof(xmlChar));    \
+    if (tmp == NULL) goto mem_error;                                    \
+    buffer = tmp;                                                       \
 }
 
@@ -2253 +2343 @@
             }
             if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
-                growBuffer(buffer);
+                growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
             }
         } else if ((c == '&') && (what & XML_SUBSTITUTE_REF)) {
@@ -2261 +2351 @@
                         str);
             ent = xmlParseStringEntityRef(ctxt, &str);
+            if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
+                goto int_error;
+            if (ent != NULL)
+                ctxt->nbentities += ent->owner;
             if ((ent != NULL) &&
                 (ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
@@ -2266 +2360 @@
                     COPY_BUF(0,buffer,nbchars,ent->content[0]);
                     if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
-                        growBuffer(buffer);
+                        growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
                     }
                 } else {
@@ -2285 +2379 @@
                         if (nbchars >
                             buffer_size - XML_PARSER_BUFFER_SIZE) {
-                            growBuffer(buffer);
+                            if (xmlParserEntityCheck(ctxt, nbchars, ent)) {
+                                xmlFree(rep);
+                                goto int_error;
+                            }
+                            growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
                         }
                     }
@@ -2296 +2394 @@
                 buffer[nbchars++] = '&';
                 if (nbchars > buffer_size - i - XML_PARSER_BUFFER_SIZE) {
-                    growBuffer(buffer);
+                    growBuffer(buffer, i + XML_PARSER_BUFFER_SIZE);
                 }
                 for (;i > 0;i--)
@@ -2307 +2405 @@
                         "String decoding PE Reference: %.30s\n", str);
             ent = xmlParseStringPEReference(ctxt, &str);
+            if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
+                goto int_error;
+            if (ent != NULL)
+                ctxt->nbentities += ent->owner;
             if (ent != NULL) {
                 xmlChar *rep;
@@ -2320 +2422 @@
                         if (nbchars >
                             buffer_size - XML_PARSER_BUFFER_SIZE) {
-                            growBuffer(buffer);
+                            if (xmlParserEntityCheck(ctxt, nbchars, ent)) {
+                                xmlFree(rep);
+                                goto int_error;
+                            }
+                            growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
                         }
                     }
@@ -2330 +2436 @@
             str += l;
             if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
-              growBuffer(buffer);
+              growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
             }
         }
@@ -2343 +2449 @@
 mem_error:
     xmlErrMemory(ctxt, NULL);
+int_error:
+    if (buffer != NULL)
+        xmlFree(buffer);
     return(NULL);
 }
@@ -3127 +3236 @@
                     if (ctxt->replaceEntities) {
                         if (len > buf_size - 10) {
-                            growBuffer(buf);
+                            growBuffer(buf, 10);
                         }
                         buf[len++] = '&';
@@ -3136 +3245 @@
                          */
                         if (len > buf_size - 10) {
-                            growBuffer(buf);
+                            growBuffer(buf, 10);
                         }
                         buf[len++] = '&';
@@ -3146 +3255 @@
                 } else {
                     if (len > buf_size - 10) {
-                        growBuffer(buf);
+                        growBuffer(buf, 10);
                     }
                     len += xmlCopyChar(0, &buf[len], val);
@@ -3152 +3261 @@
             } else {
                 ent = xmlParseEntityRef(ctxt);
+                ctxt->nbentities++;
+                if (ent != NULL)
+                    ctxt->nbentities += ent->owner;
                 if ((ent != NULL) &&
                     (ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
                     if (len > buf_size - 10) {
-                        growBuffer(buf);
+                        growBuffer(buf, 10);
                     }
                     if ((ctxt->replaceEntities == 0) &&
@@ -3180 +3292 @@
                                 buf[len++] = *current++;
                                 if (len > buf_size - 10) {
-                                    growBuffer(buf);
+                                    growBuffer(buf, 10);
                                 }
                             }
@@ -3187 +3299 @@
                     } else {
                         if (len > buf_size - 10) {
-                            growBuffer(buf);
+                            growBuffer(buf, 10);
                         }
                         if (ent->content != NULL)
@@ -3213 +3325 @@
                      */
                     buf[len++] = '&';
-                    if (len > buf_size - i - 10) {
-                        growBuffer(buf);
+                    while (len > buf_size - i - 10) {
+                        growBuffer(buf, i + 10);
                     }
                     for (;i > 0;i--)
@@ -3227 +3339 @@
                         COPY_BUF(l,buf,len,0x20);
                         if (len > buf_size - 10) {
-                            growBuffer(buf);
+                            growBuffer(buf, 10);
                         }
                     }
@@ -3236 +3348 @@
                 COPY_BUF(l,buf,len,c);
                 if (len > buf_size - 10) {
-                    growBuffer(buf);
+                    growBuffer(buf, 10);
                 }
             }
@@ -4251 +4363 @@
                     ctxt->sax->processingInstruction(ctxt->userData,
                                                      target, NULL);
-                ctxt->instate = state;
+                if (ctxt->instate != XML_PARSER_EOF)
+                    ctxt->instate = state;
                 return;
             }
@@ -4331 +4444 @@
             xmlFatalErr(ctxt, XML_ERR_PI_NOT_STARTED, NULL);
         }
-        ctxt->instate = state;
+        if (ctxt->instate != XML_PARSER_EOF)
+            ctxt->instate = state;
     }
 }
@@ -4434 +4548 @@
     xmlChar *orig = NULL;
     int skipped;
+    unsigned long oldnbent = ctxt->nbentities;
     
     /* GROW; done in the caller */
@@ -4643 +4758 @@
             }
             if (cur != NULL) {
+                if ((cur->owner != 0) || (cur->children == NULL)) {
+                    cur->owner = ctxt->nbentities - oldnbent;
+                    if (cur->owner ==  0)
+                        cur->owner = 1;
+                }
                 if (cur->orig != NULL)
                     xmlFree(orig);
@@ -4753 +4873 @@
             xmlFatalErrMsg(ctxt, XML_ERR_NAME_REQUIRED,
                            "Name expected in NOTATION declaration\n");
-            return(ret);
+            xmlFreeEnumeration(ret);
+            return(NULL);
         }
         cur = xmlCreateEnumeration(name);
-        if (cur == NULL) return(ret);
+        if (cur == NULL) {
+            xmlFreeEnumeration(ret);
+            return(NULL);
+        }
         if (last == NULL) ret = last = cur;
         else {
@@ -4766 +4890 @@
     if (RAW != ')') {
         xmlFatalErr(ctxt, XML_ERR_NOTATION_NOT_FINISHED, NULL);
-        if ((last != NULL) && (last != ret))
-            xmlFreeEnumeration(last);
-        return(ret);
+        xmlFreeEnumeration(ret);
+        return(NULL);
     }
     NEXT;
@@ -4809 +4932 @@
         cur = xmlCreateEnumeration(name);
         xmlFree(name);
-        if (cur == NULL) return(ret);
+        if (cur == NULL) {
+            xmlFreeEnumeration(ret);
+            return(NULL);
+        }
         if (last == NULL) ret = last = cur;
         else {
@@ -5207 +5333 @@
     xmlChar type = 0;
 
+    if (ctxt->depth > 128) {
+        xmlFatalErrMsgInt(ctxt, XML_ERR_ELEMCONTENT_NOT_FINISHED,
+                "xmlParseElementChildrenContentDecl : depth %d too deep\n",
+                          ctxt->depth);
+        return(NULL);
+    }
     SKIP_BLANKS;
     GROW;
@@ -5215 +5347 @@
         NEXT;
         SKIP_BLANKS;
+        ctxt->depth++;
         cur = ret = xmlParseElementChildrenContentDecl(ctxt, inputid);
+        ctxt->depth--;
         SKIP_BLANKS;
         GROW;
@@ -5345 +5479 @@
             NEXT;
             SKIP_BLANKS;
+            ctxt->depth++;
             last = xmlParseElementChildrenContentDecl(ctxt, inputid);
+            ctxt->depth--;
             SKIP_BLANKS;
         } else {
@@ -6072 +6208 @@
                             ent->children = list;
                             ent->last = list;
-                            ent->owner = 1;
+                            if (ent->owner == 0)
+                                ent->owner = 1;
                             list->parent = (xmlNodePtr) ent;
                         } else {
@@ -6081 +6218 @@
                     }
                 } else {
+                    unsigned long oldnbent = ctxt->nbentities;
                     /*
                      * 4.3.2: An internal general parsed entity is well-formed
@@ -6103 +6241 @@
                                            value, user_data, &list);
                         ctxt->depth--;
+
                     } else if (ent->etype ==
                                XML_EXTERNAL_GENERAL_PARSED_ENTITY) {
@@ -6114 +6253 @@
                         xmlErrMsgStr(ctxt, XML_ERR_INTERNAL_ERROR,
                                      "invalid entity type found\n", NULL);
+                    }
+                    /*
+                     * Store the number of entities needing parsing for entity
+                     * content and do checkings
+                     */
+                    if ((ent->owner != 0) || (ent->children == NULL)) {
+                        ent->owner = ctxt->nbentities - oldnbent;
+                        if (ent->owner == 0)
+                            ent->owner = 1;
+                    }
+                    if (ret == XML_ERR_ENTITY_LOOP) {
+                        xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
+                        xmlFreeNodeList(list);
+                        return;
+                    }
+                    if (xmlParserEntityCheck(ctxt, 0, ent)) {
+                        xmlFreeNodeList(list);
+                        return;
                     }
                     if (ret == XML_ERR_ENTITY_LOOP) {
@@ -6133 +6290 @@
                                     list->parent = (xmlNodePtr) ent;
                                     list = NULL;
-                                    ent->owner = 1;
+                                    if (ent->owner == 0)
+                                        ent->owner = 1;
                                 } else {
                                     ent->owner = 0;
@@ -6150 +6308 @@
                                 }
                             } else {
-                                ent->owner = 1;
+                                if (ent->owner == 0)
+                                    ent->owner = 1;
                                 while (list != NULL) {
                                     list->parent = (xmlNodePtr) ent;
@@ -6169 +6328 @@
                         xmlFreeNodeList(list);
                         list = NULL;
+                    } else if (ent->owner != 1) {
+                        ctxt->nbentities += ent->owner;
                     }
                 }
@@ -6327 +6488 @@
                             cur = next;
                         }
-                        ent->owner = 1;
+                        if (ent->owner == 0)
+                            ent->owner = 1;
 #ifdef LIBXML_LEGACY_ENABLED
                         if (ent->etype == XML_EXTERNAL_GENERAL_PARSED_ENTITY)                         
@@ -6416 +6578 @@
             if (RAW == ';') {
                 NEXT;
+                /*
+                 * Increase the number of entity references parsed
+                 */
+                ctxt->nbentities++;
+
                 /*
                  * Ask first SAX for entity resolution, otherwise try the
@@ -6588 +6755 @@
                 ptr++;
                 /*
+                 * Increase the number of entity references parsed
+                 */
+                ctxt->nbentities++;
+                /*
                  * Ask first SAX for entity resolution, otherwise try the
                  * predefined set.
@@ -6749 +6920 @@
             if (RAW == ';') {
                 NEXT;
+                /*
+                 * Increase the number of entity references parsed
+                 */
+                ctxt->nbentities++;
+
                 if ((ctxt->sax != NULL) &&
                     (ctxt->sax->getParameterEntity != NULL))
@@ -6879 +7055 @@
                 ptr++;
                 cur = *ptr;
+                /*
+                 * Increase the number of entity references parsed
+                 */
+                ctxt->nbentities++;
+
                 if ((ctxt->sax != NULL) &&
                     (ctxt->sax->getParameterEntity != NULL))
@@ -8610 +8791 @@
         name = xmlParseStartTag(ctxt);
 #endif /* LIBXML_SAX1_ENABLED */
+    if (ctxt->instate == XML_PARSER_EOF)
+        return;
     if (name == NULL) {
         spacePop(ctxt);
@@ -9932 +10115 @@
                     name = xmlParseStartTag(ctxt);
 #endif /* LIBXML_SAX1_ENABLED */
+                if (ctxt->instate == XML_PARSER_EOF)
+                    goto done;
                 if (name == NULL) {
                     spacePop(ctxt);
@@ -10118 +10303 @@
                     xmlParseEndTag1(ctxt, 0);
 #endif /* LIBXML_SAX1_ENABLED */
-                if (ctxt->nameNr == 0) {
+                if (ctxt->instate == XML_PARSER_EOF) {
+                    /* Nothing */
+                } else if (ctxt->nameNr == 0) {
                     ctxt->instate = XML_PARSER_EPILOG;
                 } else {
@@ -11538 +11725 @@
         ret = XML_ERR_OK;
     }
+
+    /*
+     * Record in the parent context the number of entities replacement
+     * done when parsing that reference.
+     */
+    oldctxt->nbentities += ctxt->nbentities;
+    /*
+     * Also record the size of the entity parsed
+     */
+    if (ctxt->input != NULL) {
+        oldctxt->sizeentities += ctxt->input->consumed;
+        oldctxt->sizeentities += (ctxt->input->cur - ctxt->input->base);
+    }
+    /*
+     * And record the last error if any
+     */
+    if (ctxt->lastError.code != XML_ERR_OK)
+        xmlCopyError(&ctxt->lastError, &oldctxt->lastError);
+
     if (sax != NULL) 
         ctxt->sax = oldsax;
@@ -11543 +11749 @@
     oldctxt->node_seq.length = ctxt->node_seq.length;
     oldctxt->node_seq.buffer = ctxt->node_seq.buffer;
+    oldctxt->nbentities += ctxt->nbentities;
     ctxt->node_seq.maximum = 0;
     ctxt->node_seq.length = 0;
@@ -11767 +11974 @@
     }
         
+    /*
+     * Record in the parent context the number of entities replacement
+     * done when parsing that reference.
+     */
+    oldctxt->nbentities += ctxt->nbentities;
+    /*
+     * Also record the last error if any
+     */
+    if (ctxt->lastError.code != XML_ERR_OK)
+        xmlCopyError(&ctxt->lastError, &oldctxt->lastError);
+
     ctxt->sax = oldsax;
     ctxt->dict = NULL;
@@ -13078 +13296 @@
     ctxt->charset = XML_CHAR_ENCODING_UTF8;
     ctxt->catalogs = NULL;
+    ctxt->nbentities = 0;
+    ctxt->sizeentities = 0;
     xmlInitNodeInfoSeq(&ctxt->node_seq);
 

trunk/src/libs/libxml2-2.6.31/parserInternals.c

@@ -1400 +1400 @@
         return(NULL);
     }
-    input->filename = (char *) entity->URI;
+    if (entity->URI != NULL)
+        input->filename = (char *) xmlStrdup((xmlChar *) entity->URI);
     input->base = entity->content;
     input->cur = entity->content;
@@ -1670 +1671 @@
     ctxt->charset = XML_CHAR_ENCODING_UTF8;
     ctxt->catalogs = NULL;
+    ctxt->nbentities = 0;
     xmlInitNodeInfoSeq(&ctxt->node_seq);
     return(0);

trunk/src/libs/libxml2-2.6.31/tree.c

@@ -15 +15 @@
 
 #include <string.h> /* for memset() only ! */
-
+#include <limits.h>
 #ifdef HAVE_CTYPE_H
 #include <ctype.h>
@@ -6899 +6899 @@
         /*take care of empty case*/
         newSize = (buf->size ? buf->size*2 : size + 10);
-        while (size > newSize) newSize *= 2;
+        while (size > newSize) {
+            if (newSize > UINT_MAX / 2) {
+                xmlTreeErrMemory("growing buffer");
+                return 0;
+            }
+            newSize *= 2;
+        }
         break;
     case XML_BUFFER_ALLOC_EXACT:

trunk/src/libs/libxml2-2.6.31/xmllint.c

@@ -2835 +2835 @@
     printf("\t--noent : substitute entity references by their value\n");
     printf("\t--noout : don't output the result tree\n");
-    printf("\t--path 'paths': provide a set of paths for resources\n");
+    printf("\t--path 'paths' : provide a set of paths for resources\n");
     printf("\t--load-trace : print trace of all external entites loaded\n");
     printf("\t--nonet : refuse to fetch DTDs or entities over network\n");
@@ -2885 +2885 @@
     printf("\t             otherwise XML Catalogs starting from \n");
     printf("\t         %s are activated by default\n", XML_XML_DEFAULT_CATALOG);
-    printf("\t--nocatalogs: deactivate all catalogs\n");
+    printf("\t--nocatalogs : deactivate all catalogs\n");
 #endif
     printf("\t--auto : generate a small doc on the fly\n");
@@ -2910 +2910 @@
 #endif
 #ifdef LIBXML_SAX1_ENABLED
-    printf("\t--sax1: use the old SAX1 interfaces for processing\n");
-#endif
-    printf("\t--sax: do not build a tree but work just at the SAX level\n");
+    printf("\t--sax1 : use the old SAX1 interfaces for processing\n");
+#endif
+    printf("\t--sax : do not build a tree but work just at the SAX level\n");
 
     printf("\nLibxml project home page: http://xmlsoft.org/\n");

trunk/src/libs/libxml2-2.6.31/xpath.c

@@ -2443 +2443 @@
         if (tmp == NULL) {
             xmlGenericError(xmlGenericErrorContext, "realloc failed !\n");
+            ctxt->error = XPATH_MEMORY_ERROR;
             return (0);
         }
@@ -3523 +3524 @@
         xmlNodePtr *temp;
 
-        cur->nodeMax *= 2;
-        temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
+        temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
                                       sizeof(xmlNodePtr));
         if (temp == NULL) {
@@ -3530 +3530 @@
             return;
         }
+        cur->nodeMax *= 2;
         cur->nodeTab = temp;
     }
@@ -3628 +3629 @@
         xmlNodePtr *temp;
 
-        cur->nodeMax *= 2;
-        temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
+        temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
                                       sizeof(xmlNodePtr));
         if (temp == NULL) {
@@ -3636 +3636 @@
         }
         cur->nodeTab = temp;
+        cur->nodeMax *= 2;
     }
     if (val->type == XML_NAMESPACE_DECL) {
@@ -3737 +3738 @@
             xmlNodePtr *temp;
 
-            val1->nodeMax *= 2;
-            temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax *
+            temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax * 2 *
                                              sizeof(xmlNodePtr));
             if (temp == NULL) {
@@ -3745 +3745 @@
             }
             val1->nodeTab = temp;
+            val1->nodeMax *= 2;
         }
         if (n2->type == XML_NAMESPACE_DECL) {
@@ -3902 +3903 @@
                 xmlNodePtr *temp;
                 
-                set1->nodeMax *= 2;
                 temp = (xmlNodePtr *) xmlRealloc(
-                    set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
+                    set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
                 if (temp == NULL) {
                     xmlXPathErrMemory(NULL, "merging nodeset\n");
@@ -3910 +3910 @@
                 }
                 set1->nodeTab = temp;
+                set1->nodeMax *= 2;
             }
             if (n2->type == XML_NAMESPACE_DECL) {
@@ -3984 +3985 @@
                 xmlNodePtr *temp;
                 
-                set1->nodeMax *= 2;
                 temp = (xmlNodePtr *) xmlRealloc(
-                    set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
+                    set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
                 if (temp == NULL) {
                     xmlXPathErrMemory(NULL, "merging nodeset\n");
@@ -3992 +3992 @@
                 }
                 set1->nodeTab = temp;
+                set1->nodeMax *= 2;
             }
             set1->nodeTab[set1->nodeNr++] = n2;
@@ -8088 +8089 @@
 xmlXPathNextFollowing(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
-    if (cur != NULL && cur->children != NULL)
-        return cur->children ;
-    if (cur == NULL) cur = ctxt->context->node;
+    if ((cur != NULL) && (cur->type  != XML_ATTRIBUTE_NODE) &&
+        (cur->type != XML_NAMESPACE_DECL) && (cur->children != NULL))
+        return(cur->children);
+
+    if (cur == NULL) {
+        cur = ctxt->context->node;
+        if (cur->type == XML_NAMESPACE_DECL)
+            return(NULL);
+        if (cur->type == XML_ATTRIBUTE_NODE)
+            cur = cur->parent;
+    }
     if (cur == NULL) return(NULL) ; /* ERROR */
     if (cur->next != NULL) return(cur->next) ;
@@ -8144 +8153 @@
 {
     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
-    if (cur == NULL)
+    if (cur == NULL) {
         cur = ctxt->context->node;
+        if (cur->type == XML_NAMESPACE_DECL)
+            return(NULL);
+        if (cur->type == XML_ATTRIBUTE_NODE)
+            return(cur->parent);
+    }
     if (cur == NULL)
         return (NULL);
@@ -8189 +8203 @@
         if (cur == NULL)
             return (NULL);
-        if (cur->type == XML_NAMESPACE_DECL)
-            cur = (xmlNodePtr)((xmlNsPtr)cur)->next;
+        if (cur->type == XML_NAMESPACE_DECL)
+            return (NULL);
         ctxt->ancestor = cur->parent;
     }
@@ -9258 +9272 @@
                     xmlGenericError(xmlGenericErrorContext,
                         "xmlXPathTranslateFunction: Invalid UTF8 string\n");
+                    /* not asserting an XPath error is probably better */
                     break;
                 }
@@ -9265 +9280 @@
                         xmlGenericError(xmlGenericErrorContext,
                             "xmlXPathTranslateFunction: Invalid UTF8 string\n");
+                        /* not asserting an XPath error is probably better */
                         break;
                     }
@@ -13302 +13318 @@
                                         "xmlXPathCompOpEval: variable %s bound to undefined prefix %s\n",
                                         op->value4, op->value5);
+                        ctxt->error = XPATH_UNDEF_PREFIX_ERROR;
                         return (total);
                     }
@@ -13350 +13367 @@
                                             "xmlXPathCompOpEval: function %s bound to undefined prefix %s\n",
                                             op->value4, op->value5);
+                            ctxt->error = XPATH_UNDEF_PREFIX_ERROR;
                             return (total);
                         }
@@ -13927 +13945 @@
     xmlGenericError(xmlGenericErrorContext,
                     "XPath: unknown precompiled operation %d\n", op->op);
+    ctxt->error = XPATH_INVALID_OPERAND;
     return (total);
 }