Index: /trunk/src/libs/libxml2-2.6.31/SAX2.c
===================================================================
--- /trunk/src/libs/libxml2-2.6.31/SAX2.c	(revision 39920)
+++ /trunk/src/libs/libxml2-2.6.31/SAX2.c	(revision 39921)
@@ -12,4 +12,5 @@
 #include <stdlib.h>
 #include <string.h>
+#include <limits.h>
 #include <libxml/xmlmemory.h>
 #include <libxml/tree.h>
@@ -2443,4 +2444,9 @@
 	               (xmlDictOwns(ctxt->dict, lastChild->content))) {
 		lastChild->content = xmlStrdup(lastChild->content);
+	    }
+	    if (ctxt->nodelen > UINT_MAX - len ||
+	        ctxt->nodemem + len > UINT_MAX / 2) {
+	            xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters overflow prevented");
+	            return;
 	    }
 	    if (ctxt->nodelen + len >= ctxt->nodemem) {
Index: /trunk/src/libs/libxml2-2.6.31/encoding.c
===================================================================
--- /trunk/src/libs/libxml2-2.6.31/encoding.c	(revision 39920)
+++ /trunk/src/libs/libxml2-2.6.31/encoding.c	(revision 39921)
@@ -1763,5 +1763,5 @@
 
     /* calculate space available */
-    written = out->size - out->use;
+    written = out->size - out->use - 1; /* count '\0' */
     toconv = in->use;
     /*
@@ -1856,5 +1856,5 @@
     if (toconv == 0)
         return (0);
-    written = out->size - out->use;
+    written = out->size - out->use -1; /* count '\0' */
     if (toconv * 2 >= written) {
         xmlBufferGrow(out, out->size + toconv * 2);
Index: /trunk/src/libs/libxml2-2.6.31/entities.c
===================================================================
--- /trunk/src/libs/libxml2-2.6.31/entities.c	(revision 39920)
+++ /trunk/src/libs/libxml2-2.6.31/entities.c	(revision 39921)
@@ -103,5 +103,5 @@
 
 
-    if ((entity->children) && (entity->owner == 1) &&
+    if ((entity->children) && (entity->owner != 0) &&
         (entity == (xmlEntityPtr) entity->children->parent))
         xmlFreeNodeList(entity->children);
Index: /trunk/src/libs/libxml2-2.6.31/error.c
===================================================================
--- /trunk/src/libs/libxml2-2.6.31/error.c	(revision 39920)
+++ /trunk/src/libs/libxml2-2.6.31/error.c	(revision 39921)
@@ -46,5 +46,5 @@
 	    size += chars + 1;					\
 	else							\
-	    size += 100;					\
+	    break;						\
 	if ((larger = (char *) xmlRealloc(str, size)) == NULL) {\
 	    break;						\
Index: /trunk/src/libs/libxml2-2.6.31/include/libxml/parser.h
===================================================================
--- /trunk/src/libs/libxml2-2.6.31/include/libxml/parser.h	(revision 39920)
+++ /trunk/src/libs/libxml2-2.6.31/include/libxml/parser.h	(revision 39921)
@@ -298,4 +298,6 @@
     xmlError          lastError;
     xmlParserMode     parseMode;    /* the parser mode */
+    unsigned long    nbentities;    /* number of entities references */
+    unsigned long  sizeentities;    /* size of parsed entities */
 };
 
Index: /trunk/src/libs/libxml2-2.6.31/libxml.h
===================================================================
--- /trunk/src/libs/libxml2-2.6.31/libxml.h	(revision 39920)
+++ /trunk/src/libs/libxml2-2.6.31/libxml.h	(revision 39921)
@@ -13,4 +13,7 @@
 #ifndef _LARGEFILE_SOURCE
 #define _LARGEFILE_SOURCE
+#endif
+#ifndef _LARGEFILE64_SOURCE
+#define _LARGEFILE64_SOURCE
 #endif
 #ifndef _FILE_OFFSET_BITS
Index: /trunk/src/libs/libxml2-2.6.31/nanohttp.c
===================================================================
--- /trunk/src/libs/libxml2-2.6.31/nanohttp.c	(revision 39920)
+++ /trunk/src/libs/libxml2-2.6.31/nanohttp.c	(revision 39921)
@@ -1333,11 +1333,21 @@
 	blen += strlen(headers) + 2;
     if (contentType && *contentType)
+	/* reserve for string plus 'Content-Type: \r\n" */
 	blen += strlen(*contentType) + 16;
     if (ctxt->query != NULL)
+	/* 1 for '?' */
 	blen += strlen(ctxt->query) + 1;
     blen += strlen(method) + strlen(ctxt->path) + 24;
 #ifdef HAVE_ZLIB_H
+    /* reserve for possible 'Accept-Encoding: gzip' string */
     blen += 23;
 #endif
+    if (ctxt->port != 80) {
+	/* reserve space for ':xxxxx', incl. potential proxy */
+	if (proxy)
+	    blen += 12;
+	else
+	    blen += 6;
+    }
     bp = (char*)xmlMallocAtomic(blen);
     if ( bp == NULL ) {
Index: /trunk/src/libs/libxml2-2.6.31/parser.c
===================================================================
--- /trunk/src/libs/libxml2-2.6.31/parser.c	(revision 39920)
+++ /trunk/src/libs/libxml2-2.6.31/parser.c	(revision 39921)
@@ -80,4 +80,93 @@
 #include <zlib.h>
 #endif
+
+static void
+xmlFatalErr(xmlParserCtxtPtr ctxt, xmlParserErrors error, const char *info);
+
+/************************************************************************
+ *									*
+ *	Arbitrary limits set in the parser.				*
+ *									*
+ ************************************************************************/
+
+#define XML_PARSER_BIG_ENTITY 1000
+#define XML_PARSER_LOT_ENTITY 5000
+
+/*
+ * XML_PARSER_NON_LINEAR is the threshold where the ratio of parsed entity
+ *    replacement over the size in byte of the input indicates that you have
+ *    and eponential behaviour. A value of 10 correspond to at least 3 entity
+ *    replacement per byte of input.
+ */
+#define XML_PARSER_NON_LINEAR 10
+
+/*
+ * xmlParserEntityCheck
+ *
+ * Function to check non-linear entity expansion behaviour
+ * This is here to detect and stop exponential linear entity expansion
+ * This is not a limitation of the parser but a safety
+ * boundary feature.
+ */
+static int
+xmlParserEntityCheck(xmlParserCtxtPtr ctxt, unsigned long size,
+                     xmlEntityPtr ent)
+{
+    unsigned long consumed = 0;
+
+    if (ctxt == NULL)
+        return (0);
+    if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
+        return (1);
+    if (size != 0) {
+        /*
+         * Do the check based on the replacement size of the entity
+         */
+        if (size < XML_PARSER_BIG_ENTITY)
+	    return(0);
+
+        /*
+         * A limit on the amount of text data reasonably used
+         */
+        if (ctxt->input != NULL) {
+            consumed = ctxt->input->consumed +
+                (ctxt->input->cur - ctxt->input->base);
+        }
+        consumed += ctxt->sizeentities;
+
+        if ((size < XML_PARSER_NON_LINEAR * consumed) &&
+	    (ctxt->nbentities * 3 < XML_PARSER_NON_LINEAR * consumed))
+            return (0);
+    } else if (ent != NULL) {
+        /*
+         * use the number of parsed entities in the replacement
+         */
+        size = ent->owner;
+
+        /*
+         * The amount of data parsed counting entities size only once
+         */
+        if (ctxt->input != NULL) {
+            consumed = ctxt->input->consumed +
+                (ctxt->input->cur - ctxt->input->base);
+        }
+        consumed += ctxt->sizeentities;
+
+        /*
+         * Check the density of entities for the amount of data
+	 * knowing an entity reference will take at least 3 bytes
+         */
+        if (size * 3 < consumed * XML_PARSER_NON_LINEAR)
+            return (0);
+    } else {
+        /*
+         * strange we got no data for checking just return
+         */
+        return (0);
+    }
+
+    xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
+    return (1);
+}
 
 /**
@@ -2179,11 +2268,12 @@
  * Macro used to grow the current buffer.
  */
-#define growBuffer(buffer) {						\
-    xmlChar *tmp;							\
-    buffer##_size *= 2;							\
-    tmp = (xmlChar *)							\
-    		xmlRealloc(buffer, buffer##_size * sizeof(xmlChar));	\
-    if (tmp == NULL) goto mem_error;					\
-    buffer = tmp;							\
+#define growBuffer(buffer, n) {                                         \
+    xmlChar *tmp;                                                       \
+    buffer##_size *= 2;                                                 \
+    buffer##_size += n;                                                 \
+    tmp = (xmlChar *)                                                   \
+                xmlRealloc(buffer, buffer##_size * sizeof(xmlChar));    \
+    if (tmp == NULL) goto mem_error;                                    \
+    buffer = tmp;                                                       \
 }
 
@@ -2253,5 +2343,5 @@
 	    }
 	    if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
-	        growBuffer(buffer);
+	        growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
 	    }
 	} else if ((c == '&') && (what & XML_SUBSTITUTE_REF)) {
@@ -2261,4 +2351,8 @@
 			str);
 	    ent = xmlParseStringEntityRef(ctxt, &str);
+	    if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
+	        goto int_error;
+	    if (ent != NULL)
+	        ctxt->nbentities += ent->owner;
 	    if ((ent != NULL) &&
 		(ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
@@ -2266,5 +2360,5 @@
 		    COPY_BUF(0,buffer,nbchars,ent->content[0]);
 		    if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
-			growBuffer(buffer);
+			growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
 		    }
 		} else {
@@ -2285,5 +2379,9 @@
 			if (nbchars >
 		            buffer_size - XML_PARSER_BUFFER_SIZE) {
-			    growBuffer(buffer);
+			    if (xmlParserEntityCheck(ctxt, nbchars, ent)) {
+			        xmlFree(rep);
+			        goto int_error;
+			    }
+			    growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
 			}
 		    }
@@ -2296,5 +2394,5 @@
 		buffer[nbchars++] = '&';
 		if (nbchars > buffer_size - i - XML_PARSER_BUFFER_SIZE) {
-		    growBuffer(buffer);
+		    growBuffer(buffer, i + XML_PARSER_BUFFER_SIZE);
 		}
 		for (;i > 0;i--)
@@ -2307,4 +2405,8 @@
 			"String decoding PE Reference: %.30s\n", str);
 	    ent = xmlParseStringPEReference(ctxt, &str);
+	    if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
+	        goto int_error;
+	    if (ent != NULL)
+	        ctxt->nbentities += ent->owner;
 	    if (ent != NULL) {
 		xmlChar *rep;
@@ -2320,5 +2422,9 @@
 			if (nbchars >
 		            buffer_size - XML_PARSER_BUFFER_SIZE) {
-			    growBuffer(buffer);
+			    if (xmlParserEntityCheck(ctxt, nbchars, ent)) {
+			        xmlFree(rep);
+			        goto int_error;
+			    }
+			    growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
 			}
 		    }
@@ -2330,5 +2436,5 @@
 	    str += l;
 	    if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
-	      growBuffer(buffer);
+	      growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
 	    }
 	}
@@ -2343,4 +2449,7 @@
 mem_error:
     xmlErrMemory(ctxt, NULL);
+int_error:
+    if (buffer != NULL)
+        xmlFree(buffer);
     return(NULL);
 }
@@ -3127,5 +3236,5 @@
 		    if (ctxt->replaceEntities) {
 			if (len > buf_size - 10) {
-			    growBuffer(buf);
+			    growBuffer(buf, 10);
 			}
 			buf[len++] = '&';
@@ -3136,5 +3245,5 @@
 			 */
 			if (len > buf_size - 10) {
-			    growBuffer(buf);
+			    growBuffer(buf, 10);
 			}
 			buf[len++] = '&';
@@ -3146,5 +3255,5 @@
 		} else {
 		    if (len > buf_size - 10) {
-			growBuffer(buf);
+			growBuffer(buf, 10);
 		    }
 		    len += xmlCopyChar(0, &buf[len], val);
@@ -3152,8 +3261,11 @@
 	    } else {
 		ent = xmlParseEntityRef(ctxt);
+		ctxt->nbentities++;
+		if (ent != NULL)
+		    ctxt->nbentities += ent->owner;
 		if ((ent != NULL) &&
 		    (ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
 		    if (len > buf_size - 10) {
-			growBuffer(buf);
+			growBuffer(buf, 10);
 		    }
 		    if ((ctxt->replaceEntities == 0) &&
@@ -3180,5 +3292,5 @@
 				buf[len++] = *current++;
 				if (len > buf_size - 10) {
-				    growBuffer(buf);
+				    growBuffer(buf, 10);
 				}
 			    }
@@ -3187,5 +3299,5 @@
 		    } else {
 			if (len > buf_size - 10) {
-			    growBuffer(buf);
+			    growBuffer(buf, 10);
 			}
 			if (ent->content != NULL)
@@ -3213,6 +3325,6 @@
 		     */
 		    buf[len++] = '&';
-		    if (len > buf_size - i - 10) {
-			growBuffer(buf);
+		    while (len > buf_size - i - 10) {
+			growBuffer(buf, i + 10);
 		    }
 		    for (;i > 0;i--)
@@ -3227,5 +3339,5 @@
 			COPY_BUF(l,buf,len,0x20);
 			if (len > buf_size - 10) {
-			    growBuffer(buf);
+			    growBuffer(buf, 10);
 			}
 		    }
@@ -3236,5 +3348,5 @@
 		COPY_BUF(l,buf,len,c);
 		if (len > buf_size - 10) {
-		    growBuffer(buf);
+		    growBuffer(buf, 10);
 		}
 	    }
@@ -4251,5 +4363,6 @@
 		    ctxt->sax->processingInstruction(ctxt->userData,
 		                                     target, NULL);
-		ctxt->instate = state;
+		if (ctxt->instate != XML_PARSER_EOF)
+		    ctxt->instate = state;
 		return;
 	    }
@@ -4331,5 +4444,6 @@
 	    xmlFatalErr(ctxt, XML_ERR_PI_NOT_STARTED, NULL);
 	}
-	ctxt->instate = state;
+	if (ctxt->instate != XML_PARSER_EOF)
+	    ctxt->instate = state;
     }
 }
@@ -4434,4 +4548,5 @@
     xmlChar *orig = NULL;
     int skipped;
+    unsigned long oldnbent = ctxt->nbentities;
     
     /* GROW; done in the caller */
@@ -4643,4 +4758,9 @@
 	    }
             if (cur != NULL) {
+	        if ((cur->owner != 0) || (cur->children == NULL)) {
+		    cur->owner = ctxt->nbentities - oldnbent;
+		    if (cur->owner ==  0)
+		        cur->owner = 1;
+		}
 	        if (cur->orig != NULL)
 		    xmlFree(orig);
@@ -4753,8 +4873,12 @@
 	    xmlFatalErrMsg(ctxt, XML_ERR_NAME_REQUIRED,
 			   "Name expected in NOTATION declaration\n");
-	    return(ret);
+            xmlFreeEnumeration(ret);
+	    return(NULL);
 	}
 	cur = xmlCreateEnumeration(name);
-	if (cur == NULL) return(ret);
+	if (cur == NULL) {
+            xmlFreeEnumeration(ret);
+            return(NULL);
+        }
 	if (last == NULL) ret = last = cur;
 	else {
@@ -4766,7 +4890,6 @@
     if (RAW != ')') {
 	xmlFatalErr(ctxt, XML_ERR_NOTATION_NOT_FINISHED, NULL);
-	if ((last != NULL) && (last != ret))
-	    xmlFreeEnumeration(last);
-	return(ret);
+        xmlFreeEnumeration(ret);
+	return(NULL);
     }
     NEXT;
@@ -4809,5 +4932,8 @@
 	cur = xmlCreateEnumeration(name);
 	xmlFree(name);
-	if (cur == NULL) return(ret);
+	if (cur == NULL) {
+            xmlFreeEnumeration(ret);
+            return(NULL);
+        }
 	if (last == NULL) ret = last = cur;
 	else {
@@ -5207,4 +5333,10 @@
     xmlChar type = 0;
 
+    if (ctxt->depth > 128) {
+        xmlFatalErrMsgInt(ctxt, XML_ERR_ELEMCONTENT_NOT_FINISHED,
+                "xmlParseElementChildrenContentDecl : depth %d too deep\n",
+                          ctxt->depth);
+	return(NULL);
+    }
     SKIP_BLANKS;
     GROW;
@@ -5215,5 +5347,7 @@
 	NEXT;
 	SKIP_BLANKS;
+        ctxt->depth++;
         cur = ret = xmlParseElementChildrenContentDecl(ctxt, inputid);
+        ctxt->depth--;
 	SKIP_BLANKS;
 	GROW;
@@ -5345,5 +5479,7 @@
 	    NEXT;
 	    SKIP_BLANKS;
+            ctxt->depth++;
 	    last = xmlParseElementChildrenContentDecl(ctxt, inputid);
+            ctxt->depth--;
 	    SKIP_BLANKS;
 	} else {
@@ -6072,5 +6208,6 @@
 			    ent->children = list;
 			    ent->last = list;
-			    ent->owner = 1;
+			    if (ent->owner == 0)
+				ent->owner = 1;
 			    list->parent = (xmlNodePtr) ent;
 			} else {
@@ -6081,4 +6218,5 @@
 		    }
 		} else {
+		    unsigned long oldnbent = ctxt->nbentities;
 		    /*
 		     * 4.3.2: An internal general parsed entity is well-formed
@@ -6103,4 +6241,5 @@
 					   value, user_data, &list);
 			ctxt->depth--;
+
 		    } else if (ent->etype ==
 			       XML_EXTERNAL_GENERAL_PARSED_ENTITY) {
@@ -6114,4 +6253,22 @@
 			xmlErrMsgStr(ctxt, XML_ERR_INTERNAL_ERROR,
 				     "invalid entity type found\n", NULL);
+		    }
+		    /*
+		     * Store the number of entities needing parsing for entity
+		     * content and do checkings
+		     */
+		    if ((ent->owner != 0) || (ent->children == NULL)) {
+			ent->owner = ctxt->nbentities - oldnbent;
+			if (ent->owner == 0)
+			    ent->owner = 1;
+		    }
+		    if (ret == XML_ERR_ENTITY_LOOP) {
+			xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
+			xmlFreeNodeList(list);
+			return;
+		    }
+		    if (xmlParserEntityCheck(ctxt, 0, ent)) {
+			xmlFreeNodeList(list);
+			return;
 		    }
 		    if (ret == XML_ERR_ENTITY_LOOP) {
@@ -6133,5 +6290,6 @@
 				    list->parent = (xmlNodePtr) ent;
 				    list = NULL;
-				    ent->owner = 1;
+				    if (ent->owner == 0)
+					ent->owner = 1;
 				} else {
 				    ent->owner = 0;
@@ -6150,5 +6308,6 @@
 				}
 			    } else {
-				ent->owner = 1;
+			        if (ent->owner == 0)
+				    ent->owner = 1;
 				while (list != NULL) {
 				    list->parent = (xmlNodePtr) ent;
@@ -6169,4 +6328,6 @@
 			xmlFreeNodeList(list);
 			list = NULL;
+		    } else if (ent->owner != 1) {
+			ctxt->nbentities += ent->owner;
 		    }
 		}
@@ -6327,5 +6488,6 @@
 			    cur = next;
 			}
-			ent->owner = 1;
+			if (ent->owner == 0)
+			    ent->owner = 1;
 #ifdef LIBXML_LEGACY_ENABLED
 			if (ent->etype == XML_EXTERNAL_GENERAL_PARSED_ENTITY)			      
@@ -6416,4 +6578,9 @@
 	    if (RAW == ';') {
 	        NEXT;
+		/*
+		 * Increase the number of entity references parsed
+		 */
+		ctxt->nbentities++;
+
 		/*
 		 * Ask first SAX for entity resolution, otherwise try the
@@ -6588,4 +6755,8 @@
 	        ptr++;
 		/*
+		 * Increase the number of entity references parsed
+		 */
+		ctxt->nbentities++;
+		/*
 		 * Ask first SAX for entity resolution, otherwise try the
 		 * predefined set.
@@ -6749,4 +6920,9 @@
             if (RAW == ';') {
                 NEXT;
+		/*
+		 * Increase the number of entity references parsed
+		 */
+		ctxt->nbentities++;
+
                 if ((ctxt->sax != NULL) &&
                     (ctxt->sax->getParameterEntity != NULL))
@@ -6879,4 +7055,9 @@
 		ptr++;
 		cur = *ptr;
+		/*
+		 * Increase the number of entity references parsed
+		 */
+		ctxt->nbentities++;
+
 		if ((ctxt->sax != NULL) &&
 		    (ctxt->sax->getParameterEntity != NULL))
@@ -8610,4 +8791,6 @@
 	name = xmlParseStartTag(ctxt);
 #endif /* LIBXML_SAX1_ENABLED */
+    if (ctxt->instate == XML_PARSER_EOF)
+	return;
     if (name == NULL) {
 	spacePop(ctxt);
@@ -9932,4 +10115,6 @@
 		    name = xmlParseStartTag(ctxt);
 #endif /* LIBXML_SAX1_ENABLED */
+		if (ctxt->instate == XML_PARSER_EOF)
+		    goto done;
 		if (name == NULL) {
 		    spacePop(ctxt);
@@ -10118,5 +10303,7 @@
 		    xmlParseEndTag1(ctxt, 0);
 #endif /* LIBXML_SAX1_ENABLED */
-		if (ctxt->nameNr == 0) {
+		if (ctxt->instate == XML_PARSER_EOF) {
+		    /* Nothing */
+		} else if (ctxt->nameNr == 0) {
 		    ctxt->instate = XML_PARSER_EPILOG;
 		} else {
@@ -11538,4 +11725,23 @@
 	ret = XML_ERR_OK;
     }
+
+    /*
+     * Record in the parent context the number of entities replacement
+     * done when parsing that reference.
+     */
+    oldctxt->nbentities += ctxt->nbentities;
+    /*
+     * Also record the size of the entity parsed
+     */
+    if (ctxt->input != NULL) {
+	oldctxt->sizeentities += ctxt->input->consumed;
+	oldctxt->sizeentities += (ctxt->input->cur - ctxt->input->base);
+    }
+    /*
+     * And record the last error if any
+     */
+    if (ctxt->lastError.code != XML_ERR_OK)
+        xmlCopyError(&ctxt->lastError, &oldctxt->lastError);
+
     if (sax != NULL) 
 	ctxt->sax = oldsax;
@@ -11543,4 +11749,5 @@
     oldctxt->node_seq.length = ctxt->node_seq.length;
     oldctxt->node_seq.buffer = ctxt->node_seq.buffer;
+    oldctxt->nbentities += ctxt->nbentities;
     ctxt->node_seq.maximum = 0;
     ctxt->node_seq.length = 0;
@@ -11767,4 +11974,15 @@
     }
 	
+    /*
+     * Record in the parent context the number of entities replacement
+     * done when parsing that reference.
+     */
+    oldctxt->nbentities += ctxt->nbentities;
+    /*
+     * Also record the last error if any
+     */
+    if (ctxt->lastError.code != XML_ERR_OK)
+        xmlCopyError(&ctxt->lastError, &oldctxt->lastError);
+
     ctxt->sax = oldsax;
     ctxt->dict = NULL;
@@ -13078,4 +13296,6 @@
     ctxt->charset = XML_CHAR_ENCODING_UTF8;
     ctxt->catalogs = NULL;
+    ctxt->nbentities = 0;
+    ctxt->sizeentities = 0;
     xmlInitNodeInfoSeq(&ctxt->node_seq);
 
Index: /trunk/src/libs/libxml2-2.6.31/parserInternals.c
===================================================================
--- /trunk/src/libs/libxml2-2.6.31/parserInternals.c	(revision 39920)
+++ /trunk/src/libs/libxml2-2.6.31/parserInternals.c	(revision 39921)
@@ -1400,5 +1400,6 @@
 	return(NULL);
     }
-    input->filename = (char *) entity->URI;
+    if (entity->URI != NULL)
+	input->filename = (char *) xmlStrdup((xmlChar *) entity->URI);
     input->base = entity->content;
     input->cur = entity->content;
@@ -1670,4 +1671,5 @@
     ctxt->charset = XML_CHAR_ENCODING_UTF8;
     ctxt->catalogs = NULL;
+    ctxt->nbentities = 0;
     xmlInitNodeInfoSeq(&ctxt->node_seq);
     return(0);
Index: /trunk/src/libs/libxml2-2.6.31/tree.c
===================================================================
--- /trunk/src/libs/libxml2-2.6.31/tree.c	(revision 39920)
+++ /trunk/src/libs/libxml2-2.6.31/tree.c	(revision 39921)
@@ -15,5 +15,5 @@
 
 #include <string.h> /* for memset() only ! */
-
+#include <limits.h>
 #ifdef HAVE_CTYPE_H
 #include <ctype.h>
@@ -6899,5 +6899,11 @@
 	/*take care of empty case*/
         newSize = (buf->size ? buf->size*2 : size + 10);
-        while (size > newSize) newSize *= 2;
+        while (size > newSize) {
+            if (newSize > UINT_MAX / 2) {
+                xmlTreeErrMemory("growing buffer");
+                return 0;
+            }
+            newSize *= 2;
+        }
         break;
     case XML_BUFFER_ALLOC_EXACT:
Index: /trunk/src/libs/libxml2-2.6.31/xmllint.c
===================================================================
--- /trunk/src/libs/libxml2-2.6.31/xmllint.c	(revision 39920)
+++ /trunk/src/libs/libxml2-2.6.31/xmllint.c	(revision 39921)
@@ -2835,5 +2835,5 @@
     printf("\t--noent : substitute entity references by their value\n");
     printf("\t--noout : don't output the result tree\n");
-    printf("\t--path 'paths': provide a set of paths for resources\n");
+    printf("\t--path 'paths' : provide a set of paths for resources\n");
     printf("\t--load-trace : print trace of all external entites loaded\n");
     printf("\t--nonet : refuse to fetch DTDs or entities over network\n");
@@ -2885,5 +2885,5 @@
     printf("\t             otherwise XML Catalogs starting from \n");
     printf("\t         %s are activated by default\n", XML_XML_DEFAULT_CATALOG);
-    printf("\t--nocatalogs: deactivate all catalogs\n");
+    printf("\t--nocatalogs : deactivate all catalogs\n");
 #endif
     printf("\t--auto : generate a small doc on the fly\n");
@@ -2910,7 +2910,7 @@
 #endif
 #ifdef LIBXML_SAX1_ENABLED
-    printf("\t--sax1: use the old SAX1 interfaces for processing\n");
-#endif
-    printf("\t--sax: do not build a tree but work just at the SAX level\n");
+    printf("\t--sax1 : use the old SAX1 interfaces for processing\n");
+#endif
+    printf("\t--sax : do not build a tree but work just at the SAX level\n");
 
     printf("\nLibxml project home page: http://xmlsoft.org/\n");
Index: /trunk/src/libs/libxml2-2.6.31/xpath.c
===================================================================
--- /trunk/src/libs/libxml2-2.6.31/xpath.c	(revision 39920)
+++ /trunk/src/libs/libxml2-2.6.31/xpath.c	(revision 39921)
@@ -2443,4 +2443,5 @@
         if (tmp == NULL) {
             xmlGenericError(xmlGenericErrorContext, "realloc failed !\n");
+            ctxt->error = XPATH_MEMORY_ERROR;
             return (0);
         }
@@ -3523,6 +3524,5 @@
         xmlNodePtr *temp;
 
-        cur->nodeMax *= 2;
-	temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
+	temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
 				      sizeof(xmlNodePtr));
 	if (temp == NULL) {
@@ -3530,4 +3530,5 @@
 	    return;
 	}
+        cur->nodeMax *= 2;
 	cur->nodeTab = temp;
     }
@@ -3628,6 +3629,5 @@
         xmlNodePtr *temp;
 
-        cur->nodeMax *= 2;
-	temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
+	temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
 				      sizeof(xmlNodePtr));
 	if (temp == NULL) {
@@ -3636,4 +3636,5 @@
 	}
 	cur->nodeTab = temp;
+        cur->nodeMax *= 2;
     }
     if (val->type == XML_NAMESPACE_DECL) {
@@ -3737,6 +3738,5 @@
 	    xmlNodePtr *temp;
 
-	    val1->nodeMax *= 2;
-	    temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax *
+	    temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax * 2 *
 					     sizeof(xmlNodePtr));
 	    if (temp == NULL) {
@@ -3745,4 +3745,5 @@
 	    }
 	    val1->nodeTab = temp;
+	    val1->nodeMax *= 2;
 	}
 	if (n2->type == XML_NAMESPACE_DECL) {
@@ -3902,7 +3903,6 @@
 		xmlNodePtr *temp;
 		
-		set1->nodeMax *= 2;
 		temp = (xmlNodePtr *) xmlRealloc(
-		    set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
+		    set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
 		if (temp == NULL) {
 		    xmlXPathErrMemory(NULL, "merging nodeset\n");
@@ -3910,4 +3910,5 @@
 		}
 		set1->nodeTab = temp;
+		set1->nodeMax *= 2;
 	    }
 	    if (n2->type == XML_NAMESPACE_DECL) {
@@ -3984,7 +3985,6 @@
 		xmlNodePtr *temp;
 		
-		set1->nodeMax *= 2;
 		temp = (xmlNodePtr *) xmlRealloc(
-		    set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
+		    set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
 		if (temp == NULL) {
 		    xmlXPathErrMemory(NULL, "merging nodeset\n");
@@ -3992,4 +3992,5 @@
 		}
 		set1->nodeTab = temp;
+		set1->nodeMax *= 2;
 	    }
 	    set1->nodeTab[set1->nodeNr++] = n2;
@@ -8088,7 +8089,15 @@
 xmlXPathNextFollowing(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
-    if (cur != NULL && cur->children != NULL)
-        return cur->children ;
-    if (cur == NULL) cur = ctxt->context->node;
+    if ((cur != NULL) && (cur->type  != XML_ATTRIBUTE_NODE) &&
+        (cur->type != XML_NAMESPACE_DECL) && (cur->children != NULL))
+        return(cur->children);
+
+    if (cur == NULL) {
+        cur = ctxt->context->node;
+        if (cur->type == XML_NAMESPACE_DECL)
+            return(NULL);
+        if (cur->type == XML_ATTRIBUTE_NODE)
+            cur = cur->parent;
+    }
     if (cur == NULL) return(NULL) ; /* ERROR */
     if (cur->next != NULL) return(cur->next) ;
@@ -8144,6 +8153,11 @@
 {
     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
-    if (cur == NULL)
+    if (cur == NULL) {
         cur = ctxt->context->node;
+        if (cur->type == XML_NAMESPACE_DECL)
+            return(NULL);
+        if (cur->type == XML_ATTRIBUTE_NODE)
+            return(cur->parent);
+    }
     if (cur == NULL)
 	return (NULL);
@@ -8189,6 +8203,6 @@
         if (cur == NULL)
             return (NULL);
-	if (cur->type == XML_NAMESPACE_DECL)
-	    cur = (xmlNodePtr)((xmlNsPtr)cur)->next;
+        if (cur->type == XML_NAMESPACE_DECL)
+            return (NULL);
         ctxt->ancestor = cur->parent;
     }
@@ -9258,4 +9272,5 @@
 		    xmlGenericError(xmlGenericErrorContext,
 			"xmlXPathTranslateFunction: Invalid UTF8 string\n");
+                    /* not asserting an XPath error is probably better */
 		    break;
 		}
@@ -9265,4 +9280,5 @@
 			xmlGenericError(xmlGenericErrorContext,
 			    "xmlXPathTranslateFunction: Invalid UTF8 string\n");
+                        /* not asserting an XPath error is probably better */
 			break;
 		    }
@@ -13302,4 +13318,5 @@
                                         "xmlXPathCompOpEval: variable %s bound to undefined prefix %s\n",
                                         op->value4, op->value5);
+                        ctxt->error = XPATH_UNDEF_PREFIX_ERROR;
                         return (total);
                     }
@@ -13350,4 +13367,5 @@
                                             "xmlXPathCompOpEval: function %s bound to undefined prefix %s\n",
                                             op->value4, op->value5);
+                            ctxt->error = XPATH_UNDEF_PREFIX_ERROR;
                             return (total);
                         }
@@ -13927,4 +13945,5 @@
     xmlGenericError(xmlGenericErrorContext,
                     "XPath: unknown precompiled operation %d\n", op->op);
+    ctxt->error = XPATH_INVALID_OPERAND;
     return (total);
 }
