<div dir="ltr">This patch won't apply, probably because of the crazy encodings. Can you push the series to a branch?<div><br></div><div>Ross</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 15 June 2017 at 13:08, Andrej Valek <span dir="ltr"><<a href="mailto:andrej.valek@siemens.com" target="_blank">andrej.valek@siemens.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">Signed-off-by: Andrej Valek <<a href="mailto:andrej.valek@siemens.com">andrej.valek@siemens.com</a>><br>
---<br>
...ibxml2-fix_and_simplify_<wbr>xmlParseStartTag2.patch | 590 +++++++++++++++++++++<br>
meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" rel="noreferrer" target="_blank">libxm<wbr>l2_2.9.4.bb</a> | 1 +<br>
2 files changed, 591 insertions(+)<br>
create mode 100644 meta/recipes-core/libxml/<wbr>libxml2/libxml2-fix_and_<wbr>simplify_xmlParseStartTag2.<wbr>patch<br>
<br>
diff --git a/meta/recipes-core/libxml/<wbr>libxml2/libxml2-fix_and_<wbr>simplify_xmlParseStartTag2.<wbr>patch b/meta/recipes-core/libxml/<wbr>libxml2/libxml2-fix_and_<wbr>simplify_xmlParseStartTag2.<wbr>patch<br>
new file mode 100644<br>
</span>index 0000000..faa5770<br>
<div class="HOEnZb"><div class="h5">--- /dev/null<br>
+++ b/meta/recipes-core/libxml/<wbr>libxml2/libxml2-fix_and_<wbr>simplify_xmlParseStartTag2.<wbr>patch<br>
@@ -0,0 +1,590 @@<br>
+libxml2-2.9.4: Avoid reparsing and simplify control flow in xmlParseStartTag2<br>
+<br>
+[No upstream tracking]<br>
+<br>
+parser: Avoid reparsing in xmlParseStartTag2<br>
+<br>
+The code in xmlParseStartTag2 must handle the case that the input<br>
+buffer was grown and reallocated which can invalidate pointers to<br>
+attribute values. Before, this was handled by detecting changes of<br>
+the input buffer "base" pointer and, in case of a change, jumping<br>
+back to the beginning of the function and reparsing the start tag.<br>
+<br>
+The major problem of this approach is that whether an input buffer is<br>
+reallocated is nondeterministic, resulting in seemingly random test<br>
+failures. See the mailing list thread "runtest mystery bug: name2.xml<br>
+error case regression test" from 2012, for example.<br>
+<br>
+If a reallocation was detected, the code also made no attempts to<br>
+continue parsing in case of errors which makes a difference in<br>
+the lax "recover" mode.<br>
+<br>
+Now we store the current input buffer "base" pointer for each (not<br>
+separately allocated) attribute in the namespace URI field, which isn't<br>
+used until later. After the whole start tag was parsed, the pointers to<br>
+the attribute values are reconstructed using the offset between the<br>
+new and the old input buffer. This relies on arithmetic on dangling<br>
+pointers which is technically undefined behavior. But it seems like<br>
+the easiest and most efficient fix and a similar approach is used in<br>
+xmlParserInputGrow.<br>
+<br>
+This changes the error output of several tests, typically making it<br>
+more verbose because we try harder to continue parsing in case of errors.<br>
+<br>
+(Another possible solution is to check not only the "base" pointer<br>
+but the size of the input buffer as well. But this would result in<br>
+even more reparsing.)<br>
+<br>
+Remove some goto labels and deduplicate a bit of code after handling<br>
+namespaces.<br>
+<br>
+There were two bugs where parameter-entity references could lead to an<br>
+unexpected change of the input buffer in xmlParseNameComplex and<br>
+xmlDictLookup being called with an invalid pointer.<br>
+<br>
+<br>
+Upstream-Status: Backport<br>
</div></div><div class="HOEnZb"><div class="h5">+ - [<a href="https://git.gnome.org/browse/libxml2/commit/?id=07b7428b69c368611d215a140fe630b2d1e61349" rel="noreferrer" target="_blank">https://git.gnome.org/browse/<wbr>libxml2/commit/?id=<wbr>07b7428b69c368611d215a140fe630<wbr>b2d1e61349</a>]<br>
+ - [<a href="https://git.gnome.org/browse/libxml2/commit/?id=855c19efb7cd30d927d673b3658563c4959ca6f0" rel="noreferrer" target="_blank">https://git.gnome.org/browse/<wbr>libxml2/commit/?id=<wbr>855c19efb7cd30d927d673b3658563<wbr>c4959ca6f0</a>]<br>
+Signed-off-by: Andrej Valek <<a href="mailto:andrej.valek@siemens.com">andrej.valek@siemens.com</a>><br>
+<br>
+diff --git a/parser.c b/parser.c<br>
+index 609a270..74016e3 100644<br>
+--- a/parser.c<br>
++++ b/parser.c<br>
+@@ -43,6 +43,7 @@<br>
+ #include <limits.h><br>
+ #include <string.h><br>
+ #include <stdarg.h><br>
++#include <stddef.h><br>
+ #include <libxml/xmlmemory.h><br>
+ #include <libxml/threads.h><br>
+ #include <libxml/globals.h><br>
+@@ -9377,8 +9378,7 @@ xmlParseStartTag2(<wbr>xmlParserCtxtPtr ctxt, const xmlChar **pref,<br>
+ const xmlChar **atts = ctxt->atts;<br>
+ int maxatts = ctxt->maxatts;<br>
+ int nratts, nbatts, nbdef;<br>
+- int i, j, nbNs, attval, oldline, oldcol, inputNr;<br>
+- const xmlChar *base;<br>
++ int i, j, nbNs, attval;<br>
+ unsigned long cur;<br>
+ int nsNr = ctxt->nsNr;<br>
+<br>
+@@ -9392,13 +9392,8 @@ xmlParseStartTag2(<wbr>xmlParserCtxtPtr ctxt, const xmlChar **pref,<br>
+ * The Shrinking is only possible once the full set of attribute<br>
+ * callbacks have been done.<br>
+ */<br>
+-reparse:<br>
+ SHRINK;<br>
+- base = ctxt->input->base;<br>
+ cur = ctxt->input->cur - ctxt->input->base;<br>
+- inputNr = ctxt->inputNr;<br>
+- oldline = ctxt->input->line;<br>
+- oldcol = ctxt->input->col;<br>
+ nbatts = 0;<br>
+ nratts = 0;<br>
+ nbdef = 0;<br>
+@@ -9422,8 +9417,6 @@ reparse:<br>
+ */<br>
+ SKIP_BLANKS;<br>
+ GROW;<br>
+- if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))<br>
+- goto base_changed;<br>
+<br>
+ while (((RAW != '>') &&<br>
+ ((RAW != '/') || (NXT(1) != '>')) &&<br>
+@@ -9434,203 +9427,174 @@ reparse:<br>
+<br>
+ attname = xmlParseAttribute2(ctxt, prefix, localname,<br>
+ &aprefix, &attvalue, &len, &alloc);<br>
+- if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr)) {<br>
+- if ((attvalue != NULL) && (alloc != 0))<br>
+- xmlFree(attvalue);<br>
+- attvalue = NULL;<br>
+- goto base_changed;<br>
+- }<br>
+- if ((attname != NULL) && (attvalue != NULL)) {<br>
+- if (len < 0) len = xmlStrlen(attvalue);<br>
+- if ((attname == ctxt->str_xmlns) && (aprefix == NULL)) {<br>
+- const xmlChar *URL = xmlDictLookup(ctxt->dict, attvalue, len);<br>
+- xmlURIPtr uri;<br>
+-<br>
+- if (URL == NULL) {<br>
+- xmlErrMemory(ctxt, "dictionary allocation failure");<br>
+- if ((attvalue != NULL) && (alloc != 0))<br>
+- xmlFree(attvalue);<br>
+- return(NULL);<br>
+- }<br>
+- if (*URL != 0) {<br>
+- uri = xmlParseURI((const char *) URL);<br>
+- if (uri == NULL) {<br>
+- xmlNsErr(ctxt, XML_WAR_NS_URI,<br>
+- "xmlns: '%s' is not a valid URI\n",<br>
+- URL, NULL, NULL);<br>
+- } else {<br>
+- if (uri->scheme == NULL) {<br>
+- xmlNsWarn(ctxt, XML_WAR_NS_URI_RELATIVE,<br>
+- "xmlns: URI %s is not absolute\n",<br>
+- URL, NULL, NULL);<br>
+- }<br>
+- xmlFreeURI(uri);<br>
+- }<br>
+- if (URL == ctxt->str_xml_ns) {<br>
+- if (attname != ctxt->str_xml) {<br>
+- xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,<br>
+- "xml namespace URI cannot be the default namespace\n",<br>
+- NULL, NULL, NULL);<br>
+- }<br>
+- goto skip_default_ns;<br>
+- }<br>
+- if ((len == 29) &&<br>
+- (xmlStrEqual(URL,<br>
+- BAD_CAST "<a href="http://www.w3.org/2000/xmlns/" rel="noreferrer" target="_blank">http://www.w3.org/2000/xmlns/</a><wbr>"))) {<br>
+- xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,<br>
+- "reuse of the xmlns namespace name is forbidden\n",<br>
+- NULL, NULL, NULL);<br>
+- goto skip_default_ns;<br>
+- }<br>
+- }<br>
+- /*<br>
+- * check that it's not a defined namespace<br>
+- */<br>
+- for (j = 1;j <= nbNs;j++)<br>
+- if (ctxt->nsTab[ctxt->nsNr - 2 * j] == NULL)<br>
+- break;<br>
+- if (j <= nbNs)<br>
+- xmlErrAttributeDup(ctxt, NULL, attname);<br>
+- else<br>
+- if (nsPush(ctxt, NULL, URL) > 0) nbNs++;<br>
+-skip_default_ns:<br>
+- if ((attvalue != NULL) && (alloc != 0)) {<br>
+- xmlFree(attvalue);<br>
+- attvalue = NULL;<br>
+- }<br>
+- if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))<br>
+- break;<br>
+- if (!IS_BLANK_CH(RAW)) {<br>
+- xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,<br>
+- "attributes construct error\n");<br>
+- break;<br>
+- }<br>
+- SKIP_BLANKS;<br>
+- if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))<br>
+- goto base_changed;<br>
+- continue;<br>
+- }<br>
+- if (aprefix == ctxt->str_xmlns) {<br>
+- const xmlChar *URL = xmlDictLookup(ctxt->dict, attvalue, len);<br>
+- xmlURIPtr uri;<br>
+-<br>
+- if (attname == ctxt->str_xml) {<br>
+- if (URL != ctxt->str_xml_ns) {<br>
+- xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,<br>
+- "xml namespace prefix mapped to wrong URI\n",<br>
+- NULL, NULL, NULL);<br>
+- }<br>
+- /*<br>
+- * Do not keep a namespace definition node<br>
+- */<br>
+- goto skip_ns;<br>
+- }<br>
++ if ((attname == NULL) || (attvalue == NULL))<br>
++ goto next_attr;<br>
++ if (len < 0) len = xmlStrlen(attvalue);<br>
++<br>
++ if ((attname == ctxt->str_xmlns) && (aprefix == NULL)) {<br>
++ const xmlChar *URL = xmlDictLookup(ctxt->dict, attvalue, len);<br>
++ xmlURIPtr uri;<br>
++<br>
++ if (URL == NULL) {<br>
++ xmlErrMemory(ctxt, "dictionary allocation failure");<br>
++ if ((attvalue != NULL) && (alloc != 0))<br>
++ xmlFree(attvalue);<br>
++ return(NULL);<br>
++ }<br>
++ if (*URL != 0) {<br>
++ uri = xmlParseURI((const char *) URL);<br>
++ if (uri == NULL) {<br>
++ xmlNsErr(ctxt, XML_WAR_NS_URI,<br>
++ "xmlns: '%s' is not a valid URI\n",<br>
++ URL, NULL, NULL);<br>
++ } else {<br>
++ if (uri->scheme == NULL) {<br>
++ xmlNsWarn(ctxt, XML_WAR_NS_URI_RELATIVE,<br>
++ "xmlns: URI %s is not absolute\n",<br>
++ URL, NULL, NULL);<br>
++ }<br>
++ xmlFreeURI(uri);<br>
++ }<br>
+ if (URL == ctxt->str_xml_ns) {<br>
+- if (attname != ctxt->str_xml) {<br>
+- xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,<br>
+- "xml namespace URI mapped to wrong prefix\n",<br>
+- NULL, NULL, NULL);<br>
+- }<br>
+- goto skip_ns;<br>
+- }<br>
+- if (attname == ctxt->str_xmlns) {<br>
+- xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,<br>
+- "redefinition of the xmlns prefix is forbidden\n",<br>
+- NULL, NULL, NULL);<br>
+- goto skip_ns;<br>
+- }<br>
+- if ((len == 29) &&<br>
+- (xmlStrEqual(URL,<br>
+- BAD_CAST "<a href="http://www.w3.org/2000/xmlns/" rel="noreferrer" target="_blank">http://www.w3.org/2000/xmlns/</a><wbr>"))) {<br>
+- xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,<br>
+- "reuse of the xmlns namespace name is forbidden\n",<br>
+- NULL, NULL, NULL);<br>
+- goto skip_ns;<br>
+- }<br>
+- if ((URL == NULL) || (URL[0] == 0)) {<br>
+- xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,<br>
+- "xmlns:%s: Empty XML namespace is not allowed\n",<br>
+- attname, NULL, NULL);<br>
+- goto skip_ns;<br>
+- } else {<br>
+- uri = xmlParseURI((const char *) URL);<br>
+- if (uri == NULL) {<br>
+- xmlNsErr(ctxt, XML_WAR_NS_URI,<br>
+- "xmlns:%s: '%s' is not a valid URI\n",<br>
+- attname, URL, NULL);<br>
+- } else {<br>
+- if ((ctxt->pedantic) && (uri->scheme == NULL)) {<br>
+- xmlNsWarn(ctxt, XML_WAR_NS_URI_RELATIVE,<br>
+- "xmlns:%s: URI %s is not absolute\n",<br>
+- attname, URL, NULL);<br>
+- }<br>
+- xmlFreeURI(uri);<br>
+- }<br>
+- }<br>
+-<br>
+- /*<br>
+- * check that it's not a defined namespace<br>
+- */<br>
+- for (j = 1;j <= nbNs;j++)<br>
+- if (ctxt->nsTab[ctxt->nsNr - 2 * j] == attname)<br>
+- break;<br>
+- if (j <= nbNs)<br>
+- xmlErrAttributeDup(ctxt, aprefix, attname);<br>
+- else<br>
+- if (nsPush(ctxt, attname, URL) > 0) nbNs++;<br>
+-skip_ns:<br>
+- if ((attvalue != NULL) && (alloc != 0)) {<br>
+- xmlFree(attvalue);<br>
+- attvalue = NULL;<br>
+- }<br>
+- if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))<br>
+- break;<br>
+- if (!IS_BLANK_CH(RAW)) {<br>
+- xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED,<br>
+- "attributes construct error\n");<br>
+- break;<br>
+- }<br>
+- SKIP_BLANKS;<br>
+- if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))<br>
+- goto base_changed;<br>
+- continue;<br>
+- }<br>
++ if (attname != ctxt->str_xml) {<br>
++ xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,<br>
++ "xml namespace URI cannot be the default namespace\n",<br>
++ NULL, NULL, NULL);<br>
++ }<br>
++ goto next_attr;<br>
++ }<br>
++ if ((len == 29) &&<br>
++ (xmlStrEqual(URL,<br>
++ BAD_CAST "<a href="http://www.w3.org/2000/xmlns/" rel="noreferrer" target="_blank">http://www.w3.org/2000/xmlns/</a><wbr>"))) {<br>
++ xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,<br>
++ "reuse of the xmlns namespace name is forbidden\n",<br>
++ NULL, NULL, NULL);<br>
++ goto next_attr;<br>
++ }<br>
++ }<br>
++ /*<br>
++ * check that it's not a defined namespace<br>
++ */<br>
++ for (j = 1;j <= nbNs;j++)<br>
++ if (ctxt->nsTab[ctxt->nsNr - 2 * j] == NULL)<br>
++ break;<br>
++ if (j <= nbNs)<br>
++ xmlErrAttributeDup(ctxt, NULL, attname);<br>
++ else<br>
++ if (nsPush(ctxt, NULL, URL) > 0) nbNs++;<br>
++<br>
++ } else if (aprefix == ctxt->str_xmlns) {<br>
++ const xmlChar *URL = xmlDictLookup(ctxt->dict, attvalue, len);<br>
++ xmlURIPtr uri;<br>
++<br>
++ if (attname == ctxt->str_xml) {<br>
++ if (URL != ctxt->str_xml_ns) {<br>
++ xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,<br>
++ "xml namespace prefix mapped to wrong URI\n",<br>
++ NULL, NULL, NULL);<br>
++ }<br>
++ /*<br>
++ * Do not keep a namespace definition node<br>
++ */<br>
++ goto next_attr;<br>
++ }<br>
++ if (URL == ctxt->str_xml_ns) {<br>
++ if (attname != ctxt->str_xml) {<br>
++ xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,<br>
++ "xml namespace URI mapped to wrong prefix\n",<br>
++ NULL, NULL, NULL);<br>
++ }<br>
++ goto next_attr;<br>
++ }<br>
++ if (attname == ctxt->str_xmlns) {<br>
++ xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,<br>
++ "redefinition of the xmlns prefix is forbidden\n",<br>
++ NULL, NULL, NULL);<br>
++ goto next_attr;<br>
++ }<br>
++ if ((len == 29) &&<br>
++ (xmlStrEqual(URL,<br>
++ BAD_CAST "<a href="http://www.w3.org/2000/xmlns/" rel="noreferrer" target="_blank">http://www.w3.org/2000/xmlns/</a><wbr>"))) {<br>
++ xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,<br>
++ "reuse of the xmlns namespace name is forbidden\n",<br>
++ NULL, NULL, NULL);<br>
++ goto next_attr;<br>
++ }<br>
++ if ((URL == NULL) || (URL[0] == 0)) {<br>
++ xmlNsErr(ctxt, XML_NS_ERR_XML_NAMESPACE,<br>
++ "xmlns:%s: Empty XML namespace is not allowed\n",<br>
++ attname, NULL, NULL);<br>
++ goto next_attr;<br>
++ } else {<br>
++ uri = xmlParseURI((const char *) URL);<br>
++ if (uri == NULL) {<br>
++ xmlNsErr(ctxt, XML_WAR_NS_URI,<br>
++ "xmlns:%s: '%s' is not a valid URI\n",<br>
++ attname, URL, NULL);<br>
++ } else {<br>
++ if ((ctxt->pedantic) && (uri->scheme == NULL)) {<br>
++ xmlNsWarn(ctxt, XML_WAR_NS_URI_RELATIVE,<br>
++ "xmlns:%s: URI %s is not absolute\n",<br>
++ attname, URL, NULL);<br>
++ }<br>
++ xmlFreeURI(uri);<br>
++ }<br>
++ }<br>
+<br>
+- /*<br>
+- * Add the pair to atts<br>
+- */<br>
+- if ((atts == NULL) || (nbatts + 5 > maxatts)) {<br>
+- if (xmlCtxtGrowAttrs(ctxt, nbatts + 5) < 0) {<br>
+- if (attvalue[len] == 0)<br>
+- xmlFree(attvalue);<br>
+- goto failed;<br>
+- }<br>
+- maxatts = ctxt->maxatts;<br>
+- atts = ctxt->atts;<br>
+- }<br>
+- ctxt->attallocs[nratts++] = alloc;<br>
+- atts[nbatts++] = attname;<br>
+- atts[nbatts++] = aprefix;<br>
+- atts[nbatts++] = NULL; /* the URI will be fetched later */<br>
+- atts[nbatts++] = attvalue;<br>
+- attvalue += len;<br>
+- atts[nbatts++] = attvalue;<br>
+- /*<br>
+- * tag if some deallocation is needed<br>
+- */<br>
+- if (alloc != 0) attval = 1;<br>
+- } else {<br>
+- if ((attvalue != NULL) && (attvalue[len] == 0))<br>
+- xmlFree(attvalue);<br>
+- }<br>
++ /*<br>
++ * check that it's not a defined namespace<br>
++ */<br>
++ for (j = 1;j <= nbNs;j++)<br>
++ if (ctxt->nsTab[ctxt->nsNr - 2 * j] == attname)<br>
++ break;<br>
++ if (j <= nbNs)<br>
++ xmlErrAttributeDup(ctxt, aprefix, attname);<br>
++ else<br>
++ if (nsPush(ctxt, attname, URL) > 0) nbNs++;<br>
++<br>
++ } else {<br>
++ /*<br>
++ * Add the pair to atts<br>
++ */<br>
++ if ((atts == NULL) || (nbatts + 5 > maxatts)) {<br>
++ if (xmlCtxtGrowAttrs(ctxt, nbatts + 5) < 0) {<br>
++ goto next_attr;<br>
++ }<br>
++ maxatts = ctxt->maxatts;<br>
++ atts = ctxt->atts;<br>
++ }<br>
++ ctxt->attallocs[nratts++] = alloc;<br>
++ atts[nbatts++] = attname;<br>
++ atts[nbatts++] = aprefix;<br>
++ /*<br>
++ * The namespace URI field is used temporarily to point at the<br>
++ * base of the current input buffer for non-alloced attributes.<br>
++ * When the input buffer is reallocated, all the pointers become<br>
++ * invalid, but they can be reconstructed later.<br>
++ */<br>
++ if (alloc)<br>
++ atts[nbatts++] = NULL;<br>
++ else<br>
++ atts[nbatts++] = ctxt->input->base;<br>
++ atts[nbatts++] = attvalue;<br>
++ attvalue += len;<br>
++ atts[nbatts++] = attvalue;<br>
++ /*<br>
++ * tag if some deallocation is needed<br>
++ */<br>
++ if (alloc != 0) attval = 1;<br>
++ attvalue = NULL; /* moved into atts */<br>
++ }<br>
+<br>
+-failed:<br>
++next_attr:<br>
++ if ((attvalue != NULL) && (alloc != 0)) {<br>
++ xmlFree(attvalue);<br>
++ attvalue = NULL;<br>
++ }<br>
+<br>
+ GROW<br>
+ if (ctxt->instate == XML_PARSER_EOF)<br>
+ break;<br>
+- if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))<br>
+- goto base_changed;<br>
+ if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))<br>
+ break;<br>
+ if (!IS_BLANK_CH(RAW)) {<br>
+@@ -9646,8 +9610,20 @@ failed:<br>
+ break;<br>
+ }<br>
+ GROW;<br>
+- if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))<br>
+- goto base_changed;<br>
++ }<br>
++<br>
++ /* Reconstruct attribute value pointers. */<br>
++ for (i = 0, j = 0; j < nratts; i += 5, j++) {<br>
++ if (atts[i+2] != NULL) {<br>
++ /*<br>
++ * Arithmetic on dangling pointers is technically undefined<br>
++ * behavior, but well...<br>
++ */<br>
++ ptrdiff_t offset = ctxt->input->base - atts[i+2];<br>
++ atts[i+2] = NULL; /* Reset repurposed namespace URI */<br>
++ atts[i+3] += offset; /* value */<br>
++ atts[i+4] += offset; /* valuend */<br>
++ }<br>
+ }<br>
+<br>
+ /*<br>
+@@ -9804,34 +9780,6 @@ failed:<br>
+ }<br>
+<br>
+ return(localname);<br>
+-<br>
+-base_changed:<br>
+- /*<br>
+- * the attribute strings are valid iif the base didn't changed<br>
+- */<br>
+- if (attval != 0) {<br>
+- for (i = 3,j = 0; j < nratts;i += 5,j++)<br>
+- if ((ctxt->attallocs[j] != 0) && (atts[i] != NULL))<br>
+- xmlFree((xmlChar *) atts[i]);<br>
+- }<br>
+-<br>
+- /*<br>
+- * We can't switch from one entity to another in the middle<br>
+- * of a start tag<br>
+- */<br>
+- if (inputNr != ctxt->inputNr) {<br>
+- xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,<br>
+- "Start tag doesn't start and stop in the same entity\n");<br>
+- return(NULL);<br>
+- }<br>
+-<br>
+- ctxt->input->cur = ctxt->input->base + cur;<br>
+- ctxt->input->line = oldline;<br>
+- ctxt->input->col = oldcol;<br>
+- if (ctxt->wellFormed == 1) {<br>
+- goto reparse;<br>
+- }<br>
+- return(NULL);<br>
+ }<br>
+<br>
+ /**<br>
+diff --git a/result/errors/759398.xml.err b/result/errors/759398.xml.err<br>
+index e08d9bf..f6036a3 100644<br>
+--- a/result/errors/759398.xml.err<br>
++++ b/result/errors/759398.xml.err<br>
+@@ -1,9 +1,12 @@<br>
+ ./test/errors/759398.xml:210: parser error : StartTag: invalid element name<br>
+ need to worry about parsers whi<! don't expand PErefs finding<br>
+ ^<br>
+-./test/errors/759398.xml:<wbr>309: parser error : Opening and ending tag mismatch: spec line 50 and termdef<br>
++./test/errors/759398.xml:<wbr>309: parser error : Opening and ending tag mismatch: №№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№!<br>
№№№<br>
№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>â!<br>
��№№â<br>
��№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>�„!<br>
�№№�„<br>
�№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№№№№№№№№№№№№<wbr>№№№№№№№№№№№№№№№№№№№m line 308 and termdef<br>
+ and provide access to their content and structure.</termdef> <termdef<br>
+ ^<br>
+-./test/errors/759398.xml:<wbr>309: parser error : Extra content at the end of the document<br>
+-and provide access to their content and structure.</termdef> <termdef<br>
+- ^<br>
++./test/errors/759398.xml:<wbr>314: parser error : Opening and ending tag mismatch: spec line 50 and p<br>
++data and the information it must provide to the application.</p><br>
++ ^<br>
++./test/errors/759398.xml:<wbr>316: parser error : Extra content at the end of the document<br>
++<div2 id='sec-origin-goals'><br>
++^<br>
+diff --git a/result/errors/attr1.xml.err b/result/errors/attr1.xml.err<br>
+index 4f08538..c4c4fc8 100644<br>
+--- a/result/errors/attr1.xml.err<br>
++++ b/result/errors/attr1.xml.err<br>
+@@ -1,6 +1,9 @@<br>
+ ./test/errors/attr1.xml:2: parser error : AttValue: ' expected<br>
+<br>
+ ^<br>
+-./test/errors/attr1.xml:1: parser error : Extra content at the end of the document<br>
+-<foo foo="<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooo<br>
+- ^<br>
++./test/errors/attr1.xml:2: parser error : attributes construct error<br>
++<br>
++^<br>
++./test/errors/attr1.xml:2: parser error : Couldn't find end of Start Tag foo line 1<br>
++<br>
++^<br>
+diff --git a/result/errors/attr2.xml.err b/result/errors/attr2.xml.err<br>
+index c8a9c7d..77e342e 100644<br>
+--- a/result/errors/attr2.xml.err<br>
++++ b/result/errors/attr2.xml.err<br>
+@@ -1,6 +1,9 @@<br>
+ ./test/errors/attr2.xml:2: parser error : AttValue: ' expected<br>
+<br>
+ ^<br>
+-./test/errors/attr2.xml:1: parser error : Extra content at the end of the document<br>
+-<foo foo="><wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>ooooooooo<br>
+- ^<br>
++./test/errors/attr2.xml:2: parser error : attributes construct error<br>
++<br>
++^<br>
++./test/errors/attr2.xml:2: parser error : Couldn't find end of Start Tag foo line 1<br>
++<br>
++^<br>
+diff --git a/result/errors/name2.xml.err b/result/errors/name2.xml.err<br>
+index a6649a1..8a6acee 100644<br>
+--- a/result/errors/name2.xml.err<br>
++++ b/result/errors/name2.xml.err<br>
+@@ -1,6 +1,9 @@<br>
+ ./test/errors/name2.xml:2: parser error : Specification mandate value for attribute fooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>ooo!<br>
ooooooooo<br>
oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooo!<br>
ooooooooo<br>
oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooo!<br>
ooooooooo<br>
oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooo!<br>
ooooooooo<br>
oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooo!<br>
ooooooooo<br>
oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>ooooooooooooooooooooo<br>
+<br>
+ ^<br>
+-./test/errors/name2.xml:1: parser error : Extra content at the end of the document<br>
+-<foo fooooooooooooooooooooooooooooo<wbr>oooooooooooooooooooooooooooooo<wbr>ooooooooooooooo<br>
+- ^<br>
++./test/errors/name2.xml:2: parser error : attributes construct error<br>
++<br>
++^<br>
++./test/errors/name2.xml:2: parser error : Couldn't find end of Start Tag foo line 1<br>
++<br>
++^<br>
diff --git a/meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" rel="noreferrer" target="_blank">lib<wbr>xml2_2.9.4.bb</a> b/meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" rel="noreferrer" target="_blank">lib<wbr>xml2_2.9.4.bb</a><br>
index 4f60781..0577ad6 100644<br>
--- a/meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" rel="noreferrer" target="_blank">lib<wbr>xml2_2.9.4.bb</a><br>
+++ b/meta/recipes-core/libxml/<a href="http://libxml2_2.9.4.bb" rel="noreferrer" target="_blank">lib<wbr>xml2_2.9.4.bb</a><br>
@@ -23,6 +23,7 @@ SRC_URI = "<a href="ftp://xmlsoft.org/libxml2/libxml2-${PV}.tar.gz;name=libtar" rel="noreferrer" target="_blank">ftp://xmlsoft.org/libxml2/<wbr>libxml2-${PV}.tar.gz;name=<wbr>libtar</a> \<br>
file://libxml2-CVE-2016-5131.<wbr>patch \<br>
file://libxml2-CVE-2016-4658.<wbr>patch \<br>
file://libxml2-fix_NULL_<wbr>pointer_derefs.patch \<br>
+ file://libxml2-fix_and_<wbr>simplify_xmlParseStartTag2.<wbr>patch \<br>
file://CVE-2016-9318.patch \<br>
file://0001-Make-ptest-run-<wbr>the-python-tests-if-python-is-<wbr>enabled.patch \<br>
"<br>
--<br>
2.1.4<br>
<br>
</div></div><br>--<br>
______________________________<wbr>_________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.<wbr>openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/<wbr>mailman/listinfo/openembedded-<wbr>core</a><br>
<br></blockquote></div><br></div>