leptris 1.9.201.4-arm-linux → 1.9.207.0-arm-linux

data/vendor-src/libleptris/src/include/leptris.h

@@ -44,7 +44,17 @@ extern "C" {
 #      define LEPTRIS_API
 #    endif
 #  else
-#    define LEPTRIS_API __attribute__((visibility("default"), used))
+     /* GCC LTO internalizes even visibility("default") symbols with
+      * no in-library caller (#1154/#1196/#1204 class: the CLI under
+      * -flto, ppc64le shared builds). `externally_visible` is the
+      * GCC-side partner of `used`; clang accepts and ignores it, so
+      * it is scoped to GCC to keep -Wall clean elsewhere. */
+#    if defined(__GNUC__) && !defined(__clang__)
+#      define LEPTRIS_API __attribute__((visibility("default"), used, \
+                                            externally_visible))
+#    else
+#      define LEPTRIS_API __attribute__((visibility("default"), used))
+#    endif
 #  endif
 #endif
 #endif  /* LEPTRIS_FOR_BINDGEN */
@@ -793,42 +803,7 @@ LEPTRIS_API LeptrisStatus leptris_document_set_root(LeptrisDocument doc,
  */
 LEPTRIS_API LeptrisDocument leptris_parse_string(const char* xml, size_t length, LeptrisStatus* status);
 
-/**
- * Parse an HTML string into a document (issue #659)
- *
- * Tolerant HTML4/5 parse into the standard DOM: implied end tags
- * (p/li/td/tr/th/dt/dd/option/...), void elements, raw-text
- * <script>/<style>, minimized + unquoted attribute values,
- * case-insensitive tag/attribute names, and the HTML named-entity
- * table. Behaviors follow libxml2's HTMLparser as exposed by
- * Nokogiri (fragment shape: no synthesized <html>/<head>/<body>,
- * no implied <tbody>). Malformed input never fails the parse — it
- * degrades to text; a document with no nodes at all is an error.
- * The result serializes and queries (XPath/XSLT) like any
- * libleptris document.
- *
- * @param html HTML input (must be valid UTF-8)
- * @param length Length of input in bytes
- * @param status Output status code (can be NULL)
- * @return Document handle or NULL on error
- *
- * Memory: Caller must call leptris_document_free() when done
- * Thread safety: Not thread-safe. One document per thread.
- */
-LEPTRIS_API LeptrisDocument leptris_parse_html_string(const char* html,
-                                                      size_t length,
-                                                      LeptrisStatus* status);
-
-/* HTML4/libxml2-compatibility mode (#659): identical tolerant
- * tokenizer and Nokogiri document shape, except leading
- * script/style content stays in <body> (libxml2's shape —
- * title/meta/link/base still lift into the implied head). Bindings
- * that must match Nokogiri byte-for-byte pin this entry;
- * leptris_parse_html_string is the WHATWG-conformant engine.
- * Memory contract identical to leptris_parse_html_string. */
-LEPTRIS_API LeptrisDocument leptris_parse_html4_string(const char* html,
-                                                       size_t length,
-                                                       LeptrisStatus* status);
+#include "leptris/html.h"
 
 /* ---- RELAX NG (#878) ------------------------------------------------
  * Phase 1: parse a RELAX NG XML-syntax schema into the compiled
@@ -1092,6 +1067,18 @@ LEPTRIS_API LeptrisStatus leptris_document_set_encoding(
 LEPTRIS_API LeptrisStatus leptris_document_set_standalone(
     LeptrisDocument doc, int standalone);
 
+/**
+ * Un-set the XML declaration (#1229): the document stops being
+ * declaration-bearing and serialization emits none — exactly as if
+ * the input had none. Clears the version/encoding strings and the
+ * standalone marker. Idempotent.
+ *
+ * @param doc Document handle
+ * @return LEPTRIS_OK, or LEPTRIS_ERROR_NULL_ARG
+ */
+LEPTRIS_API LeptrisStatus leptris_document_clear_declaration(
+    LeptrisDocument doc);
+
 /**
  * Programmatic DOCTYPE (#1094): create and set the document's
  * DOCTYPE (root name + optional PUBLIC/SYSTEM external
@@ -1105,6 +1092,19 @@ LEPTRIS_API LeptrisDoctype leptris_document_set_doctype(
     LeptrisDocument doc, const char* name,
     const char* public_id, const char* system_id);
 
+/**
+ * Un-set the document's DOCTYPE (#1229). The LeptrisDoctype node
+ * stays pool-owned and readable until leptris_document_free; it
+ * simply leaves the document children chain and the serializer's
+ * view. leptris_document_internal_subset returns NULL afterwards.
+ *
+ * @param doc Document handle
+ * @return LEPTRIS_OK; LEPTRIS_ERROR_NOT_FOUND when no DOCTYPE is
+ *         set; LEPTRIS_ERROR_NULL_ARG for a NULL document.
+ */
+LEPTRIS_API LeptrisStatus leptris_document_remove_doctype(
+    LeptrisDocument doc);
+
 /**
  * Get the document's internal DTD subset — the DOCTYPE declaration
  * (TODO 148 Phase 2).
@@ -3537,6 +3537,28 @@ LEPTRIS_API leptris_allocation_function leptris_get_memory_allocation_function(v
  */
 LEPTRIS_API leptris_deallocation_function leptris_get_memory_deallocation_function(void);
 
+/**
+ * Allocate a buffer from the engine's heap (#1219).
+ *
+ * FFI callers that must hand the engine a buffer it later frees —
+ * notably DTD parameter-entity loaders (leptris_dtd_set_pe_loader)
+ * — allocate through this entry so allocator/CRT mismatches cannot
+ * corrupt the heap (the engine DLL may link a different CRT than
+ * the host language runtime). Routes through the custom allocator
+ * when one is installed (leptris_set_memory_management_functions),
+ * malloc otherwise; the engine releases loader buffers through the
+ * matching deallocation path.
+ *
+ * @param len Bytes to allocate
+ * @return Buffer from the engine's heap (release with
+ *         `leptris_free_string`), or NULL when len is 0 or the
+ *         allocation fails
+ *
+ * Memory: Caller-owned unless handed to the engine (PE-loader
+ *         buffers are consumed and freed by the parser).
+ */
+LEPTRIS_API char* leptris_alloc_buffer(size_t len);
+
 /* ============================================================================
  * Per-Document Allocator Hooks (TODO 74)
  *

data/vendor-src/libleptris/src/leptris/core.c

@@ -96,6 +96,14 @@ LEPTRIS_API leptris_deallocation_function leptris_get_memory_deallocation_functi
     return g_leptris_dealloc_function;
 }
 
+/* #1219: engine-heap buffer for FFI callers whose buffers the
+ * engine later frees (DTD PE loaders). The hook pair keeps the
+ * custom-allocator configuration symmetric. */
+LEPTRIS_API char* leptris_alloc_buffer(size_t len) {
+    if (len == 0) return NULL;
+    return (char*)leptris_alloc_hook(len);
+}
+
 LEPTRIS_API LeptrisStatus leptris_document_set_allocators(
     LeptrisDocument doc,
     leptris_allocation_function alloc,
@@ -199,3 +207,23 @@ LEPTRIS_API LeptrisStatus leptris_document_set_standalone(
     doc->had_declaration = 1;
     return LEPTRIS_OK;
 }
+
+/* #1229: the remove-half — back to as-if-the-input-had-none. The
+ * setters' malloc'd strings are released here (document_free checks
+ * for NULL), and the standalone marker returns to unset. */
+LEPTRIS_API LeptrisStatus leptris_document_clear_declaration(
+    struct leptris_document* doc) {
+    if (!doc) return LEPTRIS_ERROR_NULL_ARG;
+    if (doc->xml_version) {
+        leptris_free(doc->xml_version);
+        doc->xml_version = NULL;
+    }
+    if (doc->encoding) {
+        leptris_free(doc->encoding);
+        doc->encoding = NULL;
+    }
+    doc->standalone = -1;
+    doc->decl_encoding_verbatim = 0;
+    doc->had_declaration = 0;
+    return LEPTRIS_OK;
+}

data/vendor-src/libleptris/src/leptris/dom/diag.h

@@ -17,20 +17,9 @@
 extern "C" {
 #endif
 
-typedef enum {
-    LEPTRIS_DIAG_INVALID = 0,
-    LEPTRIS_DIAG_NOT_ALLOWED_ANYWHERE,   /* name never valid in model */
-    LEPTRIS_DIAG_NOT_ALLOWED_HERE,       /* valid name, wrong position */
-    LEPTRIS_DIAG_NOT_ALLOWED_YET,        /* later; missing required first */
-    LEPTRIS_DIAG_INCOMPLETE,             /* content ends before required */
-    LEPTRIS_DIAG_MISSING_REQUIRED_ATTR,
-    LEPTRIS_DIAG_ATTR_NOT_ALLOWED,
-    LEPTRIS_DIAG_ATTR_VALUE_INVALID,
-    LEPTRIS_DIAG_CHAR_CONTENT_INVALID,   /* data/value/list mismatch */
-    LEPTRIS_DIAG_COUNT_
-} LeptrisDiagKind;
+/* LeptrisDiagKind lives in leptris/types.h (public, #1200). */
 
-typedef struct {
+typedef struct LeptrisDiag {
     LeptrisDiagKind kind;
     char* offender_name;          /* captured at emit time (strdup'd);
                                    * NULL when the diag has no offender.

data/vendor-src/libleptris/src/leptris/dom/digest.c

@@ -181,7 +181,11 @@ static uint64_t digest_element(LeptrisElement e, LeptrisDigestFlags flags) {
                 attrs[n].value_len = leptris_attr_value_sv(a).length;
                 n++;
             }
-            qsort(attrs, n, sizeof(DigestAttr), digest_attr_cmp);
+            /* ATTR_ORDER (#1200): document order is canonical — the
+             * walk above already collected in document order, so
+             * skip the sort and attribute order feeds the hash. */
+            if (!(flags & LEPTRIS_DIGEST_ATTR_ORDER))
+                qsort(attrs, n, sizeof(DigestAttr), digest_attr_cmp);
         }
         h = digest_mix_u64(h, n);
         for (size_t i = 0; i < n; i++) {

data/vendor-src/libleptris/src/leptris/dom/doctype.c

@@ -74,6 +74,33 @@ LEPTRIS_API LeptrisDoctype leptris_document_set_doctype(
     return (LeptrisDoctype)dt;
 }
 
+/* #1229: the remove-half of set_doctype. The node is pool-owned, so
+ * it is unlinked (document children chain, when linked) — never
+ * freed; it stays readable until leptris_document_free. */
+LEPTRIS_API LeptrisStatus leptris_document_remove_doctype(
+    LeptrisDocument doc) {
+    if (!doc) return LEPTRIS_ERROR_NULL_ARG;
+    LeptrisDoctypeNode* dt = (LeptrisDoctypeNode*)doc->doctype;
+    if (!dt) return LEPTRIS_ERROR_NOT_FOUND;
+    LeptrisNode* prev = NULL;
+    for (LeptrisNode* c = (LeptrisNode*)doc->doc_children_head; c; ) {
+        LeptrisNode* next = leptris_node_get_next_sibling(c);
+        if (c == (LeptrisNode*)dt) {
+            if (prev)
+                leptris_node_set_next_sibling(prev, next);
+            else
+                doc->doc_children_head = next;
+            if (doc->doc_children_tail == c)
+                doc->doc_children_tail = prev;
+            break;
+        }
+        prev = c;
+        c = next;
+    }
+    doc->doctype = NULL;
+    return LEPTRIS_OK;
+}
+
 LEPTRIS_API const char* leptris_doctype_get_name(LeptrisDoctypeNode* doctype) {
     return doctype ? doctype->name : NULL;
 }

data/vendor-src/libleptris/src/leptris/dom/element.c

@@ -687,19 +687,50 @@ const char* leptris_element_lookup_namespace(LeptrisElement elem,
 }
 
 /* Children manipulation */
-void leptris_element_append_child_internal_doc(LeptrisElement elem, LeptrisNode* child,
-                                              struct leptris_document* doc);
+void leptris_element_append_child_hint_doc(LeptrisElement elem,
+                                           LeptrisNode* child,
+                                           struct leptris_document* doc,
+                                           LeptrisNode* hint);
 void leptris_element_append_child_internal(LeptrisElement elem, LeptrisNode* child) {
     if (!elem || !child) return;
-    leptris_element_append_child_internal_doc(elem, child,
-                                             leptris_element_get_document(elem));
+    leptris_element_append_child_hint_doc(elem, child,
+                                          leptris_element_get_document(elem),
+                                          NULL);
+}
+
+/* #1225: caller-supplied tail hint. The HTML builder tracks each
+ * open element's last child itself — the shared direct-mapped
+ * tail cache loses a persistent parent to an address collision
+ * every ~1KB of fresh pool allocations, and each eviction costs
+ * an O(children) walk (quadratic on table/text-heavy pages). The
+ * hint is validated (parent back-pointer + no next sibling) and
+ * silently ignored when stale — callers stay correct through the
+ * cache/walk fallback. */
+void leptris_element_append_child_tail(LeptrisElement elem,
+                                       LeptrisNode* child,
+                                       struct leptris_document* doc,
+                                       LeptrisNode* hint) {
+    if (!elem || !child) return;
+    if (hint &&
+        (leptris_node_parent_inline(hint) != (LeptrisElement)elem ||
+         leptris_node_get_next_sibling(hint) != NULL))
+        hint = NULL;
+    leptris_element_append_child_hint_doc(elem, child, doc, hint);
 }
 
-/* doc is the caller-resolved document (NULL for detached trees) —
- * the public mutation path resolves it once instead of paying the
- * root walk + map lookup on every append (TODO 195c). */
 void leptris_element_append_child_internal_doc(LeptrisElement elem, LeptrisNode* child,
                                               struct leptris_document* doc) {
+    leptris_element_append_child_hint_doc(elem, child, doc, NULL);
+}
+
+/* doc is the caller-resolved document (NULL for detached trees) —
+ * the public mutation path resolves it once instead of paying the
+ * root walk + map lookup on every append (TODO 195c). hint is a
+ * pre-validated last-child hint (NULL = none). */
+void leptris_element_append_child_hint_doc(LeptrisElement elem,
+                                           LeptrisNode* child,
+                                           struct leptris_document* doc,
+                                           LeptrisNode* hint) {
     if (!elem || !child) return;
 
     /* SAFETY: Verify node type field is valid before accessing it
@@ -746,6 +777,12 @@ void leptris_element_append_child_internal_doc(LeptrisElement elem, LeptrisNode*
             mut_tail = s->child;
     }
 
+    /* An empty child list must win over any cached tail: a NULL
+     * first_child with a non-NULL tail is a stale cache (or stale
+     * tail pointer), and appending through it splices the child
+     * onto a detached node while first_child stays NULL (#1220). */
+    int list_empty = (leptris_elem_first_child(elem) == NULL);
+
     /* For element children, set up linked list structure */
     if (child->type == LEPTRIS_NODE_TYPE_ELEMENT) {
         LeptrisElement child_elem = (LeptrisElement)child;
@@ -757,7 +794,11 @@ void leptris_element_append_child_internal_doc(LeptrisElement elem, LeptrisNode*
         /* Append to end of children list.
          * last_child may point to any node type (text/comment/etc.) so
          * we set its next_sibling via the type-dispatching setter. */
-        LeptrisNode* last_node = mut_tail ? mut_tail : leptris_elem_last_child(elem);
+        LeptrisNode* last_node =
+            list_empty ? NULL
+                       : (hint ? hint
+                               : (mut_tail ? mut_tail
+                                           : leptris_elem_last_child(elem)));
         if (last_node) {
             /* Lane 18 P3: sequential appends' tail is an element —
              * the offset store directly; the type-dispatching node
@@ -776,7 +817,11 @@ void leptris_element_append_child_internal_doc(LeptrisElement elem, LeptrisNode*
         elem->child_count++;
     } else {
         /* For non-element children (text, cdata, comment, pi), append to linked list */
-        LeptrisNode* last = mut_tail ? mut_tail : leptris_elem_last_child(elem);
+        LeptrisNode* last =
+            list_empty ? NULL
+                       : (hint ? hint
+                               : (mut_tail ? mut_tail
+                                           : leptris_elem_last_child(elem)));
         if (last) {
             leptris_node_set_next_sibling(last, (LeptrisNode*)child);
             leptris_elem_set_last_child(elem, (LeptrisNode*)child);

data/vendor-src/libleptris/src/leptris/dom/element.h

@@ -1062,6 +1062,11 @@ const char* leptris_element_lookup_namespace(LeptrisElement elem,
 void leptris_element_append_child_internal(LeptrisElement elem, LeptrisNode* child);
 void leptris_element_append_child_internal_doc(LeptrisElement elem, LeptrisNode* child,
                                               struct leptris_document* doc);
+/* #1225: validated last-child hint skips the tail-cache/walk. */
+void leptris_element_append_child_tail(LeptrisElement elem,
+                                       LeptrisNode* child,
+                                       struct leptris_document* doc,
+                                       LeptrisNode* hint);
 void leptris_element_prepend_child_internal(LeptrisElement elem, LeptrisNode* child);
 
 /* Bulk allocation for subtree copy (10-15% faster for large subtrees) */

data/vendor-src/libleptris/src/leptris/dom/element_modify.c

@@ -51,7 +51,14 @@ static char* mut_name_carve(struct leptris_document* doc,
      * The store writes the full word — reserve it so the block-bound
      * check accounts for the write, never just the logical size. */
     if (name_len <= 8) need = sizeof(struct leptris_document*) + 9;
-    if (doc->mut_name_cursor + need > doc->mut_name_end) {
+    /* Keep every slot pointer-aligned: namebp reads the doc
+     * backpointer as ((struct leptris_document**)name)[-1]. The
+     * raw sizes above (17B for the S8 path) walk the cursor
+     * through every alignment mod 8 — misaligned pointer stores
+     * (UB, faults on alignment-strict targets). */
+    need = (need + sizeof(void*) - 1) & ~(sizeof(void*) - 1);
+    if (!doc->mut_name_cursor ||
+        doc->mut_name_cursor + need > doc->mut_name_end) {
         struct leptris_mut_name_block* blk =
             (struct leptris_mut_name_block*)malloc(
                 sizeof(struct leptris_mut_name_block) + MUT_NAME_BLOCK_BYTES);
@@ -107,7 +114,12 @@ static char* mut_str_carve(struct leptris_document* doc, const char* s,
                            size_t len) {
     if (len + 1 > MUT_NAME_BLOCK_BYTES / 4) return NULL;
     size_t need = 8 + len + 1;
-    if (doc->mut_name_cursor + need > doc->mut_name_end) {
+    /* Round the stride like mut_name_carve: this carve shares the
+     * name block's cursor, and an unrounded advance here misaligns
+     * every later namebp slot (doc backpointer stores). */
+    need = (need + sizeof(void*) - 1) & ~(sizeof(void*) - 1);
+    if (!doc->mut_name_cursor ||
+        doc->mut_name_cursor + need > doc->mut_name_end) {
         struct leptris_mut_name_block* blk =
             (struct leptris_mut_name_block*)malloc(
                 sizeof(struct leptris_mut_name_block) + MUT_NAME_BLOCK_BYTES);
@@ -536,11 +548,39 @@ LeptrisStatus leptris_element_remove_child(LeptrisElement parent, LeptrisElement
 LeptrisStatus leptris_element_remove_all_children(LeptrisElement elem) {
     if (!elem) return LEPTRIS_ERROR_NULL_ARG;
 
-    /* Walk through all children and clear parent references */
-    LeptrisElement child = leptris_element_get_first_child(elem);
+    /* Walk EVERY child. The element-filtered getters skip text and
+     * other non-element nodes, which left their parent backpointers
+     * dangling; a later append then validated a stale mutation-tail
+     * entry against the detached child and spliced the new subtree
+     * onto it instead of the emptied element (#1220: HTML set_text
+     * produced an empty <p/>). */
+    LeptrisNode* child =
+        leptris_node_first_child_internal((LeptrisNode*)elem);
     while (child) {
-        LeptrisElement next = leptris_element_get_next_sibling(child);
-        leptris_elem_set_parent(child, NULL);
+        LeptrisNode* next = leptris_node_get_next_sibling(child);
+        switch (child->type) {
+            case LEPTRIS_NODE_TYPE_ELEMENT:
+                leptris_elem_set_parent((LeptrisElement)child, NULL);
+                break;
+            case LEPTRIS_NODE_TYPE_TEXT:
+                leptris_textnode_set_parent((LeptrisTextNode*)child, NULL);
+                break;
+            case LEPTRIS_NODE_TYPE_COMMENT:
+                leptris_comment_set_parent((LeptrisCommentNode*)child, NULL);
+                break;
+            case LEPTRIS_NODE_TYPE_CDATA:
+                leptris_cdata_set_parent((LeptrisCDATANode*)child, NULL);
+                break;
+            case LEPTRIS_NODE_TYPE_PI:
+                leptris_pi_set_parent((LeptrisPINode*)child, NULL);
+                break;
+            case LEPTRIS_NODE_TYPE_ENTITY_REF:
+                leptris_entity_ref_set_parent(
+                    (LeptrisEntityRefNode*)child, NULL);
+                break;
+            default:
+                break;
+        }
         child = next;
     }
 

data/vendor-src/libleptris/src/leptris/dtd/model.h

@@ -130,6 +130,12 @@ struct LeptrisDTD {
      * from the document parser). ttdtd_free destroys the pool only
      * when this flag is set. */
     int owns_pool;
+    /* #1211: a declaration matched its keyword but the parser could
+     * not deliver the promised structure (malformed ELEMENT/ATTLIST/
+     * ENTITY/NOTATION). leptris_dtd_parse frees and returns NULL.
+     * Lenient paths — comments, PIs, unresolved external PEs,
+     * duplicates — never set this. */
+    int parse_failed;
 
     /* External parameter-entity loader (application-owned I/O).
      * NULL = external PEs are not resolvable and are skipped.

data/vendor-src/libleptris/src/leptris/dtd/parser.c

@@ -6,8 +6,12 @@
  * Uses stateless parsing with hash table storage for O(1) lookup.
  */
 
+#include "../../include/leptris/dtd.h"
 #include "model.h"
 #include "../memory/pool.h"
+/* Engine-heap free for PE-loader buffers (#1219); declared
+ * locally — the full internal header tangles include order. */
+extern void leptris_free_hook(void* ptr);
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
@@ -187,11 +191,16 @@ static DTDEntityDecl* dtd_parse_entity(DTDParser* p) {
         entity->notation_name = dtd_parse_name(p);
     }
 
-    /* Skip to '>' */
+    /* Skip to '>' - unterminated (input exhausted first) is a
+     * malformed declaration: the NULL-on-error contract (#1211). */
     while (!dtd_at_end(p) && dtd_peek(p) != '>') {
         dtd_advance(p);
     }
-    if (dtd_peek(p) == '>') dtd_advance(p);
+    if (dtd_peek(p) == '>') {
+        dtd_advance(p);
+    } else {
+        return NULL;
+    }
 
     return entity;
 }
@@ -226,6 +235,7 @@ static DTDElementDecl* dtd_parse_element(DTDParser* p) {
         int depth = 0;
         int in_quote = 0;
         char quote_char = 0;
+        int closed = 0;
 
         while (!dtd_at_end(p)) {
             char c = dtd_peek(p);
@@ -240,12 +250,15 @@ static DTDElementDecl* dtd_parse_element(DTDParser* p) {
             } else if (c == ')') {
                 depth--;
                 dtd_advance(p);
-                if (depth == 0) break;
+                if (depth == 0) { closed = 1; break; }
                 dtd_advance(p);
                 continue;
             }
             dtd_advance(p);
         }
+        /* #1211: running out of input before the model closes is a
+         * malformed declaration — the NULL-on-error contract. */
+        if (!closed) return NULL;
 
         size_t len = p->pos - start;
         elem->content_model = (char*)leptris_pool_alloc(p->pool, len + 1);
@@ -262,11 +275,16 @@ static DTDElementDecl* dtd_parse_element(DTDParser* p) {
         }
     }
 
-    /* Skip to '>' */
+    /* Skip to '>' - unterminated (input exhausted first) is a
+     * malformed declaration: the NULL-on-error contract (#1211). */
     while (!dtd_at_end(p) && dtd_peek(p) != '>') {
         dtd_advance(p);
     }
-    if (dtd_peek(p) == '>') dtd_advance(p);
+    if (dtd_peek(p) == '>') {
+        dtd_advance(p);
+    } else {
+        return NULL;
+    }
 
     return elem;
 }
@@ -305,11 +323,16 @@ static DTDNotationDecl* dtd_parse_notation(DTDParser* p) {
         }
     }
 
-    /* Skip to '>' */
+    /* Skip to '>' - unterminated (input exhausted first) is a
+     * malformed declaration: the NULL-on-error contract (#1211). */
     while (!dtd_at_end(p) && dtd_peek(p) != '>') {
         dtd_advance(p);
     }
-    if (dtd_peek(p) == '>') dtd_advance(p);
+    if (dtd_peek(p) == '>') {
+        dtd_advance(p);
+    } else {
+        return NULL;
+    }
 
     return notation;
 }
@@ -357,7 +380,7 @@ LeptrisDTD* leptris_dtd_parse_internal_subset(const char* dtd_content, size_t le
  * @param len Length in bytes
  * @return 1 on success, -1 on invalid arguments
  */
-void leptris_dtd_set_pe_loader(LeptrisDTD* dtd,
+LEPTRIS_API void leptris_dtd_set_pe_loader(LeptrisDTD* dtd,
                                char* (*loader)(void* user_data,
                                                const char* system_id,
                                                size_t* out_len),
@@ -367,7 +390,7 @@ void leptris_dtd_set_pe_loader(LeptrisDTD* dtd,
     dtd->pe_loader_user = user_data;
 }
 
-int leptris_dtd_parse_external_subset(LeptrisDTD* dtd, const char* content,
+LEPTRIS_API int leptris_dtd_parse_external_subset(LeptrisDTD* dtd, const char* content,
                                       size_t len) {
     if (!dtd || !content || len == 0) return -1;
     dtd_parse_into(dtd, content, len, 0);
@@ -443,7 +466,7 @@ if (text[i] == '%' && i + 1 < len) {
                         memcpy(grown + w + loaded, text + j + 1,
                                len - j - 1);
                         grown[w + loaded + (len - j - 1)] = '\0';
-                        free(got);
+                        leptris_free_hook(got);
                         /* Recurse once for nested refs in the
                          * loaded content. */
                         char* rec = dtd_substitute_decl_pes(
@@ -451,7 +474,7 @@ if (text[i] == '%' && i + 1 < len) {
                             w + loaded + (len - j - 1), depth + 1);
                         return rec ? rec : grown;
                     }
-                    free(got);
+                    leptris_free_hook(got);
                 }
             }
             if (val) {
@@ -587,16 +610,22 @@ static void dtd_parse_into(LeptrisDTD* dtd, const char* dtd_content,
             DTDEntityDecl* entity = dtd_parse_entity(&parser);
             if (entity) {
                 ttdtd_add_entity(dtd, entity);
+            } else {
+                dtd->parse_failed = 1;  /* #1211 */
             }
         } else if (dtd_match(&parser, "<!ELEMENT")) {
             DTDElementDecl* elem = dtd_parse_element(&parser);
             if (elem) {
                 ttdtd_add_element(dtd, elem);
+            } else {
+                dtd->parse_failed = 1;  /* #1211 */
             }
         } else if (dtd_match(&parser, "<!NOTATION")) {
             DTDNotationDecl* notation = dtd_parse_notation(&parser);
             if (notation) {
                 ttdtd_add_notation(dtd, notation);
+            } else {
+                dtd->parse_failed = 1;  /* #1211 */
             }
         } else if (dtd_match(&parser, "<!ATTLIST")) {
             /* Parse one or more <!ATTLIST element-name attr-decl+>
@@ -609,6 +638,7 @@ static void dtd_parse_into(LeptrisDTD* dtd, const char* dtd_content,
             char* elem_name = dtd_parse_name(&parser);
             if (!elem_name) {
                 /* Malformed; skip to '>' */
+                dtd->parse_failed = 1;  /* #1211 */
                 while (!dtd_at_end(&parser) && dtd_peek(&parser) != '>') {
                     dtd_advance(&parser);
                 }
@@ -811,7 +841,7 @@ void leptris_dtd_free(LeptrisDTD* dtd) {
  * leptris_dtd_parse_internal_subset() directly with the document's
  * pool instead.
  */
-LeptrisDTD* leptris_dtd_parse(const char* dtd_content, size_t len) {
+LEPTRIS_API LeptrisDTD* leptris_dtd_parse(const char* dtd_content, size_t len) {
     LeptrisMemoryPool* pool = leptris_pool_create();
     if (!pool) return NULL;
     LeptrisDTD* dtd = leptris_dtd_parse_internal_subset(dtd_content, len, pool);
@@ -823,5 +853,12 @@ LeptrisDTD* leptris_dtd_parse(const char* dtd_content, size_t len) {
      * Document-pool DTDs (created via the internal parser path) leave
      * owns_pool=0; their pool is destroyed with the document. */
     dtd->owns_pool = 1;
+    /* #1211: the documented NULL-on-error contract — malformed
+     * declarations (keyword matched, structure undeliverable) free
+     * the whole pool; lenient skips never set parse_failed. */
+    if (dtd->parse_failed) {
+        leptris_pool_destroy(pool);
+        return NULL;
+    }
     return dtd;
 }

data/vendor-src/libleptris/src/leptris/error.c

@@ -7,6 +7,7 @@
 #include "common/port.h"  /* LEPTRIS_THREAD_LOCAL (TODO.concurrency/01) */
 #include <stdio.h>
 #include <string.h>
+#include "dom/diag.h"   /* LeptrisDiag layout (#1200) */
 
 /* Error state — THREAD-LOCAL since TODO.concurrency/01: concurrent
  * parses (one document per thread) no longer race the channel. The
@@ -131,4 +132,25 @@ LEPTRIS_API const char* leptris_status_string(LeptrisStatus status) {
         case LEPTRIS_ERROR_IO:        return "I/O error";
         default:                     return "Unknown error";
     }
+}
+
+/* ---- #1200: recover-class parse diagnostics ------------------- */
+
+LEPTRIS_API size_t leptris_document_parse_diag_count(LeptrisDocument doc) {
+    return doc ? (size_t)doc->parse_diag_count : 0;
+}
+
+LEPTRIS_API int leptris_document_parse_diag(LeptrisDocument doc,
+                                            size_t index,
+                                            LeptrisDiagKind* kind,
+                                            char* message,
+                                            size_t message_cap) {
+    if (!doc || index >= (size_t)doc->parse_diag_count) return 0;
+    struct LeptrisDiag* d = (struct LeptrisDiag*)doc->parse_diags + index;
+    if (kind) *kind = d->kind;
+    if (message && message_cap) {
+        strncpy(message, d->message, message_cap - 1);
+        message[message_cap - 1] = '\0';
+    }
+    return 1;
 }