nokogiri 1.6.3.1 → 1.6.4

data/lib/nokogiri/css/parser.y

@@ -10,13 +10,12 @@ rule
         result = [val.first, val.last].flatten
       }
     | prefixless_combinator_selector { result = val.flatten }
-    | simple_selector_1toN { result = val.flatten }
+    | optional_S simple_selector_1toN { result = [val.last].flatten }
     ;
   combinator
     : PLUS { result = :DIRECT_ADJACENT_SELECTOR }
     | GREATER { result = :CHILD_SELECTOR }
     | TILDE { result = :FOLLOWING_SELECTOR }
-    | S { result = :DESCENDANT_SELECTOR }
     | DOUBLESLASH { result = :DESCENDANT_SELECTOR }
     | SLASH { result = :CHILD_SELECTOR }
     ;
@@ -50,6 +49,9 @@ rule
     : simple_selector combinator simple_selector_1toN {
         result = Node.new(val[1], [val.first, val.last])
       }
+    | simple_selector S simple_selector_1toN {
+        result = Node.new(:DESCENDANT_SELECTOR, [val.first, val.last])
+      }
     | simple_selector
     ;
   class
@@ -241,6 +243,10 @@ rule
     | element_name hcap_1toN
     | hcap_1toN
     ;
+  optional_S
+    : S
+    |
+    ;
 end
 
 ---- header

data/lib/nokogiri/css/tokenizer.rb

@@ -94,7 +94,7 @@ class Tokenizer # :nodoc:
       when (text = @ss.scan(/[\s]*\)/))
          action { [:RPAREN, text] }
 
-      when (text = @ss.scan(/[\s]*\[[\s]*/))
+      when (text = @ss.scan(/\[[\s]*/))
          action { [:LSQUARE, text] }
 
       when (text = @ss.scan(/[\s]*\]/))

data/lib/nokogiri/css/tokenizer.rex

@@ -34,7 +34,7 @@ rule
             {w}!={w}         { [:NOT_EQUAL, text] }
             {w}={w}          { [:EQUAL, text] }
             {w}\)            { [:RPAREN, text] }
-            {w}\[{w}         { [:LSQUARE, text] }
+            \[{w}            { [:LSQUARE, text] }
             {w}\]            { [:RSQUARE, text] }
             {w}\+{w}         { [:PLUS, text] }
             {w}>{w}          { [:GREATER, text] }

data/lib/nokogiri/version.rb

@@ -1,6 +1,6 @@
 module Nokogiri
   # The version of Nokogiri you are using
-  VERSION = '1.6.3.1'
+  VERSION = '1.6.4'
 
   class VersionInfo # :nodoc:
     def jruby?
@@ -61,6 +61,8 @@ module Nokogiri
           hash_info['libxml']['source']  = "packaged"
           hash_info['libxml']['libxml2_path'] = NOKOGIRI_LIBXML2_PATH
           hash_info['libxml']['libxslt_path'] = NOKOGIRI_LIBXSLT_PATH
+          hash_info['libxml']['libxml2_patches'] = NOKOGIRI_LIBXML2_PATCHES
+          hash_info['libxml']['libxslt_patches'] = NOKOGIRI_LIBXSLT_PATCHES
         else
           hash_info['libxml']['source']  = "system"
         end

data/ports/patches/libxml2/0001-Revert-Missing-initialization-for-the-catalog-module.patch

@@ -0,0 +1,29 @@
+From f65128f38289d77ff322d63aef2858cc0a819c34 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Fri, 17 Oct 2014 17:13:41 +0800
+Subject: [PATCH] Revert "Missing initialization for the catalog module"
+
+This reverts commit 054c716ea1bf001544127a4ab4f4346d1b9947e7.
+As this break xmlcatalog command
+https://bugzilla.redhat.com/show_bug.cgi?id=1153753
+---
+ parser.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/parser.c b/parser.c
+index 1d93967..67c9dfd 100644
+--- a/parser.c
++++ b/parser.c
+@@ -14830,9 +14830,6 @@ xmlInitParser(void) {
+ #ifdef LIBXML_XPATH_ENABLED
+ 	xmlXPathInit();
+ #endif
+-#ifdef LIBXML_CATALOG_ENABLED
+-        xmlInitializeCatalog();
+-#endif
+ 	xmlParserInitialized = 1;
+ #ifdef LIBXML_THREAD_ENABLED
+     }
+-- 
+2.1.2
+

data/ports/patches/libxml2/0002-Fix-missing-entities-after-CVE-2014-3660-fix.patch

@@ -0,0 +1,31 @@
+From 72a46a519ce7326d9a00f0b6a7f2a8e958cd1675 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Thu, 23 Oct 2014 11:35:36 +0800
+Subject: [PATCH] Fix missing entities after CVE-2014-3660 fix
+
+For https://bugzilla.gnome.org/show_bug.cgi?id=738805
+
+The fix for CVE-2014-3660 introduced a regression in some case
+where entity substitution is required and the entity is used
+first in anotther entity referenced from an attribute value
+---
+ parser.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/parser.c b/parser.c
+index 67c9dfd..a8d1b67 100644
+--- a/parser.c
++++ b/parser.c
+@@ -7235,7 +7235,8 @@ xmlParseReference(xmlParserCtxtPtr ctxt) {
+      * far more secure as the parser will only process data coming from
+      * the document entity by default.
+      */
+-    if ((ent->checked == 0) &&
++    if (((ent->checked == 0) ||
++         ((ent->children == NULL) && (ctxt->options & XML_PARSE_NOENT))) &&
+         ((ent->etype != XML_EXTERNAL_GENERAL_PARSED_ENTITY) ||
+          (ctxt->options & (XML_PARSE_NOENT | XML_PARSE_DTDVALID)))) {
+ 	unsigned long oldnbent = ctxt->nbentities;
+-- 
+2.1.2
+

data/test/css/test_parser.rb

@@ -274,6 +274,11 @@ module Nokogiri
                       @parser.parse('a:active.foo')
       end
 
+      def test_significant_space
+        assert_xpath "//x//*[count(preceding-sibling::*) = 0]//*[@a]//*[@b]", @parser.parse("x :first-child [a] [b]")
+        assert_xpath "//*[@a]//*[@b]", @parser.parse(" [a] [b]")
+      end
+
       def test_star
         assert_xpath "//*", @parser.parse('*')
         assert_xpath "//*[contains(concat(' ', normalize-space(@class), ' '), ' pastoral ')]",

data/test/css/test_tokenizer.rb

@@ -186,6 +186,23 @@ module Nokogiri
         ], @scanner)
       end
 
+      def test_significant_space
+        @scanner.scan('x :first-child [a] [b]')
+        assert_tokens([ [:IDENT, 'x'],
+                        [:S, ' '],
+                        [':', ':'],
+                        [:IDENT, 'first-child'],
+                        [:S, ' '],
+                        [:LSQUARE, '['],
+                        [:IDENT, 'a'],
+                        [:RSQUARE, ']'],
+                        [:S, ' '],
+                        [:LSQUARE, '['],
+                        [:IDENT, 'b'],
+                        [:RSQUARE, ']'],
+        ], @scanner)
+      end
+
       def assert_tokens(tokens, scanner)
         toks = []
         while tok = @scanner.next_token

data/test/html/test_document.rb

@@ -221,7 +221,7 @@ eohtml
         title = doc.at('/html/head/title')
         assert_not_nil title
         assert_equal 'new', title.text
-        assert_equal -1, doc.at('meta[@http-equiv]') <=> title
+        assert_equal(-1, doc.at('meta[@http-equiv]') <=> title)
 
         doc = Nokogiri::HTML(<<eohtml)
 <html>
@@ -236,7 +236,7 @@ eohtml
         title = doc.at('/html//title')
         assert_not_nil title
         assert_equal 'new', title.text
-        assert_equal -1, title <=> doc.at('body')
+        assert_equal(-1, title <=> doc.at('body'))
 
         doc = Nokogiri::HTML(<<eohtml)
 <html>
@@ -248,14 +248,14 @@ eohtml
 eohtml
         doc.title = 'new'
         assert_equal 'new', doc.title
-        assert_equal -1, doc.at('meta[@charset]') <=> doc.at('title')
-        assert_equal -1, doc.at('title') <=> doc.at('body')
+        assert_equal(-1, doc.at('meta[@charset]') <=> doc.at('title'))
+        assert_equal(-1, doc.at('title') <=> doc.at('body'))
 
         doc = Nokogiri::HTML('<!DOCTYPE html><p>hello')
         doc.title = 'new'
         assert_equal 'new', doc.title
         assert_instance_of Nokogiri::XML::DTD, doc.children.first
-        assert_equal -1, doc.at('title') <=> doc.at('p')
+        assert_equal(-1, doc.at('title') <=> doc.at('p'))
 
         doc = Nokogiri::HTML('')
         doc.title = 'new'

data/test/html/test_document_fragment.rb

@@ -230,6 +230,11 @@ module Nokogiri
           fragment.to_s)
       end
 
+      def test_element_children_counts
+        doc = Nokogiri::HTML::DocumentFragment.parse("   <div>  </div>\n   ")
+        assert doc.element_children.count == 1
+      end
+
       def test_malformed_fragment_is_corrected
         fragment = HTML::DocumentFragment.parse("<div </div>")
         assert_equal "<div></div>", fragment.to_s

data/test/xml/test_builder.rb

@@ -14,7 +14,7 @@ module Nokogiri
       end
 
       def test_builder_multiple_nodes
-        builder = Nokogiri::XML::Builder.new do |xml|
+        Nokogiri::XML::Builder.new do |xml|
           0.upto(10) do
             xml.text "test"
           end

data/test/xml/test_document.rb

@@ -54,7 +54,7 @@ module Nokogiri
         root << txt
         root << ent
         d << root
-        assert_match /&#8217;/, d.to_html
+        assert_match(/&#8217;/, d.to_html)
       end
 
       def test_document_with_initial_space
@@ -376,14 +376,6 @@ module Nokogiri
         end
       end
 
-      def test_prepend_child_fragment_with_multiple_nodes
-        doc = Nokogiri::XML::Document.new
-        fragment = doc.fragment('<hello /><goodbye />')
-        assert_raises(RuntimeError) do
-          doc.prepend_child fragment
-        end
-      end
-
       def test_prepend_child_with_multiple_roots
         assert_raises(RuntimeError) do
           @xml.prepend_child Node.new('foo', @xml)

data/test/xml/test_entity_reference.rb

@@ -26,7 +26,7 @@ EOF
         doc = Nokogiri::XML xml
         lf_node = Nokogiri::XML::EntityReference.new(doc, "#xa")
         doc.xpath('/item').first.add_child(lf_node)
-        assert_match /
/, doc.to_xml
+        assert_match(/
/, doc.to_xml)
       end
     end
 
@@ -236,9 +236,15 @@ EOF
         reader = Nokogiri::XML::Reader html, path do |cfg|
           cfg.default_xml
         end
-        assert_raises(Nokogiri::XML::SyntaxError) do
-          reader.each { |n| n }
+        if Nokogiri.uses_libxml? && Nokogiri::LIBXML_PARSER_VERSION.to_i >= 20900
+          # Unknown entity is not fatal in libxml2 >= 2.9
+          assert_equal 8, reader.count
+        else
+          assert_raises(Nokogiri::XML::SyntaxError) {
+            assert_equal 5, reader.count
+          }
         end
+        assert_operator reader.errors.size, :>, 0
       end
     end
   end

data/test/xml/test_node.rb

@@ -858,7 +858,7 @@ b"></div>
         ne = d1.root.xpath('//a').first.dup(1)
         ne.content += "& < & > \" &"
         d2.root << ne
-        assert_match /<a>&amp;&amp; &lt; &amp; &gt; \" &amp;<\/a>/, d2.to_s
+        assert_match(/<a>&amp;&amp; &lt; &amp; &gt; \" &amp;<\/a>/, d2.to_s)
       end
 
       def test_content_after_appending_text

data/test/xml/test_syntax_error.rb

@@ -7,6 +7,24 @@ module Nokogiri
         error = Nokogiri::XML::SyntaxError.new 'hello'
         assert_equal 'hello', error.message
       end
+
+      def test_pushing_to_array
+        reader = Nokogiri::XML::Reader(StringIO.new('&bogus;'))
+        assert_raises(SyntaxError) {
+          reader.read
+        }
+        assert_equal [SyntaxError], reader.errors.map(&:class) unless Nokogiri.jruby? # needs investigation
+      end
+
+      def test_pushing_to_non_array
+        reader = Nokogiri::XML::Reader(StringIO.new('&bogus;'))
+        def reader.errors
+          1
+        end
+        assert_raises(TypeError) {
+          reader.read
+        }
+      end unless Nokogiri.jruby? # which does not internally call `errors`
     end
   end
 end

data/test/xml/test_xpath.rb

@@ -156,6 +156,8 @@ module Nokogiri
 
       # issue #741 (xpath() around 10x slower in JRuby)
       def test_slow_jruby_xpath
+        skip("MRI will exceed this timeout when running under valgrind") unless Nokogiri.jruby?
+
         doc = Nokogiri::XML(File.open(XPATH_FILE))
         start = Time.now
 

data/test_all

@@ -10,7 +10,7 @@
 #  (e.g., 1.9.3's glob_helper). ["rake test:valgrind:suppression"]
 #
 
-RUBIES="ruby-1.9.3 ruby-1.9.2 ruby-2.0 ruby-2.1 jruby-1.7"
+RUBIES="ruby-2.2.0-preview1 ruby-2.1 ruby-2.0.0-p481 ruby-1.9.3 jruby-1.7.15"
 TEST_LOG=test.log
 VALGRIND_LOG=valgrind.log
 
@@ -29,7 +29,7 @@ set -o errexit
 
 function rvm_use {
     current_ruby=$1
-    rvm use "${1}@nokogiri" --create || rvm -v
+    rvm use "${1}@nokogiri" --create
 }
 
 function generate_parser_and_tokenizer {

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nokogiri
 version: !ruby/object:Gem::Version
-  version: 1.6.3.1
+  version: 1.6.4
 platform: ruby
 authors:
 - Aaron Patterson
@@ -12,20 +12,20 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-07-22 00:00:00.000000000 Z
+date: 2014-11-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mini_portile
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ~>
       - !ruby/object:Gem::Version
         version: 0.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ~>
       - !ruby/object:Gem::Version
         version: 0.6.0
 - !ruby/object:Gem::Dependency
@@ -174,14 +174,14 @@ dependencies:
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
-        version: '3.7'
+        version: '3.13'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
-        version: '3.7'
+        version: '3.13'
 description: |-
   Nokogiri (鋸) is an HTML, XML, SAX, and Reader parser.  Among Nokogiri's
   many features is the ability to search documents via XPath or CSS3 selectors.
@@ -393,19 +393,10 @@ files:
 - lib/nokogiri/xslt.rb
 - lib/nokogiri/xslt/stylesheet.rb
 - lib/xsd/xmlparser/nokogiri.rb
-- ports/archives/libxml2-2.8.0.tar.gz
+- ports/archives/libxml2-2.9.2.tar.gz
 - ports/archives/libxslt-1.1.28.tar.gz
-- ports/patches/libxml2/0001-Fix-parser-local-buffers-size-problems.patch
-- ports/patches/libxml2/0002-Fix-entities-local-buffers-size-problems.patch
-- ports/patches/libxml2/0003-Fix-an-error-in-previous-commit.patch
-- ports/patches/libxml2/0004-Fix-potential-out-of-bound-access.patch
-- ports/patches/libxml2/0005-Detect-excessive-entities-expansion-upon-replacement.patch
-- ports/patches/libxml2/0006-Do-not-fetch-external-parsed-entities.patch
-- ports/patches/libxml2/0007-Enforce-XML_PARSER_EOF-state-handling-through-the-pa.patch
-- ports/patches/libxml2/0008-Improve-handling-of-xmlStopParser.patch
-- ports/patches/libxml2/0009-Fix-a-couple-of-return-without-value.patch
-- ports/patches/libxml2/0010-Keep-non-significant-blanks-node-in-HTML-parser.patch
-- ports/patches/libxml2/0011-Do-not-fetch-external-parameter-entities.patch
+- ports/patches/libxml2/0001-Revert-Missing-initialization-for-the-catalog-module.patch
+- ports/patches/libxml2/0002-Fix-missing-entities-after-CVE-2014-3660-fix.patch
 - ports/patches/libxslt/0001-Adding-doc-update-related-to-1.1.28.patch
 - ports/patches/libxslt/0002-Fix-a-couple-of-places-where-f-printf-parameters-wer.patch
 - ports/patches/libxslt/0003-Initialize-pseudo-random-number-generator-with-curre.patch
@@ -552,8 +543,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: nokogiri
-rubygems_version: 2.2.2
+rubyforge_project: 
+rubygems_version: 2.4.2
 signing_key: 
 specification_version: 4
 summary: Nokogiri (鋸) is an HTML, XML, SAX, and Reader parser

data/ports/patches/libxml2/0001-Fix-parser-local-buffers-size-problems.patch

@@ -1,265 +0,0 @@
-From bc168aab5749acbe6630a29be4dcfabf0a81e2da Mon Sep 17 00:00:00 2001
-From: Daniel Veillard <veillard@redhat.com>
-Date: Tue, 17 Jul 2012 16:19:17 +0800
-Subject: [PATCH 1/9] Fix parser local buffers size problems
-
-[Origin: 459eeb9dc752d5185f57ff6b135027f11981a626]
----
- parser.c | 74 +++++++++++++++++++++++++++++++++++++---------------------------
- 1 file changed, 43 insertions(+), 31 deletions(-)
-
-diff --git a/parser.c b/parser.c
-index 2c38fae..9863275 100644
---- a/parser.c
-+++ b/parser.c
-@@ -40,6 +40,7 @@
- #endif
- 
- #include <stdlib.h>
-+#include <limits.h>
- #include <string.h>
- #include <stdarg.h>
- #include <libxml/xmlmemory.h>
-@@ -117,10 +118,10 @@ xmlCreateEntityParserCtxtInternal(const xmlChar *URL, const xmlChar *ID,
-  * parser option.
-  */
- static int
--xmlParserEntityCheck(xmlParserCtxtPtr ctxt, unsigned long size,
-+xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size,
-                      xmlEntityPtr ent)
- {
--    unsigned long consumed = 0;
-+    size_t consumed = 0;
- 
-     if ((ctxt == NULL) || (ctxt->options & XML_PARSE_HUGE))
-         return (0);
-@@ -2589,15 +2590,17 @@ xmlParserHandlePEReference(xmlParserCtxtPtr ctxt) {
- 
- /*
-  * Macro used to grow the current buffer.
-+ * buffer##_size is expected to be a size_t
-+ * mem_error: is expected to handle memory allocation failures
-  */
- #define growBuffer(buffer, n) {						\
-     xmlChar *tmp;							\
--    buffer##_size *= 2;							\
--    buffer##_size += n;							\
--    tmp = (xmlChar *)							\
--		xmlRealloc(buffer, buffer##_size * sizeof(xmlChar));	\
-+    size_t new_size = buffer##_size * 2 + n;                            \
-+    if (new_size < buffer##_size) goto mem_error;                       \
-+    tmp = (xmlChar *) xmlRealloc(buffer, new_size);                     \
-     if (tmp == NULL) goto mem_error;					\
-     buffer = tmp;							\
-+    buffer##_size = new_size;                                           \
- }
- 
- /**
-@@ -2623,14 +2626,14 @@ xmlChar *
- xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
- 		      int what, xmlChar end, xmlChar  end2, xmlChar end3) {
-     xmlChar *buffer = NULL;
--    int buffer_size = 0;
-+    size_t buffer_size = 0;
-+    size_t nbchars = 0;
- 
-     xmlChar *current = NULL;
-     xmlChar *rep = NULL;
-     const xmlChar *last;
-     xmlEntityPtr ent;
-     int c,l;
--    int nbchars = 0;
- 
-     if ((ctxt == NULL) || (str == NULL) || (len < 0))
- 	return(NULL);
-@@ -2647,7 +2650,7 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
-      * allocate a translation buffer.
-      */
-     buffer_size = XML_PARSER_BIG_BUFFER_SIZE;
--    buffer = (xmlChar *) xmlMallocAtomic(buffer_size * sizeof(xmlChar));
-+    buffer = (xmlChar *) xmlMallocAtomic(buffer_size);
-     if (buffer == NULL) goto mem_error;
- 
-     /*
-@@ -2667,7 +2670,7 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
- 	    if (val != 0) {
- 		COPY_BUF(0,buffer,nbchars,val);
- 	    }
--	    if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
-+	    if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
- 	        growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
- 	    }
- 	} else if ((c == '&') && (what & XML_SUBSTITUTE_REF)) {
-@@ -2685,7 +2688,7 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
- 		(ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
- 		if (ent->content != NULL) {
- 		    COPY_BUF(0,buffer,nbchars,ent->content[0]);
--		    if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
-+		    if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
- 			growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
- 		    }
- 		} else {
-@@ -2702,8 +2705,7 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
- 		    current = rep;
- 		    while (*current != 0) { /* non input consuming loop */
- 			buffer[nbchars++] = *current++;
--			if (nbchars >
--		            buffer_size - XML_PARSER_BUFFER_SIZE) {
-+			if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
- 			    if (xmlParserEntityCheck(ctxt, nbchars, ent))
- 				goto int_error;
- 			    growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
-@@ -2717,7 +2719,7 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
- 		const xmlChar *cur = ent->name;
- 
- 		buffer[nbchars++] = '&';
--		if (nbchars > buffer_size - i - XML_PARSER_BUFFER_SIZE) {
-+		if (nbchars + i + XML_PARSER_BUFFER_SIZE > buffer_size) {
- 		    growBuffer(buffer, i + XML_PARSER_BUFFER_SIZE);
- 		}
- 		for (;i > 0;i--)
-@@ -2745,8 +2747,7 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
- 		    current = rep;
- 		    while (*current != 0) { /* non input consuming loop */
- 			buffer[nbchars++] = *current++;
--			if (nbchars >
--		            buffer_size - XML_PARSER_BUFFER_SIZE) {
-+			if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
- 			    if (xmlParserEntityCheck(ctxt, nbchars, ent))
- 			        goto int_error;
- 			    growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
-@@ -2759,8 +2760,8 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
- 	} else {
- 	    COPY_BUF(l,buffer,nbchars,c);
- 	    str += l;
--	    if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
--	      growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
-+	    if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
-+	        growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
- 	    }
- 	}
- 	if (str < last)
-@@ -3764,8 +3765,8 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
-     xmlChar limit = 0;
-     xmlChar *buf = NULL;
-     xmlChar *rep = NULL;
--    int len = 0;
--    int buf_size = 0;
-+    size_t len = 0;
-+    size_t buf_size = 0;
-     int c, l, in_space = 0;
-     xmlChar *current = NULL;
-     xmlEntityPtr ent;
-@@ -3787,7 +3788,7 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
-      * allocate a translation buffer.
-      */
-     buf_size = XML_PARSER_BUFFER_SIZE;
--    buf = (xmlChar *) xmlMallocAtomic(buf_size * sizeof(xmlChar));
-+    buf = (xmlChar *) xmlMallocAtomic(buf_size);
-     if (buf == NULL) goto mem_error;
- 
-     /*
-@@ -3804,7 +3805,7 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
- 
- 		if (val == '&') {
- 		    if (ctxt->replaceEntities) {
--			if (len > buf_size - 10) {
-+			if (len + 10 > buf_size) {
- 			    growBuffer(buf, 10);
- 			}
- 			buf[len++] = '&';
-@@ -3813,7 +3814,7 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
- 			 * The reparsing will be done in xmlStringGetNodeList()
- 			 * called by the attribute() function in SAX.c
- 			 */
--			if (len > buf_size - 10) {
-+			if (len + 10 > buf_size) {
- 			    growBuffer(buf, 10);
- 			}
- 			buf[len++] = '&';
-@@ -3823,7 +3824,7 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
- 			buf[len++] = ';';
- 		    }
- 		} else if (val != 0) {
--		    if (len > buf_size - 10) {
-+		    if (len + 10 > buf_size) {
- 			growBuffer(buf, 10);
- 		    }
- 		    len += xmlCopyChar(0, &buf[len], val);
-@@ -3835,7 +3836,7 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
- 		    ctxt->nbentities += ent->owner;
- 		if ((ent != NULL) &&
- 		    (ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
--		    if (len > buf_size - 10) {
-+		    if (len + 10 > buf_size) {
- 			growBuffer(buf, 10);
- 		    }
- 		    if ((ctxt->replaceEntities == 0) &&
-@@ -3863,7 +3864,7 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
-                                     current++;
-                                 } else
-                                     buf[len++] = *current++;
--				if (len > buf_size - 10) {
-+				if (len + 10 > buf_size) {
- 				    growBuffer(buf, 10);
- 				}
- 			    }
-@@ -3871,7 +3872,7 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
- 			    rep = NULL;
- 			}
- 		    } else {
--			if (len > buf_size - 10) {
-+			if (len + 10 > buf_size) {
- 			    growBuffer(buf, 10);
- 			}
- 			if (ent->content != NULL)
-@@ -3899,7 +3900,7 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
- 		     * Just output the reference
- 		     */
- 		    buf[len++] = '&';
--		    while (len > buf_size - i - 10) {
-+		    while (len + i + 10 > buf_size) {
- 			growBuffer(buf, i + 10);
- 		    }
- 		    for (;i > 0;i--)
-@@ -3912,7 +3913,7 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
- 	        if ((len != 0) || (!normalize)) {
- 		    if ((!normalize) || (!in_space)) {
- 			COPY_BUF(l,buf,len,0x20);
--			while (len > buf_size - 10) {
-+			while (len + 10 > buf_size) {
- 			    growBuffer(buf, 10);
- 			}
- 		    }
-@@ -3921,7 +3922,7 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
- 	    } else {
- 	        in_space = 0;
- 		COPY_BUF(l,buf,len,c);
--		if (len > buf_size - 10) {
-+		if (len + 10 > buf_size) {
- 		    growBuffer(buf, 10);
- 		}
- 	    }
-@@ -3946,7 +3947,18 @@ xmlParseAttValueComplex(xmlParserCtxtPtr ctxt, int *attlen, int normalize) {
-         }
-     } else
- 	NEXT;
--    if (attlen != NULL) *attlen = len;
-+
-+    /*
-+     * There we potentially risk an overflow, don't allow attribute value of
-+     * lenght more than INT_MAX it is a very reasonnable assumption !
-+     */
-+    if (len >= INT_MAX) {
-+        xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
-+                       "AttValue lenght too long\n");
-+        goto mem_error;
-+    }
-+
-+    if (attlen != NULL) *attlen = (int) len;
-     return(buf);
- 
- mem_error:
--- 
-1.8.4.1
-