fixed a bug where invalid charrefs may not be detected sometimes as

* parser.c: fixed a bug where invalid charrefs may not be detected
  sometimes as pointed by Morus Walter.
* test/errors/charref1.xm result/errors/charref1.xml*: added the
  test in the regression suite.
Daniel
diff --git a/ChangeLog b/ChangeLog
index 33109d7..d28f7b0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+Thu Jun  3 13:20:36 CEST 2004 Daniel Veillard <daniel@veillard.com>
+
+	* parser.c: fixed a bug where invalid charrefs may not be detected
+	  sometimes as pointed by Morus Walter.
+	* test/errors/charref1.xm result/errors/charref1.xml*: added the
+	  test in the regression suite.
+
 Thu Jun  3 18:38:27 HKT 2004 William Brack <wbrack@mmm.com.hk>
 
 	* xmlschemas.c: small change to xmlSchemaValidateAttributes,
diff --git a/parser.c b/parser.c
index d038e46..1696009 100644
--- a/parser.c
+++ b/parser.c
@@ -1456,6 +1456,7 @@
 xmlParseCharRef(xmlParserCtxtPtr ctxt) {
     unsigned int val = 0;
     int count = 0;
+    unsigned int outofrange = 0;
 
     /*
      * Using RAW/CUR/NEXT is okay since we are working on ASCII range here
@@ -1480,6 +1481,9 @@
 		val = 0;
 		break;
 	    }
+	    if (val > 0x10FFFF)
+	        outofrange = val;
+
 	    NEXT;
 	    count++;
 	}
@@ -1504,6 +1508,9 @@
 		val = 0;
 		break;
 	    }
+	    if (val > 0x10FFFF)
+	        outofrange = val;
+
 	    NEXT;
 	    count++;
 	}
@@ -1522,7 +1529,7 @@
      * Characters referred to using character references must match the
      * production for Char. 
      */
-    if (IS_CHAR(val)) {
+    if ((IS_CHAR(val) && (outofrange == 0))) {
         return(val);
     } else {
         xmlFatalErrMsgInt(ctxt, XML_ERR_INVALID_CHAR,
@@ -1554,7 +1561,8 @@
 xmlParseStringCharRef(xmlParserCtxtPtr ctxt, const xmlChar **str) {
     const xmlChar *ptr;
     xmlChar cur;
-    int val = 0;
+    unsigned int val = 0;
+    unsigned int outofrange = 0;
 
     if ((str == NULL) || (*str == NULL)) return(0);
     ptr = *str;
@@ -1574,6 +1582,9 @@
 		val = 0;
 		break;
 	    }
+	    if (val > 0x10FFFF)
+	        outofrange = val;
+
 	    ptr++;
 	    cur = *ptr;
 	}
@@ -1590,6 +1601,9 @@
 		val = 0;
 		break;
 	    }
+	    if (val > 0x10FFFF)
+	        outofrange = val;
+
 	    ptr++;
 	    cur = *ptr;
 	}
@@ -1606,7 +1620,7 @@
      * Characters referred to using character references must match the
      * production for Char. 
      */
-    if (IS_CHAR(val)) {
+    if ((IS_CHAR(val) && (outofrange == 0))) {
         return(val);
     } else {
         xmlFatalErrMsgInt(ctxt, XML_ERR_INVALID_CHAR,
diff --git a/result/errors/charref1.xml b/result/errors/charref1.xml
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/result/errors/charref1.xml
diff --git a/result/errors/charref1.xml.err b/result/errors/charref1.xml.err
new file mode 100644
index 0000000..aa43bcf
--- /dev/null
+++ b/result/errors/charref1.xml.err
@@ -0,0 +1,3 @@
+./test/errors/charref1.xml:1: parser error : xmlParseCharRef: invalid xmlChar value 60
+<bla>&#010100000000000000000000000000000000000000000000000060;</bla>
+                                                              ^
diff --git a/result/errors/charref1.xml.str b/result/errors/charref1.xml.str
new file mode 100644
index 0000000..aa43bcf
--- /dev/null
+++ b/result/errors/charref1.xml.str
@@ -0,0 +1,3 @@
+./test/errors/charref1.xml:1: parser error : xmlParseCharRef: invalid xmlChar value 60
+<bla>&#010100000000000000000000000000000000000000000000000060;</bla>
+                                                              ^
diff --git a/test/errors/charref1.xml b/test/errors/charref1.xml
new file mode 100644
index 0000000..11423df
--- /dev/null
+++ b/test/errors/charref1.xml
@@ -0,0 +1 @@
+<bla>&#010100000000000000000000000000000000000000000000000060;</bla>