Upgrade libxml2 to 2.7.3 to patch some vulnerabilities.
diff --git a/xmlIO.c b/xmlIO.c
index 7782776..d4dc364 100644
--- a/xmlIO.c
+++ b/xmlIO.c
@@ -135,6 +135,9 @@
static xmlOutputCallback xmlOutputCallbackTable[MAX_OUTPUT_CALLBACK];
static int xmlOutputCallbackNr = 0;
static int xmlOutputCallbackInitialized = 0;
+
+xmlOutputBufferPtr
+xmlAllocOutputBufferInternal(xmlCharEncodingHandlerPtr encoder);
#endif /* LIBXML_OUTPUT_ENABLED */
/************************************************************************
@@ -1720,7 +1723,7 @@
{
/* Any character conversions should have been done before this */
- ctxt->doc_buff = xmlAllocOutputBuffer(NULL);
+ ctxt->doc_buff = xmlAllocOutputBufferInternal(NULL);
}
if (ctxt->doc_buff == NULL) {
@@ -1731,7 +1734,7 @@
return (ctxt);
}
#endif /* LIBXML_OUTPUT_ENABLED */
-
+
#ifdef LIBXML_OUTPUT_ENABLED
/**
* xmlIOHTTPDfltOpenW
@@ -2274,10 +2277,15 @@
xmlFree(ret);
return(NULL);
}
- ret->buffer->alloc = XML_BUFFER_ALLOC_DOUBLEIT;
+
ret->encoder = encoder;
if (encoder != NULL) {
ret->conv = xmlBufferCreateSize(4000);
+ if (ret->conv == NULL) {
+ xmlFree(ret);
+ return(NULL);
+ }
+
/*
* This call is designed to initiate the encoder state
*/
@@ -2291,6 +2299,62 @@
return(ret);
}
+
+/**
+ * xmlAllocOutputBufferInternal:
+ * @encoder: the encoding converter or NULL
+ *
+ * Create a buffered parser output
+ *
+ * Returns the new parser output or NULL
+ */
+xmlOutputBufferPtr
+xmlAllocOutputBufferInternal(xmlCharEncodingHandlerPtr encoder) {
+ xmlOutputBufferPtr ret;
+
+ ret = (xmlOutputBufferPtr) xmlMalloc(sizeof(xmlOutputBuffer));
+ if (ret == NULL) {
+ xmlIOErrMemory("creating output buffer");
+ return(NULL);
+ }
+ memset(ret, 0, (size_t) sizeof(xmlOutputBuffer));
+ ret->buffer = xmlBufferCreate();
+ if (ret->buffer == NULL) {
+ xmlFree(ret);
+ return(NULL);
+ }
+
+
+ /*
+ * For conversion buffers we use the special IO handling
+ * We don't do that from the exported API to avoid confusing
+ * user's code.
+ */
+ ret->buffer->alloc = XML_BUFFER_ALLOC_IO;
+ ret->buffer->contentIO = ret->buffer->content;
+
+ ret->encoder = encoder;
+ if (encoder != NULL) {
+ ret->conv = xmlBufferCreateSize(4000);
+ if (ret->conv == NULL) {
+ xmlFree(ret);
+ return(NULL);
+ }
+
+ /*
+ * This call is designed to initiate the encoder state
+ */
+ xmlCharEncOutFunc(encoder, ret->conv, NULL);
+ } else
+ ret->conv = NULL;
+ ret->writecallback = NULL;
+ ret->closecallback = NULL;
+ ret->context = NULL;
+ ret->written = 0;
+
+ return(ret);
+}
+
#endif /* LIBXML_OUTPUT_ENABLED */
/**
@@ -2491,7 +2555,7 @@
if ((compression > 0) && (compression <= 9) && (is_file_uri == 1)) {
context = xmlGzfileOpenW(unescaped, compression);
if (context != NULL) {
- ret = xmlAllocOutputBuffer(encoder);
+ ret = xmlAllocOutputBufferInternal(encoder);
if (ret != NULL) {
ret->context = context;
ret->writecallback = xmlGzfileWrite;
@@ -2528,7 +2592,7 @@
if ((compression > 0) && (compression <= 9) && (is_file_uri == 1)) {
context = xmlGzfileOpenW(URI, compression);
if (context != NULL) {
- ret = xmlAllocOutputBuffer(encoder);
+ ret = xmlAllocOutputBufferInternal(encoder);
if (ret != NULL) {
ret->context = context;
ret->writecallback = xmlGzfileWrite;
@@ -2561,7 +2625,7 @@
/*
* Allocate the Output buffer front-end.
*/
- ret = xmlAllocOutputBuffer(encoder);
+ ret = xmlAllocOutputBufferInternal(encoder);
if (ret != NULL) {
ret->context = context;
ret->writecallback = xmlOutputCallbackTable[i].writecallback;
@@ -2645,7 +2709,7 @@
if (file == NULL) return(NULL);
- ret = xmlAllocOutputBuffer(encoder);
+ ret = xmlAllocOutputBufferInternal(encoder);
if (ret != NULL) {
ret->context = file;
ret->writecallback = xmlFileWrite;
@@ -2803,7 +2867,7 @@
if (fd < 0) return(NULL);
- ret = xmlAllocOutputBuffer(encoder);
+ ret = xmlAllocOutputBufferInternal(encoder);
if (ret != NULL) {
ret->context = (void *) (long) fd;
ret->writecallback = xmlFdWrite;
@@ -2864,7 +2928,7 @@
if (iowrite == NULL) return(NULL);
- ret = xmlAllocOutputBuffer(encoder);
+ ret = xmlAllocOutputBufferInternal(encoder);
if (ret != NULL) {
ret->context = (void *) ioctx;
ret->writecallback = iowrite;
@@ -3315,6 +3379,17 @@
cons = len;
chunk = (out->buffer->size - out->buffer->use) - 1;
+ /*
+ * make sure we have enough room to save first, if this is
+ * not the case force a flush, but make sure we stay in the loop
+ */
+ if (chunk < 40) {
+ if (xmlBufferGrow(out->buffer, out->buffer->size + 100) < 0)
+ return(-1);
+ oldwritten = -1;
+ continue;
+ }
+
/*
* first handle encoding stuff.
*/