From da6293471524b14674e46363777c2fbf7adce3e8 Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@src.gnome.org>
Date: Wed, 1 Aug 2007 07:49:06 +0000
Subject: [PATCH] fixed a parser bug where invalid char in comment may not be
 detected,

* parser.c: fixed a parser bug where invalid char in comment may
  not be detected, reported by Ashwin Sinha
* test/errors/comment1.xml result/errors/comment1.xml*: added
  the example to the regression suite
Daniel

svn path=/trunk/; revision=3647
---
 ChangeLog                      |  7 +++++++
 libxml.spec.in                 |  6 +++---
 parser.c                       | 25 ++++++++++++++++++++++---
 result/errors/comment1.xml     |  0
 result/errors/comment1.xml.err |  6 ++++++
 result/errors/comment1.xml.str |  4 ++++
 test/errors/comment1.xml       |  6 ++++++
 7 files changed, 48 insertions(+), 6 deletions(-)
 create mode 100644 result/errors/comment1.xml
 create mode 100644 result/errors/comment1.xml.err
 create mode 100644 result/errors/comment1.xml.str
 create mode 100644 test/errors/comment1.xml

diff --git a/ChangeLog b/ChangeLog
index 81b235cf..491d383b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+Wed Aug  1 09:50:12 CEST 2007 Daniel Veillard <daniel@veillard.com>
+
+	* parser.c: fixed a parser bug where invalid char in comment may
+	  not be detected, reported by Ashwin Sinha
+	* test/errors/comment1.xml result/errors/comment1.xml*: added
+	  the example to the regression suite
+
 Thu Jul 26 13:42:26 CEST 2007 Daniel Veillard <daniel@veillard.com>
 
 	* xmlsave.c: fixed problem reported on bug #460415
diff --git a/libxml.spec.in b/libxml.spec.in
index 2345f3a7..fd135112 100644
--- a/libxml.spec.in
+++ b/libxml.spec.in
@@ -25,7 +25,7 @@ URI library.
 %package devel
 Summary: Libraries, includes, etc. to develop XML and HTML applications
 Group: Development/Libraries
-Requires: libxml2 = %{version}
+Requires: libxml2 = %{version}-%{release}
 Requires: zlib-devel
 Requires: pkgconfig
 
@@ -44,8 +44,8 @@ URI library.
 %package python
 Summary: Python bindings for the libxml2 library
 Group: Development/Libraries
-Requires: libxml2 = %{version}
-Requires: %{_libdir}/python%(echo `python -c "import sys; print sys.version[0:3]"`)
+Requires: libxml2 = %{version}-%{release}
+Requires: python
 
 %description python
 The libxml2-python package contains a module that permits applications
diff --git a/parser.c b/parser.c
index 6cc82775..e6ba4b8d 100644
--- a/parser.c
+++ b/parser.c
@@ -3817,10 +3817,24 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf, int len, int size) {
     q = CUR_CHAR(ql);
     if (q == 0)
         goto not_terminated;
+    if (!IS_CHAR(q)) {
+        xmlFatalErrMsgInt(ctxt, XML_ERR_INVALID_CHAR,
+                          "xmlParseComment: invalid xmlChar value %d\n",
+	                  q);
+	xmlFree (buf);
+	return;
+    }
     NEXTL(ql);
     r = CUR_CHAR(rl);
     if (r == 0)
         goto not_terminated;
+    if (!IS_CHAR(r)) {
+        xmlFatalErrMsgInt(ctxt, XML_ERR_INVALID_CHAR,
+                          "xmlParseComment: invalid xmlChar value %d\n",
+	                  q);
+	xmlFree (buf);
+	return;
+    }
     NEXTL(rl);
     cur = CUR_CHAR(l);
     if (cur == 0)
@@ -3862,10 +3876,13 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf, int len, int size) {
 	}
     }
     buf[len] = 0;
-    if (!IS_CHAR(cur)) {
+    if (cur == 0) {
 	xmlFatalErrMsgStr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
 	                     "Comment not terminated \n<!--%.50s\n", buf);
-	xmlFree(buf);
+    } else if (!IS_CHAR(cur)) {
+        xmlFatalErrMsgInt(ctxt, XML_ERR_INVALID_CHAR,
+                          "xmlParseComment: invalid xmlChar value %d\n",
+	                  cur);
     } else {
 	if (input != ctxt->input) {
 	    xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
@@ -3875,14 +3892,16 @@ xmlParseCommentComplex(xmlParserCtxtPtr ctxt, xmlChar *buf, int len, int size) {
 	if ((ctxt->sax != NULL) && (ctxt->sax->comment != NULL) &&
 	    (!ctxt->disableSAX))
 	    ctxt->sax->comment(ctxt->userData, buf);
-	xmlFree(buf);
     }
+    xmlFree(buf);
     return;
 not_terminated:
     xmlFatalErrMsgStr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
 			 "Comment not terminated\n", NULL);
     xmlFree(buf);
+    return;
 }
+
 /**
  * xmlParseComment:
  * @ctxt:  an XML parser context
diff --git a/result/errors/comment1.xml b/result/errors/comment1.xml
new file mode 100644
index 00000000..e69de29b
diff --git a/result/errors/comment1.xml.err b/result/errors/comment1.xml.err
new file mode 100644
index 00000000..5a732dd7
--- /dev/null
+++ b/result/errors/comment1.xml.err
@@ -0,0 +1,6 @@
+./test/errors/comment1.xml:5: parser error : xmlParseComment: invalid xmlChar value 14
+ in p02:  -->
+         ^
+./test/errors/comment1.xml:5: parser error : Start tag expected, '<' not found
+ in p02:  -->
+         ^
diff --git a/result/errors/comment1.xml.str b/result/errors/comment1.xml.str
new file mode 100644
index 00000000..494d1ed1
--- /dev/null
+++ b/result/errors/comment1.xml.str
@@ -0,0 +1,4 @@
+./test/errors/comment1.xml:5: parser error : xmlParseComment: invalid xmlChar value 14
+ in p02:  -->
+         ^
+./test/errors/comment1.xml : failed to parse
diff --git a/test/errors/comment1.xml b/test/errors/comment1.xml
new file mode 100644
index 00000000..b02bb175
--- /dev/null
+++ b/test/errors/comment1.xml
@@ -0,0 +1,6 @@
+<!DOCTYPE book [
+<!ELEMENT book ANY>
+]>
+<!-- IllegalChar #x0e
+ in p02:  -->
+<book/>