Skip to content
  • Nick Wellnhofer's avatar
    Fix handling of parameter-entity references · e2663054
    Nick Wellnhofer authored
    There were two bugs where parameter-entity references could lead to an
    unexpected change of the input buffer in xmlParseNameComplex and
    xmlDictLookup being called with an invalid pointer.
    
    Percent sign in DTD Names
    =========================
    
    The NEXTL macro used to call xmlParserHandlePEReference. When parsing
    "complex" names inside the DTD, this could result in entity expansion
    which created a new input buffer. The fix is to simply remove the call
    to xmlParserHandlePEReference from the NEXTL macro. This is safe because
    no users of the macro require expansion of parameter entities.
    
    - xmlParseNameComplex
    - xmlParseNCNameComplex
    - xmlParseNmtoken
    
    The percent sign is not allowed in names, which are grammatical tokens.
    
    - xmlParseEntityValue
    
    Parameter-entity references in entity values are expanded but this
    happens in a separate step in this function.
    
    - xmlParseSystemLiteral
    
    Parameter-entity references are ignored in the system literal.
    
    - xmlParseAttValueCompl...
    e2663054