Update libxml2 to 2.9.3.

v2.9.3: Nov 20 2015

    Security:
    CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh Davenport),
    CVE-2015-7500 Fix memory access error due to incorrect entities boundaries (Daniel Veillard),
    CVE-2015-7499-2 Detect incoherency on GROW (Daniel Veillard),
    CVE-2015-7499-1 Add xmlHaltParser() to stop the parser (Daniel Veillard),
    CVE-2015-5312 Another entity expansion issue (David Drysdale),
    CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey (David Drysdale),
    CVE-2015-7498 Avoid processing entities after encoding conversion failures (Daniel Veillard),
    CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard),
    CVE-2015-7942-2 Fix an error in previous Conditional section patch (Daniel Veillard),
    CVE-2015-7942 Another variation of overflow in Conditional sections (Daniel Veillard),
    CVE-2015-1819 Enforce the reader to run in constant memory (Daniel Veillard)
    CVE-2015-7941_2 Cleanup conditional section error handling (Daniel Veillard),
    CVE-2015-7941_1 Stop parsing on entities boundaries errors (Daniel Veillard),
    Documentation:
    Correct spelling of "calling" (Alex Henrie),
    Fix a small error in xmllint --format description (Fabien Degomme),
    Avoid XSS on the search of xmlsoft.org (Daniel Veillard)
    Portability:
    threads: use forward declarations only for glibc (Michael Heimpold),
    Update Win32 configure.js to search for configure.ac (Daniel Veillard)
    Bug Fixes:
    Bug on creating new stream from entity (Daniel Veillard),
    Fix some loop issues embedding NEXT (Daniel Veillard),
    Do not print error context when there is none (Daniel Veillard),
    Avoid extra processing of MarkupDecl when EOF (Hugh Davenport),
    Fix parsing short unclosed comment uninitialized access (Daniel Veillard),
    Add missing Null check in xmlParseExternalEntityPrivate (Gaurav Gupta),
    Fix a bug in CData error handling in the push parser (Daniel Veillard),
    Fix a bug on name parsing at the end of current input buffer (Daniel Veillard),
    Fix the spurious ID already defined error (Daniel Veillard),
    Fix previous change to node sort order (Nick Wellnhofer),
    Fix a self assignment issue raised by clang (Scott Graham),
    Fail parsing early on if encoding conversion failed (Daniel Veillard),
    Do not process encoding values if the declaration if broken (Daniel Veillard),
    Silence clang's -Wunknown-attribute (Michael Catanzaro),
    xmlMemUsed is not thread-safe (Martin von Gagern),
    Fix support for except in nameclasses (Daniel Veillard),
    Fix order of root nodes (Nick Wellnhofer),
    Allow attributes on descendant-or-self axis (Nick Wellnhofer),
    Fix the fix to Windows locking (Steve Nairn),
    Fix timsort invariant loop re: Envisage article (Christopher Swenson),
    Don't add IDs in xmlSetTreeDoc (Nick Wellnhofer),
    Account for ID attributes in xmlSetTreeDoc (Nick Wellnhofer),
    Remove various unused value assignments (Philip Withnall),
    Fix missing entities after CVE-2014-3660 fix (Daniel Veillard),
    Revert "Missing initialization for the catalog module" (Daniel Veillard)
    Improvements:
    Reuse xmlHaltParser() where it makes sense (Daniel Veillard),
    xmlStopParser reset errNo (Daniel Veillard),
    Reenable xz support by default (Daniel Veillard),
    Recover unescaped less-than character in HTML recovery parsing (Daniel Veillard),
    Allow HTML serializer to output HTML5 DOCTYPE (Shaun McCance),
    Regression test for bug #695699 (Nick Wellnhofer),
    Add a couple of XPath tests (Nick Wellnhofer),
    Add Python 3 rpm subpackage (Tomas Radej),
    libxml2-config.cmake.in: update include directories (Samuel Martin),
    Adding example from bugs 738805 to regression tests (Daniel Veillard)

9 files changed, 7 insertions, 359 deletions

diff --git a/textproc/libxml2/Makefile b/textproc/libxml2/Makefile
index 608e261538f..b41088162fa 100644
--- a/textproc/libxml2/Makefile
+++ b/textproc/libxml2/Makefile
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.138 2015/07/03 18:55:46 he Exp $
+# $NetBSD: Makefile,v 1.139 2015/11/22 23:49:03 wiz Exp $
 
-DISTNAME=	libxml2-2.9.2
-PKGREVISION=	3
+DISTNAME=	libxml2-2.9.3
 CATEGORIES=	textproc
 MASTER_SITES=	ftp://xmlsoft.org/libxml2/ \
 		http://xmlsoft.org/sources/
diff --git a/textproc/libxml2/distinfo b/textproc/libxml2/distinfo
index a84304bccfd..c89fcec8598 100644
--- a/textproc/libxml2/distinfo
+++ b/textproc/libxml2/distinfo
@@ -1,19 +1,12 @@
-$NetBSD: distinfo,v 1.108 2015/11/04 01:59:39 agc Exp $
+$NetBSD: distinfo,v 1.109 2015/11/22 23:49:03 wiz Exp $
 
-SHA1 (libxml2-2.9.2.tar.gz) = f46a37ea6d869f702e03f393c376760f3cbee673
-RMD160 (libxml2-2.9.2.tar.gz) = 969b4ed8782f455fd4a6ca1c1b4ffa7651090070
-SHA512 (libxml2-2.9.2.tar.gz) = a4e3b20e2efceed39c20379b32b746d4a1cf65c0cf7719d26c9bf7483c1f04a4e5a442ae2f36dc4ae8a4d011b67cfb58d9f6d0be034fa3e897a49059c9289565
-Size (libxml2-2.9.2.tar.gz) = 5444991 bytes
-SHA1 (patch-HTMLparser.c) = 46e062001d8c7688f9c938741dbd53e917169d1f
+SHA1 (libxml2-2.9.3.tar.gz) = 0301ce933637e0ceda049047dbefd18714f59b6e
+RMD160 (libxml2-2.9.3.tar.gz) = 8ffed136daaf3595c306b76c5600ce67b5984e61
+SHA512 (libxml2-2.9.3.tar.gz) = 078afa65229de4f23e6538767253fb4f9f61d96cb72e445179c71d536b224d54922f22972a2b71434796f83f8c99f6a46c3b8813cb4582ad9fca696d141e0abb
+Size (libxml2-2.9.3.tar.gz) = 5477112 bytes
 SHA1 (patch-aa) = 7d1213079cc78c9a28476c49f1283ab1c6af3b34
 SHA1 (patch-ab) = bf8983fcde35edf0e450209bf07f0fa628f7bd9e
 SHA1 (patch-ac) = 015a5903a86793bd770f16f251b94e5b2562b3f7
 SHA1 (patch-ad) = fe255e93f9aefd5403d646cd45d9fbdcbd100bd6
 SHA1 (patch-ae) = d479d5a0c8b906de3cbe1c30b100c6f8b1bb9c43
 SHA1 (patch-ag) = f037f13ccc4047d4bf824a2091e60ac89b172558
-SHA1 (patch-aj) = aab00bf2ba0168fa8f6070db985531c676b5c34d
-SHA1 (patch-ba) = 78097bb871cc614c8d95a53d825542d23e113192
-SHA1 (patch-buf.c) = 087a768a39441189b226cda500475014462ff8fd
-SHA1 (patch-include_libxml_tree.h) = 9978e6a3ea2408a9aaf68fe1663df5f7dce12eee
-SHA1 (patch-threads.c) = 425796881df8520356abbfff001f0e6191d9f186
-SHA1 (patch-xmlreader.c) = cb8710e4c0261a98a68e3e69388d3a4341629f22
diff --git a/textproc/libxml2/patches/patch-HTMLparser.c b/textproc/libxml2/patches/patch-HTMLparser.c
deleted file mode 100644
index 7ca54520837..00000000000
--- a/textproc/libxml2/patches/patch-HTMLparser.c
+++ /dev/null
@@ -1,90 +0,0 @@
-$NetBSD: patch-HTMLparser.c,v 1.1 2015/07/03 18:55:46 he Exp $
-
-Suggested patch for arbitrary-memory-access vulnerability, from
-https://bugzilla.gnome.org/show_bug.cgi?id=746048
-
---- HTMLparser.c.orig	2014-10-06 10:48:11.000000000 +0000
-+++ HTMLparser.c
-@@ -3245,13 +3245,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt)
- 	ctxt->instate = state;
- 	return;
-     }
-+    if ((ctxt->input->end - ctxt->input->cur) < 3) {
-+        ctxt->instate = XML_PARSER_EOF;
-+        htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
-+                     "Comment not terminated\n", NULL, NULL);
-+        xmlFree(buf);
-+        return;
-+    }
-     q = CUR_CHAR(ql);
-     NEXTL(ql);
-     r = CUR_CHAR(rl);
-     NEXTL(rl);
-     cur = CUR_CHAR(l);
-     len = 0;
--    while (IS_CHAR(cur) &&
-+    while (((ctxt->input->end - ctxt->input->cur) > 0) && IS_CHAR(cur) &&
-            ((cur != '>') ||
- 	    (r != '-') || (q != '-'))) {
- 	if (len + 5 >= size) {
-@@ -3281,7 +3288,7 @@ htmlParseComment(htmlParserCtxtPtr ctxt)
- 	}
-     }
-     buf[len] = 0;
--    if (!IS_CHAR(cur)) {
-+    if (!(ctxt->input->end - ctxt->input->cur) || !IS_CHAR(cur)) {
- 	htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
- 	             "Comment not terminated \n<!--%.50s\n", buf, NULL);
- 	xmlFree(buf);
-@@ -4465,6 +4472,7 @@ htmlParseContentInternal(htmlParserCtxtP
-     depth = ctxt->nameNr;
-     while (1) {
- 	long cons = ctxt->nbChars;
-+    long rem = ctxt->input->end - ctxt->input->cur;
- 
-         GROW;
- 
-@@ -4540,7 +4548,7 @@ htmlParseContentInternal(htmlParserCtxtP
- 	    /*
- 	     * Sometimes DOCTYPE arrives in the middle of the document
- 	     */
--	    if ((CUR == '<') && (NXT(1) == '!') &&
-+	    if ((rem >= 9) && (CUR == '<') && (NXT(1) == '!') &&
- 		(UPP(2) == 'D') && (UPP(3) == 'O') &&
- 		(UPP(4) == 'C') && (UPP(5) == 'T') &&
- 		(UPP(6) == 'Y') && (UPP(7) == 'P') &&
-@@ -4554,7 +4562,7 @@ htmlParseContentInternal(htmlParserCtxtP
- 	    /*
- 	     * First case :  a comment
- 	     */
--	    if ((CUR == '<') && (NXT(1) == '!') &&
-+	    if ((rem >= 4) && (CUR == '<') && (NXT(1) == '!') &&
- 		(NXT(2) == '-') && (NXT(3) == '-')) {
- 		htmlParseComment(ctxt);
- 	    }
-@@ -4562,14 +4570,14 @@ htmlParseContentInternal(htmlParserCtxtP
- 	    /*
- 	     * Second case : a Processing Instruction.
- 	     */
--	    else if ((CUR == '<') && (NXT(1) == '?')) {
-+	    else if ((rem >= 2) && (CUR == '<') && (NXT(1) == '?')) {
- 		htmlParsePI(ctxt);
- 	    }
- 
- 	    /*
- 	     * Third case :  a sub-element.
- 	     */
--	    else if (CUR == '<') {
-+	    else if ((rem >= 1) && (CUR == '<')) {
- 		htmlParseElementInternal(ctxt);
- 		if (currentNode != NULL) xmlFree(currentNode);
- 
-@@ -4581,7 +4589,7 @@ htmlParseContentInternal(htmlParserCtxtP
- 	     * Fourth case : a reference. If if has not been resolved,
- 	     *    parsing returns it's Name, create the node
- 	     */
--	    else if (CUR == '&') {
-+	    else if ((rem >= 1) && (CUR == '&')) {
- 		htmlParseReference(ctxt);
- 	    }
- 
diff --git a/textproc/libxml2/patches/patch-aj b/textproc/libxml2/patches/patch-aj
deleted file mode 100644
index d3bac6f99ad..00000000000
--- a/textproc/libxml2/patches/patch-aj
+++ /dev/null
@@ -1,18 +0,0 @@
-$NetBSD: patch-aj,v 1.4 2015/04/24 11:32:29 spz Exp $
-
-Inlucde resolv.h conditionally:
-  https://bugzilla.gnome.org/show_bug.cgi?id=617053
-
---- nanohttp.c.orig	2014-10-03 11:28:05.000000000 +0000
-+++ nanohttp.c
-@@ -43,8 +43,10 @@
- #ifdef HAVE_ARPA_NAMESER_H
- #include <arpa/nameser.h>
- #endif
-+#ifdef HAVE_RESOLV_H
- #include <resolv.h>
- #endif
-+#endif
- #ifdef HAVE_FCNTL_H
- #include <fcntl.h>
- #endif
diff --git a/textproc/libxml2/patches/patch-ba b/textproc/libxml2/patches/patch-ba
deleted file mode 100644
index fb01607cd0a..00000000000
--- a/textproc/libxml2/patches/patch-ba
+++ /dev/null
@@ -1,27 +0,0 @@
-$NetBSD: patch-ba,v 1.3 2014/10/28 18:55:56 drochner Exp $
-
-https://git.gnome.org/browse/libxml2/commit/?id=f65128f38289d77ff322d63aef2858cc0a819c34
-https://git.gnome.org/browse/libxml2/commit/?id=72a46a519ce7326d9a00f0b6a7f2a8e958cd1675
-
---- parser.c.orig	2014-10-16 05:57:40.000000000 +0000
-+++ parser.c
-@@ -7235,7 +7235,8 @@ xmlParseReference(xmlParserCtxtPtr ctxt)
-      * far more secure as the parser will only process data coming from
-      * the document entity by default.
-      */
--    if ((ent->checked == 0) &&
-+    if (((ent->checked == 0) ||
-+	 ((ent->children == NULL) && (ctxt->options & XML_PARSE_NOENT))) &&
-         ((ent->etype != XML_EXTERNAL_GENERAL_PARSED_ENTITY) ||
-          (ctxt->options & (XML_PARSE_NOENT | XML_PARSE_DTDVALID)))) {
- 	unsigned long oldnbent = ctxt->nbentities;
-@@ -14830,9 +14831,6 @@ xmlInitParser(void) {
- #ifdef LIBXML_XPATH_ENABLED
- 	xmlXPathInit();
- #endif
--#ifdef LIBXML_CATALOG_ENABLED
--        xmlInitializeCatalog();
--#endif
- 	xmlParserInitialized = 1;
- #ifdef LIBXML_THREAD_ENABLED
-     }
diff --git a/textproc/libxml2/patches/patch-buf.c b/textproc/libxml2/patches/patch-buf.c
deleted file mode 100644
index 3f7cf8fb2bd..00000000000
--- a/textproc/libxml2/patches/patch-buf.c
+++ /dev/null
@@ -1,94 +0,0 @@
-$NetBSD: patch-buf.c,v 1.1 2015/04/24 11:32:29 spz Exp $
-
-patch for CVE-2015-1819 Enforce the reader to run in constant memory
-from https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9
-part 1
-
---- buf.c.orig	2014-10-13 08:01:31.000000000 +0000
-+++ buf.c
-@@ -27,6 +27,7 @@
- #include <libxml/tree.h>
- #include <libxml/globals.h>
- #include <libxml/tree.h>
-+#include <libxml/parserInternals.h> /* for XML_MAX_TEXT_LENGTH */
- #include "buf.h"
- 
- #define WITH_BUFFER_COMPAT
-@@ -299,7 +300,8 @@ xmlBufSetAllocationScheme(xmlBufPtr buf,
-     if ((scheme == XML_BUFFER_ALLOC_DOUBLEIT) ||
-         (scheme == XML_BUFFER_ALLOC_EXACT) ||
-         (scheme == XML_BUFFER_ALLOC_HYBRID) ||
--        (scheme == XML_BUFFER_ALLOC_IMMUTABLE)) {
-+        (scheme == XML_BUFFER_ALLOC_IMMUTABLE) ||
-+        (scheme == XML_BUFFER_ALLOC_BOUNDED)) {
- 	buf->alloc = scheme;
-         if (buf->buffer)
-             buf->buffer->alloc = scheme;
-@@ -458,6 +460,18 @@ xmlBufGrowInternal(xmlBufPtr buf, size_t
-     size = buf->use + len + 100;
- #endif
- 
-+    if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
-+        /*
-+	 * Used to provide parsing limits
-+	 */
-+        if ((buf->use + len >= XML_MAX_TEXT_LENGTH) ||
-+	    (buf->size >= XML_MAX_TEXT_LENGTH)) {
-+	    xmlBufMemoryError(buf, "buffer error: text too long\n");
-+	    return(0);
-+	}
-+	if (size >= XML_MAX_TEXT_LENGTH)
-+	    size = XML_MAX_TEXT_LENGTH;
-+    }
-     if ((buf->alloc == XML_BUFFER_ALLOC_IO) && (buf->contentIO != NULL)) {
-         size_t start_buf = buf->content - buf->contentIO;
- 
-@@ -738,7 +752,15 @@ xmlBufResize(xmlBufPtr buf, size_t size)
-         return(0);
-     CHECK_COMPAT(buf)
- 
--    if (buf->alloc == XML_BUFFER_ALLOC_IMMUTABLE) return(0);
-+    if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
-+        /*
-+	 * Used to provide parsing limits
-+	 */
-+        if (size >= XML_MAX_TEXT_LENGTH) {
-+	    xmlBufMemoryError(buf, "buffer error: text too long\n");
-+	    return(0);
-+	}
-+    }
- 
-     /* Don't resize if we don't have to */
-     if (size < buf->size)
-@@ -867,6 +889,15 @@ xmlBufAdd(xmlBufPtr buf, const xmlChar *
- 
-     needSize = buf->use + len + 2;
-     if (needSize > buf->size){
-+	if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
-+	    /*
-+	     * Used to provide parsing limits
-+	     */
-+	    if (needSize >= XML_MAX_TEXT_LENGTH) {
-+		xmlBufMemoryError(buf, "buffer error: text too long\n");
-+		return(-1);
-+	    }
-+	}
-         if (!xmlBufResize(buf, needSize)){
- 	    xmlBufMemoryError(buf, "growing buffer");
-             return XML_ERR_NO_MEMORY;
-@@ -938,6 +969,15 @@ xmlBufAddHead(xmlBufPtr buf, const xmlCh
-     }
-     needSize = buf->use + len + 2;
-     if (needSize > buf->size){
-+	if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
-+	    /*
-+	     * Used to provide parsing limits
-+	     */
-+	    if (needSize >= XML_MAX_TEXT_LENGTH) {
-+		xmlBufMemoryError(buf, "buffer error: text too long\n");
-+		return(-1);
-+	    }
-+	}
-         if (!xmlBufResize(buf, needSize)){
- 	    xmlBufMemoryError(buf, "growing buffer");
-             return XML_ERR_NO_MEMORY;
diff --git a/textproc/libxml2/patches/patch-include_libxml_tree.h b/textproc/libxml2/patches/patch-include_libxml_tree.h
deleted file mode 100644
index 4ca5b0261ca..00000000000
--- a/textproc/libxml2/patches/patch-include_libxml_tree.h
+++ /dev/null
@@ -1,18 +0,0 @@
-$NetBSD: patch-include_libxml_tree.h,v 1.1 2015/04/24 11:32:29 spz Exp $
-
-patch for CVE-2015-1819 Enforce the reader to run in constant memory
-from https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9
-part 2
-
---- include/libxml/tree.h.orig	2014-10-13 08:20:09.000000000 +0000
-+++ include/libxml/tree.h
-@@ -76,7 +76,8 @@ typedef enum {
-     XML_BUFFER_ALLOC_EXACT,	/* grow only to the minimal size */
-     XML_BUFFER_ALLOC_IMMUTABLE, /* immutable buffer */
-     XML_BUFFER_ALLOC_IO,	/* special allocation scheme used for I/O */
--    XML_BUFFER_ALLOC_HYBRID	/* exact up to a threshold, and doubleit thereafter */
-+    XML_BUFFER_ALLOC_HYBRID,	/* exact up to a threshold, and doubleit thereafter */
-+    XML_BUFFER_ALLOC_BOUNDED    /* limit the upper size of the buffer */
- } xmlBufferAllocationScheme;
- 
- /**
diff --git a/textproc/libxml2/patches/patch-threads.c b/textproc/libxml2/patches/patch-threads.c
deleted file mode 100644
index 6a19f102fd2..00000000000
--- a/textproc/libxml2/patches/patch-threads.c
+++ /dev/null
@@ -1,38 +0,0 @@
-$NetBSD: patch-threads.c,v 1.5 2015/04/24 11:32:29 spz Exp $
-
-* Treat OpenBSD and MirBSD same as Linux to avoid linking with libpthread
-* NetBSD<4.99.36 and FreeBSD<7.0 lack pthread_equal() stub function in libc
-* pthread_once_t cast needed to avoid compilation error
-
---- threads.c.orig	2014-10-13 07:02:28.000000000 +0000
-+++ threads.c
-@@ -42,13 +42,17 @@
- #include <note.h>
- #endif
- 
-+#if defined(__NetBSD__)
-+#include <sys/param.h>
-+#endif
-+
- /* #define DEBUG_THREADS */
- 
- #ifdef HAVE_PTHREAD_H
- 
- static int libxml_is_threaded = -1;
- #ifdef __GNUC__
--#ifdef linux
-+#if defined(linux) || defined(__OpenBSD__) || defined(__MirBSD__)
- #if (__GNUC__ == 3 && __GNUC_MINOR__ >= 3) || (__GNUC__ > 3)
- extern int pthread_once (pthread_once_t *__once_control,
-                          void (*__init_routine) (void))
-@@ -90,6 +94,10 @@ extern int pthread_cond_signal ()
- #endif
- #endif /* linux */
- #endif /* __GNUC__ */
-+#if (defined(__NetBSD__) && __NetBSD_Version__ < 499003600) || (defined(__FreeBSD__) && __FreeBSD_version < 700000)
-+extern int pthread_equal ()
-+	   __attribute((weak));
-+#endif /* NetBSD-4, FreeBSD-6 */
- #endif /* HAVE_PTHREAD_H */
- 
- /*
diff --git a/textproc/libxml2/patches/patch-xmlreader.c b/textproc/libxml2/patches/patch-xmlreader.c
deleted file mode 100644
index 6ff602006aa..00000000000
--- a/textproc/libxml2/patches/patch-xmlreader.c
+++ /dev/null
@@ -1,59 +0,0 @@
-$NetBSD: patch-xmlreader.c,v 1.1 2015/04/24 11:32:29 spz Exp $
-
-patch for CVE-2015-1819 Enforce the reader to run in constant memory
-from https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9
-part 3
-
---- xmlreader.c.orig	2014-10-06 12:05:09.000000000 +0000
-+++ xmlreader.c
-@@ -2091,6 +2091,9 @@ xmlNewTextReader(xmlParserInputBufferPtr
- 		"xmlNewTextReader : malloc failed\n");
- 	return(NULL);
-     }
-+    /* no operation on a reader should require a huge buffer */
-+    xmlBufSetAllocationScheme(ret->buffer,
-+			      XML_BUFFER_ALLOC_BOUNDED);
-     ret->sax = (xmlSAXHandler *) xmlMalloc(sizeof(xmlSAXHandler));
-     if (ret->sax == NULL) {
- 	xmlBufFree(ret->buffer);
-@@ -3616,6 +3619,7 @@ xmlTextReaderConstValue(xmlTextReaderPtr
- 	    return(((xmlNsPtr) node)->href);
-         case XML_ATTRIBUTE_NODE:{
- 	    xmlAttrPtr attr = (xmlAttrPtr) node;
-+            const xmlChar *ret;
- 
- 	    if ((attr->children != NULL) &&
- 	        (attr->children->type == XML_TEXT_NODE) &&
-@@ -3629,10 +3633,21 @@ xmlTextReaderConstValue(xmlTextReaderPtr
-                                         "xmlTextReaderSetup : malloc failed\n");
-                         return (NULL);
-                     }
-+		    xmlBufSetAllocationScheme(reader->buffer,
-+		                              XML_BUFFER_ALLOC_BOUNDED);
-                 } else
-                     xmlBufEmpty(reader->buffer);
- 	        xmlBufGetNodeContent(reader->buffer, node);
--		return(xmlBufContent(reader->buffer));
-+		ret = xmlBufContent(reader->buffer);
-+		if (ret == NULL) {
-+		    /* error on the buffer best to reallocate */
-+		    xmlBufFree(reader->buffer);
-+		    reader->buffer = xmlBufCreateSize(100);
-+		    xmlBufSetAllocationScheme(reader->buffer,
-+		                              XML_BUFFER_ALLOC_BOUNDED);
-+		    ret = BAD_CAST "";
-+		}
-+		return(ret);
- 	    }
- 	    break;
- 	}
-@@ -5131,6 +5146,9 @@ xmlTextReaderSetup(xmlTextReaderPtr read
-                         "xmlTextReaderSetup : malloc failed\n");
-         return (-1);
-     }
-+    /* no operation on a reader should require a huge buffer */
-+    xmlBufSetAllocationScheme(reader->buffer,
-+			      XML_BUFFER_ALLOC_BOUNDED);
-     if (reader->sax == NULL)
- 	reader->sax = (xmlSAXHandler *) xmlMalloc(sizeof(xmlSAXHandler));
-     if (reader->sax == NULL) {