Merge remote-tracking branch 'libxml2/master' into cm-13.0replicant-6.0-0001stable/cm-13.0-ZNH5Ystable/cm-13.0-ZNH2KBstable/cm-13.0-ZNH2Kstable/cm-13.0-ZNH0E

Change-Id: Ie7fc53fdf2140f593e0d275ae7b445b4f4723551

90 files changed, 1100 insertions, 341 deletions

diff --git a/HTMLparser.c b/HTMLparser.c
index d329d3b5..b7291972 100644
--- a/HTMLparser.c
+++ b/HTMLparser.c
@@ -2948,8 +2948,9 @@ htmlParseScript(htmlParserCtxtPtr ctxt) {
 
 
 /**
- * htmlParseCharData:
+ * htmlParseCharDataInternal:
  * @ctxt:  an HTML parser context
+ * @readahead: optional read ahead character in ascii range
  *
  * parse a CharData section.
  * if we are within a CDATA section ']]>' marks an end of section.
@@ -2958,12 +2959,15 @@ htmlParseScript(htmlParserCtxtPtr ctxt) {
  */
 
 static void
-htmlParseCharData(htmlParserCtxtPtr ctxt) {
-    xmlChar buf[HTML_PARSER_BIG_BUFFER_SIZE + 5];
+htmlParseCharDataInternal(htmlParserCtxtPtr ctxt, int readahead) {
+    xmlChar buf[HTML_PARSER_BIG_BUFFER_SIZE + 6];
     int nbchar = 0;
     int cur, l;
     int chunk = 0;
 
+    if (readahead)
+        buf[nbchar++] = readahead;
+
     SHRINK;
     cur = CUR_CHAR(l);
     while (((cur != '<') || (ctxt->token == '<')) &&
@@ -3043,6 +3047,21 @@ htmlParseCharData(htmlParserCtxtPtr ctxt) {
 }
 
 /**
+ * htmlParseCharData:
+ * @ctxt:  an HTML parser context
+ *
+ * parse a CharData section.
+ * if we are within a CDATA section ']]>' marks an end of section.
+ *
+ * [14] CharData ::= [^<&]* - ([^<&]* ']]>' [^<&]*)
+ */
+
+static void
+htmlParseCharData(htmlParserCtxtPtr ctxt) {
+    htmlParseCharDataInternal(ctxt, 0);
+}
+
+/**
  * htmlParseExternalID:
  * @ctxt:  an HTML parser context
  * @publicID:  a xmlChar** receiving PubidLiteral
@@ -3245,12 +3264,17 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
 	ctxt->instate = state;
 	return;
     }
+    len = 0;
+    buf[len] = 0;
     q = CUR_CHAR(ql);
+    if (!IS_CHAR(q))
+        goto unfinished;
     NEXTL(ql);
     r = CUR_CHAR(rl);
+    if (!IS_CHAR(r))
+        goto unfinished;
     NEXTL(rl);
     cur = CUR_CHAR(l);
-    len = 0;
     while (IS_CHAR(cur) &&
            ((cur != '>') ||
 	    (r != '-') || (q != '-'))) {
@@ -3281,18 +3305,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
 	}
     }
     buf[len] = 0;
-    if (!IS_CHAR(cur)) {
-	htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
-	             "Comment not terminated \n<!--%.50s\n", buf, NULL);
-	xmlFree(buf);
-    } else {
+    if (IS_CHAR(cur)) {
         NEXT;
 	if ((ctxt->sax != NULL) && (ctxt->sax->comment != NULL) &&
 	    (!ctxt->disableSAX))
 	    ctxt->sax->comment(ctxt->userData, buf);
 	xmlFree(buf);
+	ctxt->instate = state;
+	return;
     }
-    ctxt->instate = state;
+
+unfinished:
+    htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
+		 "Comment not terminated \n<!--%.50s\n", buf, NULL);
+    xmlFree(buf);
 }
 
 /**
@@ -3690,6 +3716,14 @@ htmlParseStartTag(htmlParserCtxtPtr ctxt) {
 	htmlParseErr(ctxt, XML_ERR_NAME_REQUIRED,
 	             "htmlParseStartTag: invalid element name\n",
 		     NULL, NULL);
+	/* if recover preserve text on classic misconstructs */
+	if ((ctxt->recovery) && ((IS_BLANK_CH(CUR)) || (CUR == '<') ||
+	    (CUR == '=') || (CUR == '>') || (((CUR >= '0') && (CUR <= '9'))))) {
+	    htmlParseCharDataInternal(ctxt, '<');
+	    return(-1);
+	}
+
+
 	/* Dump the bogus tag like browsers do */
 	while ((IS_CHAR_CH(CUR)) && (CUR != '>') &&
                (ctxt->instate != XML_PARSER_EOF))
@@ -5701,17 +5735,17 @@ htmlParseTryOrFinish(htmlParserCtxtPtr ctxt, int terminate) {
 				if (ctxt->keepBlanks) {
 				    if (ctxt->sax->characters != NULL)
 					ctxt->sax->characters(
-						ctxt->userData, &cur, 1);
+						ctxt->userData, &in->cur[0], 1);
 				} else {
 				    if (ctxt->sax->ignorableWhitespace != NULL)
 					ctxt->sax->ignorableWhitespace(
-						ctxt->userData, &cur, 1);
+						ctxt->userData, &in->cur[0], 1);
 				}
 			    } else {
 				htmlCheckParagraph(ctxt);
 				if (ctxt->sax->characters != NULL)
 				    ctxt->sax->characters(
-					    ctxt->userData, &cur, 1);
+					    ctxt->userData, &in->cur[0], 1);
 			    }
 			}
 			ctxt->token = 0;
diff --git a/HTMLtree.c b/HTMLtree.c
index 5c57fc57..2fd0c9c5 100644
--- a/HTMLtree.c
+++ b/HTMLtree.c
@@ -668,7 +668,8 @@ htmlDtdDumpOutput(xmlOutputBufferPtr buf, xmlDocPtr doc,
 	    xmlOutputBufferWriteString(buf, " ");
 	    xmlBufWriteQuotedString(buf->buffer, cur->SystemID);
 	}
-    }  else if (cur->SystemID != NULL) {
+    } else if (cur->SystemID != NULL &&
+	       xmlStrcmp(cur->SystemID, BAD_CAST "about:legacy-compat")) {
 	xmlOutputBufferWriteString(buf, " SYSTEM ");
 	xmlBufWriteQuotedString(buf->buffer, cur->SystemID);
     }
diff --git a/buf.c b/buf.c
index 6efc7b67..07922ff6 100644
--- a/buf.c
+++ b/buf.c
@@ -27,6 +27,7 @@
 #include <libxml/tree.h>
 #include <libxml/globals.h>
 #include <libxml/tree.h>
+#include <libxml/parserInternals.h> /* for XML_MAX_TEXT_LENGTH */
 #include "buf.h"
 
 #define WITH_BUFFER_COMPAT
@@ -299,7 +300,8 @@ xmlBufSetAllocationScheme(xmlBufPtr buf,
     if ((scheme == XML_BUFFER_ALLOC_DOUBLEIT) ||
         (scheme == XML_BUFFER_ALLOC_EXACT) ||
         (scheme == XML_BUFFER_ALLOC_HYBRID) ||
-        (scheme == XML_BUFFER_ALLOC_IMMUTABLE)) {
+        (scheme == XML_BUFFER_ALLOC_IMMUTABLE) ||
+	(scheme == XML_BUFFER_ALLOC_BOUNDED)) {
 	buf->alloc = scheme;
         if (buf->buffer)
             buf->buffer->alloc = scheme;
@@ -458,6 +460,18 @@ xmlBufGrowInternal(xmlBufPtr buf, size_t len) {
     size = buf->use + len + 100;
 #endif
 
+    if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
+        /*
+	 * Used to provide parsing limits
+	 */
+        if ((buf->use + len >= XML_MAX_TEXT_LENGTH) ||
+	    (buf->size >= XML_MAX_TEXT_LENGTH)) {
+	    xmlBufMemoryError(buf, "buffer error: text too long\n");
+	    return(0);
+	}
+	if (size >= XML_MAX_TEXT_LENGTH)
+	    size = XML_MAX_TEXT_LENGTH;
+    }
     if ((buf->alloc == XML_BUFFER_ALLOC_IO) && (buf->contentIO != NULL)) {
         size_t start_buf = buf->content - buf->contentIO;
 
@@ -739,6 +753,15 @@ xmlBufResize(xmlBufPtr buf, size_t size)
     CHECK_COMPAT(buf)
 
     if (buf->alloc == XML_BUFFER_ALLOC_IMMUTABLE) return(0);
+    if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
+        /*
+	 * Used to provide parsing limits
+	 */
+        if (size >= XML_MAX_TEXT_LENGTH) {
+	    xmlBufMemoryError(buf, "buffer error: text too long\n");
+	    return(0);
+	}
+    }
 
     /* Don't resize if we don't have to */
     if (size < buf->size)
@@ -867,6 +890,15 @@ xmlBufAdd(xmlBufPtr buf, const xmlChar *str, int len) {
 
     needSize = buf->use + len + 2;
     if (needSize > buf->size){
+	if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
+	    /*
+	     * Used to provide parsing limits
+	     */
+	    if (needSize >= XML_MAX_TEXT_LENGTH) {
+		xmlBufMemoryError(buf, "buffer error: text too long\n");
+		return(-1);
+	    }
+	}
         if (!xmlBufResize(buf, needSize)){
 	    xmlBufMemoryError(buf, "growing buffer");
             return XML_ERR_NO_MEMORY;
@@ -938,6 +970,15 @@ xmlBufAddHead(xmlBufPtr buf, const xmlChar *str, int len) {
     }
     needSize = buf->use + len + 2;
     if (needSize > buf->size){
+	if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
+	    /*
+	     * Used to provide parsing limits
+	     */
+	    if (needSize >= XML_MAX_TEXT_LENGTH) {
+		xmlBufMemoryError(buf, "buffer error: text too long\n");
+		return(-1);
+	    }
+	}
         if (!xmlBufResize(buf, needSize)){
 	    xmlBufMemoryError(buf, "growing buffer");
             return XML_ERR_NO_MEMORY;
diff --git a/configure.ac b/configure.ac
index 14ac0a8a..02602814 100644
--- a/configure.ac
+++ b/configure.ac
@@ -8,7 +8,7 @@ AC_CANONICAL_HOST
 
 LIBXML_MAJOR_VERSION=2
 LIBXML_MINOR_VERSION=9
-LIBXML_MICRO_VERSION=2
+LIBXML_MICRO_VERSION=3
 LIBXML_MICRO_VERSION_SUFFIX=
 LIBXML_VERSION=$LIBXML_MAJOR_VERSION.$LIBXML_MINOR_VERSION.$LIBXML_MICRO_VERSION$LIBXML_MICRO_VERSION_SUFFIX
 LIBXML_VERSION_INFO=`expr $LIBXML_MAJOR_VERSION + $LIBXML_MINOR_VERSION`:$LIBXML_MICRO_VERSION:$LIBXML_MINOR_VERSION
@@ -445,6 +445,9 @@ else
                 fi],
                 [have_liblzma=no])
 	     LDFLAGS="${SAVE_LDFLAGS}"])
+    else
+	# we still need to check for lzma,h header
+	AC_CHECK_HEADERS([lzma.h])
     fi
 
     # Found the library via either method?
diff --git a/dict.c b/dict.c
index 5f71d55d..8c8f9314 100644
--- a/dict.c
+++ b/dict.c
@@ -486,7 +486,10 @@ xmlDictComputeFastQKey(const xmlChar *prefix, int plen,
 	value += 30 * (*prefix);
 
     if (len > 10) {
-        value += name[len - (plen + 1 + 1)];
+        int offset = len - (plen + 1 + 1);
+	if (offset < 0)
+	    offset = len - (10 + 1);
+	value += name[offset];
         len = 10;
 	if (plen > 10)
 	    plen = 10;
diff --git a/doc/APIfiles.html b/doc/APIfiles.html
index 65e004be..2252a6b0 100644
--- a/doc/APIfiles.html
+++ b/doc/APIfiles.html
@@ -1309,6 +1309,7 @@ A:link, A:visited, A:active { text-decoration: underline }
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NONE">XML_ATTRIBUTE_NONE</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NOTATION">XML_ATTRIBUTE_NOTATION</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_REQUIRED">XML_ATTRIBUTE_REQUIRED</a><br />
+<a href="html/libxml-tree.html#XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_DOUBLEIT">XML_BUFFER_ALLOC_DOUBLEIT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_EXACT">XML_BUFFER_ALLOC_EXACT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a><br />
diff --git a/doc/APIsymbols.html b/doc/APIsymbols.html
index c2b82e7d..cdde358d 100644
--- a/doc/APIsymbols.html
+++ b/doc/APIsymbols.html
@@ -154,6 +154,7 @@ A:link, A:visited, A:active { text-decoration: underline }
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NONE">XML_ATTRIBUTE_NONE</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NOTATION">XML_ATTRIBUTE_NOTATION</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_REQUIRED">XML_ATTRIBUTE_REQUIRED</a><br />
+<a href="html/libxml-tree.html#XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_DOUBLEIT">XML_BUFFER_ALLOC_DOUBLEIT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_EXACT">XML_BUFFER_ALLOC_EXACT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a><br />
diff --git a/doc/devhelp/libxml2-tree.html b/doc/devhelp/libxml2-tree.html
index 3cc28c71..5f8d1f28 100644
--- a/doc/devhelp/libxml2-tree.html
+++ b/doc/devhelp/libxml2-tree.html
@@ -409,7 +409,8 @@ The content of this structure is not made public by the API.
     <a name="XML_BUFFER_ALLOC_EXACT">XML_BUFFER_ALLOC_EXACT</a> = 2 /* grow only to the minimal size */
     <a name="XML_BUFFER_ALLOC_IMMUTABLE">XML_BUFFER_ALLOC_IMMUTABLE</a> = 3 /* immutable buffer */
     <a name="XML_BUFFER_ALLOC_IO">XML_BUFFER_ALLOC_IO</a> = 4 /* special allocation scheme used for I/O */
-    <a name="XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a> = 5 /*  exact up to a threshold, and doubleit thereafter */
+    <a name="XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a> = 5 /* exact up to a threshold, and doubleit thereafter */
+    <a name="XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a> = 6 /*  limit the upper size of the buffer */
 };
 </pre><p/>
 </div>
diff --git a/doc/devhelp/libxml2.devhelp b/doc/devhelp/libxml2.devhelp
index 282546ab..fbd3ad4a 100644
--- a/doc/devhelp/libxml2.devhelp
+++ b/doc/devhelp/libxml2.devhelp
@@ -351,6 +351,7 @@
     <function name="XML_ATTRIBUTE_NONE" link="libxml2-tree.html#XML_ATTRIBUTE_NONE"/>
     <function name="XML_ATTRIBUTE_NOTATION" link="libxml2-tree.html#XML_ATTRIBUTE_NOTATION"/>
     <function name="XML_ATTRIBUTE_REQUIRED" link="libxml2-tree.html#XML_ATTRIBUTE_REQUIRED"/>
+    <function name="XML_BUFFER_ALLOC_BOUNDED" link="libxml2-tree.html#XML_BUFFER_ALLOC_BOUNDED"/>
     <function name="XML_BUFFER_ALLOC_DOUBLEIT" link="libxml2-tree.html#XML_BUFFER_ALLOC_DOUBLEIT"/>
     <function name="XML_BUFFER_ALLOC_EXACT" link="libxml2-tree.html#XML_BUFFER_ALLOC_EXACT"/>
     <function name="XML_BUFFER_ALLOC_HYBRID" link="libxml2-tree.html#XML_BUFFER_ALLOC_HYBRID"/>
diff --git a/doc/html/libxml-tree.html b/doc/html/libxml-tree.html
index e2081cc5..d1d005f6 100644
--- a/doc/html/libxml-tree.html
+++ b/doc/html/libxml-tree.html
@@ -305,6 +305,7 @@ The content of this structure is not made public by the API.
     <a name="XML_BUFFER_ALLOC_IMMUTABLE" id="XML_BUFFER_ALLOC_IMMUTABLE">XML_BUFFER_ALLOC_IMMUTABLE</a> = 3 : immutable buffer
     <a name="XML_BUFFER_ALLOC_IO" id="XML_BUFFER_ALLOC_IO">XML_BUFFER_ALLOC_IO</a> = 4 : special allocation scheme used for I/O
     <a name="XML_BUFFER_ALLOC_HYBRID" id="XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a> = 5 : exact up to a threshold, and doubleit thereafter
+    <a name="XML_BUFFER_ALLOC_BOUNDED" id="XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a> = 6 : limit the upper size of the buffer
 }
 </pre><h3><a name="xmlDOMWrapCtxt" id="xmlDOMWrapCtxt">Structure xmlDOMWrapCtxt</a></h3><pre class="programlisting">Structure xmlDOMWrapCtxt<br />struct _xmlDOMWrapCtxt {
     void *	_private	: * The type of this context, just in case
diff --git a/doc/libxml2-api.xml b/doc/libxml2-api.xml
index f83d14f0..5573f0c5 100644
--- a/doc/libxml2-api.xml
+++ b/doc/libxml2-api.xml
@@ -1441,12 +1441,12 @@
      <exports symbol='XML_DOC_DTDVALID' type='enum'/>
      <exports symbol='XML_ELEMENT_TYPE_ANY' type='enum'/>
      <exports symbol='XML_DOC_NSVALID' type='enum'/>
-     <exports symbol='XML_ELEMENT_CONTENT_ONCE' type='enum'/>
+     <exports symbol='XML_BUFFER_ALLOC_BOUNDED' type='enum'/>
      <exports symbol='XML_ELEMENT_CONTENT_PCDATA' type='enum'/>
      <exports symbol='XML_ATTRIBUTE_FIXED' type='enum'/>
      <exports symbol='XML_DOCUMENT_TYPE_NODE' type='enum'/>
      <exports symbol='XML_DOC_HTML' type='enum'/>
-     <exports symbol='XML_ELEMENT_CONTENT_OPT' type='enum'/>
+     <exports symbol='XML_ELEMENT_CONTENT_ONCE' type='enum'/>
      <exports symbol='XML_NAMESPACE_DECL' type='enum'/>
      <exports symbol='XML_ATTRIBUTE_NOTATION' type='enum'/>
      <exports symbol='XML_ELEMENT_TYPE_MIXED' type='enum'/>
@@ -1459,6 +1459,7 @@
      <exports symbol='XML_NOTATION_NODE' type='enum'/>
      <exports symbol='XML_ELEMENT_CONTENT_SEQ' type='enum'/>
      <exports symbol='XML_ELEMENT_TYPE_EMPTY' type='enum'/>
+     <exports symbol='XML_ELEMENT_CONTENT_OPT' type='enum'/>
      <exports symbol='XML_ATTRIBUTE_ENUMERATION' type='enum'/>
      <exports symbol='XML_DOC_OLD10' type='enum'/>
      <exports symbol='XML_HTML_DOCUMENT_NODE' type='enum'/>
@@ -4702,9 +4703,10 @@
     <enum name='XML_ATTRIBUTE_NONE' file='tree' value='1' type='xmlAttributeDefault'/>
     <enum name='XML_ATTRIBUTE_NOTATION' file='tree' value='10' type='xmlAttributeType'/>
     <enum name='XML_ATTRIBUTE_REQUIRED' file='tree' value='2' type='xmlAttributeDefault'/>
+    <enum name='XML_BUFFER_ALLOC_BOUNDED' file='tree' value='6' type='xmlBufferAllocationScheme' info=' limit the upper size of the buffer'/>
     <enum name='XML_BUFFER_ALLOC_DOUBLEIT' file='tree' value='1' type='xmlBufferAllocationScheme' info='double each time one need to grow'/>
     <enum name='XML_BUFFER_ALLOC_EXACT' file='tree' value='2' type='xmlBufferAllocationScheme' info='grow only to the minimal size'/>
-    <enum name='XML_BUFFER_ALLOC_HYBRID' file='tree' value='5' type='xmlBufferAllocationScheme' info=' exact up to a threshold, and doubleit thereafter'/>
+    <enum name='XML_BUFFER_ALLOC_HYBRID' file='tree' value='5' type='xmlBufferAllocationScheme' info='exact up to a threshold, and doubleit thereafter'/>
     <enum name='XML_BUFFER_ALLOC_IMMUTABLE' file='tree' value='3' type='xmlBufferAllocationScheme' info='immutable buffer'/>
     <enum name='XML_BUFFER_ALLOC_IO' file='tree' value='4' type='xmlBufferAllocationScheme' info='special allocation scheme used for I/O'/>
     <enum name='XML_BUF_OVERFLOW' file='xmlerror' value='7000' type='xmlParserErrors'/>
diff --git a/doc/libxml2-refs.xml b/doc/libxml2-refs.xml
index f42fab4e..71586099 100644
--- a/doc/libxml2-refs.xml
+++ b/doc/libxml2-refs.xml
@@ -148,6 +148,7 @@
     <reference name='XML_ATTRIBUTE_NONE' href='html/libxml-tree.html#XML_ATTRIBUTE_NONE'/>
     <reference name='XML_ATTRIBUTE_NOTATION' href='html/libxml-tree.html#XML_ATTRIBUTE_NOTATION'/>
     <reference name='XML_ATTRIBUTE_REQUIRED' href='html/libxml-tree.html#XML_ATTRIBUTE_REQUIRED'/>
+    <reference name='XML_BUFFER_ALLOC_BOUNDED' href='html/libxml-tree.html#XML_BUFFER_ALLOC_BOUNDED'/>
     <reference name='XML_BUFFER_ALLOC_DOUBLEIT' href='html/libxml-tree.html#XML_BUFFER_ALLOC_DOUBLEIT'/>
     <reference name='XML_BUFFER_ALLOC_EXACT' href='html/libxml-tree.html#XML_BUFFER_ALLOC_EXACT'/>
     <reference name='XML_BUFFER_ALLOC_HYBRID' href='html/libxml-tree.html#XML_BUFFER_ALLOC_HYBRID'/>
@@ -3749,6 +3750,7 @@
       <ref name='XML_ATTRIBUTE_NONE'/>
       <ref name='XML_ATTRIBUTE_NOTATION'/>
       <ref name='XML_ATTRIBUTE_REQUIRED'/>
+      <ref name='XML_BUFFER_ALLOC_BOUNDED'/>
       <ref name='XML_BUFFER_ALLOC_DOUBLEIT'/>
       <ref name='XML_BUFFER_ALLOC_EXACT'/>
       <ref name='XML_BUFFER_ALLOC_HYBRID'/>
@@ -12100,6 +12102,7 @@
       <ref name='XML_ATTRIBUTE_NONE'/>
       <ref name='XML_ATTRIBUTE_NOTATION'/>
       <ref name='XML_ATTRIBUTE_REQUIRED'/>
+      <ref name='XML_BUFFER_ALLOC_BOUNDED'/>
       <ref name='XML_BUFFER_ALLOC_DOUBLEIT'/>
       <ref name='XML_BUFFER_ALLOC_EXACT'/>
       <ref name='XML_BUFFER_ALLOC_HYBRID'/>
diff --git a/doc/libxml2.xsa b/doc/libxml2.xsa
index da61d57d..0825d53f 100644
--- a/doc/libxml2.xsa
+++ b/doc/libxml2.xsa
@@ -8,95 +8,182 @@
   </vendor>
   <product id="libxml2">
     <name>libxml2</name>
-    <version>2.9.1</version>
-    <last-release> Apr 19 2013</last-release>
+    <version>2.9.2</version>
+    <last-release> Oct 16 2014</last-release>
     <info-url>http://xmlsoft.org/</info-url>
-    <changes>   -  Features:
-    Support for Python3 (Daniel Veillard),
-    Add xmlXPathSetContextNode and xmlXPathNodeEval (Alex Bligh)
+    <changes>   - Security:
+  Fix for CVE-2014-3660 billion laugh variant (Daniel Veillard),
+  CVE-2014-0191 Do not fetch external parameter entities (Daniel Veillard)
   
-   -  Documentation:
-    Add documentation for xmllint --xpath (Daniel Veillard),
-    Fix the URL of the SAX documentation from James (Daniel Veillard),
-    Fix spelling of "length". (Michael Wood)
+   - Bug Fixes:
+  fix memory leak xml header encoding field with XML_PARSE_IGNORE_ENC (Bart De Schuymer),
+  xmlmemory: handle realloc properly (Yegor Yefremov),
+  Python generator bug raised by the const change (Daniel Veillard),
+  Windows Critical sections not released correctly (Daniel Veillard),
+  Parser error on repeated recursive entity expansion containing &amp;lt; (Daniel Veillard),
+  xpointer : fixing Null Pointers (Gaurav Gupta),
+  Remove Unnecessary Null check in xpointer.c (Gaurav Gupta),
+  parser bug on misformed namespace attributes (Dennis Filder),
+  Pointer dereferenced before null check (Daniel Veillard),
+  Leak of struct addrinfo in xmlNanoFTPConnect() (Gaurav Gupta),
+  Possible overflow in HTMLParser.c (Daniel Veillard),
+  python/tests/sync.py assumes Python dictionaries are ordered (John Beck),
+  Fix Enum check and missing break (Gaurav Gupta),
+  xmlIO: Handle error returns from dup() (Philip Withnall),
+  Fix a problem properly saving URIs (Daniel Veillard),
+  wrong error column in structured error when parsing attribute values (Juergen Keil),
+  wrong error column in structured error when skipping whitespace in xml decl (Juergen Keil),
+  no error column in structured error handler for xml schema validation errors (Juergen Keil),
+  Couple of Missing Null checks (Gaurav Gupta),
+  Add couple of missing Null checks (Daniel Veillard),
+  xmlschemastypes: Fix potential array overflow (Philip Withnall),
+  runtest: Fix a memory leak on parse failure (Philip Withnall),
+  xmlIO: Fix an FD leak on gzdopen() failure (Philip Withnall),
+  xmlcatalog: Fix a memory leak on quit (Philip Withnall),
+  HTMLparser: Correctly initialise a stack allocated structure (Philip Withnall),
+  Check for tmon in _xmlSchemaDateAdd() is incorrect (David Kilzer),
+  Avoid Possible Null Pointer in trio.c (Gaurav Gupta),
+  Fix processing in SAX2 in case of an allocation failure (Daniel Veillard),
+  XML Shell command "cd" does not handle "/" at end of path (Daniel Veillard),
+  Fix various Missing Null checks (Gaurav Gupta),
+  Fix a potential NULL dereference (Daniel Veillard),
+  Add a couple of misisng check in xmlRelaxNGCleanupTree (Gaurav Gupta),
+  Add a missing argument check (Gaurav Gupta),
+  Adding a check in case of allocation error (Gaurav Gupta),
+  xmlSaveUri() incorrectly recomposes URIs with rootless paths (Dennis Filder),
+  Adding some missing NULL checks (Gaurav),
+  Fixes for xmlInitParserCtxt (Daniel Veillard),
+  Fix regressions introduced by CVE-2014-0191 patch (Daniel Veillard),
+  erroneously ignores a validation error if no error callback set (Daniel Veillard),
+  xmllint was not parsing the --c14n11 flag (Sérgio Batista),
+  Avoid Possible null pointer dereference in memory debug mode (Gaurav),
+  Avoid Double Null Check (Gaurav),
+  Restore context size and position after XPATH_OP_ARG (Nick Wellnhofer),
+  Fix xmlParseInNodeContext() if node is not element (Daniel Veillard),
+  Avoid a possible NULL pointer dereference (Gaurav),
+  Fix xmlTextWriterWriteElement when a null content is given (Daniel Veillard),
+  Fix an typo 'onrest' in htmlScriptAttributes (Daniel Veillard),
+  fixing a ptotential uninitialized access (Daniel Veillard),
+  Fix an fd leak in an error case (Daniel Veillard),
+  Missing initialization for the catalog module (Daniel Veillard),
+  Handling of XPath function arguments in error case (Nick Wellnhofer),
+  Fix a couple of missing NULL checks (Gaurav),
+  Avoid a possibility of dangling encoding handler (Gaurav),
+  Fix HTML push parser to accept HTML_PARSE_NODEFDTD (Arnold Hendriks),
+  Fix a bug loading some compressed files (Mike Alexander),
+  Fix XPath node comparison bug (Gaurav),
+  Type mismatch in xmlschemas.c (Gaurav),
+  Type mismatch in xmlschemastypes.c (Gaurav),
+  Avoid a deadcode in catalog.c (Daniel Veillard),
+  run close socket on Solaris, same as we do on other platforms (Denis Pauk),
+  Fix pointer dereferenced before null check (Gaurav),
+  Fix a potential NULL dereference in tree code (Daniel Veillard),
+  Fix potential NULL pointer dereferences in regexp code (Gaurav),
+  xmllint --pretty crashed without following numeric argument (Tim Galeckas),
+  Fix XPath expressions of the form '@ns:*' (Nick Wellnhofer),
+  Fix XPath '//' optimization with predicates (Nick Wellnhofer),
+  Clear up a potential NULL dereference (Daniel Veillard),
+  Fix a possible NULL dereference (Gaurav),
+  Avoid crash if allocation fails (Daniel Veillard),
+  Remove occasional leading space in XPath number formatting (Daniel Veillard),
+  Fix handling of mmap errors (Daniel Veillard),
+  Catch malloc error and exit accordingly (Daniel Veillard),
+  missing else in xlink.c (Ami Fischman),
+  Fix a parsing bug on non-ascii element and CR/LF usage (Daniel Veillard),
+  Fix a regression in xmlGetDocCompressMode() (Daniel Veillard),
+  properly quote the namespace uris written out during c14n (Aleksey Sanin),
+  Remove premature XInclude check on URI being relative (Alexey Neyman),
+  Fix missing break on last() function for attributes (dcb),
+  Do not URI escape in server side includes (Romain Bondue),
+  Fix an error in xmlCleanupParser (Alexander Pastukhov)
   
-   -  Portability:
-    Fix python bindings with versions older than 2.7 (Daniel Veillard),
-    rebuild docs:Makefile.am (Roumen Petrov),
-    elfgcchack.h after rebuild in doc (Roumen Petrov),
-    elfgcchack for buf module (Roumen Petrov),
-    Fix a uneeded and wrong extra link parameter (Daniel Veillard),
-    Few cleanup patches for Windows (Denis Pauk),
-    Fix rpmbuild --nocheck (Mark Salter),
-    Fix for win32/configure.js and WITH_THREAD_ALLOC (Daniel Richard),
-    Fix Broken multi-arch support in xml2-config (Daniel Veillard),
-    Fix a portability issue for GCC &lt; 3.4.0 (Daniel Veillard),
-    Windows build fixes (Daniel Richard),
-    Fix a thread portability problem (Friedrich Haubensak),
-    Downgrade autoconf requirement to 2.63 (Daniel Veillard)
+   - Documentation:
+  typo in error messages "colon are forbidden from..." (Daniel Veillard),
+  Fix a link to James SAX documentation old page (Daniel Veillard),
+  Fix typos in relaxng.c (Jan Pokorný),
+  Fix a doc typo (Daniel Veillard),
+  Fix typos in {tree,xpath}.c (errror) (Jan Pokorný),
+  Add limitations about encoding conversion (Daniel Veillard),
+  Fix typos in xmlschemas{,types}.c (Jan Pokorný),
+  Fix incorrect spelling entites-&gt;entities (Jan Pokorný),
+  Forgot to document 2.9.1 release, regenerate docs (Daniel Veillard)
   
-   -  Bug Fixes:
-    Fix a linking error for python bindings (Daniel Veillard),
-    Fix a couple of return without value (Jüri Aedla),
-    Improve the hashing functions (Daniel Franke),
-    Improve handling of xmlStopParser() (Daniel Veillard),
-    Remove risk of lockup in dictionary initialization (Daniel Veillard),
-    Activate detection of encoding in external subset (Daniel Veillard),
-    Fix an output buffer flushing conversion bug (Mikhail Titov),
-    Fix an old bug in xmlSchemaValidateOneElement (Csaba László),
-    Fix configure cannot remove messages (Gilles Espinasse),
-    fix schema validation in combination with xsi:nil (Daniel Veillard),
-    xmlCtxtReadFile doesn't work with literal IPv6 URLs (Steve Wolf),
-    Fix a few problems with setEntityLoader (Alexey Neyman),
-    Detect excessive entities expansion upon replacement (Daniel Veillard),
-    Fix the flushing out of raw buffers on encoding conversions (Daniel,
-Veillard),
-    Fix some buffer conversion issues (Daniel Veillard),
-    When calling xmlNodeDump make sure we grow the buffer quickly (Daniel,
-Veillard),
-    Fix an error in the progressive DTD parsing code (Dan Winship),
-    xmllint should not load DTD by default when using the reader (Daniel,
-Veillard),
-    Try IBM-037 when looking for EBCDIC handlers (Petr Sumbera),
-    Fix potential out of bound access (Daniel Veillard),
-    Fix large parse of file from memory (Daniel Veillard),
-    Fix a bug in the nsclean option of the parser (Daniel Veillard),
-    Fix a regression in 2.9.0 breaking validation while streaming (Daniel,
-Veillard),
-    Remove potential calls to exit() (Daniel Veillard)
+   - Portability:
+  AC_CONFIG_FILES and executable bit (Roumen Petrov),
+  remove HAVE_CONFIG_H dependency in testlimits.c (Roumen Petrov),
+  fix some tabs mixing incompatible with python3 (Roumen Petrov),
+  Visual Studio 14 CTP defines snprintf() (Francis Dupont),
+  OS400: do not try to copy unexisting doc files (Patrick Monnerat),
+  OS400: use either configure.ac or configure.in. (Patrick Monnerat),
+  os400: make-src.sh: create physical file with target CCSID (Patrick Monnerat),
+  OS400: Add some more C macros equivalent procedures. (Patrick Monnerat),
+  OS400: use C macros to implement equivalent RPG support procedures. (Patrick Monnerat),
+  OS400: implement XPath macros as procedures for ILE/RPG support. (Patrick Monnerat),
+  OS400: include in distribution tarball. (Patrick Monnerat),
+  OS400: Add README: compilation directives and OS/400 specific stuff. (Patrick Monnerat),
+  OS400: Add compilation scripts. (Patrick Monnerat),
+  OS400: ILE RPG language header files. (Patrick Monnerat),
+  OS400: implement some macros as functions for ILE/RPG language support (that as no macros). (Patrick Monnerat),
+  OS400: UTF8&lt;--&gt;EBCDIC wrappers for system and external library calls (Patrick Monnerat),
+  OS400: Easy character transcoding support (Patrick Monnerat),
+  OS400: iconv functions compatibility wrappers and table builder. (Patrick Monnerat),
+  OS400: create architecture directory. Implement dlfcn emulation. (Patrick Monnerat),
+  Fix building when configuring without xpath and xptr (Daniel Veillard),
+  configure: Add --with-python-install-dir (Jonas Eriksson),
+  Fix compilation with minimum and xinclude. (Nicolas Le Cam),
+  Compile out use of xmlValidateNCName() when not available. (Nicolas Le Cam),
+  Fix compilation with minimum and schematron. (Nicolas Le Cam),
+  Legacy needs xmlSAX2StartElement() and xmlSAX2EndElement(). (Nicolas Le Cam),
+  Don't use xmlValidateName() when not available. (Nicolas Le Cam),
+  Fix a portability issue on Windows (Longstreth Jon),
+  Various portability patches for OpenVMS (Jacob (Jouk) Jansen),
+  Use specific macros for portability to OS/400 (Patrick Monnerat),
+  Add macros needed for OS/400 portability (Patrick Monnerat),
+  Portability patch for fopen on OS/400 (Patrick Monnerat),
+  Portability fixes for OS/400 (Patrick Monnerat),
+  Improve va_list portability (Patrick Monnerat),
+  Portability fix (Patrick Monnerat),
+  Portability fix (Patrick Monnerat),
+  Generic portability fix (Patrick Monnerat),
+  Shortening lines in headers (Patrick Monnerat),
+  build: Use pkg-config to find liblzma in preference to AC_CHECK_LIB (Philip Withnall),
+  build: Add @LZMA_LIBS@ to libxml’s pkg-config files (Philip Withnall),
+  fix some tabs mixing incompatible with python3 (Daniel Veillard),
+  add additional defines checks for support "./configure --with-minimum" (Denis Pauk),
+  Another round of fixes for older versions of Python (Arfrever Frehtes Taifersar Arahesis),
+  python: fix drv_libxml2.py for python3 compatibility (Alexandre Rostovtsev),
+  python: Fix compiler warnings when building python3 bindings (Armin K),
+  Fix for compilation with python 2.6.8 (Petr Sumbera)
   
-   -  Improvements:
-    Regenerated API, and testapi, rebuild documentation (Daniel Veillard),
-    Fix tree iterators broken by 2to3 script (Daniel Veillard),
-    update all tests for Python3 and Python2 (Daniel Veillard),
-    A few more fixes for python 3 affecting libxml2.py (Daniel Veillard),
-    Fix compilation on Python3 (Daniel Veillard),
-    Converting apibuild.py to python3 (Daniel Veillard),
-    First pass at starting porting to python3 (Daniel Veillard),
-    updated configure.in for python3 (Daniel Veillard),
-    Add support for xpathRegisterVariable in Python (Shaun McCance),
-    Added a regression tests from bug 694228 data (Daniel Veillard),
-    Cache presence of '&lt;' in entities content (Daniel Veillard),
-    Avoid extra processing on entities (Daniel Veillard),
-    Python binding for xmlRegisterInputCallback (Alexey Neyman),
-    Python bindings: DOM casts everything to xmlNode (Alexey Neyman),
-    Define LIBXML_THREAD_ALLOC_ENABLED via xmlversion.h (Tim Starling),
-    Adding streaming validation to runtest checks (Daniel Veillard),
-    Add a --pushsmall option to xmllint (Daniel Veillard)
+   - Improvements:
+  win32/libxml2.def.src after rebuild in doc (Roumen Petrov),
+  elfgcchack.h: more legacy needs xmlSAX2StartElement() and xmlSAX2EndElement() (Roumen Petrov),
+  elfgcchack.h: add xmlXPathNodeEval and xmlXPathSetContextNode (Roumen Petrov),
+  Provide cmake module (Samuel Martin),
+  Fix a couple of issues raised by make dist (Daniel Veillard),
+  Fix and add const qualifiers (Kurt Roeckx),
+  Preparing for upcoming release of 2.9.2 (Daniel Veillard),
+  Fix zlib and lzma libraries check via command line (Dmitriy),
+  wrong error column in structured error when parsing end tag (Juergen Keil),
+  doc/news.html: small update to avoid line join while generating NEWS. (Patrick Monnerat),
+  Add methods for python3 iterator (Ron Angeles),
+  Support element node traversal in document fragments. (Kyle VanderBeek),
+  xmlNodeSetName: Allow setting the name to a substring of the currently set name (Tristan Van Berkom),
+  Added macros for argument casts (Eric Zurcher),
+  adding init calls to xml and html Read parsing entry points (Daniel Veillard),
+  Get rid of 'REPLACEMENT CHARACTER' Unicode chars in xmlschemas.c (Jan Pokorný),
+  Implement choice for name classes on attributes (Shaun McCance),
+  Two small namespace tweaks (Daniel Veillard),
+  xmllint --memory should fail on empty files (Daniel Veillard),
+  Cast encoding name to char pointer to match arg type (Nikolay Sivov)
   
-   -  Cleanups:
-    Switched comment in file to UTF-8 encoding (Daniel Veillard),
-    Extend gitignore (Daniel Veillard),
-    Silent the new python test on input (Alexey Neyman),
-    Cleanup of a duplicate test (Daniel Veillard),
-    Cleanup on duplicate test expressions (Daniel Veillard),
-    Fix compiler warning after 153cf15905cf4ec080612ada6703757d10caba1e (Patrick,
-Gansterer),
-    Spec cleanups and a fix for multiarch support (Daniel Veillard),
-    Silence a clang warning (Daniel Veillard),
-    Cleanup the Copyright to be pure MIT Licence wording (Daniel Veillard),
-    rand_seed should be static in dict.c (Wouter Van Rooy),
-    Fix typos in parser comments (Jan Pokorný)
+   - Cleanups:
+  Removal of old configure.in (Daniel Veillard),
+  Unreachable code in tree.c (Gaurav Gupta),
+  Remove a couple of dead conditions (Gaurav Gupta),
+  Avoid some dead code and cleanup in relaxng.c (Gaurav),
+  Drop not needed checks (Denis Pauk),
+  Fix a wrong test (Daniel Veillard)
   
 
 </changes>
diff --git a/doc/news.html b/doc/news.html
index 5c03ba32..e76ef558 100644
--- a/doc/news.html
+++ b/doc/news.html
@@ -8,7 +8,78 @@ H2 {font-family: Verdana,Arial,Helvetica}
 H3 {font-family: Verdana,Arial,Helvetica}
 A:link, A:visited, A:active { text-decoration: underline }
 </style><title>Releases</title></head><body bgcolor="#8b7765" text="#000000" link="#a06060" vlink="#000000"><table border="0" width="100%" cellpadding="5" cellspacing="0" align="center"><tr><td width="120"><a href="http://swpat.ffii.org/"><img src="epatents.png" alt="Action against software patents" /></a></td><td width="180"><a href="http://www.gnome.org/"><img src="gnome2.png" alt="Gnome2 Logo" /></a><a href="http://www.w3.org/Status"><img src="w3c.png" alt="W3C Logo" /></a><a href="http://www.redhat.com/"><img src="redhat.gif" alt="Red Hat Logo" /></a><div align="left"><a href="http://xmlsoft.org/"><img src="Libxml2-Logo-180x168.gif" alt="Made with Libxml2 Logo" /></a></div></td><td><table border="0" width="90%" cellpadding="2" cellspacing="0" align="center" bgcolor="#000000"><tr><td><table width="100%" border="0" cellspacing="1" cellpadding="3" bgcolor="#fffacd"><tr><td align="center"><h1>The XML C parser and toolkit of Gnome</h1><h2>Releases</h2></td></tr></table></td></tr></table></td></tr></table><table border="0" cellpadding="4" cellspacing="0" width="100%" align="center"><tr><td bgcolor="#8b7765"><table border="0" cellspacing="0" cellpadding="2" width="100%"><tr><td valign="top" width="200" bgcolor="#8b7765"><table border="0" cellspacing="0" cellpadding="1" width="100%" bgcolor="#000000"><tr><td><table width="100%" border="0" cellspacing="1" cellpadding="3"><tr><td colspan="1" bgcolor="#eecfa1" align="center"><center><b>Main Menu</b></center></td></tr><tr><td bgcolor="#fffacd"><form action="search.php" enctype="application/x-www-form-urlencoded" method="get"><input name="query" type="text" size="20" value="" /><input name="submit" type="submit" value="Search ..." /></form><ul><li><a href="index.html">Home</a></li><li><a href="html/index.html">Reference Manual</a></li><li><a href="intro.html">Introduction</a></li><li><a href="FAQ.html">FAQ</a></li><li><a href="docs.html" style="font-weight:bold">Developer Menu</a></li><li><a href="bugs.html">Reporting bugs and getting help</a></li><li><a href="help.html">How to help</a></li><li><a href="downloads.html">Downloads</a></li><li><a href="news.html">Releases</a></li><li><a href="XMLinfo.html">XML</a></li><li><a href="XSLT.html">XSLT</a></li><li><a href="xmldtd.html">Validation &amp; DTDs</a></li><li><a href="encoding.html">Encodings support</a></li><li><a href="catalog.html">Catalog support</a></li><li><a href="namespaces.html">Namespaces</a></li><li><a href="contribs.html">Contributions</a></li><li><a href="examples/index.html" style="font-weight:bold">Code Examples</a></li><li><a href="html/index.html" style="font-weight:bold">API Menu</a></li><li><a href="guidelines.html">XML Guidelines</a></li><li><a href="ChangeLog.html">Recent Changes</a></li></ul></td></tr></table><table width="100%" border="0" cellspacing="1" cellpadding="3"><tr><td colspan="1" bgcolor="#eecfa1" align="center"><center><b>Related links</b></center></td></tr><tr><td bgcolor="#fffacd"><ul><li><a href="http://mail.gnome.org/archives/xml/">Mail archive</a></li><li><a href="http://xmlsoft.org/XSLT/">XSLT libxslt</a></li><li><a href="http://phd.cs.unibo.it/gdome2/">DOM gdome2</a></li><li><a href="http://www.aleksey.com/xmlsec/">XML-DSig xmlsec</a></li><li><a href="ftp://xmlsoft.org/">FTP</a></li><li><a href="http://www.zlatkovic.com/projects/libxml/">Windows binaries</a></li><li><a href="http://opencsw.org/packages/libxml2">Solaris binaries</a></li><li><a href="http://www.explain.com.au/oss/libxml2xslt.html">MacOsX binaries</a></li><li><a href="http://lxml.de/">lxml Python bindings</a></li><li><a href="http://cpan.uwinnipeg.ca/dist/XML-LibXML">Perl bindings</a></li><li><a href="http://libxmlplusplus.sourceforge.net/">C++ bindings</a></li><li><a href="http://www.zend.com/php5/articles/php5-xmlphp.php#Heading4">PHP bindings</a></li><li><a href="http://sourceforge.net/projects/libxml2-pas/">Pascal bindings</a></li><li><a href="http://libxml.rubyforge.org/">Ruby bindings</a></li><li><a href="http://tclxml.sourceforge.net/">Tcl bindings</a></li><li><a href="http://bugzilla.gnome.org/buglist.cgi?product=libxml2">Bug Tracker</a></li></ul></td></tr></table></td></tr></table></td><td valign="top" bgcolor="#8b7765"><table border="0" cellspacing="0" cellpadding="1" width="100%"><tr><td><table border="0" cellspacing="0" cellpadding="1" width="100%" bgcolor="#000000"><tr><td><table border="0" cellpadding="3" cellspacing="1" width="100%"><tr><td bgcolor="#fffacd"><p>The <a href="ChangeLog.html">change log</a> describes the recents commits
-to the <a href="http://git.gnome.org/browse/libxml2/">GIT</a> code base.</p><p>Here is the list of public releases:</p><h3>2.9.2: Oct 16 2014</h3><ul>
+to the <a href="http://git.gnome.org/browse/libxml2/">GIT</a> code base.</p><p>Here is the list of public releases:</p><h3>v2.9.3: Nov 20 2015</h3><ul>
+  <li>Security:<br />
+  CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh Davenport),<br />
+  CVE-2015-7500 Fix memory access error due to incorrect entities boundaries (Daniel Veillard),<br />
+  CVE-2015-7499-2 Detect incoherency on GROW (Daniel Veillard),<br />
+  CVE-2015-7499-1 Add xmlHaltParser() to stop the parser (Daniel Veillard),<br />
+  CVE-2015-5312 Another entity expansion issue (David Drysdale),<br />
+  CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey (David Drysdale),<br />
+  CVE-2015-7498 Avoid processing entities after encoding conversion failures (Daniel Veillard),<br />
+  CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard),<br />
+  CVE-2015-7942-2 Fix an error in previous Conditional section patch (Daniel Veillard),<br />
+  CVE-2015-7942 Another variation of overflow in Conditional sections (Daniel Veillard),<br />
+  CVE-2015-1819 Enforce the reader to run in constant memory (Daniel Veillard)<br />
+  CVE-2015-7941_2 Cleanup conditional section error handling (Daniel Veillard),<br />
+  CVE-2015-7941_1 Stop parsing on entities boundaries errors (Daniel Veillard),<br />
+  </li>
+
+  <li>Documentation:<br />
+  Correct spelling of "calling" (Alex Henrie),<br />
+  Fix a small error in xmllint --format description (Fabien Degomme),<br />
+  Avoid XSS on the search of xmlsoft.org (Daniel Veillard)<br />
+  </li>
+
+  <li>Portability:<br />
+  threads: use forward declarations only for glibc (Michael Heimpold),<br />
+  Update Win32 configure.js to search for configure.ac (Daniel Veillard)<br />
+  </li>
+
+  <li>Bug Fixes:<br />
+  Bug on creating new stream from entity (Daniel Veillard),<br />
+  Fix some loop issues embedding NEXT (Daniel Veillard),<br />
+  Do not print error context when there is none (Daniel Veillard),<br />
+  Avoid extra processing of MarkupDecl when EOF (Hugh Davenport),<br />
+  Fix parsing short unclosed comment uninitialized access (Daniel Veillard),<br />
+  Add missing Null check in xmlParseExternalEntityPrivate (Gaurav Gupta),<br />
+  Fix a bug in CData error handling in the push parser (Daniel Veillard),<br />
+  Fix a bug on name parsing at the end of current input buffer (Daniel Veillard),<br />
+  Fix the spurious ID already defined error (Daniel Veillard),<br />
+  Fix previous change to node sort order (Nick Wellnhofer),<br />
+  Fix a self assignment issue raised by clang (Scott Graham),<br />
+  Fail parsing early on if encoding conversion failed (Daniel Veillard),<br />
+  Do not process encoding values if the declaration if broken (Daniel Veillard),<br />
+  Silence clang's -Wunknown-attribute (Michael Catanzaro),<br />
+  xmlMemUsed is not thread-safe (Martin von Gagern),<br />
+  Fix support for except in nameclasses (Daniel Veillard),<br />
+  Fix order of root nodes (Nick Wellnhofer),<br />
+  Allow attributes on descendant-or-self axis (Nick Wellnhofer),<br />
+  Fix the fix to Windows locking (Steve Nairn),<br />
+  Fix timsort invariant loop re: Envisage article (Christopher Swenson),<br />
+  Don't add IDs in xmlSetTreeDoc (Nick Wellnhofer),<br />
+  Account for ID attributes in xmlSetTreeDoc (Nick Wellnhofer),<br />
+  Remove various unused value assignments (Philip Withnall),<br />
+  Fix missing entities after CVE-2014-3660 fix (Daniel Veillard),<br />
+  Revert "Missing initialization for the catalog module" (Daniel Veillard)<br />
+  </li>
+
+  <li>Improvements:<br />
+  Reuse xmlHaltParser() where it makes sense (Daniel Veillard),<br />
+  xmlStopParser reset errNo (Daniel Veillard),<br />
+  Reenable xz support by default (Daniel Veillard),<br />
+  Recover unescaped less-than character in HTML recovery parsing (Daniel Veillard),<br />
+  Allow HTML serializer to output HTML5 DOCTYPE (Shaun McCance),<br />
+  Regression test for bug #695699 (Nick Wellnhofer),<br />
+  Add a couple of XPath tests (Nick Wellnhofer),<br />
+  Add Python 3 rpm subpackage (Tomas Radej),<br />
+  libxml2-config.cmake.in: update include directories (Samuel Martin),<br />
+  Adding example from bugs 738805 to regression tests (Daniel Veillard)<br />
+  </li>
+
+  <li>Cleanups:<br />
+  </li>
+</ul><h3>2.9.2: Oct 16 2014</h3><ul>
   <li>Security:<br />
   Fix for CVE-2014-3660 billion laugh variant (Daniel Veillard),<br />
   CVE-2014-0191 Do not fetch external parameter entities (Daniel Veillard)<br />
diff --git a/doc/search.php b/doc/search.php
index ce1a25fb..c94e87ec 100644
--- a/doc/search.php
+++ b/doc/search.php
@@ -102,13 +102,14 @@ A:link, A:visited, A:active { text-decoration: underline }
     $scope = ltrim ($scope);
     if ($scope == "")
         $scope = "any";
+    $querystr = htmlspecialchars($query, ENT_QUOTES, 'UTF-8');
 
 ?>
 <p> The search service indexes the libxml2 and libxslt APIs and documentation as well as the xml@gnome.org and xslt@gnome.org mailing-list archives. To use it simply provide a set of keywords:
 <p>
 <form action="<?php echo "$PHP_SELF", "?query=", rawurlencode($query) ?>"
       enctype="application/x-www-form-urlencoded" method="GET">
-  <input name="query" type="TEXT" size="50" value="<?php echo $query?>">
+  <input name="query" type="TEXT" size="50" value="<?php echo $querystr?>">
   <select name="scope">
     <option value="any">Search All</option>
     <option value="XML" <?php if ($scope == 'XML') print "selected"?>>XML resources</option>
@@ -446,7 +447,7 @@ A:link, A:visited, A:active { text-decoration: underline }
 	    }
 	    mysql_close($link);
 	    $nb = count($results);
-	    echo "<h3 align='center'>Found $nb results for query $query</h3>\n";
+	    echo "<h3 align='center'>Found $nb results for query $querystr</h3>\n";
 	    usort($results, "resSort");
 
             if ($nb > 0) {
diff --git a/doc/xml.html b/doc/xml.html
index 373285d2..51dca8c3 100644
--- a/doc/xml.html
+++ b/doc/xml.html
@@ -709,6 +709,79 @@ to the <a href="http://git.gnome.org/browse/libxml2/">GIT</a> code base.</p>
 
 <p>Here is the list of public releases:</p>
 
+<h3>v2.9.3: Nov 20 2015</h3>
+<ul>
+  <li>Security:<br/>
+  CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh Davenport),<br/>
+  CVE-2015-7500 Fix memory access error due to incorrect entities boundaries (Daniel Veillard),<br/>
+  CVE-2015-7499-2 Detect incoherency on GROW (Daniel Veillard),<br/>
+  CVE-2015-7499-1 Add xmlHaltParser() to stop the parser (Daniel Veillard),<br/>
+  CVE-2015-5312 Another entity expansion issue (David Drysdale),<br/>
+  CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey (David Drysdale),<br/>
+  CVE-2015-7498 Avoid processing entities after encoding conversion failures (Daniel Veillard),<br/>
+  CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard),<br/>
+  CVE-2015-7942-2 Fix an error in previous Conditional section patch (Daniel Veillard),<br/>
+  CVE-2015-7942 Another variation of overflow in Conditional sections (Daniel Veillard),<br/>
+  CVE-2015-1819 Enforce the reader to run in constant memory (Daniel Veillard)<br/>
+  CVE-2015-7941_2 Cleanup conditional section error handling (Daniel Veillard),<br/>
+  CVE-2015-7941_1 Stop parsing on entities boundaries errors (Daniel Veillard),<br/>
+  </li>
+
+  <li>Documentation:<br/>
+  Correct spelling of "calling" (Alex Henrie),<br/>
+  Fix a small error in xmllint --format description (Fabien Degomme),<br/>
+  Avoid XSS on the search of xmlsoft.org (Daniel Veillard)<br/>
+  </li>
+
+  <li>Portability:<br/>
+  threads: use forward declarations only for glibc (Michael Heimpold),<br/>
+  Update Win32 configure.js to search for configure.ac (Daniel Veillard)<br/>
+  </li>
+
+  <li>Bug Fixes:<br/>
+  Bug on creating new stream from entity (Daniel Veillard),<br/>
+  Fix some loop issues embedding NEXT (Daniel Veillard),<br/>
+  Do not print error context when there is none (Daniel Veillard),<br/>
+  Avoid extra processing of MarkupDecl when EOF (Hugh Davenport),<br/>
+  Fix parsing short unclosed comment uninitialized access (Daniel Veillard),<br/>
+  Add missing Null check in xmlParseExternalEntityPrivate (Gaurav Gupta),<br/>
+  Fix a bug in CData error handling in the push parser (Daniel Veillard),<br/>
+  Fix a bug on name parsing at the end of current input buffer (Daniel Veillard),<br/>
+  Fix the spurious ID already defined error (Daniel Veillard),<br/>
+  Fix previous change to node sort order (Nick Wellnhofer),<br/>
+  Fix a self assignment issue raised by clang (Scott Graham),<br/>
+  Fail parsing early on if encoding conversion failed (Daniel Veillard),<br/>
+  Do not process encoding values if the declaration if broken (Daniel Veillard),<br/>
+  Silence clang's -Wunknown-attribute (Michael Catanzaro),<br/>
+  xmlMemUsed is not thread-safe (Martin von Gagern),<br/>
+  Fix support for except in nameclasses (Daniel Veillard),<br/>
+  Fix order of root nodes (Nick Wellnhofer),<br/>
+  Allow attributes on descendant-or-self axis (Nick Wellnhofer),<br/>
+  Fix the fix to Windows locking (Steve Nairn),<br/>
+  Fix timsort invariant loop re: Envisage article (Christopher Swenson),<br/>
+  Don't add IDs in xmlSetTreeDoc (Nick Wellnhofer),<br/>
+  Account for ID attributes in xmlSetTreeDoc (Nick Wellnhofer),<br/>
+  Remove various unused value assignments (Philip Withnall),<br/>
+  Fix missing entities after CVE-2014-3660 fix (Daniel Veillard),<br/>
+  Revert "Missing initialization for the catalog module" (Daniel Veillard)<br/>
+  </li>
+
+  <li>Improvements:<br/>
+  Reuse xmlHaltParser() where it makes sense (Daniel Veillard),<br/>
+  xmlStopParser reset errNo (Daniel Veillard),<br/>
+  Reenable xz support by default (Daniel Veillard),<br/>
+  Recover unescaped less-than character in HTML recovery parsing (Daniel Veillard),<br/>
+  Allow HTML serializer to output HTML5 DOCTYPE (Shaun McCance),<br/>
+  Regression test for bug #695699 (Nick Wellnhofer),<br/>
+  Add a couple of XPath tests (Nick Wellnhofer),<br/>
+  Add Python 3 rpm subpackage (Tomas Radej),<br/>
+  libxml2-config.cmake.in: update include directories (Samuel Martin),<br/>
+  Adding example from bugs 738805 to regression tests (Daniel Veillard)<br/>
+  </li>
+
+  <li>Cleanups:<br/>
+  </li>
+</ul>
 <h3>2.9.2: Oct 16 2014</h3>
 <ul>
   <li>Security:<br/>
diff --git a/error.c b/error.c
index cbcf5c96..9c450405 100644
--- a/error.c
+++ b/error.c
@@ -177,7 +177,9 @@ xmlParserPrintFileContextInternal(xmlParserInputPtr input ,
     xmlChar  content[81]; /* space for 80 chars + line terminator */
     xmlChar *ctnt;
 
-    if (input == NULL) return;
+    if ((input == NULL) || (input->cur == NULL) ||
+        (*input->cur == 0)) return;
+
     cur = input->cur;
     base = input->base;
     /* skip backwards over any end-of-lines */
diff --git a/include/libxml/tree.h b/include/libxml/tree.h
index 2f90717c..4a9b3bc6 100644
--- a/include/libxml/tree.h
+++ b/include/libxml/tree.h
@@ -76,7 +76,8 @@ typedef enum {
     XML_BUFFER_ALLOC_EXACT,	/* grow only to the minimal size */
     XML_BUFFER_ALLOC_IMMUTABLE, /* immutable buffer */
     XML_BUFFER_ALLOC_IO,	/* special allocation scheme used for I/O */
-    XML_BUFFER_ALLOC_HYBRID	/* exact up to a threshold, and doubleit thereafter */
+    XML_BUFFER_ALLOC_HYBRID,	/* exact up to a threshold, and doubleit thereafter */
+    XML_BUFFER_ALLOC_BOUNDED	/* limit the upper size of the buffer */
 } xmlBufferAllocationScheme;
 
 /**
diff --git a/include/libxml/xmlversion.h.in b/include/libxml/xmlversion.h.in
index 00a836fb..b173be9e 100644
--- a/include/libxml/xmlversion.h.in
+++ b/include/libxml/xmlversion.h.in
@@ -435,7 +435,7 @@ XMLPUBFUN void XMLCALL xmlCheckVersion(int version);
  */
 
 #ifndef LIBXML_ATTR_ALLOC_SIZE
-# if ((__GNUC__ > 4) || ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 3)))
+# if (!defined(__clang__) && ((__GNUC__ > 4) || ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 3))))
 #  define LIBXML_ATTR_ALLOC_SIZE(x) __attribute__((alloc_size(x)))
 # else
 #  define LIBXML_ATTR_ALLOC_SIZE(x)
diff --git a/libxml.spec.in b/libxml.spec.in
index 242a4fee..9029a180 100644
--- a/libxml.spec.in
+++ b/libxml.spec.in
@@ -1,3 +1,5 @@
+%global with_python3 1
+
 Summary: Library providing XML and HTML support
 Name: libxml2
 Version: @VERSION@
@@ -6,7 +8,13 @@ License: MIT
 Group: Development/Libraries
 Source: ftp://xmlsoft.org/libxml2/libxml2-%{version}.tar.gz
 BuildRoot: %{_tmppath}/%{name}-%{version}-root
-BuildRequires: python python-devel zlib-devel pkgconfig xz-devel
+BuildRequires: python-devel
+%if 0%{?with_python3}
+BuildRequires: python3-devel
+%endif # with_python3
+BuildRequires: zlib-devel
+BuildRequires: pkgconfig
+BuildRequires: xz-devel
 URL: http://xmlsoft.org/
 
 %description
@@ -55,8 +63,8 @@ Group: Development/Libraries
 Requires: libxml2 = %{version}-%{release}
 
 %description python
-The libxml2-python package contains a module that permits applications
-written in the Python programming language to use the interface
+The libxml2-python package contains a Python 2 module that permits applications
+written in the Python programming language, version 2, to use the interface
 supplied by the libxml2 library to manipulate XML files.
 
 This library allows to manipulate XML files. It includes support
@@ -64,6 +72,23 @@ to read, modify and write XML and HTML files. There is DTDs support
 this includes parsing and validation even with complex DTDs, either
 at parse time or later once the document has been modified.
 
+%if 0%{?with_python3}
+%package python3
+Summary: Python 3 bindings for the libxml2 library
+Group: Development/Libraries
+Requires: libxml2 = %{version}-%{release}
+
+%description python3
+The libxml2-python3 package contains a Python 3 module that permits
+applications written in the Python programming language, version 3, to use the
+interface supplied by the libxml2 library to manipulate XML files.
+
+This library allows to manipulate XML files. It includes support
+to read, modify and write XML and HTML files. There is DTDs support
+this includes parsing and validation even with complex DTDs, either
+at parse time or later once the document has been modified.
+%endif # with_python3
+
 %prep
 %setup -q
 
@@ -76,6 +101,13 @@ rm -fr %{buildroot}
 
 make install DESTDIR=%{buildroot}
 
+%if 0%{?with_python3}
+make clean
+%configure --with-python=%{__python3}
+make install DESTDIR=%{buildroot}
+%endif # with_python3
+
+
 rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
 rm -f $RPM_BUILD_ROOT%{_libdir}/python*/site-packages/*.a
 rm -f $RPM_BUILD_ROOT%{_libdir}/python*/site-packages/*.la
@@ -136,14 +168,30 @@ rm -fr %{buildroot}
 %files python
 %defattr(-, root, root)
 
-%{_libdir}/python*/site-packages/libxml2.py*
-%{_libdir}/python*/site-packages/drv_libxml2.py*
-%{_libdir}/python*/site-packages/libxml2mod*
+%{_libdir}/python2*/site-packages/libxml2.py*
+%{_libdir}/python2*/site-packages/drv_libxml2.py*
+%{_libdir}/python2*/site-packages/libxml2mod*
+%doc python/TODO
+%doc python/libxml2class.txt
+%doc python/tests/*.py
+%doc doc/*.py
+%doc doc/python.html
+
+%if 0%{?with_python3}
+%files python3
+%defattr(-, root, root)
+
+%{_libdir}/python3*/site-packages/libxml2.py*
+%{_libdir}/python3*/site-packages/drv_libxml2.py*
+%{_libdir}/python3*/site-packages/__pycache__/libxml2.cpython-34.py*
+%{_libdir}/python3*/site-packages/__pycache__/drv_libxml2.cpython-34.py*
+%{_libdir}/python3*/site-packages/libxml2mod*
 %doc python/TODO
 %doc python/libxml2class.txt
 %doc python/tests/*.py
 %doc doc/*.py
 %doc doc/python.html
+%endif # with_python3
 
 %changelog
 * @RELDATE@ Daniel Veillard <veillard@redhat.com>
diff --git a/libxml2-config.cmake.in b/libxml2-config.cmake.in
index ac293291..6b16fc2e 100644
--- a/libxml2-config.cmake.in
+++ b/libxml2-config.cmake.in
@@ -21,7 +21,7 @@ set(LIBXML2_VERSION_MINOR  @LIBXML_MINOR_VERSION@)
 set(LIBXML2_VERSION_MICRO  @LIBXML_MICRO_VERSION@)
 set(LIBXML2_VERSION_STRING "@VERSION@")
 set(LIBXML2_INSTALL_PREFIX ${_libxml2_rootdir})
-set(LIBXML2_INCLUDE_DIRS   ${_libxml2_rootdir}/include)
+set(LIBXML2_INCLUDE_DIRS   ${_libxml2_rootdir}/include ${_libxml2_rootdir}/include/libxml2)
 set(LIBXML2_LIBRARY_DIR    ${_libxml2_rootdir}/lib)
 set(LIBXML2_LIBRARIES      -L${LIBXML2_LIBRARY_DIR} -lxml2)
 
diff --git a/os400/libxmlrpg/HTMLparser.rpgle b/os400/libxmlrpg/HTMLparser.rpgle
index 7b4a6269..d4c5f8d9 100644
--- a/os400/libxmlrpg/HTMLparser.rpgle
+++ b/os400/libxmlrpg/HTMLparser.rpgle
@@ -12,6 +12,7 @@
       /define HTML_PARSER_H__
 
       /include "libxmlrpg/xmlversion"
+      /include "libxmlrpg/xmlTypesC"
       /include "libxmlrpg/parser"
 
       /if defined(LIBXML_HTML_ENABLED)
@@ -63,13 +64,13 @@
      d htmlElemDesc    ds                  based(htmlElemDescPtr)
      d                                     align qualified
      d  name                           *                                        const char *
-     d  startTag                      3u 0                                      Start tag implied ?
-     d  endTag                        3u 0                                      End tag implied ?
-     d  saveEndTag                    3u 0                                      Save end tag ?
-     d  empty                         3u 0                                      Empty element ?
-     d  depr                          3u 0                                      Deprecated element ?
-     d  dtd                           3u 0                                      Loose DTD/Frameset
-     d  isinline                      3u 0                                      Block 0/inline elem?
+     d  startTag                           like(xmlCchar)                       Start tag implied ?
+     d  endTag                             like(xmlCchar)                       End tag implied ?
+     d  saveEndTag                         like(xmlCchar)                       Save end tag ?
+     d  empty                              like(xmlCchar)                       Empty element ?
+     d  depr                               like(xmlCchar)                       Deprecated element ?
+     d  dtd                                like(xmlCchar)                       Loose DTD/Frameset
+     d  isinline                           like(xmlCchar)                       Block 0/inline elem?
      d  desc                           *                                        const char *
       *
       * New fields encapsulating HTML structure
diff --git a/os400/libxmlrpg/SAX.rpgle b/os400/libxmlrpg/SAX.rpgle
index 18f851dd..85f15ccf 100644
--- a/os400/libxmlrpg/SAX.rpgle
+++ b/os400/libxmlrpg/SAX.rpgle
@@ -186,19 +186,19 @@
       /if defined(LIBXML_SAX1_ENABLED)
      d initxmlDefaultSAXHandler...
      d                 pr                  extproc('initxmlDefaultSAXHandler')
-     d  hdlr                               like(xmlSAXHandlerV1)
+     d  hdlr                               likeds(xmlSAXHandlerV1)
      d  warning                      10i 0 value
 
       /if defined(LIBXML_HTML_ENABLED)
      d inithtmlDefaultSAXHandler...
      d                 pr                  extproc('inithtmlDefaultSAXHandler')
-     d  hdlr                               like(xmlSAXHandlerV1)
+     d  hdlr                               likeds(xmlSAXHandlerV1)
       /endif
 
       /if defined(LIBXML_DOCB_ENABLED)
      d initdocbDefaultSAXHandler...
      d                 pr                  extproc('initdocbDefaultSAXHandler')
-     d  hdlr                               like(xmlSAXHandlerV1)
+     d  hdlr                               likeds(xmlSAXHandlerV1)
       /endif
       /endif                                                                    LIBXML_SAX1_ENABLED
 
diff --git a/os400/libxmlrpg/SAX2.rpgle b/os400/libxmlrpg/SAX2.rpgle
index c9ab9d10..fb687e99 100644
--- a/os400/libxmlrpg/SAX2.rpgle
+++ b/os400/libxmlrpg/SAX2.rpgle
@@ -213,20 +213,20 @@
       /endif                                                                    LIBXML_SAX1_ENABLED
 
      d xmlSAXVersion   pr            10i 0 extproc('xmlSAXVersion')
-     d  hdlr                               like(xmlSAXHandler)
+     d  hdlr                               likeds(xmlSAXHandler)
      d  version                      10i 0 value
 
      d xmlSAX2InitDefaultSAXHandler...
      d                 pr                  extproc(
      d                                      'xmlSAX2InitDefaultSAXHandler')
-     d  hdlr                               like(xmlSAXHandler)
+     d  hdlr                               likeds(xmlSAXHandler)
      d  warning                      10i 0 value
 
       /if defined(LIBXML_HTML_ENABLED)
      d xmlSAX2InitHtmlDefaultSAXHandler...
      d                 pr                  extproc(
      d                                      'xmlSAX2InitHtmlDefaultSAXHandler')
-     d  hdlr                               like(xmlSAXHandler)
+     d  hdlr                               likeds(xmlSAXHandler)
 
      d htmlDefaultSAXHandlerInit...
      d                 pr                  extproc('htmlDefaultSAXHandlerInit')
@@ -236,7 +236,7 @@
      d xmlSAX2InitDocbDefaultSAXHandler...
      d                 pr                  extproc(
      d                                      'xmlSAX2InitDocbDefaultSAXHandler')
-     d  hdlr                               like(xmlSAXHandler)
+     d  hdlr                               likeds(xmlSAXHandler)
 
      d docbDefaultSAXHandlerInit...
      d                 pr                  extproc('docbDefaultSAXHandlerInit')
diff --git a/os400/libxmlrpg/chvalid.rpgle b/os400/libxmlrpg/chvalid.rpgle
index 33393f6f..444d1cb2 100644
--- a/os400/libxmlrpg/chvalid.rpgle
+++ b/os400/libxmlrpg/chvalid.rpgle
@@ -10,6 +10,7 @@
       /define XML_CHVALID_H__
 
       /include "libxmlrpg/xmlversion"
+      /include "libxmlrpg/xmlTypesC"
       /include "libxmlrpg/xmlstring"
 
       * Define our typedefs and structures
@@ -18,8 +19,8 @@
 
      d xmlChSRange     ds                  based(xmlChSRangePtr)
      d                                     align qualified
-     d  low                           5u 0
-     d  high                          5u 0
+     d  low                                like(xmlCushort)
+     d  high                               like(xmlCushort)
 
      d xmlChLRangePtr  s               *   based(######typedef######)
 
diff --git a/os400/libxmlrpg/dict.rpgle b/os400/libxmlrpg/dict.rpgle
index cd36f50f..bcb6576e 100644
--- a/os400/libxmlrpg/dict.rpgle
+++ b/os400/libxmlrpg/dict.rpgle
@@ -10,6 +10,7 @@
       /define XML_DICT_H__
 
       /include "libxmlrpg/xmlversion"
+      /include "libxmlrpg/xmlTypesC"
       /include "libxmlrpg/tree"
 
       * The dictionary.
@@ -27,12 +28,14 @@
      d                                     like(xmlDictPtr)
 
      d xmlDictSetLimit...
-     d                 pr            10u 0 extproc('xmlDictSetLimit')           size_t
+     d                 pr                  extproc('xmlDictSetLimit')
+     d                                     like(xmlCsize_t)
      d  dict                               value like(xmlDictPtr)
-     d  limit                        10u 0 value                                size_t
+     d  limit                              value like(xmlCsize_t)
 
      d xmlDictGetUsage...
-     d                 pr            10u 0 extproc('xmlDictGetUsage')           size_t
+     d                 pr                  extproc('xmlDictGetUsage')
+     d                                     like(xmlCsize_t)
      d  dict                               value like(xmlDictPtr)
 
      d xmlDictCreateSub...
diff --git a/os400/libxmlrpg/encoding.rpgle b/os400/libxmlrpg/encoding.rpgle
index 80970fb0..c0ed7e65 100644
--- a/os400/libxmlrpg/encoding.rpgle
+++ b/os400/libxmlrpg/encoding.rpgle
@@ -234,25 +234,25 @@
 
      d xmlCharEncOutFunc...
      d                 pr            10i 0 extproc('xmlCharEncOutFunc')
-     d  handler                            like(xmlCharEncodingHandler)
+     d  handler                            likeds(xmlCharEncodingHandler)
      d  out                                value like(xmlBufferPtr)
      d  in                                 value like(xmlBufferPtr)
 
      d xmlCharEncInFunc...
      d                 pr            10i 0 extproc('xmlCharEncInFunc')
-     d  handler                            like(xmlCharEncodingHandler)
+     d  handler                            likeds(xmlCharEncodingHandler)
      d  out                                value like(xmlBufferPtr)
      d  in                                 value like(xmlBufferPtr)
 
      d xmlCharEncFirstLine...
      d                 pr            10i 0 extproc('xmlCharEncFirstLine')
-     d  handler                            like(xmlCharEncodingHandler)
+     d  handler                            likeds(xmlCharEncodingHandler)
      d  out                                value like(xmlBufferPtr)
      d  in                                 value like(xmlBufferPtr)
 
      d xmlCharEncCloseFunc...
      d                 pr            10i 0 extproc('xmlCharEncCloseFunc')
-     d  handler                            like(xmlCharEncodingHandler)
+     d  handler                            likeds(xmlCharEncodingHandler)
 
       * Export a few useful functions
 
diff --git a/os400/libxmlrpg/globals.rpgle b/os400/libxmlrpg/globals.rpgle
index 80dadcac..e51182fb 100644
--- a/os400/libxmlrpg/globals.rpgle
+++ b/os400/libxmlrpg/globals.rpgle
@@ -94,13 +94,13 @@
      d  xmlParserVersion...
      d                                 *                                        const char *
      d  xmlDefaultSAXLocator...
-     d                                     like(xmlSAXLocator)
+     d                                     likeds(xmlSAXLocator)
      d  xmlDefaultSAXHandler...
-     d                                     like(xmlSAXHandlerV1)
+     d                                     likeds(xmlSAXHandlerV1)
      d  docbDefaultSAXHandler...
-     d                                     like(xmlSAXHandlerV1)
+     d                                     likeds(xmlSAXHandlerV1)
      d  htmlDefaultSAXHandler...
-     d                                     like(xmlSAXHandlerV1)
+     d                                     likeds(xmlSAXHandlerV1)
      d  xmlFree                            like(xmlFreeFunc)
      d  xmlMalloc                          like(xmlMallocFunc)
      d  xmlMemStrdup                       like(xmlStrdupFunc)
@@ -145,7 +145,7 @@
      d                                     like(xmlDeregisterNodeFunc)
      d  xmlMallocAtomic...
      d                                     like(xmlMallocFunc)
-     d  xmlLastError                       like(xmlError)
+     d  xmlLastError                       likeds(xmlError)
      d  xmlParserInputBufferCreateFilenameValue...
      d                                     like(xmlParserInputBuffer...
      d                                     CreateFilenameFunc)
@@ -215,33 +215,33 @@
      d get_docbDefaultSAXHandler...
      d                 pr                  extproc(
      d                                       '__get_docbDefaultSAXHandler')
-     d                                     like(xmlSAXHandlerV1)
+     d                                     likeds(xmlSAXHandlerV1)
 
      d set_docbDefaultSAXHandler...
      d                 pr                  extproc(
      d                                       '__set_docbDefaultSAXHandler')
-     d  value                              value like(xmlSAXHandlerV1)
+     d  value                              value likeds(xmlSAXHandlerV1)
       /endif
 
       /if defined(LIBXML_HTML_ENABLED)
      d get_htmlDefaultSAXHandler...
      d                 pr                  extproc(
      d                                       '__get_htmlDefaultSAXHandler')
-     d                                     like(xmlSAXHandlerV1)
+     d                                     likeds(xmlSAXHandlerV1)
 
      d set_htmlDefaultSAXHandler...
      d                 pr                  extproc(
      d                                       '__set_htmlDefaultSAXHandler')
-     d  value                              value like(xmlSAXHandlerV1)
+     d  value                              value likeds(xmlSAXHandlerV1)
       /endif
 
      d get_xmlLastError...
      d                 pr                  extproc('__get_xmlLastError')
-     d                                     like(xmlError)
+     d                                     likeds(xmlError)
 
      d set_xmlLastError...
      d                 pr                  extproc('__set_xmlLastError')
-     d  value                              value like(xmlError)
+     d  value                              value likeds(xmlError)
 
      d get_oldXMLWDcompatibility...
      d                 pr            10i 0 extproc(
@@ -278,19 +278,19 @@
 
      d get_xmlDefaultSAXHandler...
      d                 pr                  extproc('__get_xmlDefaultSAXHandler')
-     d                                     like(xmlSAXHandlerV1)
+     d                                     likeds(xmlSAXHandlerV1)
 
      d set_xmlDefaultSAXHandler...
      d                 pr                  extproc('__set_xmlDefaultSAXHandler')
-     d  value                              value like(xmlSAXHandlerV1)
+     d  value                              value likeds(xmlSAXHandlerV1)
 
      d get_xmlDefaultSAXLocator...
      d                 pr                  extproc('__get_xmlDefaultSAXLocator')
-     d                                     like(xmlSAXLocator)
+     d                                     likeds(xmlSAXLocator)
 
      d set_xmlDefaultSAXLocator...
      d                 pr                  extproc('__set_xmlDefaultSAXLocator')
-     d  value                              value like(xmlSAXLocator)
+     d  value                              value likeds(xmlSAXLocator)
 
      d get_xmlDoValidityCheckingDefaultValue...
      d                 pr            10i 0 extproc('__get_xmlDoValidity+
diff --git a/os400/libxmlrpg/nanoftp.rpgle b/os400/libxmlrpg/nanoftp.rpgle
index 0637562e..d8d5ef97 100644
--- a/os400/libxmlrpg/nanoftp.rpgle
+++ b/os400/libxmlrpg/nanoftp.rpgle
@@ -9,7 +9,7 @@
       /if not defined(NANO_FTP_H__)
       /define NANO_FTP_H__
 
-      /include /libxmlrpg/xmlversion"
+      /include "libxmlrpg/xmlversion"
 
       /if defined(LIBXML_FTP_ENABLED)
 
diff --git a/os400/libxmlrpg/parser.rpgle b/os400/libxmlrpg/parser.rpgle
index 7f29e31e..f04aa2eb 100644
--- a/os400/libxmlrpg/parser.rpgle
+++ b/os400/libxmlrpg/parser.rpgle
@@ -9,6 +9,7 @@
       /define XML_PARSER_H__
 
       /include "libxmlrpg/xmlversion"
+      /include "libxmlrpg/xmlTypesC"
       /include "libxmlrpg/tree"
       /include "libxmlrpg/dict"
       /include "libxmlrpg/hash"
@@ -60,7 +61,7 @@
       *       so even if there is an overflow this should not give troubles
       *       for parsing very large instances.
       *
-     d  consumed                     20u 0                                      # consumed xmlChars
+     d  consumed                           like(xmlCulong)                      # consumed xmlChars
      d  free                               like(xmlParserInputDeallocate)       base deallocator
      d  encoding                       *                                        const xmlChar *
      d  version                        *                                        const xmlChar *
@@ -81,10 +82,10 @@
      d                                     align qualified
      d  node                               like(xmlNodePtr)                     const
       * Position & line # that text that created the node begins & ends on
-     d  begin_pos                    20u 0
-     d  begin_line                   20u 0
-     d  end_pos                      20u 0
-     d  end_line                     20u 0
+     d  begin_pos                          like(xmlCulong)
+     d  begin_line                         like(xmlCulong)
+     d  end_pos                            like(xmlCulong)
+     d  end_line                           like(xmlCulong)
 
      d xmlParserNodeInfoSeqPtr...
      d                 s               *   based(######typedef######)
@@ -92,8 +93,8 @@
      d xmlParserNodeInfoSeq...
      d                 ds                  based(xmlParserNodeInfoSeqPtr)
      d                                     align qualified
-     d  maximum                      20u 0
-     d  length                       20u 0
+     d  maximum                            like(xmlCulong)
+     d  length                             like(xmlCulong)
      d  buffer                             like(xmlParserNodeInfoPtr)
 
       * xmlParserInputState:
@@ -221,18 +222,18 @@
      d  nodeTab                        *                                        xmlNodePtr *
       *
      d  record_info                  10i 0                                      Keep node info ?
-     d  node_seq                           like(xmlParserNodeInfoSeq)           Parsed nodes info
+     d  node_seq                           likeds(xmlParserNodeInfoSeq)         Parsed nodes info
       *
      d  errNo                        10i 0                                      Error code
       *
      d  hasExternalSubset...
      d                               10i 0
-     d  hashPErefs                   10i 0
+     d  hasPErefs                    10i 0
      d  external                     10i 0                                      Parsing ext. entity?
       *
      d  valid                        10i 0                                      Valid document ?
      d  validate                     10i 0                                      Try to validate ?
-     d  vctxt                              like(xmlValidCtxt)                   Validity context
+     d  vctxt                              likeds(xmlValidCtxt)                 Validity context
       *
      d  instate                            like(xmlParserInputState)            Current input type
      d  token                        10i 0                                      Next look-ahead char
@@ -246,8 +247,8 @@
      d  nameMax                      10i 0                                      Max stack depth
      d  nameTab                        *                                        const xmlChar * *
       *
-     d  nbChars                      20i 0                                      # xmlChars processed
-     d  checkIndex                   20i 0                                      4 progressive parse
+     d  nbChars                            like(xmlClong)                       # xmlChars processed
+     d  checkIndex                         like(xmlClong)                       4 progressive parse
      d  keepBlanks                   10i 0                                      Ugly but ...
      d  disableSAX                   10i 0                                      Disable SAX cllbacks
      d  inSubset                     10i 0                                      In int 1/ext 2 sbset
@@ -309,20 +310,20 @@
       *
       * the complete error informations for the last error.
       *
-     d  lastError                          like(xmlError)
+     d  lastError                          likeds(xmlError)
      d  parseMode                          like(xmlParserMode)                  The parser mode
-     d  nbentities                   20u 0                                      # entity references
-     d  sizeentities                 20u 0                                      Parsed entities size
+     d  nbentities                         like(xmlCulong)                      # entity references
+     d  sizeentities                       like(xmlCulong)                      Parsed entities size
       *
       * for use by HTML non-recursive parser
       *
-     d  nodeInfo                           like(xmlParserNodeInfo)              Current NodeInfo
+     d  nodeInfo                           like(xmlParserNodeInfoPtr)           Current NodeInfo
      d  nodeInfoNr                   10i 0                                      Parsing stack depth
      d  nodeInfoMax                  10i 0                                      Max stack depth
      d  nodeInfoTab                    *                                        xmlParserNodeInfo *
       *
      d  input_id                     10i 0                                      Label inputs ?
-     d  sizeentcopy                  20u 0                                      Entity copy volume
+     d  sizeentcopy                        like(xmlCulong)                      Entity copy volume
 
       * xmlSAXLocator:
       *
@@ -1151,7 +1152,8 @@
      d  seq                                value like(xmlParserNodeInfoSeqPtr)
 
      d xmlParserFindNodeInfoIndex...
-     d                 pr            20u 0 extproc('xmlParserFindNodeInfoIndex')
+     d                 pr                  extproc('xmlParserFindNodeInfoIndex')
+     d                                     like(xmlCulong)
      d  seq                                value like(xmlParserNodeInfoSeqPtr)
      d  node                               value like(xmlNodePtr)               const
 
@@ -1180,7 +1182,8 @@
       * Index lookup, actually implemented in the encoding module
 
      d xmlByteConsumed...
-     d                 pr            20i 0 extproc('xmlByteConsumed')
+     d                 pr                  extproc('xmlByteConsumed')
+     d                                     like(xmlClong)
      d  ctxt                               value like(xmlParserCtxtPtr)
 
       * New set of simpler/more flexible APIs
diff --git a/os400/libxmlrpg/parserInternals.rpgle b/os400/libxmlrpg/parserInternals.rpgle
index 6942b7dd..26913977 100644
--- a/os400/libxmlrpg/parserInternals.rpgle
+++ b/os400/libxmlrpg/parserInternals.rpgle
@@ -89,7 +89,7 @@
      d                 s              9    import('xmlStringTextNoenc')         \0 in 10th byte
 
      d xmlStringComment...
-     d                 s              7    import('xmlStringTextComment')       \0 in 8th byte
+     d                 s              7    import('xmlStringComment')           \0 in 8th byte
 
       * Function to finish the work of the macros where needed.
 
diff --git a/os400/libxmlrpg/schematron.rpgle b/os400/libxmlrpg/schematron.rpgle
index ff8ea625..c987cd5e 100644
--- a/os400/libxmlrpg/schematron.rpgle
+++ b/os400/libxmlrpg/schematron.rpgle
@@ -101,7 +101,7 @@
      d  err                                value
      d                                     like(xmlSchematronValidityErrorFunc)
      d  warn                               value like(
-     d                                     xmlSchematronValidityWarningFunc)
+     d                                       xmlSchematronValidityWarningFunc)
      d  ctx                            *   value                                void *
 
      d xmlSchematronGetParserErrors...
diff --git a/os400/libxmlrpg/tree.rpgle b/os400/libxmlrpg/tree.rpgle
index 8b4981ab..5c67f4fa 100644
--- a/os400/libxmlrpg/tree.rpgle
+++ b/os400/libxmlrpg/tree.rpgle
@@ -11,6 +11,7 @@
       /define XML_TREE_H__
 
       /include "libxmlrpg/xmlversion"
+      /include "libxmlrpg/xmlTypesC"
       /include "libxmlrpg/xmlstring"
 
 
@@ -109,12 +110,14 @@
      d xmlBufEnd       pr              *   extproc('xmlBufEnd')                 xmlChar *
      d  buf                                value like(xmlBufPtr)                const
 
-     d xmlBufUse       pr            10u 0 extproc('xmlBufUse')                 size_t
+     d xmlBufUse       pr                  extproc('xmlBufUse')
+     d                                     like(xmlCsize_t)
      d  buf                                value like(xmlBufPtr)                const
 
-     d xmlBufShrink    pr            10u 0 extproc('xmlBufShrink')              size_t
+     d xmlBufShrink    pr                  extproc('xmlBufShrink')
+     d                                     like(xmlCsize_t)
      d  buf                                value like(xmlBufPtr)
-     d  len                          10u 0 value                                size_t
+     d  len                                value like(xmlCsize_t)
 
       * LIBXML2_NEW_BUFFER:
       *
@@ -503,8 +506,8 @@
      d  properties                         like(xmlAttrPtr)                     Properties list
      d  nsDef                              like(xmlNsPtr)                       Node ns definitions
      d  psvi                           *                                        Type/PSVI info
-     d  line                          5u 0                                      Line number
-     d  extra                         5u 0                                      Data for XPath/XSLT
+     d  line                               like(xmlCushort)
+     d  extra                              like(xmlCushort)                     Data for XPath/XSLT
 
       * xmlDocProperty
       *
@@ -681,18 +684,18 @@
      d xmlBufferCreateSize...
      d                 pr                  extproc('xmlBufferCreateSize')
      d                                     like(xmlBufferPtr)
-     d  size                         10u 0 value                                size_t
+     d  size                               value like(xmlCsize_t)
 
      d xmlBufferCreateStatic...
      d                 pr                  extproc('xmlBufferCreateStatic')
      d                                     like(xmlBufferPtr)
      d  mem                            *   value
-     d  size                         10u 0 value                                size_t
+     d  size                               value like(xmlCsize_t)
 
      d xmlBufferResize...
      d                 pr            10i 0 extproc('xmlBufferResize')
      d  buf                                value like(xmlBufferPtr)
-     d  size                         10u 0 value                                size_t
+     d  size                               value like(xmlCsize_t)
 
      d xmlBufferFree   pr                  extproc('xmlBufferFree')
      d  buf                                value like(xmlBufferPtr)
@@ -1030,7 +1033,8 @@
       * Navigating.
 
      d xmlNewDocFragment...
-     d xmlGetLineNo    pr            20i 0 extproc('xmlGetLineNo')
+     d xmlGetLineNo    pr                  extproc('xmlGetLineNo')
+     d                                     like(xmlClong)
      d  node                               value like(xmlNodePtr)
 
       /if defined(LIBXML_TREE_ENABLED)
@@ -1476,7 +1480,8 @@
      d  cur                                value like(xmlDocPtr)
      d  format                       10i 0 value
 
-     d xmlBufNodeDump  pr            10u 0 extproc('xmlBufNodeDump')            size_t
+     d xmlBufNodeDump  pr                  extproc('xmlBufNodeDump')
+     d                                     like(xmlCsize_t)
      d  buf                                value like(xmlBufPtr)
      d  doc                                value like(xmlDocPtr)
      d  cur                                value like(xmlNodePtr)
@@ -1597,7 +1602,8 @@
       * traversal.
 
      d xmlChildElementCount...
-     d                 pr            20u 0 extproc('xmlChildElementCount')
+     d                 pr                  extproc('xmlChildElementCount')
+     d                                     like(xmlClong)
      d  parent                             value like(xmlNodePtr)
 
      d xmlNextElementSibling...
diff --git a/os400/libxmlrpg/xmlIO.rpgle b/os400/libxmlrpg/xmlIO.rpgle
index 72911bc0..261b0e22 100644
--- a/os400/libxmlrpg/xmlIO.rpgle
+++ b/os400/libxmlrpg/xmlIO.rpgle
@@ -9,6 +9,7 @@
       /define XML_IO_H__
 
       /include "libxmlrpg/xmlversion"
+      /include "libxmlrpg/xmlTypesC"
 
       * Those are the functions and datatypes for the parser input
       * I/O structures.
@@ -131,7 +132,7 @@
      d  raw                                like(xmlBufPtr)                      Raw input buffer
      d  compressed                   10i 0
      d  error                        10i 0
-     d  rawconsumed                  20u 0
+     d  rawconsumed                        like(xmlCulong)
 
       /if defined(LIBXML_OUTPUT_ENABLED)
      d xmlOutputBuffer...
@@ -307,7 +308,8 @@
      d  out                                value like(xmlOutputBufferPtr)
 
      d xmlOutputBufferGetSize...
-     d                 pr            10u 0 extproc('xmlOutputBufferGetSize')    size_t
+     d                 pr                  extproc('xmlOutputBufferGetSize')
+     d                                     like(xmlCsize_t)
      d  out                                value like(xmlOutputBufferPtr)
 
      d xmlOutputBufferWrite...
diff --git a/os400/libxmlrpg/xmlTypesC.rpgle b/os400/libxmlrpg/xmlTypesC.rpgle
new file mode 100644
index 00000000..798d74d3
--- /dev/null
+++ b/os400/libxmlrpg/xmlTypesC.rpgle
@@ -0,0 +1,24 @@
+      * Eqivalent of C data types.
+      *
+      * Copy: See Copyright for the status of this software.
+      *
+      * Author: Patrick Monnerat <pm@datasphere.ch>, DATASPHERE S.A.
+
+      /if not defined(XMLTYPESC_H__)
+      /define XMLTYPESC_H__
+
+     d xmlCchar        s              3i 0 based(######typedef######)
+     d xmlCuchar       s              3u 0 based(######typedef######)
+     d xmlCshort       s              5i 0 based(######typedef######)
+     d xmlCushort      s              5u 0 based(######typedef######)
+     d xmlCint         s             10i 0 based(######typedef######)
+     d xmlCuInt        s             10u 0 based(######typedef######)
+     d xmlClong        s             10i 0 based(######typedef######)
+     d xmlCulong       s             10u 0 based(######typedef######)
+     d xmlClonglong    s             20i 0 based(######typedef######)
+     d xmlCulonglong   s             20u 0 based(######typedef######)
+     d xmlCenum        s             10i 0 based(######typedef######)
+     d xmlCssize_t     s             10i 0 based(######typedef######)
+     d xmlCsize_t      s             10u 0 based(######typedef######)
+
+      /endif
diff --git a/os400/libxmlrpg/xmlmemory.rpgle b/os400/libxmlrpg/xmlmemory.rpgle
index 165eacac..3c791038 100644
--- a/os400/libxmlrpg/xmlmemory.rpgle
+++ b/os400/libxmlrpg/xmlmemory.rpgle
@@ -10,6 +10,7 @@
       /define DEBUG_MEMORY_ALLOC__
 
       /include "libxmlrpg/xmlversion"
+      /include "libxmlrpg/xmlTypesC"
 
       * DEBUG_MEMORY:
       *
@@ -96,7 +97,7 @@
      d  func                               value like(xmlMallocFunc)
 
      d xmlMalloc       pr              *   extproc('__call_xmlMalloc')          void *
-     d  size                         10u 0 value                                size_t
+     d  size                               value like(xmlCsize_t)
 
      d get_xmlMallocAtomic...
      d                 pr                  extproc('__get_xmlMallocAtomic')
@@ -108,7 +109,7 @@
 
      d xmlMallocAtomic...
      d                 pr              *   extproc('__call_xmlMallocAtomic')    void *
-     d  size                         10u 0 value                                size_t
+     d  size                               value like(xmlCsize_t)
 
      d get_xmlRealloc  pr                  extproc('__get_xmlRealloc')
      d                                     like(xmlReallocFunc)
@@ -118,7 +119,7 @@
 
      d xmlRealloc      pr              *   extproc('__call_xmlRealloc')         void *
      d  mem                            *   value                                void *
-     d  size                         10u 0 value                                size_t
+     d  size                               value like(xmlCsize_t)
 
      d get_xmlMemStrdup...
      d                 pr                  extproc('__get_xmlMemStrdup')
@@ -184,7 +185,7 @@
      d xmlMmDisplayLast...
      d                 pr                  extproc('xmlMemDisplayLast')
      d  fp                             *   value                                FILE *
-     d  nbBytes                      20i 0 value
+     d  nbBytes                            value like(xmlClong)
 
      d xmlMemShow      pr                  extproc('xmlMemShow')
      d  fp                             *   value                                FILE *
@@ -193,11 +194,11 @@
      d xmlMemoryDump   pr                  extproc('xmlMemoryDump')
 
      d xmlMemMalloc    pr              *   extproc('xmlMemMalloc')              void *
-     d  size                         10u 0 value                                size_t
+     d  size                               value like(xmlCsize_t)
 
      d xmlMemRealloc   pr              *   extproc('xmlMemRealloc')             void *
      d  ptr                            *   value                                void *
-     d  size                         10u 0 value                                size_t
+     d  size                               value like(xmlCsize_t)
 
      d xmlMemFree      pr                  extproc('xmlMemFree')
      d  ptr                            *   value                                void *
@@ -207,19 +208,19 @@
      d  str                            *   value options(*string)               const char *
 
      d xmlMallocLoc    pr              *   extproc('xmlMallocLoc')              void *
-     d  size                         10u 0 value                                size_t
+     d  size                               value like(xmlCsize_t)
      d  file                           *   value options(*string)               const char *
      d  line                         10i 0 value
 
      d xmlReallocLoc   pr              *   extproc('xmlReallocLoc')              void *
      d  ptr                            *   value                                void *
-     d  size                         10u 0 value                                size_t
+     d  size                               value like(xmlCsize_t)
      d  file                           *   value options(*string)               const char *
      d  line                         10i 0 value
 
      d xmlMallocAtomicLoc...
      d                 pr              *   extproc('xmlMallocAtomicLoc')        void *
-     d  size                         10u 0 value                                size_t
+     d  size                               value like(xmlCsize_t)
      d  file                           *   value options(*string)               const char *
      d  line                         10i 0 value
 
diff --git a/os400/libxmlrpg/xmlreader.rpgle b/os400/libxmlrpg/xmlreader.rpgle
index eccd37c4..5084fc86 100644
--- a/os400/libxmlrpg/xmlreader.rpgle
+++ b/os400/libxmlrpg/xmlreader.rpgle
@@ -9,6 +9,7 @@
       /define XML_XMLREADER_H__
 
       /include "libxmlrpg/xmlversion"
+      /include "libxmlrpg/xmlTypesC"
       /include "libxmlrpg/tree"
       /include "libxmlrpg/xmlIO"
 
@@ -472,7 +473,8 @@
       * Index lookup
 
      d xmlTextReaderByteConsumed...
-     d                 pr            20i 0 extproc('xmlTextReaderByteConsumed')
+     d                 pr                  extproc('xmlTextReaderByteConsumed')
+     d                                     like(xmlClong)
      d  reader                             value like(xmlTextReaderPtr)
 
       * New more complete APIs for simpler creation and reuse of readers
diff --git a/os400/libxmlrpg/xmlsave.rpgle b/os400/libxmlrpg/xmlsave.rpgle
index efcb09fb..764dceb6 100644
--- a/os400/libxmlrpg/xmlsave.rpgle
+++ b/os400/libxmlrpg/xmlsave.rpgle
@@ -9,6 +9,7 @@
       /define XML_XMLSAVE_H__
 
       /include "libxmlrpg/xmlversion"
+      /include "libxmlrpg/xmlTypesC"
       /include "libxmlrpg/tree"
       /include "libxmlrpg/encoding"
       /include "libxmlrpg/xmlIO"
@@ -68,11 +69,13 @@
      d  encoding                       *   value options(*string)               const char *
      d  options                      10i 0 value
 
-     d xmlSaveDoc      pr            20i 0 extproc('xmlSaveDoc')
+     d xmlSaveDoc      pr                  extproc('xmlSaveDoc')
+     d                                     like(xmlClong)
      d  ctxt                               value like(xmlSaveCtxtPtr)
      d  doc                                value like(xmlDocPtr)
 
-     d xmlSaveTree     pr            20i 0 extproc('xmlSaveTree')
+     d xmlSaveTree     pr                  extproc('xmlSaveTree')
+     d                                     like(xmlClong)
      d  ctxt                               value like(xmlSaveCtxtPtr)
      d  node                               value like(xmlNodePtr)
 
diff --git a/os400/libxmlrpg/xmlschemastypes.rpgle b/os400/libxmlrpg/xmlschemastypes.rpgle
index 6433c329..0bf0f709 100644
--- a/os400/libxmlrpg/xmlschemastypes.rpgle
+++ b/os400/libxmlrpg/xmlschemastypes.rpgle
@@ -10,6 +10,7 @@
       /define XML_SCHEMA_TYPES_H__
 
       /include "libxmlrpg/xmlversion"
+      /include "libxmlrpg/xmlTypesC"
 
       /if defined(LIBXML_SCHEMAS_ENABLED)
 
@@ -107,7 +108,7 @@
      d                                     TypeFacet')
      d  facet                              value like(xmlSchemaFacetPtr)
      d  value                          *   value options(*string)               const xmlChar *
-     d  actualLen                    20u 0 value
+     d  actualLen                          value like(xmlCulong)
      d  expectedLen                    *   value                                unsigned long *
 
      d xmlSchemaGetBuiltInType...
@@ -130,8 +131,9 @@
      d  value                          *   value options(*string)               const xmlChar *
 
      d xmlSchemaGetFacetValueAsULong...
-     d                 pr            20u 0 extproc(
+     d                 pr                  extproc(
      d                                     'xmlSchemaGetFacetValueAsULong')
+     d                                     like(xmlCulong)
      d  facet                              value like(xmlSchemaFacetPtr)
 
      d xmlSchemaValidateLengthFacet...
@@ -141,7 +143,7 @@
      d  facet                              value like(xmlSchemaFacetPtr)
      d  value                          *   value options(*string)               const xmlChar *
      d  val                                value like(xmlSchemaValPtr)
-     d  length                       20u 0
+     d  length                             like(xmlCulong)
 
      d xmlSchemaValidateLengthFacetWhtsp...
      d                 pr            10i 0 extproc(
@@ -150,7 +152,7 @@
      d  valType                            value like(xmlSchemaValType)
      d  value                          *   value options(*string)               const xmlChar *
      d  val                                value like(xmlSchemaValPtr)
-     d  length                       20u 0
+     d  length                             like(xmlCulong)
      d  ws                                 value
      d                                     like(xmlSchemaWhitespaceValueType)
 
diff --git a/os400/libxmlrpg/xmlstdarg.rpgle b/os400/libxmlrpg/xmlstdarg.rpgle
index 4e6f121d..9e45a4c8 100644
--- a/os400/libxmlrpg/xmlstdarg.rpgle
+++ b/os400/libxmlrpg/xmlstdarg.rpgle
@@ -19,16 +19,16 @@
       * Procedures.
 
      d xmlVaStart      pr                  extproc('__xmlVaStart')
-     d  list                               like(xmlVaList)
+     d  list                               likeds(xmlVaList)
      d  lastargaddr                    *   value
      d  lastargsize                  10u 0 value
 
      d xmlVaArg        pr              *   extproc('__xmlVaArg')
-     d  list                               like(xmlVaList)
+     d  list                               likeds(xmlVaList)
      d  dest                           *   value
      d  argsize                      10i 0 value
 
      d xmlVaEnd        pr                  extproc('__xmlVaEnd')
-     d  list                               like(xmlVaList)
+     d  list                               likeds(xmlVaList)
 
       /endif                                                                    XML_STDARG_H__
diff --git a/os400/libxmlrpg/xmlstring.rpgle b/os400/libxmlrpg/xmlstring.rpgle
index 41e9eb51..5b863e45 100644
--- a/os400/libxmlrpg/xmlstring.rpgle
+++ b/os400/libxmlrpg/xmlstring.rpgle
@@ -10,6 +10,7 @@
       /define XML_STRING_H__
 
       /include "libxmlrpg/xmlversion"
+      /include "libxmlrpg/xmlTypesC"
       /include "libxmlrpg/xmlstdarg"
 
       * xmlChar:
@@ -18,7 +19,8 @@
       * It's unsigned allowing to pinpoint case where char * are assigned
       * to xmlChar * (possibly making serialization back impossible).
 
-     d xmlChar         s              3u 0 based(######typedef######)
+     d xmlChar         s                   based(######typedef######)
+     d                                     like(xmlCuchar)
 
       * xmlChar handling
 
diff --git a/os400/libxmlrpg/xpath.rpgle b/os400/libxmlrpg/xpath.rpgle
index 3f3be326..1784fada 100644
--- a/os400/libxmlrpg/xpath.rpgle
+++ b/os400/libxmlrpg/xpath.rpgle
@@ -18,6 +18,7 @@
       /define XML_XPATH_H__
 
       /include "libxmlrpg/xmlversion"
+      /include "libxmlrpg/xmlTypesC"
 
       /if defined(LIBXML_XPATH_ENABLED)
 
@@ -366,7 +367,7 @@
       *
      d  userData                       *                                        void *
      d  error                              like(xmlStructuredErrorFunc)         Error callback
-     d  lastError                          like(xmlError)                       The last error
+     d  lastError                          likeds(xmlError)                     The last error
      d  debugNode                          like(xmlNodePtr)                     XSLT source node
       *
       * dictionary
@@ -550,7 +551,8 @@
       * Evaluation functions.
 
      d xmlXPathOrderDocElems...
-     d                 pr            20i 0 extproc('xmlXPathOrderDocElems')
+     d                 pr                  extproc('xmlXPathOrderDocElems')
+     d                                     like(xmlClong)
      d doc                                 value like(xmlDocPtr)
 
      d xmlXPathSetContextNode...
diff --git a/os400/make-rpg.sh b/os400/make-rpg.sh
index 95d3249c..664b47bf 100644
--- a/os400/make-rpg.sh
+++ b/os400/make-rpg.sh
@@ -25,8 +25,6 @@ fi
 
 #       Map file names to DB2 name syntax.
 
-> tmpsubstfile
-
 for HFILE in *.rpgle *.rpgle.in
 do      NAME="`basename \"${HFILE}\" .in`"
         VAR="`basename \"${NAME}\" .rpgle`"
@@ -36,9 +34,14 @@ do      NAME="`basename \"${HFILE}\" .in`"
         then    VAL=SCHMTYPES
         fi
 
-        echo "s/${VAR}/${VAL}/g" >> tmpsubstfile
         eval "VAR_${VAR}=\"${VAL}\""
-done
+        echo "${VAR} s/${VAR}/${VAL}/g"
+done > tmpsubstfile1
+
+#       Order substitution commands so that a prefix appears after all
+#               file names beginning with the prefix.
+
+sort -r tmpsubstfile1 | sed 's/^[^ ]*[ ]*//' > tmpsubstfile2
 
 
 change_include()
@@ -47,7 +50,7 @@ change_include()
         sed -e '\#^....../include  *"libxmlrpg/#{'                      \
             -e 's///'                                                   \
             -e 's/".*//'                                                \
-            -f tmpsubstfile                                             \
+            -f tmpsubstfile2                                            \
             -e 's#.*#      /include libxmlrpg,&#'                       \
             -e '}'
 }
diff --git a/os400/make.sh b/os400/make.sh
index 864e72b2..95a35a28 100644
--- a/os400/make.sh
+++ b/os400/make.sh
@@ -42,7 +42,16 @@ do      if [ -f "${TEXT}" ]
                 MEMBER="${LIBIFSNAME}/DOCS.FILE/`db2_name \"${MEMBER}\"`.MBR"
 
                 if action_needed "${MEMBER}" "${TEXT}"
-                then    CMD="CPY OBJ('${TEXT}') TOOBJ('${MEMBER}')"
+                then    # Sources are in UTF-8.
+                        rm -f "${TOPDIR}/tmpfile"[12]
+                        CMD="CPY OBJ('${TEXT}') TOOBJ('${TOPDIR}/tmpfile1')"
+                        CMD="${CMD} FROMCCSID(1208) TOCCSID(${TGTCCSID})"
+                        CMD="${CMD} DTAFMT(*TEXT) REPLACE(*YES)"
+                        system "${CMD}"
+                        # Make sure all lines are < 100 characters.
+                        sed -e 's/.\{99\}/&\
+/g' -e 's/\n$//' "${TOPDIR}/tmpfile1" > "${TOPDIR}/tmpfile2"
+                        CMD="CPY OBJ('${TOPDIR}/tmpfile2') TOOBJ('${MEMBER}')"
                         CMD="${CMD} TOCCSID(${TGTCCSID})"
                         CMD="${CMD} DTAFMT(*TEXT) REPLACE(*YES)"
                         system "${CMD}"
diff --git a/parser.c b/parser.c
index a8d1b673..c5741e3b 100644
--- a/parser.c
+++ b/parser.c
@@ -94,6 +94,8 @@ static xmlParserCtxtPtr
 xmlCreateEntityParserCtxtInternal(const xmlChar *URL, const xmlChar *ID,
 	                  const xmlChar *base, xmlParserCtxtPtr pctx);
 
+static void xmlHaltParser(xmlParserCtxtPtr ctxt);
+
 /************************************************************************
  *									*
  *	Arbitrary limits set in the parser. See XML_PARSE_HUGE		*
@@ -1771,7 +1773,7 @@ nodePush(xmlParserCtxtPtr ctxt, xmlNodePtr value)
 	xmlFatalErrMsgInt(ctxt, XML_ERR_INTERNAL_ERROR,
 		 "Excessive depth in document: %d use XML_PARSE_HUGE option\n",
 			  xmlParserMaxDepth);
-	ctxt->instate = XML_PARSER_EOF;
+	xmlHaltParser(ctxt);
 	return(-1);
     }
     ctxt->nodeTab[ctxt->nodeNr] = value;
@@ -2073,9 +2075,16 @@ static void xmlGROW (xmlParserCtxtPtr ctxt) {
          ((ctxt->input->buf) && (ctxt->input->buf->readcallback != (xmlInputReadCallback) xmlNop)) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
-        ctxt->instate = XML_PARSER_EOF;
+        xmlHaltParser(ctxt);
+	return;
     }
     xmlParserInputGrow(ctxt->input, INPUT_CHUNK);
+    if ((ctxt->input->cur > ctxt->input->end) ||
+        (ctxt->input->cur < ctxt->input->base)) {
+        xmlHaltParser(ctxt);
+        xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "cur index out of bound");
+	return;
+    }
     if ((ctxt->input->cur != NULL) && (*ctxt->input->cur == 0) &&
         (xmlParserInputGrow(ctxt->input, INPUT_CHUNK) <= 0))
 	    xmlPopInput(ctxt);
@@ -2151,7 +2160,8 @@ xmlSkipBlankChars(xmlParserCtxtPtr ctxt) {
 	int cur;
 	do {
 	    cur = CUR;
-	    while (IS_BLANK_CH(cur)) { /* CHECKED tstblanks.xml */
+	    while ((IS_BLANK_CH(cur) && /* CHECKED tstblanks.xml */
+	           (ctxt->instate != XML_PARSER_EOF))) {
 		NEXT;
 		cur = CUR;
 		res++;
@@ -2165,7 +2175,8 @@ xmlSkipBlankChars(xmlParserCtxtPtr ctxt) {
 	     * Need to handle support of entities branching here
 	     */
 	    if (*ctxt->input->cur == '%') xmlParserHandlePEReference(ctxt);
-	} while (IS_BLANK(cur)); /* CHECKED tstblanks.xml */
+	} while ((IS_BLANK(cur)) && /* CHECKED tstblanks.xml */
+	         (ctxt->instate != XML_PARSER_EOF));
     }
     return(res);
 }
@@ -2806,6 +2817,10 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
 			                      0, 0, 0);
 		ctxt->depth--;
 
+		if ((ctxt->lastError.code == XML_ERR_ENTITY_LOOP) ||
+		    (ctxt->lastError.code == XML_ERR_INTERNAL_ERROR))
+		    goto int_error;
+
 		if (rep != NULL) {
 		    current = rep;
 		    while (*current != 0) { /* non input consuming loop */
@@ -3491,7 +3506,14 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) {
 	c = CUR_CHAR(l);
 	if (c == 0) {
 	    count = 0;
+	    /*
+	     * when shrinking to extend the buffer we really need to preserve
+	     * the part of the name we already parsed. Hence rolling back
+	     * by current lenght.
+	     */
+	    ctxt->input->cur -= l;
 	    GROW;
+	    ctxt->input->cur += l;
             if (ctxt->instate == XML_PARSER_EOF)
                 return(NULL);
 	    end = ctxt->input->cur;
@@ -3523,7 +3545,7 @@ xmlParseNCNameComplex(xmlParserCtxtPtr ctxt) {
 
 static const xmlChar *
 xmlParseNCName(xmlParserCtxtPtr ctxt) {
-    const xmlChar *in;
+    const xmlChar *in, *e;
     const xmlChar *ret;
     int count = 0;
 
@@ -3535,16 +3557,19 @@ xmlParseNCName(xmlParserCtxtPtr ctxt) {
      * Accelerator for simple ASCII names
      */
     in = ctxt->input->cur;
-    if (((*in >= 0x61) && (*in <= 0x7A)) ||
-	((*in >= 0x41) && (*in <= 0x5A)) ||
-	(*in == '_')) {
+    e = ctxt->input->end;
+    if ((((*in >= 0x61) && (*in <= 0x7A)) ||
+	 ((*in >= 0x41) && (*in <= 0x5A)) ||
+	 (*in == '_')) && (in < e)) {
 	in++;
-	while (((*in >= 0x61) && (*in <= 0x7A)) ||
-	       ((*in >= 0x41) && (*in <= 0x5A)) ||
-	       ((*in >= 0x30) && (*in <= 0x39)) ||
-	       (*in == '_') || (*in == '-') ||
-	       (*in == '.'))
+	while ((((*in >= 0x61) && (*in <= 0x7A)) ||
+	        ((*in >= 0x41) && (*in <= 0x5A)) ||
+	        ((*in >= 0x30) && (*in <= 0x39)) ||
+	        (*in == '_') || (*in == '-') ||
+	        (*in == '.')) && (in < e))
 	    in++;
+	if (in >= e)
+	    goto complex;
 	if ((*in > 0) && (*in < 0x80)) {
 	    count = in - ctxt->input->cur;
             if ((count > XML_MAX_NAME_LENGTH) &&
@@ -3562,6 +3587,7 @@ xmlParseNCName(xmlParserCtxtPtr ctxt) {
 	    return(ret);
 	}
     }
+complex:
     return(xmlParseNCNameComplex(ctxt));
 }
 
@@ -5658,6 +5684,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt) {
 	if (RAW != '>') {
 	    xmlFatalErrMsgStr(ctxt, XML_ERR_ENTITY_NOT_FINISHED,
 	            "xmlParseEntityDecl: entity %s not terminated\n", name);
+	    xmlHaltParser(ctxt);
 	} else {
 	    if (input != ctxt->input) {
 		xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
@@ -6769,6 +6796,8 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 	SKIP_BLANKS;
 	if (RAW != '[') {
 	    xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
+	    xmlHaltParser(ctxt);
+	    return;
 	} else {
 	    if (ctxt->input->id != id) {
 		xmlValidityError(ctxt, XML_ERR_ENTITY_BOUNDARY,
@@ -6829,6 +6858,8 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 	SKIP_BLANKS;
 	if (RAW != '[') {
 	    xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
+	    xmlHaltParser(ctxt);
+	    return;
 	} else {
 	    if (ctxt->input->id != id) {
 		xmlValidityError(ctxt, XML_ERR_ENTITY_BOUNDARY,
@@ -6884,6 +6915,8 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 
     } else {
 	xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID_KEYWORD, NULL);
+	xmlHaltParser(ctxt);
+	return;
     }
 
     if (RAW == 0)
@@ -6897,7 +6930,9 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 	"All markup of the conditional section is not in the same entity\n",
 				 NULL, NULL);
 	}
-        SKIP(3);
+	if ((ctxt-> instate != XML_PARSER_EOF) &&
+	    ((ctxt->input->cur + 3) <= ctxt->input->end))
+	    SKIP(3);
     }
 }
 
@@ -6952,6 +6987,14 @@ xmlParseMarkupDecl(xmlParserCtxtPtr ctxt) {
 	    xmlParsePI(ctxt);
 	}
     }
+
+    /*
+     * detect requirement to exit there and act accordingly
+     * and avoid having instate overriden later on
+     */
+    if (ctxt->instate == XML_PARSER_EOF)
+        return;
+
     /*
      * This is only for internal subset. On external entities,
      * the replacement is done before parsing stage
@@ -7083,7 +7126,7 @@ xmlParseExternalSubset(xmlParserCtxtPtr ctxt, const xmlChar *ExternalID,
 	    /*
 	     * The XML REC instructs us to stop parsing right here
 	     */
-	    ctxt->instate = XML_PARSER_EOF;
+	    xmlHaltParser(ctxt);
 	    return;
 	}
     }
@@ -8070,7 +8113,7 @@ xmlParsePEReference(xmlParserCtxtPtr ctxt)
 		     * The XML REC instructs us to stop parsing
 		     * right here
 		     */
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    return;
 		}
 	    }
@@ -9305,7 +9348,7 @@ xmlParseStartTag2(xmlParserCtxtPtr ctxt, const xmlChar **pref,
     const xmlChar **atts = ctxt->atts;
     int maxatts = ctxt->maxatts;
     int nratts, nbatts, nbdef;
-    int i, j, nbNs, attval, oldline, oldcol;
+    int i, j, nbNs, attval, oldline, oldcol, inputNr;
     const xmlChar *base;
     unsigned long cur;
     int nsNr = ctxt->nsNr;
@@ -9324,6 +9367,7 @@ reparse:
     SHRINK;
     base = ctxt->input->base;
     cur = ctxt->input->cur - ctxt->input->base;
+    inputNr = ctxt->inputNr;
     oldline = ctxt->input->line;
     oldcol = ctxt->input->col;
     nbatts = 0;
@@ -9349,7 +9393,8 @@ reparse:
      */
     SKIP_BLANKS;
     GROW;
-    if (ctxt->input->base != base) goto base_changed;
+    if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+        goto base_changed;
 
     while (((RAW != '>') &&
 	   ((RAW != '/') || (NXT(1) != '>')) &&
@@ -9360,7 +9405,7 @@ reparse:
 
 	attname = xmlParseAttribute2(ctxt, prefix, localname,
 	                             &aprefix, &attvalue, &len, &alloc);
-	if (ctxt->input->base != base) {
+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr)) {
 	    if ((attvalue != NULL) && (alloc != 0))
 	        xmlFree(attvalue);
 	    attvalue = NULL;
@@ -9509,7 +9554,8 @@ skip_ns:
 		    break;
 		}
 		SKIP_BLANKS;
-		if (ctxt->input->base != base) goto base_changed;
+		if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+		    goto base_changed;
 		continue;
 	    }
 
@@ -9546,7 +9592,8 @@ failed:
 	GROW
         if (ctxt->instate == XML_PARSER_EOF)
             break;
-	if (ctxt->input->base != base) goto base_changed;
+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+	    goto base_changed;
 	if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
 	    break;
 	if (!IS_BLANK_CH(RAW)) {
@@ -9562,7 +9609,8 @@ failed:
 	    break;
 	}
         GROW;
-	if (ctxt->input->base != base) goto base_changed;
+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+	    goto base_changed;
     }
 
     /*
@@ -9729,6 +9777,17 @@ base_changed:
 	    if ((ctxt->attallocs[j] != 0) && (atts[i] != NULL))
 	        xmlFree((xmlChar *) atts[i]);
     }
+
+    /*
+     * We can't switch from one entity to another in the middle
+     * of a start tag
+     */
+    if (inputNr != ctxt->inputNr) {
+        xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
+		    "Start tag doesn't start and stop in the same entity\n");
+	return(NULL);
+    }
+
     ctxt->input->cur = ctxt->input->base + cur;
     ctxt->input->line = oldline;
     ctxt->input->col = oldcol;
@@ -10010,7 +10069,7 @@ xmlParseContent(xmlParserCtxtPtr ctxt) {
 	if ((cons == ctxt->input->consumed) && (test == CUR_PTR)) {
 	    xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR,
 	                "detected an error in element content\n");
-	    ctxt->instate = XML_PARSER_EOF;
+	    xmlHaltParser(ctxt);
             break;
 	}
     }
@@ -10045,7 +10104,7 @@ xmlParseElement(xmlParserCtxtPtr ctxt) {
 	xmlFatalErrMsgInt(ctxt, XML_ERR_INTERNAL_ERROR,
 		 "Excessive depth in document: %d use XML_PARSE_HUGE option\n",
 			  xmlParserMaxDepth);
-	ctxt->instate = XML_PARSER_EOF;
+	xmlHaltParser(ctxt);
 	return;
     }
 
@@ -10397,6 +10456,8 @@ xmlParseEncodingDecl(xmlParserCtxtPtr ctxt) {
 	    encoding = xmlParseEncName(ctxt);
 	    if (RAW != '"') {
 		xmlFatalErr(ctxt, XML_ERR_STRING_NOT_CLOSED, NULL);
+		xmlFree((xmlChar *) encoding);
+		return(NULL);
 	    } else
 	        NEXT;
 	} else if (RAW == '\''){
@@ -10404,6 +10465,8 @@ xmlParseEncodingDecl(xmlParserCtxtPtr ctxt) {
 	    encoding = xmlParseEncName(ctxt);
 	    if (RAW != '\'') {
 		xmlFatalErr(ctxt, XML_ERR_STRING_NOT_CLOSED, NULL);
+		xmlFree((xmlChar *) encoding);
+		return(NULL);
 	    } else
 	        NEXT;
 	} else {
@@ -10460,7 +10523,11 @@ xmlParseEncodingDecl(xmlParserCtxtPtr ctxt) {
 
             handler = xmlFindCharEncodingHandler((const char *) encoding);
 	    if (handler != NULL) {
-		xmlSwitchToEncoding(ctxt, handler);
+		if (xmlSwitchToEncoding(ctxt, handler) < 0) {
+		    /* failed to convert */
+		    ctxt->errNo = XML_ERR_UNSUPPORTED_ENCODING;
+		    return(NULL);
+		}
 	    } else {
 		xmlFatalErrMsgStr(ctxt, XML_ERR_UNSUPPORTED_ENCODING,
 			"Unsupported encoding %s\n", encoding);
@@ -10629,7 +10696,8 @@ xmlParseXMLDecl(xmlParserCtxtPtr ctxt) {
 	xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED, "Blank needed here\n");
     }
     xmlParseEncodingDecl(ctxt);
-    if (ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) {
+    if ((ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) ||
+         (ctxt->instate == XML_PARSER_EOF)) {
 	/*
 	 * The XML REC instructs us to stop parsing right here
 	 */
@@ -10753,6 +10821,7 @@ xmlParseDocument(xmlParserCtxtPtr ctxt) {
 
     if (CUR == 0) {
 	xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
+	return(-1);
     }
 
     /*
@@ -10770,7 +10839,8 @@ xmlParseDocument(xmlParserCtxtPtr ctxt) {
 	 * Note that we will switch encoding on the fly.
 	 */
 	xmlParseXMLDecl(ctxt);
-	if (ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) {
+	if ((ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) ||
+	    (ctxt->instate == XML_PARSER_EOF)) {
 	    /*
 	     * The XML REC instructs us to stop parsing right here
 	     */
@@ -11166,7 +11236,7 @@ xmlCheckCdataPush(const xmlChar *utf, int len) {
 	    else
 	        return(-ix);
 	} else if ((c & 0xe0) == 0xc0) {/* 2-byte code, starts with 110 */
-	    if (ix + 2 > len) return(ix);
+	    if (ix + 2 > len) return(-ix);
 	    if ((utf[ix+1] & 0xc0 ) != 0x80)
 	        return(-ix);
 	    codepoint = (utf[ix] & 0x1f) << 6;
@@ -11175,7 +11245,7 @@ xmlCheckCdataPush(const xmlChar *utf, int len) {
 	        return(-ix);
 	    ix += 2;
 	} else if ((c & 0xf0) == 0xe0) {/* 3-byte code, starts with 1110 */
-	    if (ix + 3 > len) return(ix);
+	    if (ix + 3 > len) return(-ix);
 	    if (((utf[ix+1] & 0xc0) != 0x80) ||
 	        ((utf[ix+2] & 0xc0) != 0x80))
 		    return(-ix);
@@ -11186,7 +11256,7 @@ xmlCheckCdataPush(const xmlChar *utf, int len) {
 	        return(-ix);
 	    ix += 3;
 	} else if ((c & 0xf8) == 0xf0) {/* 4-byte code, starts with 11110 */
-	    if (ix + 4 > len) return(ix);
+	    if (ix + 4 > len) return(-ix);
 	    if (((utf[ix+1] & 0xc0) != 0x80) ||
 	        ((utf[ix+2] & 0xc0) != 0x80) ||
 		((utf[ix+3] & 0xc0) != 0x80))
@@ -11364,7 +11434,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 			ctxt->sax->setDocumentLocator(ctxt->userData,
 						      &xmlDefaultSAXLocator);
 		    xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 #ifdef DEBUG_PUSH
 		    xmlGenericError(xmlGenericErrorContext,
 			    "PP: entering EOF\n");
@@ -11397,7 +11467,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 			     * The XML REC instructs us to stop parsing right
 			     * here
 			     */
-			    ctxt->instate = XML_PARSER_EOF;
+			    xmlHaltParser(ctxt);
 			    return(0);
 			}
 			ctxt->standalone = ctxt->input->standalone;
@@ -11453,7 +11523,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		cur = ctxt->input->cur[0];
 	        if (cur != '<') {
 		    xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
 			ctxt->sax->endDocument(ctxt->userData);
 		    goto done;
@@ -11485,7 +11555,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		    goto done;
 		if (name == NULL) {
 		    spacePop(ctxt);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
 			ctxt->sax->endDocument(ctxt->userData);
 		    goto done;
@@ -11652,7 +11722,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		if ((cons == ctxt->input->consumed) && (test == CUR_PTR)) {
 		    xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR,
 		                "detected an error in element content\n");
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    break;
 		}
 		break;
@@ -11973,7 +12043,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		    goto done;
 		} else {
 		    xmlFatalErr(ctxt, XML_ERR_DOCUMENT_END, NULL);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 #ifdef DEBUG_PUSH
 		    xmlGenericError(xmlGenericErrorContext,
 			    "PP: entering EOF\n");
@@ -12337,7 +12407,7 @@ xmldecl_done:
 	res = xmlParserInputBufferPush(ctxt->input->buf, size, chunk);
 	if (res < 0) {
 	    ctxt->errNo = XML_PARSER_EOF;
-	    ctxt->disableSAX = 1;
+	    xmlHaltParser(ctxt);
 	    return (XML_PARSER_EOF);
 	}
         xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input, base, cur);
@@ -12391,7 +12461,7 @@ xmldecl_done:
          ((ctxt->input->cur - ctxt->input->base) > XML_MAX_LOOKUP_LIMIT)) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
-        ctxt->instate = XML_PARSER_EOF;
+        xmlHaltParser(ctxt);
     }
     if ((ctxt->errNo != XML_ERR_OK) && (ctxt->disableSAX == 1))
         return(ctxt->errNo);
@@ -12579,25 +12649,47 @@ xmlCreatePushParserCtxt(xmlSAXHandlerPtr sax, void *user_data,
 #endif /* LIBXML_PUSH_ENABLED */
 
 /**
- * xmlStopParser:
+ * xmlHaltParser:
  * @ctxt:  an XML parser context
  *
- * Blocks further parser processing
+ * Blocks further parser processing don't override error
+ * for internal use
  */
-void
-xmlStopParser(xmlParserCtxtPtr ctxt) {
+static void
+xmlHaltParser(xmlParserCtxtPtr ctxt) {
     if (ctxt == NULL)
         return;
     ctxt->instate = XML_PARSER_EOF;
-    ctxt->errNo = XML_ERR_USER_STOP;
     ctxt->disableSAX = 1;
     if (ctxt->input != NULL) {
+        /*
+	 * in case there was a specific allocation deallocate before
+	 * overriding base
+	 */
+        if (ctxt->input->free != NULL) {
+	    ctxt->input->free((xmlChar *) ctxt->input->base);
+	    ctxt->input->free = NULL;
+	}
 	ctxt->input->cur = BAD_CAST"";
 	ctxt->input->base = ctxt->input->cur;
     }
 }
 
 /**
+ * xmlStopParser:
+ * @ctxt:  an XML parser context
+ *
+ * Blocks further parser processing
+ */
+void
+xmlStopParser(xmlParserCtxtPtr ctxt) {
+    if (ctxt == NULL)
+        return;
+    xmlHaltParser(ctxt);
+    ctxt->errNo = XML_ERR_USER_STOP;
+}
+
+/**
  * xmlCreateIOParserCtxt:
  * @sax:  a SAX handler
  * @user_data:  The user data returned on SAX callbacks
@@ -13341,7 +13433,7 @@ xmlParseExternalEntityPrivate(xmlDocPtr doc, xmlParserCtxtPtr oldctxt,
     /*
      * Also record the size of the entity parsed
      */
-    if (ctxt->input != NULL) {
+    if (ctxt->input != NULL && oldctxt != NULL) {
 	oldctxt->sizeentities += ctxt->input->consumed;
 	oldctxt->sizeentities += (ctxt->input->cur - ctxt->input->base);
     }
@@ -13353,9 +13445,11 @@ xmlParseExternalEntityPrivate(xmlDocPtr doc, xmlParserCtxtPtr oldctxt,
 
     if (sax != NULL)
 	ctxt->sax = oldsax;
-    oldctxt->node_seq.maximum = ctxt->node_seq.maximum;
-    oldctxt->node_seq.length = ctxt->node_seq.length;
-    oldctxt->node_seq.buffer = ctxt->node_seq.buffer;
+    if (oldctxt != NULL) {
+        oldctxt->node_seq.maximum = ctxt->node_seq.maximum;
+        oldctxt->node_seq.length = ctxt->node_seq.length;
+        oldctxt->node_seq.buffer = ctxt->node_seq.buffer;
+    }
     ctxt->node_seq.maximum = 0;
     ctxt->node_seq.length = 0;
     ctxt->node_seq.buffer = NULL;
diff --git a/parserInternals.c b/parserInternals.c
index df204fde..2b8646c2 100644
--- a/parserInternals.c
+++ b/parserInternals.c
@@ -937,6 +937,7 @@ xmlSwitchEncoding(xmlParserCtxtPtr ctxt, xmlCharEncoding enc)
 {
     xmlCharEncodingHandlerPtr handler;
     int len = -1;
+    int ret;
 
     if (ctxt == NULL) return(-1);
     switch (enc) {
@@ -1097,7 +1098,15 @@ xmlSwitchEncoding(xmlParserCtxtPtr ctxt, xmlCharEncoding enc)
     if (handler == NULL)
 	return(-1);
     ctxt->charset = XML_CHAR_ENCODING_UTF8;
-    return(xmlSwitchToEncodingInt(ctxt, handler, len));
+    ret = xmlSwitchToEncodingInt(ctxt, handler, len);
+    if ((ret < 0) || (ctxt->errNo == XML_I18N_CONV_FAILED)) {
+        /*
+	 * on encoding conversion errors, stop the parser
+	 */
+        xmlStopParser(ctxt);
+	ctxt->errNo = XML_I18N_CONV_FAILED;
+    }
+    return(ret);
 }
 
 /**
@@ -1450,6 +1459,8 @@ xmlNewEntityInputStream(xmlParserCtxtPtr ctxt, xmlEntityPtr entity) {
     if (entity->URI != NULL)
 	input->filename = (char *) xmlStrdup((xmlChar *) entity->URI);
     input->base = entity->content;
+    if (entity->length == 0)
+        entity->length = xmlStrlen(entity->content);
     input->cur = entity->content;
     input->length = entity->length;
     input->end = &entity->content[input->length];
diff --git a/python/setup.py b/python/setup.py
index e1ff3650..f10b9c11 100755
--- a/python/setup.py
+++ b/python/setup.py
@@ -226,7 +226,7 @@ else:
 setup (name = "libxml2-python",
        # On *nix, the version number is created from setup.py.in
        # On windows, it is set by configure.js
-       version = "2.9.2",
+       version = "2.9.3",
        description = descr,
        author = "Daniel Veillard",
        author_email = "veillard@redhat.com",
diff --git a/relaxng.c b/relaxng.c
index 5357b569..5779e7fc 100644
--- a/relaxng.c
+++ b/relaxng.c
@@ -3819,7 +3819,11 @@ xmlRelaxNGCompareNameClasses(xmlRelaxNGDefinePtr def1,
             return (0);
         return (1);
     } else if (def1->type == XML_RELAXNG_EXCEPT) {
-        TODO ret = 0;
+        ret = xmlRelaxNGCompareNameClasses(def1->content, def2);
+	if (ret == 0)
+	    ret = 1;
+	else if (ret == 1)
+	    ret = 0;
     } else {
         TODO ret = 0;
     }
diff --git a/result/XPath/tests/chaptersbase b/result/XPath/tests/chaptersbase
index 03c65670..e023bf01 100644
--- a/result/XPath/tests/chaptersbase
+++ b/result/XPath/tests/chaptersbase
@@ -113,3 +113,13 @@ Set contains 5 nodes:
     ATTRIBUTE id
       TEXT
         content=chapter5
+
+========================
+Expression: //p[1]
+Object is a Node Set :
+Set contains 5 nodes:
+1  ELEMENT p
+2  ELEMENT p
+3  ELEMENT p
+4  ELEMENT p
+5  ELEMENT p
diff --git a/result/XPath/tests/simplebase b/result/XPath/tests/simplebase
index 38fa1449..3c32d17e 100644
--- a/result/XPath/tests/simplebase
+++ b/result/XPath/tests/simplebase
@@ -60,6 +60,60 @@ Set contains 3 nodes:
     content=   
 
 ========================
+Expression: /child::EXAMPLE/attribute::prop1/self::node()
+Object is a Node Set :
+Set contains 1 nodes:
+1  ATTRIBUTE prop1
+    TEXT
+      content=gnome is great
+
+========================
+Expression: /child::EXAMPLE/attribute::prop1/self::*
+Object is a Node Set :
+Set contains 0 nodes:
+
+========================
+Expression: /child::EXAMPLE/attribute::prop1/descendant-or-self::node()
+Object is a Node Set :
+Set contains 1 nodes:
+1  ATTRIBUTE prop1
+    TEXT
+      content=gnome is great
+
+========================
+Expression: /child::EXAMPLE/attribute::prop1/descendant-or-self::*
+Object is a Node Set :
+Set contains 0 nodes:
+
+========================
+Expression: /child::EXAMPLE/attribute::prop1/ancestor-or-self::node()
+Object is a Node Set :
+Set contains 3 nodes:
+1   /
+2  ELEMENT EXAMPLE
+    ATTRIBUTE prop1
+      TEXT
+        content=gnome is great
+    ATTRIBUTE prop2
+      TEXT
+        content=& linux too
+3  ATTRIBUTE prop1
+    TEXT
+      content=gnome is great
+
+========================
+Expression: /child::EXAMPLE/attribute::prop1/ancestor-or-self::*
+Object is a Node Set :
+Set contains 1 nodes:
+1  ELEMENT EXAMPLE
+    ATTRIBUTE prop1
+      TEXT
+        content=gnome is great
+    ATTRIBUTE prop2
+      TEXT
+        content=& linux too
+
+========================
 Expression: /descendant::title
 Object is a Node Set :
 Set contains 2 nodes:
diff --git a/result/errors/754946.xml b/result/errors/754946.xml
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/result/errors/754946.xml
diff --git a/result/errors/754946.xml.err b/result/errors/754946.xml.err
new file mode 100644
index 00000000..a75088b9
--- /dev/null
+++ b/result/errors/754946.xml.err
@@ -0,0 +1,19 @@
+Entity: line 1: parser error : internal error: xmlParseInternalSubset: error detected in Markup declaration
+
+ %SYSTEM; 
+         ^
+Entity: line 1: 
+A<lbbbbbbbbbbbbbbbbbbb_
+^
+Entity: line 1: parser error : DOCTYPE improperly terminated
+ %SYSTEM; 
+         ^
+Entity: line 1: 
+A<lbbbbbbbbbbbbbbbbbbb_
+^
+./test/errors/754946.xml:1: parser error : Start tag doesn't start and stop in the same entity
+>%SYSTEM;<![
+         ^
+./test/errors/754946.xml:1: parser error : Extra content at the end of the document
+>%SYSTEM;<![
+         ^
diff --git a/result/errors/754946.xml.str b/result/errors/754946.xml.str
new file mode 100644
index 00000000..3b748cc7
--- /dev/null
+++ b/result/errors/754946.xml.str
@@ -0,0 +1,4 @@
+./test/errors/754946.xml:1: parser error : Extra content at the end of the document
+<!DOCTYPEA[<!ENTITY %
+          ^
+./test/errors/754946.xml : failed to parse
diff --git a/result/errors/754947.xml b/result/errors/754947.xml
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/result/errors/754947.xml
diff --git a/result/errors/754947.xml.err b/result/errors/754947.xml.err
new file mode 100644
index 00000000..f45cb5a2
--- /dev/null
+++ b/result/errors/754947.xml.err
@@ -0,0 +1,7 @@
+./test/errors/754947.xml:1: parser error : Input is not proper UTF-8, indicate encoding !
+Bytes: 0xEE 0x5D 0x5D 0x3E
+<d><![CDATA[0000000000000î]]>
+                         ^
+./test/errors/754947.xml:1: parser error : Premature end of data in tag d line 1
+<d><![CDATA[0000000000000î]]>
+                             ^
diff --git a/result/errors/754947.xml.str b/result/errors/754947.xml.str
new file mode 100644
index 00000000..4d2f52e3
--- /dev/null
+++ b/result/errors/754947.xml.str
@@ -0,0 +1,5 @@
+./test/errors/754947.xml:1: parser error : Input is not proper UTF-8, indicate encoding !
+Bytes: 0xEE 0x5D 0x5D 0x3E
+<d><![CDATA[0000000000000î]]>
+                         ^
+./test/errors/754947.xml : failed to parse
diff --git a/result/errors/cdata.xml.str b/result/errors/cdata.xml.str
index e043441a..cf83d2b3 100644
--- a/result/errors/cdata.xml.str
+++ b/result/errors/cdata.xml.str
@@ -1,5 +1,5 @@
 ./test/errors/cdata.xml:2: parser error : Input is not proper UTF-8, indicate encoding !
-Bytes: 0x5B 0x43 0xE1 0x72
+Bytes: 0xE1 0x72 0x5D 0x5D
 <A><![CDATA[Cár]]></A>
-           ^
+             ^
 ./test/errors/cdata.xml : failed to parse
diff --git a/result/relaxng/565219_0 b/result/relaxng/565219_0
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/result/relaxng/565219_0
diff --git a/result/relaxng/565219_0.err b/result/relaxng/565219_0.err
new file mode 100644
index 00000000..e3f73fac
--- /dev/null
+++ b/result/relaxng/565219_0.err
@@ -0,0 +1,2 @@
+./test/relaxng/565219_0.xml:1: element foo: Relax-NG validity error : Element foo has wrong namespace: expecting http://bar.com/
+./test/relaxng/565219_0.xml fails to validate
diff --git a/result/relaxng/565219_1 b/result/relaxng/565219_1
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/result/relaxng/565219_1
diff --git a/result/relaxng/565219_1.err b/result/relaxng/565219_1.err
new file mode 100644
index 00000000..2999bbae
--- /dev/null
+++ b/result/relaxng/565219_1.err
@@ -0,0 +1 @@
+./test/relaxng/565219_1.xml validates
diff --git a/result/relaxng/565219_2 b/result/relaxng/565219_2
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/result/relaxng/565219_2
diff --git a/result/relaxng/565219_2.err b/result/relaxng/565219_2.err
new file mode 100644
index 00000000..7a997d35
--- /dev/null
+++ b/result/relaxng/565219_2.err
@@ -0,0 +1,2 @@
+./test/relaxng/565219_2.xml:1: element foo: Relax-NG validity error : Element foo has wrong namespace: expecting http://bar.com/
+./test/relaxng/565219_2.xml fails to validate
diff --git a/result/relaxng/565219_err b/result/relaxng/565219_err
new file mode 100644
index 00000000..c43e67cf
--- /dev/null
+++ b/result/relaxng/565219_err
@@ -0,0 +1 @@
+./test/relaxng/565219.rng validates
diff --git a/result/relaxng/565219_valid b/result/relaxng/565219_valid
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/result/relaxng/565219_valid
diff --git a/result/valid/737840.xml b/result/valid/737840.xml
new file mode 100644
index 00000000..433c6d6d
--- /dev/null
+++ b/result/valid/737840.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0"?>
+<!DOCTYPE root [
+<!ELEMENT root (elem)>
+<!ELEMENT elem (#PCDATA)>
+<!ATTLIST elem id ID #IMPLIED>
+<!ENTITY target SYSTEM "dtds/737840.ent">
+]>
+<root>
+  &target;
+</root>
diff --git a/result/valid/737840.xml.err b/result/valid/737840.xml.err
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/result/valid/737840.xml.err
diff --git a/result/valid/737840.xml.err.rdr b/result/valid/737840.xml.err.rdr
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/result/valid/737840.xml.err.rdr
diff --git a/test/XPath/tests/chaptersbase b/test/XPath/tests/chaptersbase
index daa53b75..17638f73 100644
--- a/test/XPath/tests/chaptersbase
+++ b/test/XPath/tests/chaptersbase
@@ -7,3 +7,4 @@
 /child::EXAMPLE/child::head/node()
 /descendant::title
 /descendant::p/ancestor::chapter
+//p[1]
diff --git a/test/XPath/tests/simplebase b/test/XPath/tests/simplebase
index 7e4203af..8b2c7d15 100644
--- a/test/XPath/tests/simplebase
+++ b/test/XPath/tests/simplebase
@@ -5,5 +5,11 @@
 /child::EXAMPLE/child::head/child::title
 /child::EXAMPLE/child::head/child::title/child::text()
 /child::EXAMPLE/child::head/node()
+/child::EXAMPLE/attribute::prop1/self::node()
+/child::EXAMPLE/attribute::prop1/self::*
+/child::EXAMPLE/attribute::prop1/descendant-or-self::node()
+/child::EXAMPLE/attribute::prop1/descendant-or-self::*
+/child::EXAMPLE/attribute::prop1/ancestor-or-self::node()
+/child::EXAMPLE/attribute::prop1/ancestor-or-self::*
 /descendant::title
 /descendant::p/ancestor::chapter
diff --git a/test/errors/754946.xml b/test/errors/754946.xml
new file mode 100644
index 00000000..6b5f9b06
--- /dev/null
+++ b/test/errors/754946.xml
@@ -0,0 +1 @@
+<!DOCTYPEA[<!ENTITY %

SYSTEM "A<lbbbbbbbbbbbbbbbbbbb_"
>%SYSTEM;<![
\ No newline at end of file
diff --git a/test/errors/754947.xml b/test/errors/754947.xml
new file mode 100644
index 00000000..bd9997e3
--- /dev/null
+++ b/test/errors/754947.xml
@@ -0,0 +1 @@
+<d><![CDATA[0000000000000î]]>
\ No newline at end of file
diff --git a/test/relaxng/565219.rng b/test/relaxng/565219.rng
new file mode 100644
index 00000000..087ed956
--- /dev/null
+++ b/test/relaxng/565219.rng
@@ -0,0 +1,14 @@
+<grammar xmlns="http://relaxng.org/ns/structure/1.0">
+  <start>
+   <element>
+      <anyName>
+        <except>
+          <nsName ns="http://bar.com/"/>
+          <nsName ns="http://foo.com/"/>
+        </except>
+      </anyName>
+      <empty/>
+   </element>
+  </start>
+</grammar>
+
diff --git a/test/relaxng/565219_0.xml b/test/relaxng/565219_0.xml
new file mode 100644
index 00000000..a964a07b
--- /dev/null
+++ b/test/relaxng/565219_0.xml
@@ -0,0 +1 @@
+<foo xmlns="http://foo.com/"/>
diff --git a/test/relaxng/565219_1.xml b/test/relaxng/565219_1.xml
new file mode 100644
index 00000000..f1999f80
--- /dev/null
+++ b/test/relaxng/565219_1.xml
@@ -0,0 +1 @@
+<foo/>
diff --git a/test/relaxng/565219_2.xml b/test/relaxng/565219_2.xml
new file mode 100644
index 00000000..a964a07b
--- /dev/null
+++ b/test/relaxng/565219_2.xml
@@ -0,0 +1 @@
+<foo xmlns="http://foo.com/"/>
diff --git a/test/valid/737840.xml b/test/valid/737840.xml
new file mode 100644
index 00000000..2d27b731
--- /dev/null
+++ b/test/valid/737840.xml
@@ -0,0 +1,10 @@
+<!DOCTYPE root [
+<!ELEMENT root (elem)>
+<!ELEMENT elem (#PCDATA)>
+<!ATTLIST elem id ID #IMPLIED>
+<!ENTITY target SYSTEM "dtds/737840.ent">
+]>
+
+<root>
+  &target;
+</root>
diff --git a/test/valid/dtds/737840.ent b/test/valid/dtds/737840.ent
new file mode 100644
index 00000000..e9721324
--- /dev/null
+++ b/test/valid/dtds/737840.ent
@@ -0,0 +1 @@
+<elem id="id0"/>
\ No newline at end of file
diff --git a/testapi.c b/testapi.c
index 0367ffd4..9205e643 100644
--- a/testapi.c
+++ b/testapi.c
@@ -1034,10 +1034,10 @@ static void des_xmlAttributeType(int no ATTRIBUTE_UNUSED, xmlAttributeType val A
 
 #define gen_nb_xmlBufferAllocationScheme 4
 static xmlBufferAllocationScheme gen_xmlBufferAllocationScheme(int no, int nr ATTRIBUTE_UNUSED) {
-    if (no == 1) return(XML_BUFFER_ALLOC_DOUBLEIT);
-    if (no == 2) return(XML_BUFFER_ALLOC_EXACT);
-    if (no == 3) return(XML_BUFFER_ALLOC_HYBRID);
-    if (no == 4) return(XML_BUFFER_ALLOC_IMMUTABLE);
+    if (no == 1) return(XML_BUFFER_ALLOC_BOUNDED);
+    if (no == 2) return(XML_BUFFER_ALLOC_DOUBLEIT);
+    if (no == 3) return(XML_BUFFER_ALLOC_EXACT);
+    if (no == 4) return(XML_BUFFER_ALLOC_HYBRID);
     return(0);
 }
 
diff --git a/threads.c b/threads.c
index 8921204b..b9d6cae3 100644
--- a/threads.c
+++ b/threads.c
@@ -47,7 +47,7 @@
 #ifdef HAVE_PTHREAD_H
 
 static int libxml_is_threaded = -1;
-#ifdef __GNUC__
+#if defined(__GNUC__) && defined(__GLIBC__)
 #ifdef linux
 #if (__GNUC__ == 3 && __GNUC_MINOR__ >= 3) || (__GNUC__ > 3)
 extern int pthread_once (pthread_once_t *__once_control,
@@ -89,7 +89,7 @@ extern int pthread_cond_signal ()
 	   __attribute((weak));
 #endif
 #endif /* linux */
-#endif /* __GNUC__ */
+#endif /* defined(__GNUC__) && defined(__GLIBC__) */
 #endif /* HAVE_PTHREAD_H */
 
 /*
@@ -415,8 +415,8 @@ xmlRMutexUnlock(xmlRMutexPtr tok ATTRIBUTE_UNUSED)
     pthread_mutex_unlock(&tok->lock);
 #elif defined HAVE_WIN32_THREADS
     if (tok->count > 0) {
-        LeaveCriticalSection(&tok->cs);
 	tok->count--;
+        LeaveCriticalSection(&tok->cs);
     }
 #elif defined HAVE_BEOS_THREADS
     if (tok->lock->tid == find_thread(NULL)) {
diff --git a/timsort.h b/timsort.h
index efa3aab1..795f2721 100644
--- a/timsort.h
+++ b/timsort.h
@@ -392,62 +392,66 @@ static void TIM_SORT_MERGE(SORT_TYPE *dst, const TIM_SORT_RUN_T *stack, const in
 
 static int TIM_SORT_COLLAPSE(SORT_TYPE *dst, TIM_SORT_RUN_T *stack, int stack_curr, TEMP_STORAGE_T *store, const size_t size)
 {
-  while (1)
-  {
-    int64_t A, B, C;
+  while (1) {
+    int64_t A, B, C, D;
+    int ABC, BCD, BD, CD;
+
     /* if the stack only has one thing on it, we are done with the collapse */
-    if (stack_curr <= 1) break;
+    if (stack_curr <= 1) {
+      break;
+    }
+
     /* if this is the last merge, just do it */
-    if ((stack_curr == 2) &&
-        (stack[0].length + stack[1].length == (int64_t) size))
-    {
+    if ((stack_curr == 2) && (stack[0].length + stack[1].length == size)) {
       TIM_SORT_MERGE(dst, stack, stack_curr, store);
       stack[0].length += stack[1].length;
       stack_curr--;
       break;
     }
     /* check if the invariant is off for a stack of 2 elements */
-    else if ((stack_curr == 2) && (stack[0].length <= stack[1].length))
-    {
+    else if ((stack_curr == 2) && (stack[0].length <= stack[1].length)) {
       TIM_SORT_MERGE(dst, stack, stack_curr, store);
       stack[0].length += stack[1].length;
       stack_curr--;
       break;
-    }
-    else if (stack_curr == 2)
+    } else if (stack_curr == 2) {
       break;
+    }
 
-    A = stack[stack_curr - 3].length;
-    B = stack[stack_curr - 2].length;
-    C = stack[stack_curr - 1].length;
+    B = stack[stack_curr - 3].length;
+    C = stack[stack_curr - 2].length;
+    D = stack[stack_curr - 1].length;
 
-    /* check first invariant */
-    if (A <= B + C)
-    {
-      if (A < C)
-      {
-        TIM_SORT_MERGE(dst, stack, stack_curr - 1, store);
-        stack[stack_curr - 3].length += stack[stack_curr - 2].length;
-        stack[stack_curr - 2] = stack[stack_curr - 1];
-        stack_curr--;
-      }
-      else
-      {
-        TIM_SORT_MERGE(dst, stack, stack_curr, store);
-        stack[stack_curr - 2].length += stack[stack_curr - 1].length;
-        stack_curr--;
-      }
+    if (stack_curr >= 4) {
+      A = stack[stack_curr - 4].length;
+      ABC = (A <= B + C);
+    } else {
+      ABC = 0;
     }
-    /* check second invariant */
-    else if (B <= C)
-    {
+
+    BCD = (B <= C + D) || ABC;
+    CD = (C <= D);
+    BD = (B < D);
+
+    /* Both invariants are good */
+    if (!BCD && !CD) {
+      break;
+    }
+
+    /* left merge */
+    if (BCD && !CD) {
+      TIM_SORT_MERGE(dst, stack, stack_curr - 1, store);
+      stack[stack_curr - 3].length += stack[stack_curr - 2].length;
+      stack[stack_curr - 2] = stack[stack_curr - 1];
+      stack_curr--;
+    } else {
+      /* right merge */
       TIM_SORT_MERGE(dst, stack, stack_curr, store);
       stack[stack_curr - 2].length += stack[stack_curr - 1].length;
       stack_curr--;
     }
-    else
-      break;
   }
+
   return stack_curr;
 }
 
diff --git a/tree.c b/tree.c
index 6ec92236..6a158cec 100644
--- a/tree.c
+++ b/tree.c
@@ -2799,8 +2799,27 @@ xmlSetTreeDoc(xmlNodePtr tree, xmlDocPtr doc) {
 	if(tree->type == XML_ELEMENT_NODE) {
 	    prop = tree->properties;
 	    while (prop != NULL) {
+                if (prop->atype == XML_ATTRIBUTE_ID) {
+                    xmlRemoveID(tree->doc, prop);
+                }
+
 		prop->doc = doc;
 		xmlSetListDoc(prop->children, doc);
+
+                /*
+                 * TODO: ID attributes should be also added to the new
+                 * document, but this breaks things like xmlReplaceNode.
+                 * The underlying problem is that xmlRemoveID is only called
+                 * if a node is destroyed, not if it's unlinked.
+                 */
+#if 0
+                if (xmlIsID(doc, tree, prop)) {
+                    xmlChar *idVal = xmlNodeListGetString(doc, prop->children,
+                                                          1);
+                    xmlAddID(NULL, doc, idVal, prop);
+                }
+#endif
+
 		prop = prop->next;
 	    }
 	}
diff --git a/valid.c b/valid.c
index 409aa81d..45a3f703 100644
--- a/valid.c
+++ b/valid.c
@@ -2634,8 +2634,10 @@ xmlAddID(xmlValidCtxtPtr ctxt, xmlDocPtr doc, const xmlChar *value,
 	/*
 	 * The id is already defined in this DTD.
 	 */
-	xmlErrValidNode(ctxt, attr->parent, XML_DTD_ID_REDEFINED,
-			"ID %s already defined\n", value, NULL, NULL);
+	if (ctxt != NULL) {
+	    xmlErrValidNode(ctxt, attr->parent, XML_DTD_ID_REDEFINED,
+			    "ID %s already defined\n", value, NULL, NULL);
+	}
 #endif /* LIBXML_VALID_ENABLED */
 	xmlFreeID(ret);
 	return(NULL);
diff --git a/xmlIO.c b/xmlIO.c
index e628ab09..8b13184a 100644
--- a/xmlIO.c
+++ b/xmlIO.c
@@ -1334,7 +1334,7 @@ xmlGzfileClose (void * context) {
 }
 #endif /* HAVE_ZLIB_H */
 
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 /************************************************************************
  *									*
  *		I/O for compressed file accesses			*
@@ -1451,7 +1451,7 @@ xmlXzfileClose (void * context) {
     if (ret < 0) xmlIOErr(0, "xzclose()");
     return(ret);
 }
-#endif /* HAVE_LZMA_H */
+#endif /* LIBXML_LZMA_ENABLED */
 
 #ifdef LIBXML_HTTP_ENABLED
 /************************************************************************
@@ -2328,10 +2328,10 @@ xmlRegisterDefaultInputCallbacks(void) {
     xmlRegisterInputCallbacks(xmlGzfileMatch, xmlGzfileOpen,
 	                      xmlGzfileRead, xmlGzfileClose);
 #endif /* HAVE_ZLIB_H */
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
     xmlRegisterInputCallbacks(xmlXzfileMatch, xmlXzfileOpen,
 	                      xmlXzfileRead, xmlXzfileClose);
-#endif /* HAVE_ZLIB_H */
+#endif /* LIBXML_LZMA_ENABLED */
 
 #ifdef LIBXML_HTTP_ENABLED
     xmlRegisterInputCallbacks(xmlIOHTTPMatch, xmlIOHTTPOpen,
@@ -2683,7 +2683,7 @@ __xmlParserInputBufferCreateFilename(const char *URI, xmlCharEncoding enc) {
 #endif
 	}
 #endif
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 	if ((xmlInputCallbackTable[i].opencallback == xmlXzfileOpen) &&
 		(strcmp(URI, "-") != 0)) {
             ret->compressed = __libxml2_xzcompressed(context);
@@ -3350,7 +3350,7 @@ xmlParserInputBufferGrow(xmlParserInputBufferPtr in, int len) {
      * try to establish compressed status of input if not done already
      */
     if (in->compressed == -1) {
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 	if (in->readcallback == xmlXzfileRead)
             in->compressed = __libxml2_xzcompressed(in->context);
 #endif
diff --git a/xmllint.c b/xmllint.c
index b297ded1..1e2eb4ab 100644
--- a/xmllint.c
+++ b/xmllint.c
@@ -3046,7 +3046,7 @@ static void usage(const char *name) {
     printf("\t--noblanks : drop (ignorable?) blanks spaces\n");
     printf("\t--nocdata : replace cdata section with text nodes\n");
 #ifdef LIBXML_OUTPUT_ENABLED
-    printf("\t--format : reformat/reindent the input\n");
+    printf("\t--format : reformat/reindent the output\n");
     printf("\t--encode encoding : output in the given encoding\n");
     printf("\t--dropdtd : remove the DOCTYPE of the input docs\n");
     printf("\t--pretty STYLE : pretty-print in a particular style\n");
diff --git a/xmlmemory.c b/xmlmemory.c
index a3dc737f..f24fd6d4 100644
--- a/xmlmemory.c
+++ b/xmlmemory.c
@@ -554,7 +554,12 @@ xmlMemoryStrdup(const char *str) {
 
 int
 xmlMemUsed(void) {
-     return(debugMemSize);
+    int res;
+
+    xmlMutexLock(xmlMemMutex);
+    res = debugMemSize;
+    xmlMutexUnlock(xmlMemMutex);
+    return(res);
 }
 
 /**
@@ -567,7 +572,12 @@ xmlMemUsed(void) {
 
 int
 xmlMemBlocks(void) {
-     return(debugMemBlocks);
+    int res;
+
+    xmlMutexLock(xmlMemMutex);
+    res = debugMemBlocks;
+    xmlMutexUnlock(xmlMemMutex);
+    return(res);
 }
 
 #ifdef MEM_LIST
diff --git a/xmlreader.c b/xmlreader.c
index f19e1233..471e7e2a 100644
--- a/xmlreader.c
+++ b/xmlreader.c
@@ -2091,6 +2091,9 @@ xmlNewTextReader(xmlParserInputBufferPtr input, const char *URI) {
 		"xmlNewTextReader : malloc failed\n");
 	return(NULL);
     }
+    /* no operation on a reader should require a huge buffer */
+    xmlBufSetAllocationScheme(ret->buffer,
+			      XML_BUFFER_ALLOC_BOUNDED);
     ret->sax = (xmlSAXHandler *) xmlMalloc(sizeof(xmlSAXHandler));
     if (ret->sax == NULL) {
 	xmlBufFree(ret->buffer);
@@ -3616,6 +3619,7 @@ xmlTextReaderConstValue(xmlTextReaderPtr reader) {
 	    return(((xmlNsPtr) node)->href);
         case XML_ATTRIBUTE_NODE:{
 	    xmlAttrPtr attr = (xmlAttrPtr) node;
+	    const xmlChar *ret;
 
 	    if ((attr->children != NULL) &&
 	        (attr->children->type == XML_TEXT_NODE) &&
@@ -3629,10 +3633,21 @@ xmlTextReaderConstValue(xmlTextReaderPtr reader) {
                                         "xmlTextReaderSetup : malloc failed\n");
                         return (NULL);
                     }
+		    xmlBufSetAllocationScheme(reader->buffer,
+		                              XML_BUFFER_ALLOC_BOUNDED);
                 } else
                     xmlBufEmpty(reader->buffer);
 	        xmlBufGetNodeContent(reader->buffer, node);
-		return(xmlBufContent(reader->buffer));
+		ret = xmlBufContent(reader->buffer);
+		if (ret == NULL) {
+		    /* error on the buffer best to reallocate */
+		    xmlBufFree(reader->buffer);
+		    reader->buffer = xmlBufCreateSize(100);
+		    xmlBufSetAllocationScheme(reader->buffer,
+		                              XML_BUFFER_ALLOC_BOUNDED);
+		    ret = BAD_CAST "";
+		}
+		return(ret);
 	    }
 	    break;
 	}
@@ -5131,6 +5146,9 @@ xmlTextReaderSetup(xmlTextReaderPtr reader,
                         "xmlTextReaderSetup : malloc failed\n");
         return (-1);
     }
+    /* no operation on a reader should require a huge buffer */
+    xmlBufSetAllocationScheme(reader->buffer,
+			      XML_BUFFER_ALLOC_BOUNDED);
     if (reader->sax == NULL)
 	reader->sax = (xmlSAXHandler *) xmlMalloc(sizeof(xmlSAXHandler));
     if (reader->sax == NULL) {
diff --git a/xmlschemas.c b/xmlschemas.c
index 0657b66a..fe533e6f 100644
--- a/xmlschemas.c
+++ b/xmlschemas.c
@@ -24186,6 +24186,7 @@ xmlSchemaValidateFacets(xmlSchemaAbstractCtxtPtr actxt,
 	else
 	    goto pattern_and_enum;
     }
+
     /*
     * Whitespace handling is only of importance for string-based
     * types.
@@ -24196,14 +24197,13 @@ xmlSchemaValidateFacets(xmlSchemaAbstractCtxtPtr actxt,
 	ws = xmlSchemaGetWhiteSpaceFacetValue(type);
     } else
 	ws = XML_SCHEMA_WHITESPACE_COLLAPSE;
+
     /*
     * If the value was not computed (for string or
     * anySimpleType based types), then use the provided
     * type.
     */
-    if (val == NULL)
-	valType = valType;
-    else
+    if (val != NULL)
 	valType = xmlSchemaGetValType(val);
 
     ret = 0;
@@ -25546,7 +25546,7 @@ xmlSchemaVAttributesComplex(xmlSchemaValidCtxtPtr vctxt)
 		    if (xmlNewProp(defAttrOwnerElem,
 			iattr->localName, value) == NULL) {
 			VERROR_INT("xmlSchemaVAttributesComplex",
-			    "callling xmlNewProp()");
+			    "calling xmlNewProp()");
 			if (normValue != NULL)
 			    xmlFree(normValue);
 			goto internal_error;
diff --git a/xpath.c b/xpath.c
index dc41ce6b..935fcff0 100644
--- a/xpath.c
+++ b/xpath.c
@@ -361,14 +361,14 @@ turtle_comparison:
     /*
      * compute depth to root
      */
-    for (depth2 = 0, cur = node2;cur->parent != NULL;cur = cur->parent) {
-	if (cur == node1)
+    for (depth2 = 0, cur = node2; cur->parent != NULL; cur = cur->parent) {
+	if (cur->parent == node1)
 	    return(1);
 	depth2++;
     }
     root = cur;
-    for (depth1 = 0, cur = node1;cur->parent != NULL;cur = cur->parent) {
-	if (cur == node2)
+    for (depth1 = 0, cur = node1; cur->parent != NULL; cur = cur->parent) {
+	if (cur->parent == node2)
 	    return(-1);
 	depth1++;
     }
@@ -7933,14 +7933,14 @@ xmlXPathNextDescendant(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
 xmlNodePtr
 xmlXPathNextDescendantOrSelf(xmlXPathParserContextPtr ctxt, xmlNodePtr cur) {
     if ((ctxt == NULL) || (ctxt->context == NULL)) return(NULL);
-    if (cur == NULL) {
-	if (ctxt->context->node == NULL)
-	    return(NULL);
-	if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
-	    (ctxt->context->node->type == XML_NAMESPACE_DECL))
-	    return(NULL);
+    if (cur == NULL)
         return(ctxt->context->node);
-    }
+
+    if (ctxt->context->node == NULL)
+        return(NULL);
+    if ((ctxt->context->node->type == XML_ATTRIBUTE_NODE) ||
+        (ctxt->context->node->type == XML_NAMESPACE_DECL))
+        return(NULL);
 
     return(xmlXPathNextDescendant(ctxt, cur));
 }
diff --git a/xzlib.c b/xzlib.c
index 0dcb9f48..782957f6 100644
--- a/xzlib.c
+++ b/xzlib.c
@@ -8,7 +8,7 @@
  */
 #define IN_LIBXML
 #include "libxml.h"
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 
 #include <string.h>
 #ifdef HAVE_ERRNO_H
@@ -34,7 +34,9 @@
 #ifdef HAVE_ZLIB_H
 #include <zlib.h>
 #endif
+#ifdef HAVE_LZMA_H
 #include <lzma.h>
+#endif
 
 #include "xzlib.h"
 #include <libxml/xmlmemory.h>
@@ -581,6 +583,10 @@ xz_decomp(xz_statep state)
             xz_error(state, LZMA_DATA_ERROR, "compressed data error");
             return -1;
         }
+        if (ret == LZMA_PROG_ERROR) {
+            xz_error(state, LZMA_PROG_ERROR, "compression error");
+            return -1;
+        }
     } while (strm->avail_out && ret != LZMA_STREAM_END);
 
     /* update available output and crc check value */
@@ -795,4 +801,4 @@ __libxml2_xzclose(xzFile file)
     xmlFree(state);
     return ret ? ret : LZMA_OK;
 }
-#endif /* HAVE_LZMA_H */
+#endif /* LIBXML_LZMA_ENABLED */