Merge remote-tracking branch 'libxml2/master' into mymerge

22 files changed, 492 insertions, 152 deletions

diff --git a/HTMLparser.c b/HTMLparser.c
index 19c10c3f..b7291972 100644
--- a/HTMLparser.c
+++ b/HTMLparser.c
@@ -3264,12 +3264,17 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
 	ctxt->instate = state;
 	return;
     }
+    len = 0;
+    buf[len] = 0;
     q = CUR_CHAR(ql);
+    if (!IS_CHAR(q))
+        goto unfinished;
     NEXTL(ql);
     r = CUR_CHAR(rl);
+    if (!IS_CHAR(r))
+        goto unfinished;
     NEXTL(rl);
     cur = CUR_CHAR(l);
-    len = 0;
     while (IS_CHAR(cur) &&
            ((cur != '>') ||
 	    (r != '-') || (q != '-'))) {
@@ -3300,18 +3305,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
 	}
     }
     buf[len] = 0;
-    if (!IS_CHAR(cur)) {
-	htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
-	             "Comment not terminated \n<!--%.50s\n", buf, NULL);
-	xmlFree(buf);
-    } else {
+    if (IS_CHAR(cur)) {
         NEXT;
 	if ((ctxt->sax != NULL) && (ctxt->sax->comment != NULL) &&
 	    (!ctxt->disableSAX))
 	    ctxt->sax->comment(ctxt->userData, buf);
 	xmlFree(buf);
+	ctxt->instate = state;
+	return;
     }
-    ctxt->instate = state;
+
+unfinished:
+    htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
+		 "Comment not terminated \n<!--%.50s\n", buf, NULL);
+    xmlFree(buf);
 }
 
 /**
@@ -5728,17 +5735,17 @@ htmlParseTryOrFinish(htmlParserCtxtPtr ctxt, int terminate) {
 				if (ctxt->keepBlanks) {
 				    if (ctxt->sax->characters != NULL)
 					ctxt->sax->characters(
-						ctxt->userData, &cur, 1);
+						ctxt->userData, &in->cur[0], 1);
 				} else {
 				    if (ctxt->sax->ignorableWhitespace != NULL)
 					ctxt->sax->ignorableWhitespace(
-						ctxt->userData, &cur, 1);
+						ctxt->userData, &in->cur[0], 1);
 				}
 			    } else {
 				htmlCheckParagraph(ctxt);
 				if (ctxt->sax->characters != NULL)
 				    ctxt->sax->characters(
-					    ctxt->userData, &cur, 1);
+					    ctxt->userData, &in->cur[0], 1);
 			    }
 			}
 			ctxt->token = 0;
diff --git a/configure.ac b/configure.ac
index 14ac0a8a..02602814 100644
--- a/configure.ac
+++ b/configure.ac
@@ -8,7 +8,7 @@ AC_CANONICAL_HOST
 
 LIBXML_MAJOR_VERSION=2
 LIBXML_MINOR_VERSION=9
-LIBXML_MICRO_VERSION=2
+LIBXML_MICRO_VERSION=3
 LIBXML_MICRO_VERSION_SUFFIX=
 LIBXML_VERSION=$LIBXML_MAJOR_VERSION.$LIBXML_MINOR_VERSION.$LIBXML_MICRO_VERSION$LIBXML_MICRO_VERSION_SUFFIX
 LIBXML_VERSION_INFO=`expr $LIBXML_MAJOR_VERSION + $LIBXML_MINOR_VERSION`:$LIBXML_MICRO_VERSION:$LIBXML_MINOR_VERSION
@@ -445,6 +445,9 @@ else
                 fi],
                 [have_liblzma=no])
 	     LDFLAGS="${SAVE_LDFLAGS}"])
+    else
+	# we still need to check for lzma,h header
+	AC_CHECK_HEADERS([lzma.h])
     fi
 
     # Found the library via either method?
diff --git a/dict.c b/dict.c
index 5f71d55d..8c8f9314 100644
--- a/dict.c
+++ b/dict.c
@@ -486,7 +486,10 @@ xmlDictComputeFastQKey(const xmlChar *prefix, int plen,
 	value += 30 * (*prefix);
 
     if (len > 10) {
-        value += name[len - (plen + 1 + 1)];
+        int offset = len - (plen + 1 + 1);
+	if (offset < 0)
+	    offset = len - (10 + 1);
+	value += name[offset];
         len = 10;
 	if (plen > 10)
 	    plen = 10;
diff --git a/doc/APIfiles.html b/doc/APIfiles.html
index 65e004be..2252a6b0 100644
--- a/doc/APIfiles.html
+++ b/doc/APIfiles.html
@@ -1309,6 +1309,7 @@ A:link, A:visited, A:active { text-decoration: underline }
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NONE">XML_ATTRIBUTE_NONE</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NOTATION">XML_ATTRIBUTE_NOTATION</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_REQUIRED">XML_ATTRIBUTE_REQUIRED</a><br />
+<a href="html/libxml-tree.html#XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_DOUBLEIT">XML_BUFFER_ALLOC_DOUBLEIT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_EXACT">XML_BUFFER_ALLOC_EXACT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a><br />
diff --git a/doc/APIsymbols.html b/doc/APIsymbols.html
index c2b82e7d..cdde358d 100644
--- a/doc/APIsymbols.html
+++ b/doc/APIsymbols.html
@@ -154,6 +154,7 @@ A:link, A:visited, A:active { text-decoration: underline }
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NONE">XML_ATTRIBUTE_NONE</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NOTATION">XML_ATTRIBUTE_NOTATION</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_REQUIRED">XML_ATTRIBUTE_REQUIRED</a><br />
+<a href="html/libxml-tree.html#XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_DOUBLEIT">XML_BUFFER_ALLOC_DOUBLEIT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_EXACT">XML_BUFFER_ALLOC_EXACT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a><br />
diff --git a/doc/devhelp/libxml2-tree.html b/doc/devhelp/libxml2-tree.html
index 3cc28c71..5f8d1f28 100644
--- a/doc/devhelp/libxml2-tree.html
+++ b/doc/devhelp/libxml2-tree.html
@@ -409,7 +409,8 @@ The content of this structure is not made public by the API.
     <a name="XML_BUFFER_ALLOC_EXACT">XML_BUFFER_ALLOC_EXACT</a> = 2 /* grow only to the minimal size */
     <a name="XML_BUFFER_ALLOC_IMMUTABLE">XML_BUFFER_ALLOC_IMMUTABLE</a> = 3 /* immutable buffer */
     <a name="XML_BUFFER_ALLOC_IO">XML_BUFFER_ALLOC_IO</a> = 4 /* special allocation scheme used for I/O */
-    <a name="XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a> = 5 /*  exact up to a threshold, and doubleit thereafter */
+    <a name="XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a> = 5 /* exact up to a threshold, and doubleit thereafter */
+    <a name="XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a> = 6 /*  limit the upper size of the buffer */
 };
 </pre><p/>
 </div>
diff --git a/doc/devhelp/libxml2.devhelp b/doc/devhelp/libxml2.devhelp
index 282546ab..fbd3ad4a 100644
--- a/doc/devhelp/libxml2.devhelp
+++ b/doc/devhelp/libxml2.devhelp
@@ -351,6 +351,7 @@
     <function name="XML_ATTRIBUTE_NONE" link="libxml2-tree.html#XML_ATTRIBUTE_NONE"/>
     <function name="XML_ATTRIBUTE_NOTATION" link="libxml2-tree.html#XML_ATTRIBUTE_NOTATION"/>
     <function name="XML_ATTRIBUTE_REQUIRED" link="libxml2-tree.html#XML_ATTRIBUTE_REQUIRED"/>
+    <function name="XML_BUFFER_ALLOC_BOUNDED" link="libxml2-tree.html#XML_BUFFER_ALLOC_BOUNDED"/>
     <function name="XML_BUFFER_ALLOC_DOUBLEIT" link="libxml2-tree.html#XML_BUFFER_ALLOC_DOUBLEIT"/>
     <function name="XML_BUFFER_ALLOC_EXACT" link="libxml2-tree.html#XML_BUFFER_ALLOC_EXACT"/>
     <function name="XML_BUFFER_ALLOC_HYBRID" link="libxml2-tree.html#XML_BUFFER_ALLOC_HYBRID"/>
diff --git a/doc/html/libxml-tree.html b/doc/html/libxml-tree.html
index e2081cc5..d1d005f6 100644
--- a/doc/html/libxml-tree.html
+++ b/doc/html/libxml-tree.html
@@ -305,6 +305,7 @@ The content of this structure is not made public by the API.
     <a name="XML_BUFFER_ALLOC_IMMUTABLE" id="XML_BUFFER_ALLOC_IMMUTABLE">XML_BUFFER_ALLOC_IMMUTABLE</a> = 3 : immutable buffer
     <a name="XML_BUFFER_ALLOC_IO" id="XML_BUFFER_ALLOC_IO">XML_BUFFER_ALLOC_IO</a> = 4 : special allocation scheme used for I/O
     <a name="XML_BUFFER_ALLOC_HYBRID" id="XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a> = 5 : exact up to a threshold, and doubleit thereafter
+    <a name="XML_BUFFER_ALLOC_BOUNDED" id="XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a> = 6 : limit the upper size of the buffer
 }
 </pre><h3><a name="xmlDOMWrapCtxt" id="xmlDOMWrapCtxt">Structure xmlDOMWrapCtxt</a></h3><pre class="programlisting">Structure xmlDOMWrapCtxt<br />struct _xmlDOMWrapCtxt {
     void *	_private	: * The type of this context, just in case
diff --git a/doc/libxml2-api.xml b/doc/libxml2-api.xml
index f83d14f0..5573f0c5 100644
--- a/doc/libxml2-api.xml
+++ b/doc/libxml2-api.xml
@@ -1441,12 +1441,12 @@
      <exports symbol='XML_DOC_DTDVALID' type='enum'/>
      <exports symbol='XML_ELEMENT_TYPE_ANY' type='enum'/>
      <exports symbol='XML_DOC_NSVALID' type='enum'/>
-     <exports symbol='XML_ELEMENT_CONTENT_ONCE' type='enum'/>
+     <exports symbol='XML_BUFFER_ALLOC_BOUNDED' type='enum'/>
      <exports symbol='XML_ELEMENT_CONTENT_PCDATA' type='enum'/>
      <exports symbol='XML_ATTRIBUTE_FIXED' type='enum'/>
      <exports symbol='XML_DOCUMENT_TYPE_NODE' type='enum'/>
      <exports symbol='XML_DOC_HTML' type='enum'/>
-     <exports symbol='XML_ELEMENT_CONTENT_OPT' type='enum'/>
+     <exports symbol='XML_ELEMENT_CONTENT_ONCE' type='enum'/>
      <exports symbol='XML_NAMESPACE_DECL' type='enum'/>
      <exports symbol='XML_ATTRIBUTE_NOTATION' type='enum'/>
      <exports symbol='XML_ELEMENT_TYPE_MIXED' type='enum'/>
@@ -1459,6 +1459,7 @@
      <exports symbol='XML_NOTATION_NODE' type='enum'/>
      <exports symbol='XML_ELEMENT_CONTENT_SEQ' type='enum'/>
      <exports symbol='XML_ELEMENT_TYPE_EMPTY' type='enum'/>
+     <exports symbol='XML_ELEMENT_CONTENT_OPT' type='enum'/>
      <exports symbol='XML_ATTRIBUTE_ENUMERATION' type='enum'/>
      <exports symbol='XML_DOC_OLD10' type='enum'/>
      <exports symbol='XML_HTML_DOCUMENT_NODE' type='enum'/>
@@ -4702,9 +4703,10 @@
     <enum name='XML_ATTRIBUTE_NONE' file='tree' value='1' type='xmlAttributeDefault'/>
     <enum name='XML_ATTRIBUTE_NOTATION' file='tree' value='10' type='xmlAttributeType'/>
     <enum name='XML_ATTRIBUTE_REQUIRED' file='tree' value='2' type='xmlAttributeDefault'/>
+    <enum name='XML_BUFFER_ALLOC_BOUNDED' file='tree' value='6' type='xmlBufferAllocationScheme' info=' limit the upper size of the buffer'/>
     <enum name='XML_BUFFER_ALLOC_DOUBLEIT' file='tree' value='1' type='xmlBufferAllocationScheme' info='double each time one need to grow'/>
     <enum name='XML_BUFFER_ALLOC_EXACT' file='tree' value='2' type='xmlBufferAllocationScheme' info='grow only to the minimal size'/>
-    <enum name='XML_BUFFER_ALLOC_HYBRID' file='tree' value='5' type='xmlBufferAllocationScheme' info=' exact up to a threshold, and doubleit thereafter'/>
+    <enum name='XML_BUFFER_ALLOC_HYBRID' file='tree' value='5' type='xmlBufferAllocationScheme' info='exact up to a threshold, and doubleit thereafter'/>
     <enum name='XML_BUFFER_ALLOC_IMMUTABLE' file='tree' value='3' type='xmlBufferAllocationScheme' info='immutable buffer'/>
     <enum name='XML_BUFFER_ALLOC_IO' file='tree' value='4' type='xmlBufferAllocationScheme' info='special allocation scheme used for I/O'/>
     <enum name='XML_BUF_OVERFLOW' file='xmlerror' value='7000' type='xmlParserErrors'/>
diff --git a/doc/libxml2-refs.xml b/doc/libxml2-refs.xml
index f42fab4e..71586099 100644
--- a/doc/libxml2-refs.xml
+++ b/doc/libxml2-refs.xml
@@ -148,6 +148,7 @@
     <reference name='XML_ATTRIBUTE_NONE' href='html/libxml-tree.html#XML_ATTRIBUTE_NONE'/>
     <reference name='XML_ATTRIBUTE_NOTATION' href='html/libxml-tree.html#XML_ATTRIBUTE_NOTATION'/>
     <reference name='XML_ATTRIBUTE_REQUIRED' href='html/libxml-tree.html#XML_ATTRIBUTE_REQUIRED'/>
+    <reference name='XML_BUFFER_ALLOC_BOUNDED' href='html/libxml-tree.html#XML_BUFFER_ALLOC_BOUNDED'/>
     <reference name='XML_BUFFER_ALLOC_DOUBLEIT' href='html/libxml-tree.html#XML_BUFFER_ALLOC_DOUBLEIT'/>
     <reference name='XML_BUFFER_ALLOC_EXACT' href='html/libxml-tree.html#XML_BUFFER_ALLOC_EXACT'/>
     <reference name='XML_BUFFER_ALLOC_HYBRID' href='html/libxml-tree.html#XML_BUFFER_ALLOC_HYBRID'/>
@@ -3749,6 +3750,7 @@
       <ref name='XML_ATTRIBUTE_NONE'/>
       <ref name='XML_ATTRIBUTE_NOTATION'/>
       <ref name='XML_ATTRIBUTE_REQUIRED'/>
+      <ref name='XML_BUFFER_ALLOC_BOUNDED'/>
       <ref name='XML_BUFFER_ALLOC_DOUBLEIT'/>
       <ref name='XML_BUFFER_ALLOC_EXACT'/>
       <ref name='XML_BUFFER_ALLOC_HYBRID'/>
@@ -12100,6 +12102,7 @@
       <ref name='XML_ATTRIBUTE_NONE'/>
       <ref name='XML_ATTRIBUTE_NOTATION'/>
       <ref name='XML_ATTRIBUTE_REQUIRED'/>
+      <ref name='XML_BUFFER_ALLOC_BOUNDED'/>
       <ref name='XML_BUFFER_ALLOC_DOUBLEIT'/>
       <ref name='XML_BUFFER_ALLOC_EXACT'/>
       <ref name='XML_BUFFER_ALLOC_HYBRID'/>
diff --git a/doc/libxml2.xsa b/doc/libxml2.xsa
index da61d57d..0825d53f 100644
--- a/doc/libxml2.xsa
+++ b/doc/libxml2.xsa
@@ -8,95 +8,182 @@
   </vendor>
   <product id="libxml2">
     <name>libxml2</name>
-    <version>2.9.1</version>
-    <last-release> Apr 19 2013</last-release>
+    <version>2.9.2</version>
+    <last-release> Oct 16 2014</last-release>
     <info-url>http://xmlsoft.org/</info-url>
-    <changes>   -  Features:
-    Support for Python3 (Daniel Veillard),
-    Add xmlXPathSetContextNode and xmlXPathNodeEval (Alex Bligh)
+    <changes>   - Security:
+  Fix for CVE-2014-3660 billion laugh variant (Daniel Veillard),
+  CVE-2014-0191 Do not fetch external parameter entities (Daniel Veillard)
   
-   -  Documentation:
-    Add documentation for xmllint --xpath (Daniel Veillard),
-    Fix the URL of the SAX documentation from James (Daniel Veillard),
-    Fix spelling of "length". (Michael Wood)
+   - Bug Fixes:
+  fix memory leak xml header encoding field with XML_PARSE_IGNORE_ENC (Bart De Schuymer),
+  xmlmemory: handle realloc properly (Yegor Yefremov),
+  Python generator bug raised by the const change (Daniel Veillard),
+  Windows Critical sections not released correctly (Daniel Veillard),
+  Parser error on repeated recursive entity expansion containing &amp;lt; (Daniel Veillard),
+  xpointer : fixing Null Pointers (Gaurav Gupta),
+  Remove Unnecessary Null check in xpointer.c (Gaurav Gupta),
+  parser bug on misformed namespace attributes (Dennis Filder),
+  Pointer dereferenced before null check (Daniel Veillard),
+  Leak of struct addrinfo in xmlNanoFTPConnect() (Gaurav Gupta),
+  Possible overflow in HTMLParser.c (Daniel Veillard),
+  python/tests/sync.py assumes Python dictionaries are ordered (John Beck),
+  Fix Enum check and missing break (Gaurav Gupta),
+  xmlIO: Handle error returns from dup() (Philip Withnall),
+  Fix a problem properly saving URIs (Daniel Veillard),
+  wrong error column in structured error when parsing attribute values (Juergen Keil),
+  wrong error column in structured error when skipping whitespace in xml decl (Juergen Keil),
+  no error column in structured error handler for xml schema validation errors (Juergen Keil),
+  Couple of Missing Null checks (Gaurav Gupta),
+  Add couple of missing Null checks (Daniel Veillard),
+  xmlschemastypes: Fix potential array overflow (Philip Withnall),
+  runtest: Fix a memory leak on parse failure (Philip Withnall),
+  xmlIO: Fix an FD leak on gzdopen() failure (Philip Withnall),
+  xmlcatalog: Fix a memory leak on quit (Philip Withnall),
+  HTMLparser: Correctly initialise a stack allocated structure (Philip Withnall),
+  Check for tmon in _xmlSchemaDateAdd() is incorrect (David Kilzer),
+  Avoid Possible Null Pointer in trio.c (Gaurav Gupta),
+  Fix processing in SAX2 in case of an allocation failure (Daniel Veillard),
+  XML Shell command "cd" does not handle "/" at end of path (Daniel Veillard),
+  Fix various Missing Null checks (Gaurav Gupta),
+  Fix a potential NULL dereference (Daniel Veillard),
+  Add a couple of misisng check in xmlRelaxNGCleanupTree (Gaurav Gupta),
+  Add a missing argument check (Gaurav Gupta),
+  Adding a check in case of allocation error (Gaurav Gupta),
+  xmlSaveUri() incorrectly recomposes URIs with rootless paths (Dennis Filder),
+  Adding some missing NULL checks (Gaurav),
+  Fixes for xmlInitParserCtxt (Daniel Veillard),
+  Fix regressions introduced by CVE-2014-0191 patch (Daniel Veillard),
+  erroneously ignores a validation error if no error callback set (Daniel Veillard),
+  xmllint was not parsing the --c14n11 flag (Sérgio Batista),
+  Avoid Possible null pointer dereference in memory debug mode (Gaurav),
+  Avoid Double Null Check (Gaurav),
+  Restore context size and position after XPATH_OP_ARG (Nick Wellnhofer),
+  Fix xmlParseInNodeContext() if node is not element (Daniel Veillard),
+  Avoid a possible NULL pointer dereference (Gaurav),
+  Fix xmlTextWriterWriteElement when a null content is given (Daniel Veillard),
+  Fix an typo 'onrest' in htmlScriptAttributes (Daniel Veillard),
+  fixing a ptotential uninitialized access (Daniel Veillard),
+  Fix an fd leak in an error case (Daniel Veillard),
+  Missing initialization for the catalog module (Daniel Veillard),
+  Handling of XPath function arguments in error case (Nick Wellnhofer),
+  Fix a couple of missing NULL checks (Gaurav),
+  Avoid a possibility of dangling encoding handler (Gaurav),
+  Fix HTML push parser to accept HTML_PARSE_NODEFDTD (Arnold Hendriks),
+  Fix a bug loading some compressed files (Mike Alexander),
+  Fix XPath node comparison bug (Gaurav),
+  Type mismatch in xmlschemas.c (Gaurav),
+  Type mismatch in xmlschemastypes.c (Gaurav),
+  Avoid a deadcode in catalog.c (Daniel Veillard),
+  run close socket on Solaris, same as we do on other platforms (Denis Pauk),
+  Fix pointer dereferenced before null check (Gaurav),
+  Fix a potential NULL dereference in tree code (Daniel Veillard),
+  Fix potential NULL pointer dereferences in regexp code (Gaurav),
+  xmllint --pretty crashed without following numeric argument (Tim Galeckas),
+  Fix XPath expressions of the form '@ns:*' (Nick Wellnhofer),
+  Fix XPath '//' optimization with predicates (Nick Wellnhofer),
+  Clear up a potential NULL dereference (Daniel Veillard),
+  Fix a possible NULL dereference (Gaurav),
+  Avoid crash if allocation fails (Daniel Veillard),
+  Remove occasional leading space in XPath number formatting (Daniel Veillard),
+  Fix handling of mmap errors (Daniel Veillard),
+  Catch malloc error and exit accordingly (Daniel Veillard),
+  missing else in xlink.c (Ami Fischman),
+  Fix a parsing bug on non-ascii element and CR/LF usage (Daniel Veillard),
+  Fix a regression in xmlGetDocCompressMode() (Daniel Veillard),
+  properly quote the namespace uris written out during c14n (Aleksey Sanin),
+  Remove premature XInclude check on URI being relative (Alexey Neyman),
+  Fix missing break on last() function for attributes (dcb),
+  Do not URI escape in server side includes (Romain Bondue),
+  Fix an error in xmlCleanupParser (Alexander Pastukhov)
   
-   -  Portability:
-    Fix python bindings with versions older than 2.7 (Daniel Veillard),
-    rebuild docs:Makefile.am (Roumen Petrov),
-    elfgcchack.h after rebuild in doc (Roumen Petrov),
-    elfgcchack for buf module (Roumen Petrov),
-    Fix a uneeded and wrong extra link parameter (Daniel Veillard),
-    Few cleanup patches for Windows (Denis Pauk),
-    Fix rpmbuild --nocheck (Mark Salter),
-    Fix for win32/configure.js and WITH_THREAD_ALLOC (Daniel Richard),
-    Fix Broken multi-arch support in xml2-config (Daniel Veillard),
-    Fix a portability issue for GCC &lt; 3.4.0 (Daniel Veillard),
-    Windows build fixes (Daniel Richard),
-    Fix a thread portability problem (Friedrich Haubensak),
-    Downgrade autoconf requirement to 2.63 (Daniel Veillard)
+   - Documentation:
+  typo in error messages "colon are forbidden from..." (Daniel Veillard),
+  Fix a link to James SAX documentation old page (Daniel Veillard),
+  Fix typos in relaxng.c (Jan Pokorný),
+  Fix a doc typo (Daniel Veillard),
+  Fix typos in {tree,xpath}.c (errror) (Jan Pokorný),
+  Add limitations about encoding conversion (Daniel Veillard),
+  Fix typos in xmlschemas{,types}.c (Jan Pokorný),
+  Fix incorrect spelling entites-&gt;entities (Jan Pokorný),
+  Forgot to document 2.9.1 release, regenerate docs (Daniel Veillard)
   
-   -  Bug Fixes:
-    Fix a linking error for python bindings (Daniel Veillard),
-    Fix a couple of return without value (Jüri Aedla),
-    Improve the hashing functions (Daniel Franke),
-    Improve handling of xmlStopParser() (Daniel Veillard),
-    Remove risk of lockup in dictionary initialization (Daniel Veillard),
-    Activate detection of encoding in external subset (Daniel Veillard),
-    Fix an output buffer flushing conversion bug (Mikhail Titov),
-    Fix an old bug in xmlSchemaValidateOneElement (Csaba László),
-    Fix configure cannot remove messages (Gilles Espinasse),
-    fix schema validation in combination with xsi:nil (Daniel Veillard),
-    xmlCtxtReadFile doesn't work with literal IPv6 URLs (Steve Wolf),
-    Fix a few problems with setEntityLoader (Alexey Neyman),
-    Detect excessive entities expansion upon replacement (Daniel Veillard),
-    Fix the flushing out of raw buffers on encoding conversions (Daniel,
-Veillard),
-    Fix some buffer conversion issues (Daniel Veillard),
-    When calling xmlNodeDump make sure we grow the buffer quickly (Daniel,
-Veillard),
-    Fix an error in the progressive DTD parsing code (Dan Winship),
-    xmllint should not load DTD by default when using the reader (Daniel,
-Veillard),
-    Try IBM-037 when looking for EBCDIC handlers (Petr Sumbera),
-    Fix potential out of bound access (Daniel Veillard),
-    Fix large parse of file from memory (Daniel Veillard),
-    Fix a bug in the nsclean option of the parser (Daniel Veillard),
-    Fix a regression in 2.9.0 breaking validation while streaming (Daniel,
-Veillard),
-    Remove potential calls to exit() (Daniel Veillard)
+   - Portability:
+  AC_CONFIG_FILES and executable bit (Roumen Petrov),
+  remove HAVE_CONFIG_H dependency in testlimits.c (Roumen Petrov),
+  fix some tabs mixing incompatible with python3 (Roumen Petrov),
+  Visual Studio 14 CTP defines snprintf() (Francis Dupont),
+  OS400: do not try to copy unexisting doc files (Patrick Monnerat),
+  OS400: use either configure.ac or configure.in. (Patrick Monnerat),
+  os400: make-src.sh: create physical file with target CCSID (Patrick Monnerat),
+  OS400: Add some more C macros equivalent procedures. (Patrick Monnerat),
+  OS400: use C macros to implement equivalent RPG support procedures. (Patrick Monnerat),
+  OS400: implement XPath macros as procedures for ILE/RPG support. (Patrick Monnerat),
+  OS400: include in distribution tarball. (Patrick Monnerat),
+  OS400: Add README: compilation directives and OS/400 specific stuff. (Patrick Monnerat),
+  OS400: Add compilation scripts. (Patrick Monnerat),
+  OS400: ILE RPG language header files. (Patrick Monnerat),
+  OS400: implement some macros as functions for ILE/RPG language support (that as no macros). (Patrick Monnerat),
+  OS400: UTF8&lt;--&gt;EBCDIC wrappers for system and external library calls (Patrick Monnerat),
+  OS400: Easy character transcoding support (Patrick Monnerat),
+  OS400: iconv functions compatibility wrappers and table builder. (Patrick Monnerat),
+  OS400: create architecture directory. Implement dlfcn emulation. (Patrick Monnerat),
+  Fix building when configuring without xpath and xptr (Daniel Veillard),
+  configure: Add --with-python-install-dir (Jonas Eriksson),
+  Fix compilation with minimum and xinclude. (Nicolas Le Cam),
+  Compile out use of xmlValidateNCName() when not available. (Nicolas Le Cam),
+  Fix compilation with minimum and schematron. (Nicolas Le Cam),
+  Legacy needs xmlSAX2StartElement() and xmlSAX2EndElement(). (Nicolas Le Cam),
+  Don't use xmlValidateName() when not available. (Nicolas Le Cam),
+  Fix a portability issue on Windows (Longstreth Jon),
+  Various portability patches for OpenVMS (Jacob (Jouk) Jansen),
+  Use specific macros for portability to OS/400 (Patrick Monnerat),
+  Add macros needed for OS/400 portability (Patrick Monnerat),
+  Portability patch for fopen on OS/400 (Patrick Monnerat),
+  Portability fixes for OS/400 (Patrick Monnerat),
+  Improve va_list portability (Patrick Monnerat),
+  Portability fix (Patrick Monnerat),
+  Portability fix (Patrick Monnerat),
+  Generic portability fix (Patrick Monnerat),
+  Shortening lines in headers (Patrick Monnerat),
+  build: Use pkg-config to find liblzma in preference to AC_CHECK_LIB (Philip Withnall),
+  build: Add @LZMA_LIBS@ to libxml’s pkg-config files (Philip Withnall),
+  fix some tabs mixing incompatible with python3 (Daniel Veillard),
+  add additional defines checks for support "./configure --with-minimum" (Denis Pauk),
+  Another round of fixes for older versions of Python (Arfrever Frehtes Taifersar Arahesis),
+  python: fix drv_libxml2.py for python3 compatibility (Alexandre Rostovtsev),
+  python: Fix compiler warnings when building python3 bindings (Armin K),
+  Fix for compilation with python 2.6.8 (Petr Sumbera)
   
-   -  Improvements:
-    Regenerated API, and testapi, rebuild documentation (Daniel Veillard),
-    Fix tree iterators broken by 2to3 script (Daniel Veillard),
-    update all tests for Python3 and Python2 (Daniel Veillard),
-    A few more fixes for python 3 affecting libxml2.py (Daniel Veillard),
-    Fix compilation on Python3 (Daniel Veillard),
-    Converting apibuild.py to python3 (Daniel Veillard),
-    First pass at starting porting to python3 (Daniel Veillard),
-    updated configure.in for python3 (Daniel Veillard),
-    Add support for xpathRegisterVariable in Python (Shaun McCance),
-    Added a regression tests from bug 694228 data (Daniel Veillard),
-    Cache presence of '&lt;' in entities content (Daniel Veillard),
-    Avoid extra processing on entities (Daniel Veillard),
-    Python binding for xmlRegisterInputCallback (Alexey Neyman),
-    Python bindings: DOM casts everything to xmlNode (Alexey Neyman),
-    Define LIBXML_THREAD_ALLOC_ENABLED via xmlversion.h (Tim Starling),
-    Adding streaming validation to runtest checks (Daniel Veillard),
-    Add a --pushsmall option to xmllint (Daniel Veillard)
+   - Improvements:
+  win32/libxml2.def.src after rebuild in doc (Roumen Petrov),
+  elfgcchack.h: more legacy needs xmlSAX2StartElement() and xmlSAX2EndElement() (Roumen Petrov),
+  elfgcchack.h: add xmlXPathNodeEval and xmlXPathSetContextNode (Roumen Petrov),
+  Provide cmake module (Samuel Martin),
+  Fix a couple of issues raised by make dist (Daniel Veillard),
+  Fix and add const qualifiers (Kurt Roeckx),
+  Preparing for upcoming release of 2.9.2 (Daniel Veillard),
+  Fix zlib and lzma libraries check via command line (Dmitriy),
+  wrong error column in structured error when parsing end tag (Juergen Keil),
+  doc/news.html: small update to avoid line join while generating NEWS. (Patrick Monnerat),
+  Add methods for python3 iterator (Ron Angeles),
+  Support element node traversal in document fragments. (Kyle VanderBeek),
+  xmlNodeSetName: Allow setting the name to a substring of the currently set name (Tristan Van Berkom),
+  Added macros for argument casts (Eric Zurcher),
+  adding init calls to xml and html Read parsing entry points (Daniel Veillard),
+  Get rid of 'REPLACEMENT CHARACTER' Unicode chars in xmlschemas.c (Jan Pokorný),
+  Implement choice for name classes on attributes (Shaun McCance),
+  Two small namespace tweaks (Daniel Veillard),
+  xmllint --memory should fail on empty files (Daniel Veillard),
+  Cast encoding name to char pointer to match arg type (Nikolay Sivov)
   
-   -  Cleanups:
-    Switched comment in file to UTF-8 encoding (Daniel Veillard),
-    Extend gitignore (Daniel Veillard),
-    Silent the new python test on input (Alexey Neyman),
-    Cleanup of a duplicate test (Daniel Veillard),
-    Cleanup on duplicate test expressions (Daniel Veillard),
-    Fix compiler warning after 153cf15905cf4ec080612ada6703757d10caba1e (Patrick,
-Gansterer),
-    Spec cleanups and a fix for multiarch support (Daniel Veillard),
-    Silence a clang warning (Daniel Veillard),
-    Cleanup the Copyright to be pure MIT Licence wording (Daniel Veillard),
-    rand_seed should be static in dict.c (Wouter Van Rooy),
-    Fix typos in parser comments (Jan Pokorný)
+   - Cleanups:
+  Removal of old configure.in (Daniel Veillard),
+  Unreachable code in tree.c (Gaurav Gupta),
+  Remove a couple of dead conditions (Gaurav Gupta),
+  Avoid some dead code and cleanup in relaxng.c (Gaurav),
+  Drop not needed checks (Denis Pauk),
+  Fix a wrong test (Daniel Veillard)
   
 
 </changes>
diff --git a/doc/news.html b/doc/news.html
index 5c03ba32..e76ef558 100644
--- a/doc/news.html
+++ b/doc/news.html
@@ -8,7 +8,78 @@ H2 {font-family: Verdana,Arial,Helvetica}
 H3 {font-family: Verdana,Arial,Helvetica}
 A:link, A:visited, A:active { text-decoration: underline }
 </style><title>Releases</title></head><body bgcolor="#8b7765" text="#000000" link="#a06060" vlink="#000000"><table border="0" width="100%" cellpadding="5" cellspacing="0" align="center"><tr><td width="120"><a href="http://swpat.ffii.org/"><img src="epatents.png" alt="Action against software patents" /></a></td><td width="180"><a href="http://www.gnome.org/"><img src="gnome2.png" alt="Gnome2 Logo" /></a><a href="http://www.w3.org/Status"><img src="w3c.png" alt="W3C Logo" /></a><a href="http://www.redhat.com/"><img src="redhat.gif" alt="Red Hat Logo" /></a><div align="left"><a href="http://xmlsoft.org/"><img src="Libxml2-Logo-180x168.gif" alt="Made with Libxml2 Logo" /></a></div></td><td><table border="0" width="90%" cellpadding="2" cellspacing="0" align="center" bgcolor="#000000"><tr><td><table width="100%" border="0" cellspacing="1" cellpadding="3" bgcolor="#fffacd"><tr><td align="center"><h1>The XML C parser and toolkit of Gnome</h1><h2>Releases</h2></td></tr></table></td></tr></table></td></tr></table><table border="0" cellpadding="4" cellspacing="0" width="100%" align="center"><tr><td bgcolor="#8b7765"><table border="0" cellspacing="0" cellpadding="2" width="100%"><tr><td valign="top" width="200" bgcolor="#8b7765"><table border="0" cellspacing="0" cellpadding="1" width="100%" bgcolor="#000000"><tr><td><table width="100%" border="0" cellspacing="1" cellpadding="3"><tr><td colspan="1" bgcolor="#eecfa1" align="center"><center><b>Main Menu</b></center></td></tr><tr><td bgcolor="#fffacd"><form action="search.php" enctype="application/x-www-form-urlencoded" method="get"><input name="query" type="text" size="20" value="" /><input name="submit" type="submit" value="Search ..." /></form><ul><li><a href="index.html">Home</a></li><li><a href="html/index.html">Reference Manual</a></li><li><a href="intro.html">Introduction</a></li><li><a href="FAQ.html">FAQ</a></li><li><a href="docs.html" style="font-weight:bold">Developer Menu</a></li><li><a href="bugs.html">Reporting bugs and getting help</a></li><li><a href="help.html">How to help</a></li><li><a href="downloads.html">Downloads</a></li><li><a href="news.html">Releases</a></li><li><a href="XMLinfo.html">XML</a></li><li><a href="XSLT.html">XSLT</a></li><li><a href="xmldtd.html">Validation &amp; DTDs</a></li><li><a href="encoding.html">Encodings support</a></li><li><a href="catalog.html">Catalog support</a></li><li><a href="namespaces.html">Namespaces</a></li><li><a href="contribs.html">Contributions</a></li><li><a href="examples/index.html" style="font-weight:bold">Code Examples</a></li><li><a href="html/index.html" style="font-weight:bold">API Menu</a></li><li><a href="guidelines.html">XML Guidelines</a></li><li><a href="ChangeLog.html">Recent Changes</a></li></ul></td></tr></table><table width="100%" border="0" cellspacing="1" cellpadding="3"><tr><td colspan="1" bgcolor="#eecfa1" align="center"><center><b>Related links</b></center></td></tr><tr><td bgcolor="#fffacd"><ul><li><a href="http://mail.gnome.org/archives/xml/">Mail archive</a></li><li><a href="http://xmlsoft.org/XSLT/">XSLT libxslt</a></li><li><a href="http://phd.cs.unibo.it/gdome2/">DOM gdome2</a></li><li><a href="http://www.aleksey.com/xmlsec/">XML-DSig xmlsec</a></li><li><a href="ftp://xmlsoft.org/">FTP</a></li><li><a href="http://www.zlatkovic.com/projects/libxml/">Windows binaries</a></li><li><a href="http://opencsw.org/packages/libxml2">Solaris binaries</a></li><li><a href="http://www.explain.com.au/oss/libxml2xslt.html">MacOsX binaries</a></li><li><a href="http://lxml.de/">lxml Python bindings</a></li><li><a href="http://cpan.uwinnipeg.ca/dist/XML-LibXML">Perl bindings</a></li><li><a href="http://libxmlplusplus.sourceforge.net/">C++ bindings</a></li><li><a href="http://www.zend.com/php5/articles/php5-xmlphp.php#Heading4">PHP bindings</a></li><li><a href="http://sourceforge.net/projects/libxml2-pas/">Pascal bindings</a></li><li><a href="http://libxml.rubyforge.org/">Ruby bindings</a></li><li><a href="http://tclxml.sourceforge.net/">Tcl bindings</a></li><li><a href="http://bugzilla.gnome.org/buglist.cgi?product=libxml2">Bug Tracker</a></li></ul></td></tr></table></td></tr></table></td><td valign="top" bgcolor="#8b7765"><table border="0" cellspacing="0" cellpadding="1" width="100%"><tr><td><table border="0" cellspacing="0" cellpadding="1" width="100%" bgcolor="#000000"><tr><td><table border="0" cellpadding="3" cellspacing="1" width="100%"><tr><td bgcolor="#fffacd"><p>The <a href="ChangeLog.html">change log</a> describes the recents commits
-to the <a href="http://git.gnome.org/browse/libxml2/">GIT</a> code base.</p><p>Here is the list of public releases:</p><h3>2.9.2: Oct 16 2014</h3><ul>
+to the <a href="http://git.gnome.org/browse/libxml2/">GIT</a> code base.</p><p>Here is the list of public releases:</p><h3>v2.9.3: Nov 20 2015</h3><ul>
+  <li>Security:<br />
+  CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh Davenport),<br />
+  CVE-2015-7500 Fix memory access error due to incorrect entities boundaries (Daniel Veillard),<br />
+  CVE-2015-7499-2 Detect incoherency on GROW (Daniel Veillard),<br />
+  CVE-2015-7499-1 Add xmlHaltParser() to stop the parser (Daniel Veillard),<br />
+  CVE-2015-5312 Another entity expansion issue (David Drysdale),<br />
+  CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey (David Drysdale),<br />
+  CVE-2015-7498 Avoid processing entities after encoding conversion failures (Daniel Veillard),<br />
+  CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard),<br />
+  CVE-2015-7942-2 Fix an error in previous Conditional section patch (Daniel Veillard),<br />
+  CVE-2015-7942 Another variation of overflow in Conditional sections (Daniel Veillard),<br />
+  CVE-2015-1819 Enforce the reader to run in constant memory (Daniel Veillard)<br />
+  CVE-2015-7941_2 Cleanup conditional section error handling (Daniel Veillard),<br />
+  CVE-2015-7941_1 Stop parsing on entities boundaries errors (Daniel Veillard),<br />
+  </li>
+
+  <li>Documentation:<br />
+  Correct spelling of "calling" (Alex Henrie),<br />
+  Fix a small error in xmllint --format description (Fabien Degomme),<br />
+  Avoid XSS on the search of xmlsoft.org (Daniel Veillard)<br />
+  </li>
+
+  <li>Portability:<br />
+  threads: use forward declarations only for glibc (Michael Heimpold),<br />
+  Update Win32 configure.js to search for configure.ac (Daniel Veillard)<br />
+  </li>
+
+  <li>Bug Fixes:<br />
+  Bug on creating new stream from entity (Daniel Veillard),<br />
+  Fix some loop issues embedding NEXT (Daniel Veillard),<br />
+  Do not print error context when there is none (Daniel Veillard),<br />
+  Avoid extra processing of MarkupDecl when EOF (Hugh Davenport),<br />
+  Fix parsing short unclosed comment uninitialized access (Daniel Veillard),<br />
+  Add missing Null check in xmlParseExternalEntityPrivate (Gaurav Gupta),<br />
+  Fix a bug in CData error handling in the push parser (Daniel Veillard),<br />
+  Fix a bug on name parsing at the end of current input buffer (Daniel Veillard),<br />
+  Fix the spurious ID already defined error (Daniel Veillard),<br />
+  Fix previous change to node sort order (Nick Wellnhofer),<br />
+  Fix a self assignment issue raised by clang (Scott Graham),<br />
+  Fail parsing early on if encoding conversion failed (Daniel Veillard),<br />
+  Do not process encoding values if the declaration if broken (Daniel Veillard),<br />
+  Silence clang's -Wunknown-attribute (Michael Catanzaro),<br />
+  xmlMemUsed is not thread-safe (Martin von Gagern),<br />
+  Fix support for except in nameclasses (Daniel Veillard),<br />
+  Fix order of root nodes (Nick Wellnhofer),<br />
+  Allow attributes on descendant-or-self axis (Nick Wellnhofer),<br />
+  Fix the fix to Windows locking (Steve Nairn),<br />
+  Fix timsort invariant loop re: Envisage article (Christopher Swenson),<br />
+  Don't add IDs in xmlSetTreeDoc (Nick Wellnhofer),<br />
+  Account for ID attributes in xmlSetTreeDoc (Nick Wellnhofer),<br />
+  Remove various unused value assignments (Philip Withnall),<br />
+  Fix missing entities after CVE-2014-3660 fix (Daniel Veillard),<br />
+  Revert "Missing initialization for the catalog module" (Daniel Veillard)<br />
+  </li>
+
+  <li>Improvements:<br />
+  Reuse xmlHaltParser() where it makes sense (Daniel Veillard),<br />
+  xmlStopParser reset errNo (Daniel Veillard),<br />
+  Reenable xz support by default (Daniel Veillard),<br />
+  Recover unescaped less-than character in HTML recovery parsing (Daniel Veillard),<br />
+  Allow HTML serializer to output HTML5 DOCTYPE (Shaun McCance),<br />
+  Regression test for bug #695699 (Nick Wellnhofer),<br />
+  Add a couple of XPath tests (Nick Wellnhofer),<br />
+  Add Python 3 rpm subpackage (Tomas Radej),<br />
+  libxml2-config.cmake.in: update include directories (Samuel Martin),<br />
+  Adding example from bugs 738805 to regression tests (Daniel Veillard)<br />
+  </li>
+
+  <li>Cleanups:<br />
+  </li>
+</ul><h3>2.9.2: Oct 16 2014</h3><ul>
   <li>Security:<br />
   Fix for CVE-2014-3660 billion laugh variant (Daniel Veillard),<br />
   CVE-2014-0191 Do not fetch external parameter entities (Daniel Veillard)<br />
diff --git a/doc/xml.html b/doc/xml.html
index 373285d2..51dca8c3 100644
--- a/doc/xml.html
+++ b/doc/xml.html
@@ -709,6 +709,79 @@ to the <a href="http://git.gnome.org/browse/libxml2/">GIT</a> code base.</p>
 
 <p>Here is the list of public releases:</p>
 
+<h3>v2.9.3: Nov 20 2015</h3>
+<ul>
+  <li>Security:<br/>
+  CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh Davenport),<br/>
+  CVE-2015-7500 Fix memory access error due to incorrect entities boundaries (Daniel Veillard),<br/>
+  CVE-2015-7499-2 Detect incoherency on GROW (Daniel Veillard),<br/>
+  CVE-2015-7499-1 Add xmlHaltParser() to stop the parser (Daniel Veillard),<br/>
+  CVE-2015-5312 Another entity expansion issue (David Drysdale),<br/>
+  CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey (David Drysdale),<br/>
+  CVE-2015-7498 Avoid processing entities after encoding conversion failures (Daniel Veillard),<br/>
+  CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard),<br/>
+  CVE-2015-7942-2 Fix an error in previous Conditional section patch (Daniel Veillard),<br/>
+  CVE-2015-7942 Another variation of overflow in Conditional sections (Daniel Veillard),<br/>
+  CVE-2015-1819 Enforce the reader to run in constant memory (Daniel Veillard)<br/>
+  CVE-2015-7941_2 Cleanup conditional section error handling (Daniel Veillard),<br/>
+  CVE-2015-7941_1 Stop parsing on entities boundaries errors (Daniel Veillard),<br/>
+  </li>
+
+  <li>Documentation:<br/>
+  Correct spelling of "calling" (Alex Henrie),<br/>
+  Fix a small error in xmllint --format description (Fabien Degomme),<br/>
+  Avoid XSS on the search of xmlsoft.org (Daniel Veillard)<br/>
+  </li>
+
+  <li>Portability:<br/>
+  threads: use forward declarations only for glibc (Michael Heimpold),<br/>
+  Update Win32 configure.js to search for configure.ac (Daniel Veillard)<br/>
+  </li>
+
+  <li>Bug Fixes:<br/>
+  Bug on creating new stream from entity (Daniel Veillard),<br/>
+  Fix some loop issues embedding NEXT (Daniel Veillard),<br/>
+  Do not print error context when there is none (Daniel Veillard),<br/>
+  Avoid extra processing of MarkupDecl when EOF (Hugh Davenport),<br/>
+  Fix parsing short unclosed comment uninitialized access (Daniel Veillard),<br/>
+  Add missing Null check in xmlParseExternalEntityPrivate (Gaurav Gupta),<br/>
+  Fix a bug in CData error handling in the push parser (Daniel Veillard),<br/>
+  Fix a bug on name parsing at the end of current input buffer (Daniel Veillard),<br/>
+  Fix the spurious ID already defined error (Daniel Veillard),<br/>
+  Fix previous change to node sort order (Nick Wellnhofer),<br/>
+  Fix a self assignment issue raised by clang (Scott Graham),<br/>
+  Fail parsing early on if encoding conversion failed (Daniel Veillard),<br/>
+  Do not process encoding values if the declaration if broken (Daniel Veillard),<br/>
+  Silence clang's -Wunknown-attribute (Michael Catanzaro),<br/>
+  xmlMemUsed is not thread-safe (Martin von Gagern),<br/>
+  Fix support for except in nameclasses (Daniel Veillard),<br/>
+  Fix order of root nodes (Nick Wellnhofer),<br/>
+  Allow attributes on descendant-or-self axis (Nick Wellnhofer),<br/>
+  Fix the fix to Windows locking (Steve Nairn),<br/>
+  Fix timsort invariant loop re: Envisage article (Christopher Swenson),<br/>
+  Don't add IDs in xmlSetTreeDoc (Nick Wellnhofer),<br/>
+  Account for ID attributes in xmlSetTreeDoc (Nick Wellnhofer),<br/>
+  Remove various unused value assignments (Philip Withnall),<br/>
+  Fix missing entities after CVE-2014-3660 fix (Daniel Veillard),<br/>
+  Revert "Missing initialization for the catalog module" (Daniel Veillard)<br/>
+  </li>
+
+  <li>Improvements:<br/>
+  Reuse xmlHaltParser() where it makes sense (Daniel Veillard),<br/>
+  xmlStopParser reset errNo (Daniel Veillard),<br/>
+  Reenable xz support by default (Daniel Veillard),<br/>
+  Recover unescaped less-than character in HTML recovery parsing (Daniel Veillard),<br/>
+  Allow HTML serializer to output HTML5 DOCTYPE (Shaun McCance),<br/>
+  Regression test for bug #695699 (Nick Wellnhofer),<br/>
+  Add a couple of XPath tests (Nick Wellnhofer),<br/>
+  Add Python 3 rpm subpackage (Tomas Radej),<br/>
+  libxml2-config.cmake.in: update include directories (Samuel Martin),<br/>
+  Adding example from bugs 738805 to regression tests (Daniel Veillard)<br/>
+  </li>
+
+  <li>Cleanups:<br/>
+  </li>
+</ul>
 <h3>2.9.2: Oct 16 2014</h3>
 <ul>
   <li>Security:<br/>
diff --git a/error.c b/error.c
index cbcf5c96..9c450405 100644
--- a/error.c
+++ b/error.c
@@ -177,7 +177,9 @@ xmlParserPrintFileContextInternal(xmlParserInputPtr input ,
     xmlChar  content[81]; /* space for 80 chars + line terminator */
     xmlChar *ctnt;
 
-    if (input == NULL) return;
+    if ((input == NULL) || (input->cur == NULL) ||
+        (*input->cur == 0)) return;
+
     cur = input->cur;
     base = input->base;
     /* skip backwards over any end-of-lines */
diff --git a/parser.c b/parser.c
index b9217ff1..c5741e3b 100644
--- a/parser.c
+++ b/parser.c
@@ -94,6 +94,8 @@ static xmlParserCtxtPtr
 xmlCreateEntityParserCtxtInternal(const xmlChar *URL, const xmlChar *ID,
 	                  const xmlChar *base, xmlParserCtxtPtr pctx);
 
+static void xmlHaltParser(xmlParserCtxtPtr ctxt);
+
 /************************************************************************
  *									*
  *	Arbitrary limits set in the parser. See XML_PARSE_HUGE		*
@@ -1771,7 +1773,7 @@ nodePush(xmlParserCtxtPtr ctxt, xmlNodePtr value)
 	xmlFatalErrMsgInt(ctxt, XML_ERR_INTERNAL_ERROR,
 		 "Excessive depth in document: %d use XML_PARSE_HUGE option\n",
 			  xmlParserMaxDepth);
-	ctxt->instate = XML_PARSER_EOF;
+	xmlHaltParser(ctxt);
 	return(-1);
     }
     ctxt->nodeTab[ctxt->nodeNr] = value;
@@ -2073,9 +2075,16 @@ static void xmlGROW (xmlParserCtxtPtr ctxt) {
          ((ctxt->input->buf) && (ctxt->input->buf->readcallback != (xmlInputReadCallback) xmlNop)) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
-        ctxt->instate = XML_PARSER_EOF;
+        xmlHaltParser(ctxt);
+	return;
     }
     xmlParserInputGrow(ctxt->input, INPUT_CHUNK);
+    if ((ctxt->input->cur > ctxt->input->end) ||
+        (ctxt->input->cur < ctxt->input->base)) {
+        xmlHaltParser(ctxt);
+        xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "cur index out of bound");
+	return;
+    }
     if ((ctxt->input->cur != NULL) && (*ctxt->input->cur == 0) &&
         (xmlParserInputGrow(ctxt->input, INPUT_CHUNK) <= 0))
 	    xmlPopInput(ctxt);
@@ -2151,7 +2160,8 @@ xmlSkipBlankChars(xmlParserCtxtPtr ctxt) {
 	int cur;
 	do {
 	    cur = CUR;
-	    while (IS_BLANK_CH(cur)) { /* CHECKED tstblanks.xml */
+	    while ((IS_BLANK_CH(cur) && /* CHECKED tstblanks.xml */
+	           (ctxt->instate != XML_PARSER_EOF))) {
 		NEXT;
 		cur = CUR;
 		res++;
@@ -2165,7 +2175,8 @@ xmlSkipBlankChars(xmlParserCtxtPtr ctxt) {
 	     * Need to handle support of entities branching here
 	     */
 	    if (*ctxt->input->cur == '%') xmlParserHandlePEReference(ctxt);
-	} while (IS_BLANK(cur)); /* CHECKED tstblanks.xml */
+	} while ((IS_BLANK(cur)) && /* CHECKED tstblanks.xml */
+	         (ctxt->instate != XML_PARSER_EOF));
     }
     return(res);
 }
@@ -2806,6 +2817,10 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
 			                      0, 0, 0);
 		ctxt->depth--;
 
+		if ((ctxt->lastError.code == XML_ERR_ENTITY_LOOP) ||
+		    (ctxt->lastError.code == XML_ERR_INTERNAL_ERROR))
+		    goto int_error;
+
 		if (rep != NULL) {
 		    current = rep;
 		    while (*current != 0) { /* non input consuming loop */
@@ -5669,7 +5684,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt) {
 	if (RAW != '>') {
 	    xmlFatalErrMsgStr(ctxt, XML_ERR_ENTITY_NOT_FINISHED,
 	            "xmlParseEntityDecl: entity %s not terminated\n", name);
-	    xmlStopParser(ctxt);
+	    xmlHaltParser(ctxt);
 	} else {
 	    if (input != ctxt->input) {
 		xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
@@ -6781,7 +6796,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 	SKIP_BLANKS;
 	if (RAW != '[') {
 	    xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
-	    xmlStopParser(ctxt);
+	    xmlHaltParser(ctxt);
 	    return;
 	} else {
 	    if (ctxt->input->id != id) {
@@ -6843,7 +6858,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 	SKIP_BLANKS;
 	if (RAW != '[') {
 	    xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
-	    xmlStopParser(ctxt);
+	    xmlHaltParser(ctxt);
 	    return;
 	} else {
 	    if (ctxt->input->id != id) {
@@ -6900,7 +6915,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 
     } else {
 	xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID_KEYWORD, NULL);
-	xmlStopParser(ctxt);
+	xmlHaltParser(ctxt);
 	return;
     }
 
@@ -6916,7 +6931,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 				 NULL, NULL);
 	}
 	if ((ctxt-> instate != XML_PARSER_EOF) &&
-	    ((ctxt->input->cur + 3) < ctxt->input->end))
+	    ((ctxt->input->cur + 3) <= ctxt->input->end))
 	    SKIP(3);
     }
 }
@@ -6972,6 +6987,14 @@ xmlParseMarkupDecl(xmlParserCtxtPtr ctxt) {
 	    xmlParsePI(ctxt);
 	}
     }
+
+    /*
+     * detect requirement to exit there and act accordingly
+     * and avoid having instate overriden later on
+     */
+    if (ctxt->instate == XML_PARSER_EOF)
+        return;
+
     /*
      * This is only for internal subset. On external entities,
      * the replacement is done before parsing stage
@@ -7103,7 +7126,7 @@ xmlParseExternalSubset(xmlParserCtxtPtr ctxt, const xmlChar *ExternalID,
 	    /*
 	     * The XML REC instructs us to stop parsing right here
 	     */
-	    ctxt->instate = XML_PARSER_EOF;
+	    xmlHaltParser(ctxt);
 	    return;
 	}
     }
@@ -8090,7 +8113,7 @@ xmlParsePEReference(xmlParserCtxtPtr ctxt)
 		     * The XML REC instructs us to stop parsing
 		     * right here
 		     */
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    return;
 		}
 	    }
@@ -9325,7 +9348,7 @@ xmlParseStartTag2(xmlParserCtxtPtr ctxt, const xmlChar **pref,
     const xmlChar **atts = ctxt->atts;
     int maxatts = ctxt->maxatts;
     int nratts, nbatts, nbdef;
-    int i, j, nbNs, attval, oldline, oldcol;
+    int i, j, nbNs, attval, oldline, oldcol, inputNr;
     const xmlChar *base;
     unsigned long cur;
     int nsNr = ctxt->nsNr;
@@ -9344,6 +9367,7 @@ reparse:
     SHRINK;
     base = ctxt->input->base;
     cur = ctxt->input->cur - ctxt->input->base;
+    inputNr = ctxt->inputNr;
     oldline = ctxt->input->line;
     oldcol = ctxt->input->col;
     nbatts = 0;
@@ -9369,7 +9393,8 @@ reparse:
      */
     SKIP_BLANKS;
     GROW;
-    if (ctxt->input->base != base) goto base_changed;
+    if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+        goto base_changed;
 
     while (((RAW != '>') &&
 	   ((RAW != '/') || (NXT(1) != '>')) &&
@@ -9380,7 +9405,7 @@ reparse:
 
 	attname = xmlParseAttribute2(ctxt, prefix, localname,
 	                             &aprefix, &attvalue, &len, &alloc);
-	if (ctxt->input->base != base) {
+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr)) {
 	    if ((attvalue != NULL) && (alloc != 0))
 	        xmlFree(attvalue);
 	    attvalue = NULL;
@@ -9529,7 +9554,8 @@ skip_ns:
 		    break;
 		}
 		SKIP_BLANKS;
-		if (ctxt->input->base != base) goto base_changed;
+		if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+		    goto base_changed;
 		continue;
 	    }
 
@@ -9566,7 +9592,8 @@ failed:
 	GROW
         if (ctxt->instate == XML_PARSER_EOF)
             break;
-	if (ctxt->input->base != base) goto base_changed;
+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+	    goto base_changed;
 	if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
 	    break;
 	if (!IS_BLANK_CH(RAW)) {
@@ -9582,7 +9609,8 @@ failed:
 	    break;
 	}
         GROW;
-	if (ctxt->input->base != base) goto base_changed;
+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+	    goto base_changed;
     }
 
     /*
@@ -9749,6 +9777,17 @@ base_changed:
 	    if ((ctxt->attallocs[j] != 0) && (atts[i] != NULL))
 	        xmlFree((xmlChar *) atts[i]);
     }
+
+    /*
+     * We can't switch from one entity to another in the middle
+     * of a start tag
+     */
+    if (inputNr != ctxt->inputNr) {
+        xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
+		    "Start tag doesn't start and stop in the same entity\n");
+	return(NULL);
+    }
+
     ctxt->input->cur = ctxt->input->base + cur;
     ctxt->input->line = oldline;
     ctxt->input->col = oldcol;
@@ -10030,7 +10069,7 @@ xmlParseContent(xmlParserCtxtPtr ctxt) {
 	if ((cons == ctxt->input->consumed) && (test == CUR_PTR)) {
 	    xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR,
 	                "detected an error in element content\n");
-	    ctxt->instate = XML_PARSER_EOF;
+	    xmlHaltParser(ctxt);
             break;
 	}
     }
@@ -10065,7 +10104,7 @@ xmlParseElement(xmlParserCtxtPtr ctxt) {
 	xmlFatalErrMsgInt(ctxt, XML_ERR_INTERNAL_ERROR,
 		 "Excessive depth in document: %d use XML_PARSE_HUGE option\n",
 			  xmlParserMaxDepth);
-	ctxt->instate = XML_PARSER_EOF;
+	xmlHaltParser(ctxt);
 	return;
     }
 
@@ -10657,7 +10696,8 @@ xmlParseXMLDecl(xmlParserCtxtPtr ctxt) {
 	xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED, "Blank needed here\n");
     }
     xmlParseEncodingDecl(ctxt);
-    if (ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) {
+    if ((ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) ||
+         (ctxt->instate == XML_PARSER_EOF)) {
 	/*
 	 * The XML REC instructs us to stop parsing right here
 	 */
@@ -10781,6 +10821,7 @@ xmlParseDocument(xmlParserCtxtPtr ctxt) {
 
     if (CUR == 0) {
 	xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
+	return(-1);
     }
 
     /*
@@ -10798,7 +10839,8 @@ xmlParseDocument(xmlParserCtxtPtr ctxt) {
 	 * Note that we will switch encoding on the fly.
 	 */
 	xmlParseXMLDecl(ctxt);
-	if (ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) {
+	if ((ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) ||
+	    (ctxt->instate == XML_PARSER_EOF)) {
 	    /*
 	     * The XML REC instructs us to stop parsing right here
 	     */
@@ -11392,7 +11434,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 			ctxt->sax->setDocumentLocator(ctxt->userData,
 						      &xmlDefaultSAXLocator);
 		    xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 #ifdef DEBUG_PUSH
 		    xmlGenericError(xmlGenericErrorContext,
 			    "PP: entering EOF\n");
@@ -11425,7 +11467,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 			     * The XML REC instructs us to stop parsing right
 			     * here
 			     */
-			    ctxt->instate = XML_PARSER_EOF;
+			    xmlHaltParser(ctxt);
 			    return(0);
 			}
 			ctxt->standalone = ctxt->input->standalone;
@@ -11481,7 +11523,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		cur = ctxt->input->cur[0];
 	        if (cur != '<') {
 		    xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
 			ctxt->sax->endDocument(ctxt->userData);
 		    goto done;
@@ -11513,7 +11555,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		    goto done;
 		if (name == NULL) {
 		    spacePop(ctxt);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
 			ctxt->sax->endDocument(ctxt->userData);
 		    goto done;
@@ -11680,7 +11722,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		if ((cons == ctxt->input->consumed) && (test == CUR_PTR)) {
 		    xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR,
 		                "detected an error in element content\n");
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    break;
 		}
 		break;
@@ -12001,7 +12043,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		    goto done;
 		} else {
 		    xmlFatalErr(ctxt, XML_ERR_DOCUMENT_END, NULL);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 #ifdef DEBUG_PUSH
 		    xmlGenericError(xmlGenericErrorContext,
 			    "PP: entering EOF\n");
@@ -12365,7 +12407,7 @@ xmldecl_done:
 	res = xmlParserInputBufferPush(ctxt->input->buf, size, chunk);
 	if (res < 0) {
 	    ctxt->errNo = XML_PARSER_EOF;
-	    ctxt->disableSAX = 1;
+	    xmlHaltParser(ctxt);
 	    return (XML_PARSER_EOF);
 	}
         xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input, base, cur);
@@ -12419,7 +12461,7 @@ xmldecl_done:
          ((ctxt->input->cur - ctxt->input->base) > XML_MAX_LOOKUP_LIMIT)) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
-        ctxt->instate = XML_PARSER_EOF;
+        xmlHaltParser(ctxt);
     }
     if ((ctxt->errNo != XML_ERR_OK) && (ctxt->disableSAX == 1))
         return(ctxt->errNo);
@@ -12607,25 +12649,47 @@ xmlCreatePushParserCtxt(xmlSAXHandlerPtr sax, void *user_data,
 #endif /* LIBXML_PUSH_ENABLED */
 
 /**
- * xmlStopParser:
+ * xmlHaltParser:
  * @ctxt:  an XML parser context
  *
- * Blocks further parser processing
+ * Blocks further parser processing don't override error
+ * for internal use
  */
-void
-xmlStopParser(xmlParserCtxtPtr ctxt) {
+static void
+xmlHaltParser(xmlParserCtxtPtr ctxt) {
     if (ctxt == NULL)
         return;
     ctxt->instate = XML_PARSER_EOF;
-    ctxt->errNo = XML_ERR_USER_STOP;
     ctxt->disableSAX = 1;
     if (ctxt->input != NULL) {
+        /*
+	 * in case there was a specific allocation deallocate before
+	 * overriding base
+	 */
+        if (ctxt->input->free != NULL) {
+	    ctxt->input->free((xmlChar *) ctxt->input->base);
+	    ctxt->input->free = NULL;
+	}
 	ctxt->input->cur = BAD_CAST"";
 	ctxt->input->base = ctxt->input->cur;
     }
 }
 
 /**
+ * xmlStopParser:
+ * @ctxt:  an XML parser context
+ *
+ * Blocks further parser processing
+ */
+void
+xmlStopParser(xmlParserCtxtPtr ctxt) {
+    if (ctxt == NULL)
+        return;
+    xmlHaltParser(ctxt);
+    ctxt->errNo = XML_ERR_USER_STOP;
+}
+
+/**
  * xmlCreateIOParserCtxt:
  * @sax:  a SAX handler
  * @user_data:  The user data returned on SAX callbacks
diff --git a/parserInternals.c b/parserInternals.c
index df204fde..2b8646c2 100644
--- a/parserInternals.c
+++ b/parserInternals.c
@@ -937,6 +937,7 @@ xmlSwitchEncoding(xmlParserCtxtPtr ctxt, xmlCharEncoding enc)
 {
     xmlCharEncodingHandlerPtr handler;
     int len = -1;
+    int ret;
 
     if (ctxt == NULL) return(-1);
     switch (enc) {
@@ -1097,7 +1098,15 @@ xmlSwitchEncoding(xmlParserCtxtPtr ctxt, xmlCharEncoding enc)
     if (handler == NULL)
 	return(-1);
     ctxt->charset = XML_CHAR_ENCODING_UTF8;
-    return(xmlSwitchToEncodingInt(ctxt, handler, len));
+    ret = xmlSwitchToEncodingInt(ctxt, handler, len);
+    if ((ret < 0) || (ctxt->errNo == XML_I18N_CONV_FAILED)) {
+        /*
+	 * on encoding conversion errors, stop the parser
+	 */
+        xmlStopParser(ctxt);
+	ctxt->errNo = XML_I18N_CONV_FAILED;
+    }
+    return(ret);
 }
 
 /**
@@ -1450,6 +1459,8 @@ xmlNewEntityInputStream(xmlParserCtxtPtr ctxt, xmlEntityPtr entity) {
     if (entity->URI != NULL)
 	input->filename = (char *) xmlStrdup((xmlChar *) entity->URI);
     input->base = entity->content;
+    if (entity->length == 0)
+        entity->length = xmlStrlen(entity->content);
     input->cur = entity->content;
     input->length = entity->length;
     input->end = &entity->content[input->length];
diff --git a/python/setup.py b/python/setup.py
index e1ff3650..f10b9c11 100755
--- a/python/setup.py
+++ b/python/setup.py
@@ -226,7 +226,7 @@ else:
 setup (name = "libxml2-python",
        # On *nix, the version number is created from setup.py.in
        # On windows, it is set by configure.js
-       version = "2.9.2",
+       version = "2.9.3",
        description = descr,
        author = "Daniel Veillard",
        author_email = "veillard@redhat.com",
diff --git a/result/errors/754946.xml.err b/result/errors/754946.xml.err
index 423dff56..a75088b9 100644
--- a/result/errors/754946.xml.err
+++ b/result/errors/754946.xml.err
@@ -11,6 +11,9 @@ Entity: line 1: parser error : DOCTYPE improperly terminated
 Entity: line 1: 
 A<lbbbbbbbbbbbbbbbbbbb_
 ^
+./test/errors/754946.xml:1: parser error : Start tag doesn't start and stop in the same entity
+>%SYSTEM;<![
+         ^
 ./test/errors/754946.xml:1: parser error : Extra content at the end of the document
-<!DOCTYPEA[<!ENTITY %
-  ^
+>%SYSTEM;<![
+         ^
diff --git a/testapi.c b/testapi.c
index 0367ffd4..9205e643 100644
--- a/testapi.c
+++ b/testapi.c
@@ -1034,10 +1034,10 @@ static void des_xmlAttributeType(int no ATTRIBUTE_UNUSED, xmlAttributeType val A
 
 #define gen_nb_xmlBufferAllocationScheme 4
 static xmlBufferAllocationScheme gen_xmlBufferAllocationScheme(int no, int nr ATTRIBUTE_UNUSED) {
-    if (no == 1) return(XML_BUFFER_ALLOC_DOUBLEIT);
-    if (no == 2) return(XML_BUFFER_ALLOC_EXACT);
-    if (no == 3) return(XML_BUFFER_ALLOC_HYBRID);
-    if (no == 4) return(XML_BUFFER_ALLOC_IMMUTABLE);
+    if (no == 1) return(XML_BUFFER_ALLOC_BOUNDED);
+    if (no == 2) return(XML_BUFFER_ALLOC_DOUBLEIT);
+    if (no == 3) return(XML_BUFFER_ALLOC_EXACT);
+    if (no == 4) return(XML_BUFFER_ALLOC_HYBRID);
     return(0);
 }
 
diff --git a/xmlIO.c b/xmlIO.c
index e628ab09..8b13184a 100644
--- a/xmlIO.c
+++ b/xmlIO.c
@@ -1334,7 +1334,7 @@ xmlGzfileClose (void * context) {
 }
 #endif /* HAVE_ZLIB_H */
 
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 /************************************************************************
  *									*
  *		I/O for compressed file accesses			*
@@ -1451,7 +1451,7 @@ xmlXzfileClose (void * context) {
     if (ret < 0) xmlIOErr(0, "xzclose()");
     return(ret);
 }
-#endif /* HAVE_LZMA_H */
+#endif /* LIBXML_LZMA_ENABLED */
 
 #ifdef LIBXML_HTTP_ENABLED
 /************************************************************************
@@ -2328,10 +2328,10 @@ xmlRegisterDefaultInputCallbacks(void) {
     xmlRegisterInputCallbacks(xmlGzfileMatch, xmlGzfileOpen,
 	                      xmlGzfileRead, xmlGzfileClose);
 #endif /* HAVE_ZLIB_H */
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
     xmlRegisterInputCallbacks(xmlXzfileMatch, xmlXzfileOpen,
 	                      xmlXzfileRead, xmlXzfileClose);
-#endif /* HAVE_ZLIB_H */
+#endif /* LIBXML_LZMA_ENABLED */
 
 #ifdef LIBXML_HTTP_ENABLED
     xmlRegisterInputCallbacks(xmlIOHTTPMatch, xmlIOHTTPOpen,
@@ -2683,7 +2683,7 @@ __xmlParserInputBufferCreateFilename(const char *URI, xmlCharEncoding enc) {
 #endif
 	}
 #endif
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 	if ((xmlInputCallbackTable[i].opencallback == xmlXzfileOpen) &&
 		(strcmp(URI, "-") != 0)) {
             ret->compressed = __libxml2_xzcompressed(context);
@@ -3350,7 +3350,7 @@ xmlParserInputBufferGrow(xmlParserInputBufferPtr in, int len) {
      * try to establish compressed status of input if not done already
      */
     if (in->compressed == -1) {
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 	if (in->readcallback == xmlXzfileRead)
             in->compressed = __libxml2_xzcompressed(in->context);
 #endif
diff --git a/xmlschemas.c b/xmlschemas.c
index d47512f0..fe533e6f 100644
--- a/xmlschemas.c
+++ b/xmlschemas.c
@@ -25546,7 +25546,7 @@ xmlSchemaVAttributesComplex(xmlSchemaValidCtxtPtr vctxt)
 		    if (xmlNewProp(defAttrOwnerElem,
 			iattr->localName, value) == NULL) {
 			VERROR_INT("xmlSchemaVAttributesComplex",
-			    "callling xmlNewProp()");
+			    "calling xmlNewProp()");
 			if (normValue != NULL)
 			    xmlFree(normValue);
 			goto internal_error;
diff --git a/xzlib.c b/xzlib.c
index 0dcb9f48..782957f6 100644
--- a/xzlib.c
+++ b/xzlib.c
@@ -8,7 +8,7 @@
  */
 #define IN_LIBXML
 #include "libxml.h"
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 
 #include <string.h>
 #ifdef HAVE_ERRNO_H
@@ -34,7 +34,9 @@
 #ifdef HAVE_ZLIB_H
 #include <zlib.h>
 #endif
+#ifdef HAVE_LZMA_H
 #include <lzma.h>
+#endif
 
 #include "xzlib.h"
 #include <libxml/xmlmemory.h>
@@ -581,6 +583,10 @@ xz_decomp(xz_statep state)
             xz_error(state, LZMA_DATA_ERROR, "compressed data error");
             return -1;
         }
+        if (ret == LZMA_PROG_ERROR) {
+            xz_error(state, LZMA_PROG_ERROR, "compression error");
+            return -1;
+        }
     } while (strm->avail_out && ret != LZMA_STREAM_END);
 
     /* update available output and crc check value */
@@ -795,4 +801,4 @@ __libxml2_xzclose(xzFile file)
     xmlFree(state);
     return ret ? ret : LZMA_OK;
 }
-#endif /* HAVE_LZMA_H */
+#endif /* LIBXML_LZMA_ENABLED */