Merge remote-tracking branch \'libxml2/master\' into mymerge

am: 6be364848c

* commit '6be364848cb20f3345abc12fedff35cdd464a600':
  Release of libxml2-2.9.3
  CVE-2015-8242 Buffer overead with HTML parser in push mode
  CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
  Bug on creating new stream from entity
  Fix some loop issues embedding NEXT
  Detect incoherency on GROW
  Do not print error context when there is none
  Reuse xmlHaltParser() where it makes sense
  Add xmlHaltParser() to stop the parser
  CVE-2015-5312 Another entity expansion issue
  CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
  xmlStopParser reset errNo
  Avoid processing entities after encoding conversion failures
  Avoid extra processing of MarkupDecl when EOF
  Reenable xz support by default
  CVE-2015-8035 Fix XZ compression support loop
  Fix parsing short unclosed comment uninitialized access
  Fix an error in previous Conditional section patch
  Correct spelling of "calling"

22 files changed, 492 insertions, 152 deletions

diff --git a/HTMLparser.c b/HTMLparser.c
index 19c10c3f..b7291972 100644
--- a/HTMLparser.c
+++ b/HTMLparser.c
@@ -3264,12 +3264,17 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
 	ctxt->instate = state;
 	return;
     }
+    len = 0;
+    buf[len] = 0;
     q = CUR_CHAR(ql);
+    if (!IS_CHAR(q))
+        goto unfinished;
     NEXTL(ql);
     r = CUR_CHAR(rl);
+    if (!IS_CHAR(r))
+        goto unfinished;
     NEXTL(rl);
     cur = CUR_CHAR(l);
-    len = 0;
     while (IS_CHAR(cur) &&
            ((cur != '>') ||
 	    (r != '-') || (q != '-'))) {
@@ -3300,18 +3305,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
 	}
     }
     buf[len] = 0;
-    if (!IS_CHAR(cur)) {
-	htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
-	             "Comment not terminated \n<!--%.50s\n", buf, NULL);
-	xmlFree(buf);
-    } else {
+    if (IS_CHAR(cur)) {
         NEXT;
 	if ((ctxt->sax != NULL) && (ctxt->sax->comment != NULL) &&
 	    (!ctxt->disableSAX))
 	    ctxt->sax->comment(ctxt->userData, buf);
 	xmlFree(buf);
+	ctxt->instate = state;
+	return;
     }
-    ctxt->instate = state;
+
+unfinished:
+    htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
+		 "Comment not terminated \n<!--%.50s\n", buf, NULL);
+    xmlFree(buf);
 }
 
 /**
@@ -5728,17 +5735,17 @@ htmlParseTryOrFinish(htmlParserCtxtPtr ctxt, int terminate) {
 				if (ctxt->keepBlanks) {
 				    if (ctxt->sax->characters != NULL)
 					ctxt->sax->characters(
-						ctxt->userData, &cur, 1);
+						ctxt->userData, &in->cur[0], 1);
 				} else {
 				    if (ctxt->sax->ignorableWhitespace != NULL)
 					ctxt->sax->ignorableWhitespace(
-						ctxt->userData, &cur, 1);
+						ctxt->userData, &in->cur[0], 1);
 				}
 			    } else {
 				htmlCheckParagraph(ctxt);
 				if (ctxt->sax->characters != NULL)
 				    ctxt->sax->characters(
-					    ctxt->userData, &cur, 1);
+					    ctxt->userData, &in->cur[0], 1);
 			    }
 			}
 			ctxt->token = 0;
diff --git a/configure.ac b/configure.ac
index 14ac0a8a..02602814 100644
--- a/configure.ac
+++ b/configure.ac
@@ -8,7 +8,7 @@ AC_CANONICAL_HOST
 
 LIBXML_MAJOR_VERSION=2
 LIBXML_MINOR_VERSION=9
-LIBXML_MICRO_VERSION=2
+LIBXML_MICRO_VERSION=3
 LIBXML_MICRO_VERSION_SUFFIX=
 LIBXML_VERSION=$LIBXML_MAJOR_VERSION.$LIBXML_MINOR_VERSION.$LIBXML_MICRO_VERSION$LIBXML_MICRO_VERSION_SUFFIX
 LIBXML_VERSION_INFO=`expr $LIBXML_MAJOR_VERSION + $LIBXML_MINOR_VERSION`:$LIBXML_MICRO_VERSION:$LIBXML_MINOR_VERSION
@@ -445,6 +445,9 @@ else
                 fi],
                 [have_liblzma=no])
 	     LDFLAGS="${SAVE_LDFLAGS}"])
+    else
+	# we still need to check for lzma,h header
+	AC_CHECK_HEADERS([lzma.h])
     fi
 
     # Found the library via either method?
diff --git a/dict.c b/dict.c
index 5f71d55d..8c8f9314 100644
--- a/dict.c
+++ b/dict.c
@@ -486,7 +486,10 @@ xmlDictComputeFastQKey(const xmlChar *prefix, int plen,
 	value += 30 * (*prefix);
 
     if (len > 10) {
-        value += name[len - (plen + 1 + 1)];
+        int offset = len - (plen + 1 + 1);
+	if (offset < 0)
+	    offset = len - (10 + 1);
+	value += name[offset];
         len = 10;
 	if (plen > 10)
 	    plen = 10;
diff --git a/doc/APIfiles.html b/doc/APIfiles.html
index 65e004be..2252a6b0 100644
--- a/doc/APIfiles.html
+++ b/doc/APIfiles.html
@@ -1309,6 +1309,7 @@ A:link, A:visited, A:active { text-decoration: underline }
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NONE">XML_ATTRIBUTE_NONE</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NOTATION">XML_ATTRIBUTE_NOTATION</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_REQUIRED">XML_ATTRIBUTE_REQUIRED</a><br />
+<a href="html/libxml-tree.html#XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_DOUBLEIT">XML_BUFFER_ALLOC_DOUBLEIT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_EXACT">XML_BUFFER_ALLOC_EXACT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a><br />
diff --git a/doc/APIsymbols.html b/doc/APIsymbols.html
index c2b82e7d..cdde358d 100644
--- a/doc/APIsymbols.html
+++ b/doc/APIsymbols.html
@@ -154,6 +154,7 @@ A:link, A:visited, A:active { text-decoration: underline }
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NONE">XML_ATTRIBUTE_NONE</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NOTATION">XML_ATTRIBUTE_NOTATION</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_REQUIRED">XML_ATTRIBUTE_REQUIRED</a><br />
+<a href="html/libxml-tree.html#XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_DOUBLEIT">XML_BUFFER_ALLOC_DOUBLEIT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_EXACT">XML_BUFFER_ALLOC_EXACT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a><br />
diff --git a/doc/devhelp/libxml2-tree.html b/doc/devhelp/libxml2-tree.html
index 3cc28c71..5f8d1f28 100644
--- a/doc/devhelp/libxml2-tree.html
+++ b/doc/devhelp/libxml2-tree.html
@@ -409,7 +409,8 @@ The content of this structure is not made public by the API.
     <a name="XML_BUFFER_ALLOC_EXACT">XML_BUFFER_ALLOC_EXACT</a> = 2 /* grow only to the minimal size */
     <a name="XML_BUFFER_ALLOC_IMMUTABLE">XML_BUFFER_ALLOC_IMMUTABLE</a> = 3 /* immutable buffer */
     <a name="XML_BUFFER_ALLOC_IO">XML_BUFFER_ALLOC_IO</a> = 4 /* special allocation scheme used for I/O */
-    <a name="XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a> = 5 /*  exact up to a threshold, and doubleit thereafter */
+    <a name="XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a> = 5 /* exact up to a threshold, and doubleit thereafter */
+    <a name="XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a> = 6 /*  limit the upper size of the buffer */
 };
 </pre><p/>
 </div>
diff --git a/doc/devhelp/libxml2.devhelp b/doc/devhelp/libxml2.devhelp
index 282546ab..fbd3ad4a 100644
--- a/doc/devhelp/libxml2.devhelp
+++ b/doc/devhelp/libxml2.devhelp
@@ -351,6 +351,7 @@
     <function name="XML_ATTRIBUTE_NONE" link="libxml2-tree.html#XML_ATTRIBUTE_NONE"/>
     <function name="XML_ATTRIBUTE_NOTATION" link="libxml2-tree.html#XML_ATTRIBUTE_NOTATION"/>
     <function name="XML_ATTRIBUTE_REQUIRED" link="libxml2-tree.html#XML_ATTRIBUTE_REQUIRED"/>
+    <function name="XML_BUFFER_ALLOC_BOUNDED" link="libxml2-tree.html#XML_BUFFER_ALLOC_BOUNDED"/>
     <function name="XML_BUFFER_ALLOC_DOUBLEIT" link="libxml2-tree.html#XML_BUFFER_ALLOC_DOUBLEIT"/>
     <function name="XML_BUFFER_ALLOC_EXACT" link="libxml2-tree.html#XML_BUFFER_ALLOC_EXACT"/>
     <function name="XML_BUFFER_ALLOC_HYBRID" link="libxml2-tree.html#XML_BUFFER_ALLOC_HYBRID"/>
diff --git a/doc/html/libxml-tree.html b/doc/html/libxml-tree.html
index e2081cc5..d1d005f6 100644
--- a/doc/html/libxml-tree.html
+++ b/doc/html/libxml-tree.html
@@ -305,6 +305,7 @@ The content of this structure is not made public by the API.
     <a name="XML_BUFFER_ALLOC_IMMUTABLE" id="XML_BUFFER_ALLOC_IMMUTABLE">XML_BUFFER_ALLOC_IMMUTABLE</a> = 3 : immutable buffer
     <a name="XML_BUFFER_ALLOC_IO" id="XML_BUFFER_ALLOC_IO">XML_BUFFER_ALLOC_IO</a> = 4 : special allocation scheme used for I/O
     <a name="XML_BUFFER_ALLOC_HYBRID" id="XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a> = 5 : exact up to a threshold, and doubleit thereafter
+    <a name="XML_BUFFER_ALLOC_BOUNDED" id="XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a> = 6 : limit the upper size of the buffer
 }
 </pre><h3><a name="xmlDOMWrapCtxt" id="xmlDOMWrapCtxt">Structure xmlDOMWrapCtxt</a></h3><pre class="programlisting">Structure xmlDOMWrapCtxt<br />struct _xmlDOMWrapCtxt {
     void *	_private	: * The type of this context, just in case
diff --git a/doc/libxml2-api.xml b/doc/libxml2-api.xml
index f83d14f0..5573f0c5 100644
--- a/doc/libxml2-api.xml
+++ b/doc/libxml2-api.xml
@@ -1441,12 +1441,12 @@
      <exports symbol='XML_DOC_DTDVALID' type='enum'/>
      <exports symbol='XML_ELEMENT_TYPE_ANY' type='enum'/>
      <exports symbol='XML_DOC_NSVALID' type='enum'/>
-     <exports symbol='XML_ELEMENT_CONTENT_ONCE' type='enum'/>
+     <exports symbol='XML_BUFFER_ALLOC_BOUNDED' type='enum'/>
      <exports symbol='XML_ELEMENT_CONTENT_PCDATA' type='enum'/>
      <exports symbol='XML_ATTRIBUTE_FIXED' type='enum'/>
      <exports symbol='XML_DOCUMENT_TYPE_NODE' type='enum'/>
      <exports symbol='XML_DOC_HTML' type='enum'/>
-     <exports symbol='XML_ELEMENT_CONTENT_OPT' type='enum'/>
+     <exports symbol='XML_ELEMENT_CONTENT_ONCE' type='enum'/>
      <exports symbol='XML_NAMESPACE_DECL' type='enum'/>
      <exports symbol='XML_ATTRIBUTE_NOTATION' type='enum'/>
      <exports symbol='XML_ELEMENT_TYPE_MIXED' type='enum'/>
@@ -1459,6 +1459,7 @@
      <exports symbol='XML_NOTATION_NODE' type='enum'/>
      <exports symbol='XML_ELEMENT_CONTENT_SEQ' type='enum'/>
      <exports symbol='XML_ELEMENT_TYPE_EMPTY' type='enum'/>
+     <exports symbol='XML_ELEMENT_CONTENT_OPT' type='enum'/>
      <exports symbol='XML_ATTRIBUTE_ENUMERATION' type='enum'/>
      <exports symbol='XML_DOC_OLD10' type='enum'/>
      <exports symbol='XML_HTML_DOCUMENT_NODE' type='enum'/>
@@ -4702,9 +4703,10 @@
     <enum name='XML_ATTRIBUTE_NONE' file='tree' value='1' type='xmlAttributeDefault'/>
     <enum name='XML_ATTRIBUTE_NOTATION' file='tree' value='10' type='xmlAttributeType'/>
     <enum name='XML_ATTRIBUTE_REQUIRED' file='tree' value='2' type='xmlAttributeDefault'/>
+    <enum name='XML_BUFFER_ALLOC_BOUNDED' file='tree' value='6' type='xmlBufferAllocationScheme' info=' limit the upper size of the buffer'/>
     <enum name='XML_BUFFER_ALLOC_DOUBLEIT' file='tree' value='1' type='xmlBufferAllocationScheme' info='double each time one need to grow'/>
     <enum name='XML_BUFFER_ALLOC_EXACT' file='tree' value='2' type='xmlBufferAllocationScheme' info='grow only to the minimal size'/>
-    <enum name='XML_BUFFER_ALLOC_HYBRID' file='tree' value='5' type='xmlBufferAllocationScheme' info=' exact up to a threshold, and doubleit thereafter'/>
+    <enum name='XML_BUFFER_ALLOC_HYBRID' file='tree' value='5' type='xmlBufferAllocationScheme' info='exact up to a threshold, and doubleit thereafter'/>
     <enum name='XML_BUFFER_ALLOC_IMMUTABLE' file='tree' value='3' type='xmlBufferAllocationScheme' info='immutable buffer'/>
     <enum name='XML_BUFFER_ALLOC_IO' file='tree' value='4' type='xmlBufferAllocationScheme' info='special allocation scheme used for I/O'/>
     <enum name='XML_BUF_OVERFLOW' file='xmlerror' value='7000' type='xmlParserErrors'/>
diff --git a/doc/libxml2-refs.xml b/doc/libxml2-refs.xml
index f42fab4e..71586099 100644
--- a/doc/libxml2-refs.xml
+++ b/doc/libxml2-refs.xml
@@ -148,6 +148,7 @@
     <reference name='XML_ATTRIBUTE_NONE' href='html/libxml-tree.html#XML_ATTRIBUTE_NONE'/>
     <reference name='XML_ATTRIBUTE_NOTATION' href='html/libxml-tree.html#XML_ATTRIBUTE_NOTATION'/>
     <reference name='XML_ATTRIBUTE_REQUIRED' href='html/libxml-tree.html#XML_ATTRIBUTE_REQUIRED'/>
+    <reference name='XML_BUFFER_ALLOC_BOUNDED' href='html/libxml-tree.html#XML_BUFFER_ALLOC_BOUNDED'/>
     <reference name='XML_BUFFER_ALLOC_DOUBLEIT' href='html/libxml-tree.html#XML_BUFFER_ALLOC_DOUBLEIT'/>
     <reference name='XML_BUFFER_ALLOC_EXACT' href='html/libxml-tree.html#XML_BUFFER_ALLOC_EXACT'/>
     <reference name='XML_BUFFER_ALLOC_HYBRID' href='html/libxml-tree.html#XML_BUFFER_ALLOC_HYBRID'/>
@@ -3749,6 +3750,7 @@
       <ref name='XML_ATTRIBUTE_NONE'/>
       <ref name='XML_ATTRIBUTE_NOTATION'/>
       <ref name='XML_ATTRIBUTE_REQUIRED'/>
+      <ref name='XML_BUFFER_ALLOC_BOUNDED'/>
       <ref name='XML_BUFFER_ALLOC_DOUBLEIT'/>
       <ref name='XML_BUFFER_ALLOC_EXACT'/>
       <ref name='XML_BUFFER_ALLOC_HYBRID'/>
@@ -12100,6 +12102,7 @@
       <ref name='XML_ATTRIBUTE_NONE'/>
       <ref name='XML_ATTRIBUTE_NOTATION'/>
       <ref name='XML_ATTRIBUTE_REQUIRED'/>
+      <ref name='XML_BUFFER_ALLOC_BOUNDED'/>
       <ref name='XML_BUFFER_ALLOC_DOUBLEIT'/>
       <ref name='XML_BUFFER_ALLOC_EXACT'/>
       <ref name='XML_BUFFER_ALLOC_HYBRID'/>
diff --git a/doc/libxml2.xsa b/doc/libxml2.xsa
index da61d57d..0825d53f 100644
--- a/doc/libxml2.xsa
+++ b/doc/libxml2.xsa
@@ -8,95 +8,182 @@
   </vendor>
   <product id="libxml2">
     <name>libxml2</name>
-    <version>2.9.1</version>
-    <last-release> Apr 19 2013</last-release>
+    <version>2.9.2</version>
+    <last-release> Oct 16 2014</last-release>
     <info-url>http://xmlsoft.org/</info-url>
-    <changes>   -  Features:
-    Support for Python3 (Daniel Veillard),
-    Add xmlXPathSetContextNode and xmlXPathNodeEval (Alex Bligh)
+    <changes>   - Security:
+  Fix for CVE-2014-3660 billion laugh variant (Daniel Veillard),
+  CVE-2014-0191 Do not fetch external parameter entities (Daniel Veillard)
   
-   -  Documentation:
-    Add documentation for xmllint --xpath (Daniel Veillard),
-    Fix the URL of the SAX documentation from James (Daniel Veillard),
-    Fix spelling of "length". (Michael Wood)
+   - Bug Fixes:
+  fix memory leak xml header encoding field with XML_PARSE_IGNORE_ENC (Bart De Schuymer),
+  xmlmemory: handle realloc properly (Yegor Yefremov),
+  Python generator bug raised by the const change (Daniel Veillard),
+  Windows Critical sections not released correctly (Daniel Veillard),
+  Parser error on repeated recursive entity expansion containing &amp;lt; (Daniel Veillard),
+  xpointer : fixing Null Pointers (Gaurav Gupta),
+  Remove Unnecessary Null check in xpointer.c (Gaurav Gupta),
+  parser bug on misformed namespace attributes (Dennis Filder),
+  Pointer dereferenced before null check (Daniel Veillard),
+  Leak of struct addrinfo in xmlNanoFTPConnect() (Gaurav Gupta),
+  Possible overflow in HTMLParser.c (Daniel Veillard),
+  python/tests/sync.py assumes Python dictionaries are ordered (John Beck),
+  Fix Enum check and missing break (Gaurav Gupta),
+  xmlIO: Handle error returns from dup() (Philip Withnall),
+  Fix a problem properly saving URIs (Daniel Veillard),
+  wrong error column in structured error when parsing attribute values (Juergen Keil),
+  wrong error column in structured error when skipping whitespace in xml decl (Juergen Keil),
+  no error column in structured error handler for xml schema validation errors (Juergen Keil),
+  Couple of Missing Null checks (Gaurav Gupta),
+  Add couple of missing Null checks (Daniel Veillard),
+  xmlschemastypes: Fix potential array overflow (Philip Withnall),
+  runtest: Fix a memory leak on parse failure (Philip Withnall),
+  xmlIO: Fix an FD leak on gzdopen() failure (Philip Withnall),
+  xmlcatalog: Fix a memory leak on quit (Philip Withnall),
+  HTMLparser: Correctly initialise a stack allocated structure (Philip Withnall),
+  Check for tmon in _xmlSchemaDateAdd() is incorrect (David Kilzer),
+  Avoid Possible Null Pointer in trio.c (Gaurav Gupta),
+  Fix processing in SAX2 in case of an allocation failure (Daniel Veillard),
+  XML Shell command "cd" does not handle "/" at end of path (Daniel Veillard),
+  Fix various Missing Null checks (Gaurav Gupta),
+  Fix a potential NULL dereference (Daniel Veillard),
+  Add a couple of misisng check in xmlRelaxNGCleanupTree (Gaurav Gupta),
+  Add a missing argument check (Gaurav Gupta),
+  Adding a check in case of allocation error (Gaurav Gupta),
+  xmlSaveUri() incorrectly recomposes URIs with rootless paths (Dennis Filder),
+  Adding some missing NULL checks (Gaurav),
+  Fixes for xmlInitParserCtxt (Daniel Veillard),
+  Fix regressions introduced by CVE-2014-0191 patch (Daniel Veillard),
+  erroneously ignores a validation error if no error callback set (Daniel Veillard),
+  xmllint was not parsing the --c14n11 flag (Sérgio Batista),
+  Avoid Possible null pointer dereference in memory debug mode (Gaurav),
+  Avoid Double Null Check (Gaurav),
+  Restore context size and position after XPATH_OP_ARG (Nick Wellnhofer),
+  Fix xmlParseInNodeContext() if node is not element (Daniel Veillard),
+  Avoid a possible NULL pointer dereference (Gaurav),
+  Fix xmlTextWriterWriteElement when a null content is given (Daniel Veillard),
+  Fix an typo 'onrest' in htmlScriptAttributes (Daniel Veillard),
+  fixing a ptotential uninitialized access (Daniel Veillard),
+  Fix an fd leak in an error case (Daniel Veillard),
+  Missing initialization for the catalog module (Daniel Veillard),
+  Handling of XPath function arguments in error case (Nick Wellnhofer),
+  Fix a couple of missing NULL checks (Gaurav),
+  Avoid a possibility of dangling encoding handler (Gaurav),
+  Fix HTML push parser to accept HTML_PARSE_NODEFDTD (Arnold Hendriks),
+  Fix a bug loading some compressed files (Mike Alexander),
+  Fix XPath node comparison bug (Gaurav),
+  Type mismatch in xmlschemas.c (Gaurav),
+  Type mismatch in xmlschemastypes.c (Gaurav),
+  Avoid a deadcode in catalog.c (Daniel Veillard),
+  run close socket on Solaris, same as we do on other platforms (Denis Pauk),
+  Fix pointer dereferenced before null check (Gaurav),
+  Fix a potential NULL dereference in tree code (Daniel Veillard),
+  Fix potential NULL pointer dereferences in regexp code (Gaurav),
+  xmllint --pretty crashed without following numeric argument (Tim Galeckas),
+  Fix XPath expressions of the form '@ns:*' (Nick Wellnhofer),
+  Fix XPath '//' optimization with predicates (Nick Wellnhofer),
+  Clear up a potential NULL dereference (Daniel Veillard),
+  Fix a possible NULL dereference (Gaurav),
+  Avoid crash if allocation fails (Daniel Veillard),
+  Remove occasional leading space in XPath number formatting (Daniel Veillard),
+  Fix handling of mmap errors (Daniel Veillard),
+  Catch malloc error and exit accordingly (Daniel Veillard),
+  missing else in xlink.c (Ami Fischman),
+  Fix a parsing bug on non-ascii element and CR/LF usage (Daniel Veillard),
+  Fix a regression in xmlGetDocCompressMode() (Daniel Veillard),
+  properly quote the namespace uris written out during c14n (Aleksey Sanin),
+  Remove premature XInclude check on URI being relative (Alexey Neyman),
+  Fix missing break on last() function for attributes (dcb),
+  Do not URI escape in server side includes (Romain Bondue),
+  Fix an error in xmlCleanupParser (Alexander Pastukhov)
   
-   -  Portability:
-    Fix python bindings with versions older than 2.7 (Daniel Veillard),
-    rebuild docs:Makefile.am (Roumen Petrov),
-    elfgcchack.h after rebuild in doc (Roumen Petrov),
-    elfgcchack for buf module (Roumen Petrov),
-    Fix a uneeded and wrong extra link parameter (Daniel Veillard),
-    Few cleanup patches for Windows (Denis Pauk),
-    Fix rpmbuild --nocheck (Mark Salter),
-    Fix for win32/configure.js and WITH_THREAD_ALLOC (Daniel Richard),
-    Fix Broken multi-arch support in xml2-config (Daniel Veillard),
-    Fix a portability issue for GCC &lt; 3.4.0 (Daniel Veillard),
-    Windows build fixes (Daniel Richard),
-    Fix a thread portability problem (Friedrich Haubensak),
-    Downgrade autoconf requirement to 2.63 (Daniel Veillard)
+   - Documentation:
+  typo in error messages "colon are forbidden from..." (Daniel Veillard),
+  Fix a link to James SAX documentation old page (Daniel Veillard),
+  Fix typos in relaxng.c (Jan Pokorný),
+  Fix a doc typo (Daniel Veillard),
+  Fix typos in {tree,xpath}.c (errror) (Jan Pokorný),
+  Add limitations about encoding conversion (Daniel Veillard),
+  Fix typos in xmlschemas{,types}.c (Jan Pokorný),
+  Fix incorrect spelling entites-&gt;entities (Jan Pokorný),
+  Forgot to document 2.9.1 release, regenerate docs (Daniel Veillard)
   
-   -  Bug Fixes:
-    Fix a linking error for python bindings (Daniel Veillard),
-    Fix a couple of return without value (Jüri Aedla),
-    Improve the hashing functions (Daniel Franke),
-    Improve handling of xmlStopParser() (Daniel Veillard),
-    Remove risk of lockup in dictionary initialization (Daniel Veillard),
-    Activate detection of encoding in external subset (Daniel Veillard),
-    Fix an output buffer flushing conversion bug (Mikhail Titov),
-    Fix an old bug in xmlSchemaValidateOneElement (Csaba László),
-    Fix configure cannot remove messages (Gilles Espinasse),
-    fix schema validation in combination with xsi:nil (Daniel Veillard),
-    xmlCtxtReadFile doesn't work with literal IPv6 URLs (Steve Wolf),
-    Fix a few problems with setEntityLoader (Alexey Neyman),
-    Detect excessive entities expansion upon replacement (Daniel Veillard),
-    Fix the flushing out of raw buffers on encoding conversions (Daniel,
-Veillard),
-    Fix some buffer conversion issues (Daniel Veillard),
-    When calling xmlNodeDump make sure we grow the buffer quickly (Daniel,
-Veillard),
-    Fix an error in the progressive DTD parsing code (Dan Winship),
-    xmllint should not load DTD by default when using the reader (Daniel,
-Veillard),
-    Try IBM-037 when looking for EBCDIC handlers (Petr Sumbera),
-    Fix potential out of bound access (Daniel Veillard),
-    Fix large parse of file from memory (Daniel Veillard),
-    Fix a bug in the nsclean option of the parser (Daniel Veillard),
-    Fix a regression in 2.9.0 breaking validation while streaming (Daniel,
-Veillard),
-    Remove potential calls to exit() (Daniel Veillard)
+   - Portability:
+  AC_CONFIG_FILES and executable bit (Roumen Petrov),
+  remove HAVE_CONFIG_H dependency in testlimits.c (Roumen Petrov),
+  fix some tabs mixing incompatible with python3 (Roumen Petrov),
+  Visual Studio 14 CTP defines snprintf() (Francis Dupont),
+  OS400: do not try to copy unexisting doc files (Patrick Monnerat),
+  OS400: use either configure.ac or configure.in. (Patrick Monnerat),
+  os400: make-src.sh: create physical file with target CCSID (Patrick Monnerat),
+  OS400: Add some more C macros equivalent procedures. (Patrick Monnerat),
+  OS400: use C macros to implement equivalent RPG support procedures. (Patrick Monnerat),
+  OS400: implement XPath macros as procedures for ILE/RPG support. (Patrick Monnerat),
+  OS400: include in distribution tarball. (Patrick Monnerat),
+  OS400: Add README: compilation directives and OS/400 specific stuff. (Patrick Monnerat),
+  OS400: Add compilation scripts. (Patrick Monnerat),
+  OS400: ILE RPG language header files. (Patrick Monnerat),
+  OS400: implement some macros as functions for ILE/RPG language support (that as no macros). (Patrick Monnerat),
+  OS400: UTF8&lt;--&gt;EBCDIC wrappers for system and external library calls (Patrick Monnerat),
+  OS400: Easy character transcoding support (Patrick Monnerat),
+  OS400: iconv functions compatibility wrappers and table builder. (Patrick Monnerat),
+  OS400: create architecture directory. Implement dlfcn emulation. (Patrick Monnerat),
+  Fix building when configuring without xpath and xptr (Daniel Veillard),
+  configure: Add --with-python-install-dir (Jonas Eriksson),
+  Fix compilation with minimum and xinclude. (Nicolas Le Cam),
+  Compile out use of xmlValidateNCName() when not available. (Nicolas Le Cam),
+  Fix compilation with minimum and schematron. (Nicolas Le Cam),
+  Legacy needs xmlSAX2StartElement() and xmlSAX2EndElement(). (Nicolas Le Cam),
+  Don't use xmlValidateName() when not available. (Nicolas Le Cam),
+  Fix a portability issue on Windows (Longstreth Jon),
+  Various portability patches for OpenVMS (Jacob (Jouk) Jansen),
+  Use specific macros for portability to OS/400 (Patrick Monnerat),
+  Add macros needed for OS/400 portability (Patrick Monnerat),
+  Portability patch for fopen on OS/400 (Patrick Monnerat),
+  Portability fixes for OS/400 (Patrick Monnerat),
+  Improve va_list portability (Patrick Monnerat),
+  Portability fix (Patrick Monnerat),
+  Portability fix (Patrick Monnerat),
+  Generic portability fix (Patrick Monnerat),
+  Shortening lines in headers (Patrick Monnerat),
+  build: Use pkg-config to find liblzma in preference to AC_CHECK_LIB (Philip Withnall),
+  build: Add @LZMA_LIBS@ to libxml’s pkg-config files (Philip Withnall),
+  fix some tabs mixing incompatible with python3 (Daniel Veillard),
+  add additional defines checks for support "./configure --with-minimum" (Denis Pauk),
+  Another round of fixes for older versions of Python (Arfrever Frehtes Taifersar Arahesis),
+  python: fix drv_libxml2.py for python3 compatibility (Alexandre Rostovtsev),
+  python: Fix compiler warnings when building python3 bindings (Armin K),
+  Fix for compilation with python 2.6.8 (Petr Sumbera)
   
-   -  Improvements:
-    Regenerated API, and testapi, rebuild documentation (Daniel Veillard),
-    Fix tree iterators broken by 2to3 script (Daniel Veillard),
-    update all tests for Python3 and Python2 (Daniel Veillard),
-    A few more fixes for python 3 affecting libxml2.py (Daniel Veillard),
-    Fix compilation on Python3 (Daniel Veillard),
-    Converting apibuild.py to python3 (Daniel Veillard),
-    First pass at starting porting to python3 (Daniel Veillard),
-    updated configure.in for python3 (Daniel Veillard),
-    Add support for xpathRegisterVariable in Python (Shaun McCance),
-    Added a regression tests from bug 694228 data (Daniel Veillard),
-    Cache presence of '&lt;' in entities content (Daniel Veillard),
-    Avoid extra processing on entities (Daniel Veillard),
-    Python binding for xmlRegisterInputCallback (Alexey Neyman),
-    Python bindings: DOM casts everything to xmlNode (Alexey Neyman),
-    Define LIBXML_THREAD_ALLOC_ENABLED via xmlversion.h (Tim Starling),
-    Adding streaming validation to runtest checks (Daniel Veillard),
-    Add a --pushsmall option to xmllint (Daniel Veillard)
+   - Improvements:
+  win32/libxml2.def.src after rebuild in doc (Roumen Petrov),
+  elfgcchack.h: more legacy needs xmlSAX2StartElement() and xmlSAX2EndElement() (Roumen Petrov),
+  elfgcchack.h: add xmlXPathNodeEval and xmlXPathSetContextNode (Roumen Petrov),
+  Provide cmake module (Samuel Martin),
+  Fix a couple of issues raised by make dist (Daniel Veillard),
+  Fix and add const qualifiers (Kurt Roeckx),
+  Preparing for upcoming release of 2.9.2 (Daniel Veillard),
+  Fix zlib and lzma libraries check via command line (Dmitriy),
+  wrong error column in structured error when parsing end tag (Juergen Keil),
+  doc/news.html: small update to avoid line join while generating NEWS. (Patrick Monnerat),
+  Add methods for python3 iterator (Ron Angeles),
+  Support element node traversal in document fragments. (Kyle VanderBeek),
+  xmlNodeSetName: Allow setting the name to a substring of the currently set name (Tristan Van Berkom),
+  Added macros for argument casts (Eric Zurcher),
+  adding init calls to xml and html Read parsing entry points (Daniel Veillard),
+  Get rid of 'REPLACEMENT CHARACTER' Unicode chars in xmlschemas.c (Jan Pokorný),
+  Implement choice for name classes on attributes (Shaun McCance),
+  Two small namespace tweaks (Daniel Veillard),
+  xmllint --memory should fail on empty files (Daniel Veillard),
+  Cast encoding name to char pointer to match arg type (Nikolay Sivov)
   
-   -  Cleanups:
-    Switched comment in file to UTF-8 encoding (Daniel Veillard),
-    Extend gitignore (Daniel Veillard),
-    Silent the new python test on input (Alexey Neyman),
-    Cleanup of a duplicate test (Daniel Veillard),
-    Cleanup on duplicate test expressions (Daniel Veillard),
-    Fix compiler warning after 153cf15905cf4ec080612ada6703757d10caba1e (Patrick,
-Gansterer),
-    Spec cleanups and a fix for multiarch support (Daniel Veillard),
-    Silence a clang warning (Daniel Veillard),
-    Cleanup the Copyright to be pure MIT Licence wording (Daniel Veillard),
-    rand_seed should be static in dict.c (Wouter Van Rooy),
-    Fix typos in parser comments (Jan Pokorný)
+   - Cleanups:
+  Removal of old configure.in (Daniel Veillard),
+  Unreachable code in tree.c (Gaurav Gupta),
+  Remove a couple of dead conditions (Gaurav Gupta),
+  Avoid some dead code and cleanup in relaxng.c (Gaurav),
+  Drop not needed checks (Denis Pauk),
+  Fix a wrong test (Daniel Veillard)
   
 
 </changes>
diff --git a/doc/news.html b/doc/news.html
index 5c03ba32..e76ef558 100644
--- a/doc/news.html
+++ b/doc/news.html
@@ -8,7 +8,78 @@ H2 {font-family: Verdana,Arial,Helvetica}
 H3 {font-family: Verdana,Arial,Helvetica}
 A:link, A:visited, A:active { text-decoration: underline }
 </style><title>Releases</title></head><body bgcolor="#8b7765" text="#000000" link="#a06060" vlink="#000000"><table border="0" width="100%" cellpadding="5" cellspacing="0" align="center"><tr><td width="120"><a href="http://swpat.ffii.org/"><img src="epatents.png" alt="Action against software patents" /></a></td><td width="180"><a href="http://www.gnome.org/"><img src="gnome2.png" alt="Gnome2 Logo" /></a><a href="http://www.w3.org/Status"><img src="w3c.png" alt="W3C Logo" /></a><a href="http://www.redhat.com/"><img src="redhat.gif" alt="Red Hat Logo" /></a><div align="left"><a href="http://xmlsoft.org/"><img src="Libxml2-Logo-180x168.gif" alt="Made with Libxml2 Logo" /></a></div></td><td><table border="0" width="90%" cellpadding="2" cellspacing="0" align="center" bgcolor="#000000"><tr><td><table width="100%" border="0" cellspacing="1" cellpadding="3" bgcolor="#fffacd"><tr><td align="center"><h1>The XML C parser and toolkit of Gnome</h1><h2>Releases</h2></td></tr></table></td></tr></table></td></tr></table><table border="0" cellpadding="4" cellspacing="0" width="100%" align="center"><tr><td bgcolor="#8b7765"><table border="0" cellspacing="0" cellpadding="2" width="100%"><tr><td valign="top" width="200" bgcolor="#8b7765"><table border="0" cellspacing="0" cellpadding="1" width="100%" bgcolor="#000000"><tr><td><table width="100%" border="0" cellspacing="1" cellpadding="3"><tr><td colspan="1" bgcolor="#eecfa1" align="center"><center><b>Main Menu</b></center></td></tr><tr><td bgcolor="#fffacd"><form action="search.php" enctype="application/x-www-form-urlencoded" method="get"><input name="query" type="text" size="20" value="" /><input name="submit" type="submit" value="Search ..." /></form><ul><li><a href="index.html">Home</a></li><li><a href="html/index.html">Reference Manual</a></li><li><a href="intro.html">Introduction</a></li><li><a href="FAQ.html">FAQ</a></li><li><a href="docs.html" style="font-weight:bold">Developer Menu</a></li><li><a href="bugs.html">Reporting bugs and getting help</a></li><li><a href="help.html">How to help</a></li><li><a href="downloads.html">Downloads</a></li><li><a href="news.html">Releases</a></li><li><a href="XMLinfo.html">XML</a></li><li><a href="XSLT.html">XSLT</a></li><li><a href="xmldtd.html">Validation &amp; DTDs</a></li><li><a href="encoding.html">Encodings support</a></li><li><a href="catalog.html">Catalog support</a></li><li><a href="namespaces.html">Namespaces</a></li><li><a href="contribs.html">Contributions</a></li><li><a href="examples/index.html" style="font-weight:bold">Code Examples</a></li><li><a href="html/index.html" style="font-weight:bold">API Menu</a></li><li><a href="guidelines.html">XML Guidelines</a></li><li><a href="ChangeLog.html">Recent Changes</a></li></ul></td></tr></table><table width="100%" border="0" cellspacing="1" cellpadding="3"><tr><td colspan="1" bgcolor="#eecfa1" align="center"><center><b>Related links</b></center></td></tr><tr><td bgcolor="#fffacd"><ul><li><a href="http://mail.gnome.org/archives/xml/">Mail archive</a></li><li><a href="http://xmlsoft.org/XSLT/">XSLT libxslt</a></li><li><a href="http://phd.cs.unibo.it/gdome2/">DOM gdome2</a></li><li><a href="http://www.aleksey.com/xmlsec/">XML-DSig xmlsec</a></li><li><a href="ftp://xmlsoft.org/">FTP</a></li><li><a href="http://www.zlatkovic.com/projects/libxml/">Windows binaries</a></li><li><a href="http://opencsw.org/packages/libxml2">Solaris binaries</a></li><li><a href="http://www.explain.com.au/oss/libxml2xslt.html">MacOsX binaries</a></li><li><a href="http://lxml.de/">lxml Python bindings</a></li><li><a href="http://cpan.uwinnipeg.ca/dist/XML-LibXML">Perl bindings</a></li><li><a href="http://libxmlplusplus.sourceforge.net/">C++ bindings</a></li><li><a href="http://www.zend.com/php5/articles/php5-xmlphp.php#Heading4">PHP bindings</a></li><li><a href="http://sourceforge.net/projects/libxml2-pas/">Pascal bindings</a></li><li><a href="http://libxml.rubyforge.org/">Ruby bindings</a></li><li><a href="http://tclxml.sourceforge.net/">Tcl bindings</a></li><li><a href="http://bugzilla.gnome.org/buglist.cgi?product=libxml2">Bug Tracker</a></li></ul></td></tr></table></td></tr></table></td><td valign="top" bgcolor="#8b7765"><table border="0" cellspacing="0" cellpadding="1" width="100%"><tr><td><table border="0" cellspacing="0" cellpadding="1" width="100%" bgcolor="#000000"><tr><td><table border="0" cellpadding="3" cellspacing="1" width="100%"><tr><td bgcolor="#fffacd"><p>The <a href="ChangeLog.html">change log</a> describes the recents commits
-to the <a href="http://git.gnome.org/browse/libxml2/">GIT</a> code base.</p><p>Here is the list of public releases:</p><h3>2.9.2: Oct 16 2014</h3><ul>
+to the <a href="http://git.gnome.org/browse/libxml2/">GIT</a> code base.</p><p>Here is the list of public releases:</p><h3>v2.9.3: Nov 20 2015</h3><ul>
+  <li>Security:<br />
+  CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh Davenport),<br />
+  CVE-2015-7500 Fix memory access error due to incorrect entities boundaries (Daniel Veillard),<br />
+  CVE-2015-7499-2 Detect incoherency on GROW (Daniel Veillard),<br />
+  CVE-2015-7499-1 Add xmlHaltParser() to stop the parser (Daniel Veillard),<br />
+  CVE-2015-5312 Another entity expansion issue (David Drysdale),<br />
+  CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey (David Drysdale),<br />
+  CVE-2015-7498 Avoid processing entities after encoding conversion failures (Daniel Veillard),<br />
+  CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard),<br />
+  CVE-2015-7942-2 Fix an error in previous Conditional section patch (Daniel Veillard),<br />
+  CVE-2015-7942 Another variation of overflow in Conditional sections (Daniel Veillard),<br />
+  CVE-2015-1819 Enforce the reader to run in constant memory (Daniel Veillard)<br />
+  CVE-2015-7941_2 Cleanup conditional section error handling (Daniel Veillard),<br />
+  CVE-2015-7941_1 Stop parsing on entities boundaries errors (Daniel Veillard),<br />
+  </li>
+
+  <li>Documentation:<br />
+  Correct spelling of "calling" (Alex Henrie),<br />
+  Fix a small error in xmllint --format description (Fabien Degomme),<br />
+  Avoid XSS on the search of xmlsoft.org (Daniel Veillard)<br />
+  </li>
+
+  <li>Portability:<br />
+  threads: use forward declarations only for glibc (Michael Heimpold),<br />
+  Update Win32 configure.js to search for configure.ac (Daniel Veillard)<br />
+  </li>
+
+  <li>Bug Fixes:<br />
+  Bug on creating new stream from entity (Daniel Veillard),<br />
+  Fix some loop issues embedding NEXT (Daniel Veillard),<br />
+  Do not print error context when there is none (Daniel Veillard),<br />
+  Avoid extra processing of MarkupDecl when EOF (Hugh Davenport),<br />
+  Fix parsing short unclosed comment uninitialized access (Daniel Veillard),<br />
+  Add missing Null check in xmlParseExternalEntityPrivate (Gaurav Gupta),<br />
+  Fix a bug in CData error handling in the push parser (Daniel Veillard),<br />
+  Fix a bug on name parsing at the end of current input buffer (Daniel Veillard),<br />
+  Fix the spurious ID already defined error (Daniel Veillard),<br />
+  Fix previous change to node sort order (Nick Wellnhofer),<br />
+  Fix a self assignment issue raised by clang (Scott Graham),<br />
+  Fail parsing early on if encoding conversion failed (Daniel Veillard),<br />
+  Do not process encoding values if the declaration if broken (Daniel Veillard),<br />
+  Silence clang's -Wunknown-attribute (Michael Catanzaro),<br />
+  xmlMemUsed is not thread-safe (Martin von Gagern),<br />
+  Fix support for except in nameclasses (Daniel Veillard),<br />
+  Fix order of root nodes (Nick Wellnhofer),<br />
+  Allow attributes on descendant-or-self axis (Nick Wellnhofer),<br />
+  Fix the fix to Windows locking (Steve Nairn),<br />
+  Fix timsort invariant loop re: Envisage article (Christopher Swenson),<br />
+  Don't add IDs in xmlSetTreeDoc (Nick Wellnhofer),<br />
+  Account for ID attributes in xmlSetTreeDoc (Nick Wellnhofer),<br />
+  Remove various unused value assignments (Philip Withnall),<br />
+  Fix missing entities after CVE-2014-3660 fix (Daniel Veillard),<br />
+  Revert "Missing initialization for the catalog module" (Daniel Veillard)<br />
+  </li>
+
+  <li>Improvements:<br />
+  Reuse xmlHaltParser() where it makes sense (Daniel Veillard),<br />
+  xmlStopParser reset errNo (Daniel Veillard),<br />
+  Reenable xz support by default (Daniel Veillard),<br />
+  Recover unescaped less-than character in HTML recovery parsing (Daniel Veillard),<br />
+  Allow HTML serializer to output HTML5 DOCTYPE (Shaun McCance),<br />
+  Regression test for bug #695699 (Nick Wellnhofer),<br />
+  Add a couple of XPath tests (Nick Wellnhofer),<br />
+  Add Python 3 rpm subpackage (Tomas Radej),<br />
+  libxml2-config.cmake.in: update include directories (Samuel Martin),<br />
+  Adding example from bugs 738805 to regression tests (Daniel Veillard)<br />
+  </li>
+
+  <li>Cleanups:<br />
+  </li>
+</ul><h3>2.9.2: Oct 16 2014</h3><ul>
   <li>Security:<br />
   Fix for CVE-2014-3660 billion laugh variant (Daniel Veillard),<br />
   CVE-2014-0191 Do not fetch external parameter entities (Daniel Veillard)<br />
diff --git a/doc/xml.html b/doc/xml.html
index 373285d2..51dca8c3 100644
--- a/doc/xml.html
+++ b/doc/xml.html
@@ -709,6 +709,79 @@ to the <a href="http://git.gnome.org/browse/libxml2/">GIT</a> code base.</p>
 
 <p>Here is the list of public releases:</p>
 
+<h3>v2.9.3: Nov 20 2015</h3>
+<ul>
+  <li>Security:<br/>
+  CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh Davenport),<br/>
+  CVE-2015-7500 Fix memory access error due to incorrect entities boundaries (Daniel Veillard),<br/>
+  CVE-2015-7499-2 Detect incoherency on GROW (Daniel Veillard),<br/>
+  CVE-2015-7499-1 Add xmlHaltParser() to stop the parser (Daniel Veillard),<br/>
+  CVE-2015-5312 Another entity expansion issue (David Drysdale),<br/>
+  CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey (David Drysdale),<br/>
+  CVE-2015-7498 Avoid processing entities after encoding conversion failures (Daniel Veillard),<br/>
+  CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard),<br/>
+  CVE-2015-7942-2 Fix an error in previous Conditional section patch (Daniel Veillard),<br/>
+  CVE-2015-7942 Another variation of overflow in Conditional sections (Daniel Veillard),<br/>
+  CVE-2015-1819 Enforce the reader to run in constant memory (Daniel Veillard)<br/>
+  CVE-2015-7941_2 Cleanup conditional section error handling (Daniel Veillard),<br/>
+  CVE-2015-7941_1 Stop parsing on entities boundaries errors (Daniel Veillard),<br/>
+  </li>
+
+  <li>Documentation:<br/>
+  Correct spelling of "calling" (Alex Henrie),<br/>
+  Fix a small error in xmllint --format description (Fabien Degomme),<br/>
+  Avoid XSS on the search of xmlsoft.org (Daniel Veillard)<br/>
+  </li>
+
+  <li>Portability:<br/>
+  threads: use forward declarations only for glibc (Michael Heimpold),<br/>
+  Update Win32 configure.js to search for configure.ac (Daniel Veillard)<br/>
+  </li>
+
+  <li>Bug Fixes:<br/>
+  Bug on creating new stream from entity (Daniel Veillard),<br/>
+  Fix some loop issues embedding NEXT (Daniel Veillard),<br/>
+  Do not print error context when there is none (Daniel Veillard),<br/>
+  Avoid extra processing of MarkupDecl when EOF (Hugh Davenport),<br/>
+  Fix parsing short unclosed comment uninitialized access (Daniel Veillard),<br/>
+  Add missing Null check in xmlParseExternalEntityPrivate (Gaurav Gupta),<br/>
+  Fix a bug in CData error handling in the push parser (Daniel Veillard),<br/>
+  Fix a bug on name parsing at the end of current input buffer (Daniel Veillard),<br/>
+  Fix the spurious ID already defined error (Daniel Veillard),<br/>
+  Fix previous change to node sort order (Nick Wellnhofer),<br/>
+  Fix a self assignment issue raised by clang (Scott Graham),<br/>
+  Fail parsing early on if encoding conversion failed (Daniel Veillard),<br/>
+  Do not process encoding values if the declaration if broken (Daniel Veillard),<br/>
+  Silence clang's -Wunknown-attribute (Michael Catanzaro),<br/>
+  xmlMemUsed is not thread-safe (Martin von Gagern),<br/>
+  Fix support for except in nameclasses (Daniel Veillard),<br/>
+  Fix order of root nodes (Nick Wellnhofer),<br/>
+  Allow attributes on descendant-or-self axis (Nick Wellnhofer),<br/>
+  Fix the fix to Windows locking (Steve Nairn),<br/>
+  Fix timsort invariant loop re: Envisage article (Christopher Swenson),<br/>
+  Don't add IDs in xmlSetTreeDoc (Nick Wellnhofer),<br/>
+  Account for ID attributes in xmlSetTreeDoc (Nick Wellnhofer),<br/>
+  Remove various unused value assignments (Philip Withnall),<br/>
+  Fix missing entities after CVE-2014-3660 fix (Daniel Veillard),<br/>
+  Revert "Missing initialization for the catalog module" (Daniel Veillard)<br/>
+  </li>
+
+  <li>Improvements:<br/>
+  Reuse xmlHaltParser() where it makes sense (Daniel Veillard),<br/>
+  xmlStopParser reset errNo (Daniel Veillard),<br/>
+  Reenable xz support by default (Daniel Veillard),<br/>
+  Recover unescaped less-than character in HTML recovery parsing (Daniel Veillard),<br/>
+  Allow HTML serializer to output HTML5 DOCTYPE (Shaun McCance),<br/>
+  Regression test for bug #695699 (Nick Wellnhofer),<br/>
+  Add a couple of XPath tests (Nick Wellnhofer),<br/>
+  Add Python 3 rpm subpackage (Tomas Radej),<br/>
+  libxml2-config.cmake.in: update include directories (Samuel Martin),<br/>
+  Adding example from bugs 738805 to regression tests (Daniel Veillard)<br/>
+  </li>
+
+  <li>Cleanups:<br/>
+  </li>
+</ul>
 <h3>2.9.2: Oct 16 2014</h3>
 <ul>
   <li>Security:<br/>
diff --git a/error.c b/error.c
index cbcf5c96..9c450405 100644
--- a/error.c
+++ b/error.c
@@ -177,7 +177,9 @@ xmlParserPrintFileContextInternal(xmlParserInputPtr input ,
     xmlChar  content[81]; /* space for 80 chars + line terminator */
     xmlChar *ctnt;
 
-    if (input == NULL) return;
+    if ((input == NULL) || (input->cur == NULL) ||
+        (*input->cur == 0)) return;
+
     cur = input->cur;
     base = input->base;
     /* skip backwards over any end-of-lines */
diff --git a/parser.c b/parser.c
index b9217ff1..c5741e3b 100644
--- a/parser.c
+++ b/parser.c
@@ -94,6 +94,8 @@ static xmlParserCtxtPtr
 xmlCreateEntityParserCtxtInternal(const xmlChar *URL, const xmlChar *ID,
 	                  const xmlChar *base, xmlParserCtxtPtr pctx);
 
+static void xmlHaltParser(xmlParserCtxtPtr ctxt);
+
 /************************************************************************
  *									*
  *	Arbitrary limits set in the parser. See XML_PARSE_HUGE		*
@@ -1771,7 +1773,7 @@ nodePush(xmlParserCtxtPtr ctxt, xmlNodePtr value)
 	xmlFatalErrMsgInt(ctxt, XML_ERR_INTERNAL_ERROR,
 		 "Excessive depth in document: %d use XML_PARSE_HUGE option\n",
 			  xmlParserMaxDepth);
-	ctxt->instate = XML_PARSER_EOF;
+	xmlHaltParser(ctxt);
 	return(-1);
     }
     ctxt->nodeTab[ctxt->nodeNr] = value;
@@ -2073,9 +2075,16 @@ static void xmlGROW (xmlParserCtxtPtr ctxt) {
          ((ctxt->input->buf) && (ctxt->input->buf->readcallback != (xmlInputReadCallback) xmlNop)) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
-        ctxt->instate = XML_PARSER_EOF;
+        xmlHaltParser(ctxt);
+	return;
     }
     xmlParserInputGrow(ctxt->input, INPUT_CHUNK);
+    if ((ctxt->input->cur > ctxt->input->end) ||
+        (ctxt->input->cur < ctxt->input->base)) {
+        xmlHaltParser(ctxt);
+        xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "cur index out of bound");
+	return;
+    }
     if ((ctxt->input->cur != NULL) && (*ctxt->input->cur == 0) &&
         (xmlParserInputGrow(ctxt->input, INPUT_CHUNK) <= 0))
 	    xmlPopInput(ctxt);
@@ -2151,7 +2160,8 @@ xmlSkipBlankChars(xmlParserCtxtPtr ctxt) {
 	int cur;
 	do {
 	    cur = CUR;
-	    while (IS_BLANK_CH(cur)) { /* CHECKED tstblanks.xml */
+	    while ((IS_BLANK_CH(cur) && /* CHECKED tstblanks.xml */
+	           (ctxt->instate != XML_PARSER_EOF))) {
 		NEXT;
 		cur = CUR;
 		res++;
@@ -2165,7 +2175,8 @@ xmlSkipBlankChars(xmlParserCtxtPtr ctxt) {
 	     * Need to handle support of entities branching here
 	     */
 	    if (*ctxt->input->cur == '%') xmlParserHandlePEReference(ctxt);
-	} while (IS_BLANK(cur)); /* CHECKED tstblanks.xml */
+	} while ((IS_BLANK(cur)) && /* CHECKED tstblanks.xml */
+	         (ctxt->instate != XML_PARSER_EOF));
     }
     return(res);
 }
@@ -2806,6 +2817,10 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
 			                      0, 0, 0);
 		ctxt->depth--;
 
+		if ((ctxt->lastError.code == XML_ERR_ENTITY_LOOP) ||
+		    (ctxt->lastError.code == XML_ERR_INTERNAL_ERROR))
+		    goto int_error;
+
 		if (rep != NULL) {
 		    current = rep;
 		    while (*current != 0) { /* non input consuming loop */
@@ -5669,7 +5684,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt) {
 	if (RAW != '>') {
 	    xmlFatalErrMsgStr(ctxt, XML_ERR_ENTITY_NOT_FINISHED,
 	            "xmlParseEntityDecl: entity %s not terminated\n", name);
-	    xmlStopParser(ctxt);
+	    xmlHaltParser(ctxt);
 	} else {
 	    if (input != ctxt->input) {
 		xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
@@ -6781,7 +6796,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 	SKIP_BLANKS;
 	if (RAW != '[') {
 	    xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
-	    xmlStopParser(ctxt);
+	    xmlHaltParser(ctxt);
 	    return;
 	} else {
 	    if (ctxt->input->id != id) {
@@ -6843,7 +6858,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 	SKIP_BLANKS;
 	if (RAW != '[') {
 	    xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
-	    xmlStopParser(ctxt);
+	    xmlHaltParser(ctxt);
 	    return;
 	} else {
 	    if (ctxt->input->id != id) {
@@ -6900,7 +6915,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 
     } else {
 	xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID_KEYWORD, NULL);
-	xmlStopParser(ctxt);
+	xmlHaltParser(ctxt);
 	return;
     }
 
@@ -6916,7 +6931,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 				 NULL, NULL);
 	}
 	if ((ctxt-> instate != XML_PARSER_EOF) &&
-	    ((ctxt->input->cur + 3) < ctxt->input->end))
+	    ((ctxt->input->cur + 3) <= ctxt->input->end))
 	    SKIP(3);
     }
 }
@@ -6972,6 +6987,14 @@ xmlParseMarkupDecl(xmlParserCtxtPtr ctxt) {
 	    xmlParsePI(ctxt);
 	}
     }
+
+    /*
+     * detect requirement to exit there and act accordingly
+     * and avoid having instate overriden later on
+     */
+    if (ctxt->instate == XML_PARSER_EOF)
+        return;
+
     /*
      * This is only for internal subset. On external entities,
      * the replacement is done before parsing stage
@@ -7103,7 +7126,7 @@ xmlParseExternalSubset(xmlParserCtxtPtr ctxt, const xmlChar *ExternalID,
 	    /*
 	     * The XML REC instructs us to stop parsing right here
 	     */
-	    ctxt->instate = XML_PARSER_EOF;
+	    xmlHaltParser(ctxt);
 	    return;
 	}
     }
@@ -8090,7 +8113,7 @@ xmlParsePEReference(xmlParserCtxtPtr ctxt)
 		     * The XML REC instructs us to stop parsing
 		     * right here
 		     */
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    return;
 		}
 	    }
@@ -9325,7 +9348,7 @@ xmlParseStartTag2(xmlParserCtxtPtr ctxt, const xmlChar **pref,
     const xmlChar **atts = ctxt->atts;
     int maxatts = ctxt->maxatts;
     int nratts, nbatts, nbdef;
-    int i, j, nbNs, attval, oldline, oldcol;
+    int i, j, nbNs, attval, oldline, oldcol, inputNr;
     const xmlChar *base;
     unsigned long cur;
     int nsNr = ctxt->nsNr;
@@ -9344,6 +9367,7 @@ reparse:
     SHRINK;
     base = ctxt->input->base;
     cur = ctxt->input->cur - ctxt->input->base;
+    inputNr = ctxt->inputNr;
     oldline = ctxt->input->line;
     oldcol = ctxt->input->col;
     nbatts = 0;
@@ -9369,7 +9393,8 @@ reparse:
      */
     SKIP_BLANKS;
     GROW;
-    if (ctxt->input->base != base) goto base_changed;
+    if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+        goto base_changed;
 
     while (((RAW != '>') &&
 	   ((RAW != '/') || (NXT(1) != '>')) &&
@@ -9380,7 +9405,7 @@ reparse:
 
 	attname = xmlParseAttribute2(ctxt, prefix, localname,
 	                             &aprefix, &attvalue, &len, &alloc);
-	if (ctxt->input->base != base) {
+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr)) {
 	    if ((attvalue != NULL) && (alloc != 0))
 	        xmlFree(attvalue);
 	    attvalue = NULL;
@@ -9529,7 +9554,8 @@ skip_ns:
 		    break;
 		}
 		SKIP_BLANKS;
-		if (ctxt->input->base != base) goto base_changed;
+		if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+		    goto base_changed;
 		continue;
 	    }
 
@@ -9566,7 +9592,8 @@ failed:
 	GROW
         if (ctxt->instate == XML_PARSER_EOF)
             break;
-	if (ctxt->input->base != base) goto base_changed;
+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+	    goto base_changed;
 	if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
 	    break;
 	if (!IS_BLANK_CH(RAW)) {
@@ -9582,7 +9609,8 @@ failed:
 	    break;
 	}
         GROW;
-	if (ctxt->input->base != base) goto base_changed;
+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+	    goto base_changed;
     }
 
     /*
@@ -9749,6 +9777,17 @@ base_changed:
 	    if ((ctxt->attallocs[j] != 0) && (atts[i] != NULL))
 	        xmlFree((xmlChar *) atts[i]);
     }
+
+    /*
+     * We can't switch from one entity to another in the middle
+     * of a start tag
+     */
+    if (inputNr != ctxt->inputNr) {
+        xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
+		    "Start tag doesn't start and stop in the same entity\n");
+	return(NULL);
+    }
+
     ctxt->input->cur = ctxt->input->base + cur;
     ctxt->input->line = oldline;
     ctxt->input->col = oldcol;
@@ -10030,7 +10069,7 @@ xmlParseContent(xmlParserCtxtPtr ctxt) {
 	if ((cons == ctxt->input->consumed) && (test == CUR_PTR)) {
 	    xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR,
 	                "detected an error in element content\n");
-	    ctxt->instate = XML_PARSER_EOF;
+	    xmlHaltParser(ctxt);
             break;
 	}
     }
@@ -10065,7 +10104,7 @@ xmlParseElement(xmlParserCtxtPtr ctxt) {
 	xmlFatalErrMsgInt(ctxt, XML_ERR_INTERNAL_ERROR,
 		 "Excessive depth in document: %d use XML_PARSE_HUGE option\n",
 			  xmlParserMaxDepth);
-	ctxt->instate = XML_PARSER_EOF;
+	xmlHaltParser(ctxt);
 	return;
     }
 
@@ -10657,7 +10696,8 @@ xmlParseXMLDecl(xmlParserCtxtPtr ctxt) {
 	xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED, "Blank needed here\n");
     }
     xmlParseEncodingDecl(ctxt);
-    if (ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) {
+    if ((ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) ||
+         (ctxt->instate == XML_PARSER_EOF)) {
 	/*
 	 * The XML REC instructs us to stop parsing right here
 	 */
@@ -10781,6 +10821,7 @@ xmlParseDocument(xmlParserCtxtPtr ctxt) {
 
     if (CUR == 0) {
 	xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
+	return(-1);
     }
 
     /*
@@ -10798,7 +10839,8 @@ xmlParseDocument(xmlParserCtxtPtr ctxt) {
 	 * Note that we will switch encoding on the fly.
 	 */
 	xmlParseXMLDecl(ctxt);
-	if (ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) {
+	if ((ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) ||
+	    (ctxt->instate == XML_PARSER_EOF)) {
 	    /*
 	     * The XML REC instructs us to stop parsing right here
 	     */
@@ -11392,7 +11434,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 			ctxt->sax->setDocumentLocator(ctxt->userData,
 						      &xmlDefaultSAXLocator);
 		    xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 #ifdef DEBUG_PUSH
 		    xmlGenericError(xmlGenericErrorContext,
 			    "PP: entering EOF\n");
@@ -11425,7 +11467,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 			     * The XML REC instructs us to stop parsing right
 			     * here
 			     */
-			    ctxt->instate = XML_PARSER_EOF;
+			    xmlHaltParser(ctxt);
 			    return(0);
 			}
 			ctxt->standalone = ctxt->input->standalone;
@@ -11481,7 +11523,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		cur = ctxt->input->cur[0];
 	        if (cur != '<') {
 		    xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
 			ctxt->sax->endDocument(ctxt->userData);
 		    goto done;
@@ -11513,7 +11555,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		    goto done;
 		if (name == NULL) {
 		    spacePop(ctxt);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
 			ctxt->sax->endDocument(ctxt->userData);
 		    goto done;
@@ -11680,7 +11722,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		if ((cons == ctxt->input->consumed) && (test == CUR_PTR)) {
 		    xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR,
 		                "detected an error in element content\n");
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    break;
 		}
 		break;
@@ -12001,7 +12043,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		    goto done;
 		} else {
 		    xmlFatalErr(ctxt, XML_ERR_DOCUMENT_END, NULL);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 #ifdef DEBUG_PUSH
 		    xmlGenericError(xmlGenericErrorContext,
 			    "PP: entering EOF\n");
@@ -12365,7 +12407,7 @@ xmldecl_done:
 	res = xmlParserInputBufferPush(ctxt->input->buf, size, chunk);
 	if (res < 0) {
 	    ctxt->errNo = XML_PARSER_EOF;
-	    ctxt->disableSAX = 1;
+	    xmlHaltParser(ctxt);
 	    return (XML_PARSER_EOF);
 	}
         xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input, base, cur);
@@ -12419,7 +12461,7 @@ xmldecl_done:
          ((ctxt->input->cur - ctxt->input->base) > XML_MAX_LOOKUP_LIMIT)) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
-        ctxt->instate = XML_PARSER_EOF;
+        xmlHaltParser(ctxt);
     }
     if ((ctxt->errNo != XML_ERR_OK) && (ctxt->disableSAX == 1))
         return(ctxt->errNo);
@@ -12607,25 +12649,47 @@ xmlCreatePushParserCtxt(xmlSAXHandlerPtr sax, void *user_data,
 #endif /* LIBXML_PUSH_ENABLED */
 
 /**
- * xmlStopParser:
+ * xmlHaltParser:
  * @ctxt:  an XML parser context
  *
- * Blocks further parser processing
+ * Blocks further parser processing don't override error
+ * for internal use
  */
-void
-xmlStopParser(xmlParserCtxtPtr ctxt) {
+static void
+xmlHaltParser(xmlParserCtxtPtr ctxt) {
     if (ctxt == NULL)
         return;
     ctxt->instate = XML_PARSER_EOF;
-    ctxt->errNo = XML_ERR_USER_STOP;
     ctxt->disableSAX = 1;
     if (ctxt->input != NULL) {
+        /*
+	 * in case there was a specific allocation deallocate before
+	 * overriding base
+	 */
+        if (ctxt->input->free != NULL) {
+	    ctxt->input->free((xmlChar *) ctxt->input->base);
+	    ctxt->input->free = NULL;
+	}
 	ctxt->input->cur = BAD_CAST"";
 	ctxt->input->base = ctxt->input->cur;
     }
 }
 
 /**
+ * xmlStopParser:
+ * @ctxt:  an XML parser context
+ *
+ * Blocks further parser processing
+ */
+void
+xmlStopParser(xmlParserCtxtPtr ctxt) {
+    if (ctxt == NULL)
+        return;
+    xmlHaltParser(ctxt);
+    ctxt->errNo = XML_ERR_USER_STOP;
+}
+
+/**
  * xmlCreateIOParserCtxt:
  * @sax:  a SAX handler
  * @user_data:  The user data returned on SAX callbacks
diff --git a/parserInternals.c b/parserInternals.c
index df204fde..2b8646c2 100644
--- a/parserInternals.c
+++ b/parserInternals.c
@@ -937,6 +937,7 @@ xmlSwitchEncoding(xmlParserCtxtPtr ctxt, xmlCharEncoding enc)
 {
     xmlCharEncodingHandlerPtr handler;
     int len = -1;
+    int ret;
 
     if (ctxt == NULL) return(-1);
     switch (enc) {
@@ -1097,7 +1098,15 @@ xmlSwitchEncoding(xmlParserCtxtPtr ctxt, xmlCharEncoding enc)
     if (handler == NULL)
 	return(-1);
     ctxt->charset = XML_CHAR_ENCODING_UTF8;
-    return(xmlSwitchToEncodingInt(ctxt, handler, len));
+    ret = xmlSwitchToEncodingInt(ctxt, handler, len);
+    if ((ret < 0) || (ctxt->errNo == XML_I18N_CONV_FAILED)) {
+        /*
+	 * on encoding conversion errors, stop the parser
+	 */
+        xmlStopParser(ctxt);
+	ctxt->errNo = XML_I18N_CONV_FAILED;
+    }
+    return(ret);
 }
 
 /**
@@ -1450,6 +1459,8 @@ xmlNewEntityInputStream(xmlParserCtxtPtr ctxt, xmlEntityPtr entity) {
     if (entity->URI != NULL)
 	input->filename = (char *) xmlStrdup((xmlChar *) entity->URI);
     input->base = entity->content;
+    if (entity->length == 0)
+        entity->length = xmlStrlen(entity->content);
     input->cur = entity->content;
     input->length = entity->length;
     input->end = &entity->content[input->length];
diff --git a/python/setup.py b/python/setup.py
index e1ff3650..f10b9c11 100755
--- a/python/setup.py
+++ b/python/setup.py
@@ -226,7 +226,7 @@ else:
 setup (name = "libxml2-python",
        # On *nix, the version number is created from setup.py.in
        # On windows, it is set by configure.js
-       version = "2.9.2",
+       version = "2.9.3",
        description = descr,
        author = "Daniel Veillard",
        author_email = "veillard@redhat.com",
diff --git a/result/errors/754946.xml.err b/result/errors/754946.xml.err
index 423dff56..a75088b9 100644
--- a/result/errors/754946.xml.err
+++ b/result/errors/754946.xml.err
@@ -11,6 +11,9 @@ Entity: line 1: parser error : DOCTYPE improperly terminated
 Entity: line 1: 
 A<lbbbbbbbbbbbbbbbbbbb_
 ^
+./test/errors/754946.xml:1: parser error : Start tag doesn't start and stop in the same entity
+>%SYSTEM;<![
+         ^
 ./test/errors/754946.xml:1: parser error : Extra content at the end of the document
-<!DOCTYPEA[<!ENTITY %
-  ^
+>%SYSTEM;<![
+         ^
diff --git a/testapi.c b/testapi.c
index 0367ffd4..9205e643 100644
--- a/testapi.c
+++ b/testapi.c
@@ -1034,10 +1034,10 @@ static void des_xmlAttributeType(int no ATTRIBUTE_UNUSED, xmlAttributeType val A
 
 #define gen_nb_xmlBufferAllocationScheme 4
 static xmlBufferAllocationScheme gen_xmlBufferAllocationScheme(int no, int nr ATTRIBUTE_UNUSED) {
-    if (no == 1) return(XML_BUFFER_ALLOC_DOUBLEIT);
-    if (no == 2) return(XML_BUFFER_ALLOC_EXACT);
-    if (no == 3) return(XML_BUFFER_ALLOC_HYBRID);
-    if (no == 4) return(XML_BUFFER_ALLOC_IMMUTABLE);
+    if (no == 1) return(XML_BUFFER_ALLOC_BOUNDED);
+    if (no == 2) return(XML_BUFFER_ALLOC_DOUBLEIT);
+    if (no == 3) return(XML_BUFFER_ALLOC_EXACT);
+    if (no == 4) return(XML_BUFFER_ALLOC_HYBRID);
     return(0);
 }
 
diff --git a/xmlIO.c b/xmlIO.c
index e628ab09..8b13184a 100644
--- a/xmlIO.c
+++ b/xmlIO.c
@@ -1334,7 +1334,7 @@ xmlGzfileClose (void * context) {
 }
 #endif /* HAVE_ZLIB_H */
 
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 /************************************************************************
  *									*
  *		I/O for compressed file accesses			*
@@ -1451,7 +1451,7 @@ xmlXzfileClose (void * context) {
     if (ret < 0) xmlIOErr(0, "xzclose()");
     return(ret);
 }
-#endif /* HAVE_LZMA_H */
+#endif /* LIBXML_LZMA_ENABLED */
 
 #ifdef LIBXML_HTTP_ENABLED
 /************************************************************************
@@ -2328,10 +2328,10 @@ xmlRegisterDefaultInputCallbacks(void) {
     xmlRegisterInputCallbacks(xmlGzfileMatch, xmlGzfileOpen,
 	                      xmlGzfileRead, xmlGzfileClose);
 #endif /* HAVE_ZLIB_H */
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
     xmlRegisterInputCallbacks(xmlXzfileMatch, xmlXzfileOpen,
 	                      xmlXzfileRead, xmlXzfileClose);
-#endif /* HAVE_ZLIB_H */
+#endif /* LIBXML_LZMA_ENABLED */
 
 #ifdef LIBXML_HTTP_ENABLED
     xmlRegisterInputCallbacks(xmlIOHTTPMatch, xmlIOHTTPOpen,
@@ -2683,7 +2683,7 @@ __xmlParserInputBufferCreateFilename(const char *URI, xmlCharEncoding enc) {
 #endif
 	}
 #endif
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 	if ((xmlInputCallbackTable[i].opencallback == xmlXzfileOpen) &&
 		(strcmp(URI, "-") != 0)) {
             ret->compressed = __libxml2_xzcompressed(context);
@@ -3350,7 +3350,7 @@ xmlParserInputBufferGrow(xmlParserInputBufferPtr in, int len) {
      * try to establish compressed status of input if not done already
      */
     if (in->compressed == -1) {
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 	if (in->readcallback == xmlXzfileRead)
             in->compressed = __libxml2_xzcompressed(in->context);
 #endif
diff --git a/xmlschemas.c b/xmlschemas.c
index d47512f0..fe533e6f 100644
--- a/xmlschemas.c
+++ b/xmlschemas.c
@@ -25546,7 +25546,7 @@ xmlSchemaVAttributesComplex(xmlSchemaValidCtxtPtr vctxt)
 		    if (xmlNewProp(defAttrOwnerElem,
 			iattr->localName, value) == NULL) {
 			VERROR_INT("xmlSchemaVAttributesComplex",
-			    "callling xmlNewProp()");
+			    "calling xmlNewProp()");
 			if (normValue != NULL)
 			    xmlFree(normValue);
 			goto internal_error;
diff --git a/xzlib.c b/xzlib.c
index 0dcb9f48..782957f6 100644
--- a/xzlib.c
+++ b/xzlib.c
@@ -8,7 +8,7 @@
  */
 #define IN_LIBXML
 #include "libxml.h"
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 
 #include <string.h>
 #ifdef HAVE_ERRNO_H
@@ -34,7 +34,9 @@
 #ifdef HAVE_ZLIB_H
 #include <zlib.h>
 #endif
+#ifdef HAVE_LZMA_H
 #include <lzma.h>
+#endif
 
 #include "xzlib.h"
 #include <libxml/xmlmemory.h>
@@ -581,6 +583,10 @@ xz_decomp(xz_statep state)
             xz_error(state, LZMA_DATA_ERROR, "compressed data error");
             return -1;
         }
+        if (ret == LZMA_PROG_ERROR) {
+            xz_error(state, LZMA_PROG_ERROR, "compression error");
+            return -1;
+        }
     } while (strm->avail_out && ret != LZMA_STREAM_END);
 
     /* update available output and crc check value */
@@ -795,4 +801,4 @@ __libxml2_xzclose(xzFile file)
     xmlFree(state);
     return ret ? ret : LZMA_OK;
 }
-#endif /* HAVE_LZMA_H */
+#endif /* LIBXML_LZMA_ENABLED */