From 73c50805d9302263a1118356bc2553b441b31b33 Mon Sep 17 00:00:00 2001
From: Alex Henrie <alexhenrie24@gmail.com>
Date: Mon, 26 Oct 2015 18:33:14 +0800
Subject: Correct spelling of "calling"

---
 xmlschemas.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xmlschemas.c b/xmlschemas.c
index d47512f0..fe533e6f 100644
--- a/xmlschemas.c
+++ b/xmlschemas.c
@@ -25546,7 +25546,7 @@ xmlSchemaVAttributesComplex(xmlSchemaValidCtxtPtr vctxt)
 		    if (xmlNewProp(defAttrOwnerElem,
 			iattr->localName, value) == NULL) {
 			VERROR_INT("xmlSchemaVAttributesComplex",
-			    "callling xmlNewProp()");
+			    "calling xmlNewProp()");
 			if (normValue != NULL)
 			    xmlFree(normValue);
 			goto internal_error;
-- 
cgit v1.2.3


From 41ac9049a27f52e7a1f3b341f8714149fc88d450 Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Tue, 27 Oct 2015 10:53:44 +0800
Subject: Fix an error in previous Conditional section patch

an off by one mistake in the change, led to error on correct
document where the end of the included entity was exactly
the end of the conditional section, leading to regtest failure
---
 parser.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/parser.c b/parser.c
index b9217ff1..d67b3003 100644
--- a/parser.c
+++ b/parser.c
@@ -6916,7 +6916,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 				 NULL, NULL);
 	}
 	if ((ctxt-> instate != XML_PARSER_EOF) &&
-	    ((ctxt->input->cur + 3) < ctxt->input->end))
+	    ((ctxt->input->cur + 3) <= ctxt->input->end))
 	    SKIP(3);
     }
 }
-- 
cgit v1.2.3


From e724879d964d774df9b7969fc846605aa1bac54c Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Fri, 30 Oct 2015 21:14:55 +0800
Subject: Fix parsing short unclosed comment uninitialized access

For https://bugzilla.gnome.org/show_bug.cgi?id=746048
The HTML parser was too optimistic when processing comments and
didn't check for the end of the stream on the first 2 characters
---
 HTMLparser.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/HTMLparser.c b/HTMLparser.c
index 19c10c3f..bdf78071 100644
--- a/HTMLparser.c
+++ b/HTMLparser.c
@@ -3264,12 +3264,17 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
 	ctxt->instate = state;
 	return;
     }
+    len = 0;
+    buf[len] = 0;
     q = CUR_CHAR(ql);
+    if (!IS_CHAR(q))
+        goto unfinished;
     NEXTL(ql);
     r = CUR_CHAR(rl);
+    if (!IS_CHAR(r))
+        goto unfinished;
     NEXTL(rl);
     cur = CUR_CHAR(l);
-    len = 0;
     while (IS_CHAR(cur) &&
            ((cur != '>') ||
 	    (r != '-') || (q != '-'))) {
@@ -3300,18 +3305,20 @@ htmlParseComment(htmlParserCtxtPtr ctxt) {
 	}
     }
     buf[len] = 0;
-    if (!IS_CHAR(cur)) {
-	htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
-	             "Comment not terminated \n<!--%.50s\n", buf, NULL);
-	xmlFree(buf);
-    } else {
+    if (IS_CHAR(cur)) {
         NEXT;
 	if ((ctxt->sax != NULL) && (ctxt->sax->comment != NULL) &&
 	    (!ctxt->disableSAX))
 	    ctxt->sax->comment(ctxt->userData, buf);
 	xmlFree(buf);
+	ctxt->instate = state;
+	return;
     }
-    ctxt->instate = state;
+
+unfinished:
+    htmlParseErr(ctxt, XML_ERR_COMMENT_NOT_FINISHED,
+		 "Comment not terminated \n<!--%.50s\n", buf, NULL);
+    xmlFree(buf);
 }
 
 /**
-- 
cgit v1.2.3


From f0709e3ca8f8947f2d91ed34e92e38a4c23eae63 Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Tue, 3 Nov 2015 15:31:25 +0800
Subject: CVE-2015-8035 Fix XZ compression support loop

For https://bugzilla.gnome.org/show_bug.cgi?id=757466
DoS when parsing specially crafted XML document if XZ support
is compiled in (which wasn't the case for 2.9.2 and master since
Nov 2013, fixed in next commit !)
---
 xzlib.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/xzlib.c b/xzlib.c
index 0dcb9f48..1fab5463 100644
--- a/xzlib.c
+++ b/xzlib.c
@@ -581,6 +581,10 @@ xz_decomp(xz_statep state)
             xz_error(state, LZMA_DATA_ERROR, "compressed data error");
             return -1;
         }
+        if (ret == LZMA_PROG_ERROR) {
+            xz_error(state, LZMA_PROG_ERROR, "compression error");
+            return -1;
+        }
     } while (strm->avail_out && ret != LZMA_STREAM_END);
 
     /* update available output and crc check value */
-- 
cgit v1.2.3


From 18b8988511b0954272cac4d6c3e6724f9dbf6e0a Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Tue, 3 Nov 2015 15:46:29 +0800
Subject: Reenable xz support by default

For https://bugzilla.gnome.org/show_bug.cgi?id=757466

problem was introduced by commit f3f86ff465c92c79f834d7b981f3c7274a8bb5c8
for https://bugzilla.gnome.org/show_bug.cgi?id=711026
---
 configure.ac |  3 +++
 xmlIO.c      | 12 ++++++------
 xzlib.c      |  6 ++++--
 3 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/configure.ac b/configure.ac
index 14ac0a8a..48e0577b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -445,6 +445,9 @@ else
                 fi],
                 [have_liblzma=no])
 	     LDFLAGS="${SAVE_LDFLAGS}"])
+    else
+	# we still need to check for lzma,h header
+	AC_CHECK_HEADERS([lzma.h])
     fi
 
     # Found the library via either method?
diff --git a/xmlIO.c b/xmlIO.c
index e628ab09..8b13184a 100644
--- a/xmlIO.c
+++ b/xmlIO.c
@@ -1334,7 +1334,7 @@ xmlGzfileClose (void * context) {
 }
 #endif /* HAVE_ZLIB_H */
 
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 /************************************************************************
  *									*
  *		I/O for compressed file accesses			*
@@ -1451,7 +1451,7 @@ xmlXzfileClose (void * context) {
     if (ret < 0) xmlIOErr(0, "xzclose()");
     return(ret);
 }
-#endif /* HAVE_LZMA_H */
+#endif /* LIBXML_LZMA_ENABLED */
 
 #ifdef LIBXML_HTTP_ENABLED
 /************************************************************************
@@ -2328,10 +2328,10 @@ xmlRegisterDefaultInputCallbacks(void) {
     xmlRegisterInputCallbacks(xmlGzfileMatch, xmlGzfileOpen,
 	                      xmlGzfileRead, xmlGzfileClose);
 #endif /* HAVE_ZLIB_H */
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
     xmlRegisterInputCallbacks(xmlXzfileMatch, xmlXzfileOpen,
 	                      xmlXzfileRead, xmlXzfileClose);
-#endif /* HAVE_ZLIB_H */
+#endif /* LIBXML_LZMA_ENABLED */
 
 #ifdef LIBXML_HTTP_ENABLED
     xmlRegisterInputCallbacks(xmlIOHTTPMatch, xmlIOHTTPOpen,
@@ -2683,7 +2683,7 @@ __xmlParserInputBufferCreateFilename(const char *URI, xmlCharEncoding enc) {
 #endif
 	}
 #endif
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 	if ((xmlInputCallbackTable[i].opencallback == xmlXzfileOpen) &&
 		(strcmp(URI, "-") != 0)) {
             ret->compressed = __libxml2_xzcompressed(context);
@@ -3350,7 +3350,7 @@ xmlParserInputBufferGrow(xmlParserInputBufferPtr in, int len) {
      * try to establish compressed status of input if not done already
      */
     if (in->compressed == -1) {
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 	if (in->readcallback == xmlXzfileRead)
             in->compressed = __libxml2_xzcompressed(in->context);
 #endif
diff --git a/xzlib.c b/xzlib.c
index 1fab5463..782957f6 100644
--- a/xzlib.c
+++ b/xzlib.c
@@ -8,7 +8,7 @@
  */
 #define IN_LIBXML
 #include "libxml.h"
-#ifdef HAVE_LZMA_H
+#ifdef LIBXML_LZMA_ENABLED
 
 #include <string.h>
 #ifdef HAVE_ERRNO_H
@@ -34,7 +34,9 @@
 #ifdef HAVE_ZLIB_H
 #include <zlib.h>
 #endif
+#ifdef HAVE_LZMA_H
 #include <lzma.h>
+#endif
 
 #include "xzlib.h"
 #include <libxml/xmlmemory.h>
@@ -799,4 +801,4 @@ __libxml2_xzclose(xzFile file)
     xmlFree(state);
     return ret ? ret : LZMA_OK;
 }
-#endif /* HAVE_LZMA_H */
+#endif /* LIBXML_LZMA_ENABLED */
-- 
cgit v1.2.3


From ab2b9a93ff19cedde7befbf2fcc48c6e352b6cbe Mon Sep 17 00:00:00 2001
From: Hugh Davenport <hugh@allthethings.co.nz>
Date: Tue, 3 Nov 2015 20:40:49 +0800
Subject: Avoid extra processing of MarkupDecl when EOF

For https://bugzilla.gnome.org/show_bug.cgi?id=756263

One place where ctxt->instate == XML_PARSER_EOF whic was set up
by entity detection issues doesn't get noticed, and even overrided
---
 parser.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/parser.c b/parser.c
index d67b3003..134afe70 100644
--- a/parser.c
+++ b/parser.c
@@ -6972,6 +6972,14 @@ xmlParseMarkupDecl(xmlParserCtxtPtr ctxt) {
 	    xmlParsePI(ctxt);
 	}
     }
+
+    /*
+     * detect requirement to exit there and act accordingly
+     * and avoid having instate overriden later on
+     */
+    if (ctxt->instate == XML_PARSER_EOF)
+        return;
+
     /*
      * This is only for internal subset. On external entities,
      * the replacement is done before parsing stage
-- 
cgit v1.2.3


From afd27c21f6b36e22682b7da20d726bce2dcb2f43 Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Mon, 9 Nov 2015 18:07:18 +0800
Subject: Avoid processing entities after encoding conversion failures

For https://bugzilla.gnome.org/show_bug.cgi?id=756527
and was also raised by Chromium team in the past

When we hit a convwersion failure when switching encoding
it is bestter to stop parsing there, this was treated as a
fatal error but the parser was continuing to process to extract
more errors, unfortunately that makes little sense as the data
is obviously corrupt and can potentially lead to unexpected behaviour.
---
 parser.c          |  7 +++++--
 parserInternals.c | 11 ++++++++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/parser.c b/parser.c
index 134afe70..c79b4e85 100644
--- a/parser.c
+++ b/parser.c
@@ -10665,7 +10665,8 @@ xmlParseXMLDecl(xmlParserCtxtPtr ctxt) {
 	xmlFatalErrMsg(ctxt, XML_ERR_SPACE_REQUIRED, "Blank needed here\n");
     }
     xmlParseEncodingDecl(ctxt);
-    if (ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) {
+    if ((ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) ||
+         (ctxt->instate == XML_PARSER_EOF)) {
 	/*
 	 * The XML REC instructs us to stop parsing right here
 	 */
@@ -10789,6 +10790,7 @@ xmlParseDocument(xmlParserCtxtPtr ctxt) {
 
     if (CUR == 0) {
 	xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
+	return(-1);
     }
 
     /*
@@ -10806,7 +10808,8 @@ xmlParseDocument(xmlParserCtxtPtr ctxt) {
 	 * Note that we will switch encoding on the fly.
 	 */
 	xmlParseXMLDecl(ctxt);
-	if (ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) {
+	if ((ctxt->errNo == XML_ERR_UNSUPPORTED_ENCODING) ||
+	    (ctxt->instate == XML_PARSER_EOF)) {
 	    /*
 	     * The XML REC instructs us to stop parsing right here
 	     */
diff --git a/parserInternals.c b/parserInternals.c
index df204fde..c8230c1c 100644
--- a/parserInternals.c
+++ b/parserInternals.c
@@ -937,6 +937,7 @@ xmlSwitchEncoding(xmlParserCtxtPtr ctxt, xmlCharEncoding enc)
 {
     xmlCharEncodingHandlerPtr handler;
     int len = -1;
+    int ret;
 
     if (ctxt == NULL) return(-1);
     switch (enc) {
@@ -1097,7 +1098,15 @@ xmlSwitchEncoding(xmlParserCtxtPtr ctxt, xmlCharEncoding enc)
     if (handler == NULL)
 	return(-1);
     ctxt->charset = XML_CHAR_ENCODING_UTF8;
-    return(xmlSwitchToEncodingInt(ctxt, handler, len));
+    ret = xmlSwitchToEncodingInt(ctxt, handler, len);
+    if ((ret < 0) || (ctxt->errNo == XML_I18N_CONV_FAILED)) {
+        /*
+	 * on encoding conversion errors, stop the parser
+	 */
+        xmlStopParser(ctxt);
+	ctxt->errNo = XML_I18N_CONV_FAILED;
+    }
+    return(ret);
 }
 
 /**
-- 
cgit v1.2.3


From 53ac9c9649fa091377dfea9511f012171f08972d Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Mon, 9 Nov 2015 18:16:00 +0800
Subject: xmlStopParser reset errNo

I had used it in contexts where that information ought to be preserved
---
 parser.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/parser.c b/parser.c
index c79b4e85..b7b66682 100644
--- a/parser.c
+++ b/parser.c
@@ -6782,6 +6782,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 	if (RAW != '[') {
 	    xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
 	    xmlStopParser(ctxt);
+	    ctxt->errNo = XML_ERR_CONDSEC_INVALID;
 	    return;
 	} else {
 	    if (ctxt->input->id != id) {
@@ -6844,6 +6845,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 	if (RAW != '[') {
 	    xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
 	    xmlStopParser(ctxt);
+	    ctxt->errNo = XML_ERR_CONDSEC_INVALID;
 	    return;
 	} else {
 	    if (ctxt->input->id != id) {
@@ -6901,6 +6903,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
     } else {
 	xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID_KEYWORD, NULL);
 	xmlStopParser(ctxt);
+	ctxt->errNo = XML_ERR_CONDSEC_INVALID_KEYWORD;
 	return;
     }
 
-- 
cgit v1.2.3


From 6360a31a84efe69d155ed96306b9a931a40beab9 Mon Sep 17 00:00:00 2001
From: David Drysdale <drysdale@google.com>
Date: Fri, 20 Nov 2015 10:47:12 +0800
Subject: CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey

For https://bugzilla.gnome.org/show_bug.cgi?id=756528
It was possible to hit a negative offset in the name indexing
used to randomize the dictionary key generation
Reported and fix provided by David Drysdale @ Google
---
 dict.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dict.c b/dict.c
index 5f71d55d..8c8f9314 100644
--- a/dict.c
+++ b/dict.c
@@ -486,7 +486,10 @@ xmlDictComputeFastQKey(const xmlChar *prefix, int plen,
 	value += 30 * (*prefix);
 
     if (len > 10) {
-        value += name[len - (plen + 1 + 1)];
+        int offset = len - (plen + 1 + 1);
+	if (offset < 0)
+	    offset = len - (10 + 1);
+	value += name[offset];
         len = 10;
 	if (plen > 10)
 	    plen = 10;
-- 
cgit v1.2.3


From 69030714cde66d525a8884bda01b9e8f0abf8e1e Mon Sep 17 00:00:00 2001
From: David Drysdale <drysdale@google.com>
Date: Fri, 20 Nov 2015 11:13:45 +0800
Subject: CVE-2015-5312 Another entity expansion issue

For https://bugzilla.gnome.org/show_bug.cgi?id=756733
It is one case where the code in place to detect entities expansions
failed to exit when the situation was detected, leading to DoS
Problem reported by Kostya Serebryany @ Google
Patch provided by David Drysdale @ Google
---
 parser.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/parser.c b/parser.c
index b7b66682..da6e7292 100644
--- a/parser.c
+++ b/parser.c
@@ -2806,6 +2806,10 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
 			                      0, 0, 0);
 		ctxt->depth--;
 
+		if ((ctxt->lastError.code == XML_ERR_ENTITY_LOOP) ||
+		    (ctxt->lastError.code == XML_ERR_INTERNAL_ERROR))
+		    goto int_error;
+
 		if (rep != NULL) {
 		    current = rep;
 		    while (*current != 0) { /* non input consuming loop */
-- 
cgit v1.2.3


From 28cd9cb747a94483f4aea7f0968d202c20bb4cfc Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Fri, 20 Nov 2015 14:55:30 +0800
Subject: Add xmlHaltParser() to stop the parser

The problem is doing it in a consistent and safe fashion
It's more complex than just setting ctxt->instate = XML_PARSER_EOF
Update the public function to reuse that new internal routine
---
 parser.c | 34 +++++++++++++++++++++++++++++-----
 1 file changed, 29 insertions(+), 5 deletions(-)

diff --git a/parser.c b/parser.c
index da6e7292..b6e99b1d 100644
--- a/parser.c
+++ b/parser.c
@@ -94,6 +94,8 @@ static xmlParserCtxtPtr
 xmlCreateEntityParserCtxtInternal(const xmlChar *URL, const xmlChar *ID,
 	                  const xmlChar *base, xmlParserCtxtPtr pctx);
 
+static void xmlHaltParser(xmlParserCtxtPtr ctxt);
+
 /************************************************************************
  *									*
  *	Arbitrary limits set in the parser. See XML_PARSE_HUGE		*
@@ -12625,24 +12627,46 @@ xmlCreatePushParserCtxt(xmlSAXHandlerPtr sax, void *user_data,
 #endif /* LIBXML_PUSH_ENABLED */
 
 /**
- * xmlStopParser:
+ * xmlHaltParser:
  * @ctxt:  an XML parser context
  *
- * Blocks further parser processing
+ * Blocks further parser processing don't override error
+ * for internal use
  */
-void
-xmlStopParser(xmlParserCtxtPtr ctxt) {
+static void
+xmlHaltParser(xmlParserCtxtPtr ctxt) {
     if (ctxt == NULL)
         return;
     ctxt->instate = XML_PARSER_EOF;
-    ctxt->errNo = XML_ERR_USER_STOP;
     ctxt->disableSAX = 1;
     if (ctxt->input != NULL) {
+        /*
+	 * in case there was a specific allocation deallocate before
+	 * overriding base
+	 */
+        if (ctxt->input->free != NULL) {
+	    ctxt->input->free((xmlChar *) ctxt->input->base);
+	    ctxt->input->free = NULL;
+	}
 	ctxt->input->cur = BAD_CAST"";
 	ctxt->input->base = ctxt->input->cur;
     }
 }
 
+/**
+ * xmlStopParser:
+ * @ctxt:  an XML parser context
+ *
+ * Blocks further parser processing
+ */
+void
+xmlStopParser(xmlParserCtxtPtr ctxt) {
+    if (ctxt == NULL)
+        return;
+    xmlHaltParser(ctxt);
+    ctxt->errNo = XML_ERR_USER_STOP;
+}
+
 /**
  * xmlCreateIOParserCtxt:
  * @sax:  a SAX handler
-- 
cgit v1.2.3


From e3b1597421ad7cbeb5939fc3b54f43f141c82366 Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Fri, 20 Nov 2015 14:59:30 +0800
Subject: Reuse xmlHaltParser() where it makes sense

Unify the various place where either xmlStopParser was called
(which resets the error as a side effect) and places where we
used ctxt->instate = XML_PARSER_EOF to stop further processing
---
 parser.c | 37 +++++++++++++++++--------------------
 1 file changed, 17 insertions(+), 20 deletions(-)

diff --git a/parser.c b/parser.c
index b6e99b1d..1810f99f 100644
--- a/parser.c
+++ b/parser.c
@@ -1773,7 +1773,7 @@ nodePush(xmlParserCtxtPtr ctxt, xmlNodePtr value)
 	xmlFatalErrMsgInt(ctxt, XML_ERR_INTERNAL_ERROR,
 		 "Excessive depth in document: %d use XML_PARSE_HUGE option\n",
 			  xmlParserMaxDepth);
-	ctxt->instate = XML_PARSER_EOF;
+	xmlHaltParser(ctxt);
 	return(-1);
     }
     ctxt->nodeTab[ctxt->nodeNr] = value;
@@ -5675,7 +5675,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt) {
 	if (RAW != '>') {
 	    xmlFatalErrMsgStr(ctxt, XML_ERR_ENTITY_NOT_FINISHED,
 	            "xmlParseEntityDecl: entity %s not terminated\n", name);
-	    xmlStopParser(ctxt);
+	    xmlHaltParser(ctxt);
 	} else {
 	    if (input != ctxt->input) {
 		xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
@@ -6787,8 +6787,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 	SKIP_BLANKS;
 	if (RAW != '[') {
 	    xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
-	    xmlStopParser(ctxt);
-	    ctxt->errNo = XML_ERR_CONDSEC_INVALID;
+	    xmlHaltParser(ctxt);
 	    return;
 	} else {
 	    if (ctxt->input->id != id) {
@@ -6850,8 +6849,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 	SKIP_BLANKS;
 	if (RAW != '[') {
 	    xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID, NULL);
-	    xmlStopParser(ctxt);
-	    ctxt->errNo = XML_ERR_CONDSEC_INVALID;
+	    xmlHaltParser(ctxt);
 	    return;
 	} else {
 	    if (ctxt->input->id != id) {
@@ -6908,8 +6906,7 @@ xmlParseConditionalSections(xmlParserCtxtPtr ctxt) {
 
     } else {
 	xmlFatalErr(ctxt, XML_ERR_CONDSEC_INVALID_KEYWORD, NULL);
-	xmlStopParser(ctxt);
-	ctxt->errNo = XML_ERR_CONDSEC_INVALID_KEYWORD;
+	xmlHaltParser(ctxt);
 	return;
     }
 
@@ -7120,7 +7117,7 @@ xmlParseExternalSubset(xmlParserCtxtPtr ctxt, const xmlChar *ExternalID,
 	    /*
 	     * The XML REC instructs us to stop parsing right here
 	     */
-	    ctxt->instate = XML_PARSER_EOF;
+	    xmlHaltParser(ctxt);
 	    return;
 	}
     }
@@ -8107,7 +8104,7 @@ xmlParsePEReference(xmlParserCtxtPtr ctxt)
 		     * The XML REC instructs us to stop parsing
 		     * right here
 		     */
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    return;
 		}
 	    }
@@ -10047,7 +10044,7 @@ xmlParseContent(xmlParserCtxtPtr ctxt) {
 	if ((cons == ctxt->input->consumed) && (test == CUR_PTR)) {
 	    xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR,
 	                "detected an error in element content\n");
-	    ctxt->instate = XML_PARSER_EOF;
+	    xmlHaltParser(ctxt);
             break;
 	}
     }
@@ -10082,7 +10079,7 @@ xmlParseElement(xmlParserCtxtPtr ctxt) {
 	xmlFatalErrMsgInt(ctxt, XML_ERR_INTERNAL_ERROR,
 		 "Excessive depth in document: %d use XML_PARSE_HUGE option\n",
 			  xmlParserMaxDepth);
-	ctxt->instate = XML_PARSER_EOF;
+	xmlHaltParser(ctxt);
 	return;
     }
 
@@ -11412,7 +11409,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 			ctxt->sax->setDocumentLocator(ctxt->userData,
 						      &xmlDefaultSAXLocator);
 		    xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 #ifdef DEBUG_PUSH
 		    xmlGenericError(xmlGenericErrorContext,
 			    "PP: entering EOF\n");
@@ -11445,7 +11442,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 			     * The XML REC instructs us to stop parsing right
 			     * here
 			     */
-			    ctxt->instate = XML_PARSER_EOF;
+			    xmlHaltParser(ctxt);
 			    return(0);
 			}
 			ctxt->standalone = ctxt->input->standalone;
@@ -11501,7 +11498,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		cur = ctxt->input->cur[0];
 	        if (cur != '<') {
 		    xmlFatalErr(ctxt, XML_ERR_DOCUMENT_EMPTY, NULL);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
 			ctxt->sax->endDocument(ctxt->userData);
 		    goto done;
@@ -11533,7 +11530,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		    goto done;
 		if (name == NULL) {
 		    spacePop(ctxt);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    if ((ctxt->sax) && (ctxt->sax->endDocument != NULL))
 			ctxt->sax->endDocument(ctxt->userData);
 		    goto done;
@@ -11700,7 +11697,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		if ((cons == ctxt->input->consumed) && (test == CUR_PTR)) {
 		    xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR,
 		                "detected an error in element content\n");
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 		    break;
 		}
 		break;
@@ -12021,7 +12018,7 @@ xmlParseTryOrFinish(xmlParserCtxtPtr ctxt, int terminate) {
 		    goto done;
 		} else {
 		    xmlFatalErr(ctxt, XML_ERR_DOCUMENT_END, NULL);
-		    ctxt->instate = XML_PARSER_EOF;
+		    xmlHaltParser(ctxt);
 #ifdef DEBUG_PUSH
 		    xmlGenericError(xmlGenericErrorContext,
 			    "PP: entering EOF\n");
@@ -12385,7 +12382,7 @@ xmldecl_done:
 	res = xmlParserInputBufferPush(ctxt->input->buf, size, chunk);
 	if (res < 0) {
 	    ctxt->errNo = XML_PARSER_EOF;
-	    ctxt->disableSAX = 1;
+	    xmlHaltParser(ctxt);
 	    return (XML_PARSER_EOF);
 	}
         xmlBufSetInputBaseCur(ctxt->input->buf->buffer, ctxt->input, base, cur);
@@ -12439,7 +12436,7 @@ xmldecl_done:
          ((ctxt->input->cur - ctxt->input->base) > XML_MAX_LOOKUP_LIMIT)) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
-        ctxt->instate = XML_PARSER_EOF;
+        xmlHaltParser(ctxt);
     }
     if ((ctxt->errNo != XML_ERR_OK) && (ctxt->disableSAX == 1))
         return(ctxt->errNo);
-- 
cgit v1.2.3


From ce0b0d0d81fdbb5f722a890432b52d363e4de57b Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Fri, 20 Nov 2015 15:01:22 +0800
Subject: Do not print error context when there is none

Which now happens more frequently du to xmlHaltParser use
---
 error.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/error.c b/error.c
index cbcf5c96..9c450405 100644
--- a/error.c
+++ b/error.c
@@ -177,7 +177,9 @@ xmlParserPrintFileContextInternal(xmlParserInputPtr input ,
     xmlChar  content[81]; /* space for 80 chars + line terminator */
     xmlChar *ctnt;
 
-    if (input == NULL) return;
+    if ((input == NULL) || (input->cur == NULL) ||
+        (*input->cur == 0)) return;
+
     cur = input->cur;
     base = input->base;
     /* skip backwards over any end-of-lines */
-- 
cgit v1.2.3


From 35bcb1d758ed70aa7b257c9c3b3ff55e54e3d0da Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Fri, 20 Nov 2015 15:04:09 +0800
Subject: Detect incoherency on GROW

the current pointer to the input has to be between the base and end
if not stop everything we have an internal state error.
---
 parser.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/parser.c b/parser.c
index 1810f99f..ab007aaa 100644
--- a/parser.c
+++ b/parser.c
@@ -2075,9 +2075,16 @@ static void xmlGROW (xmlParserCtxtPtr ctxt) {
          ((ctxt->input->buf) && (ctxt->input->buf->readcallback != (xmlInputReadCallback) xmlNop)) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
-        ctxt->instate = XML_PARSER_EOF;
+        xmlHaltParser(ctxt);
+	return;
     }
     xmlParserInputGrow(ctxt->input, INPUT_CHUNK);
+    if ((ctxt->input->cur > ctxt->input->end) ||
+        (ctxt->input->cur < ctxt->input->base)) {
+        xmlHaltParser(ctxt);
+        xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "cur index out of bound");
+	return;
+    }
     if ((ctxt->input->cur != NULL) && (*ctxt->input->cur == 0) &&
         (xmlParserInputGrow(ctxt->input, INPUT_CHUNK) <= 0))
 	    xmlPopInput(ctxt);
-- 
cgit v1.2.3


From 3bd6ae147e294da6b378379cc87615b8fc111e73 Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Fri, 20 Nov 2015 15:06:02 +0800
Subject: Fix some loop issues embedding NEXT

Next can switch the parser back to XML_PARSER_EOF state, we
need to consider those in loops consuming input
---
 parser.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/parser.c b/parser.c
index ab007aaa..c7e4574b 100644
--- a/parser.c
+++ b/parser.c
@@ -2160,7 +2160,8 @@ xmlSkipBlankChars(xmlParserCtxtPtr ctxt) {
 	int cur;
 	do {
 	    cur = CUR;
-	    while (IS_BLANK_CH(cur)) { /* CHECKED tstblanks.xml */
+	    while ((IS_BLANK_CH(cur) && /* CHECKED tstblanks.xml */
+	           (ctxt->instate != XML_PARSER_EOF))) {
 		NEXT;
 		cur = CUR;
 		res++;
@@ -2174,7 +2175,8 @@ xmlSkipBlankChars(xmlParserCtxtPtr ctxt) {
 	     * Need to handle support of entities branching here
 	     */
 	    if (*ctxt->input->cur == '%') xmlParserHandlePEReference(ctxt);
-	} while (IS_BLANK(cur)); /* CHECKED tstblanks.xml */
+	} while ((IS_BLANK(cur)) && /* CHECKED tstblanks.xml */
+	         (ctxt->instate != XML_PARSER_EOF));
     }
     return(res);
 }
-- 
cgit v1.2.3


From fdfeecc1b73b0318466f0d61f0b8881ed9d92dd2 Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Fri, 20 Nov 2015 15:07:38 +0800
Subject: Bug on creating new stream from entity

sometimes the entity could have a lenght of 0, i.e. it wasn't
parsed or used yet, and we ended up with an incoherent input state
---
 parserInternals.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/parserInternals.c b/parserInternals.c
index c8230c1c..2b8646c2 100644
--- a/parserInternals.c
+++ b/parserInternals.c
@@ -1459,6 +1459,8 @@ xmlNewEntityInputStream(xmlParserCtxtPtr ctxt, xmlEntityPtr entity) {
     if (entity->URI != NULL)
 	input->filename = (char *) xmlStrdup((xmlChar *) entity->URI);
     input->base = entity->content;
+    if (entity->length == 0)
+        entity->length = xmlStrlen(entity->content);
     input->cur = entity->content;
     input->length = entity->length;
     input->end = &entity->content[input->length];
-- 
cgit v1.2.3


From f1063fdbe7fa66332bbb76874101c2a7b51b519f Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Fri, 20 Nov 2015 16:06:59 +0800
Subject: CVE-2015-7500 Fix memory access error due to incorrect entities
 boundaries

For https://bugzilla.gnome.org/show_bug.cgi?id=756525
handle properly the case where we popped out of the current entity
while processing a start tag
Reported by Kostya Serebryany @ Google

This slightly modifies the output of 754946 in regression tests
---
 parser.c                     | 28 ++++++++++++++++++++++------
 result/errors/754946.xml.err |  7 +++++--
 2 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/parser.c b/parser.c
index c7e4574b..c5741e3b 100644
--- a/parser.c
+++ b/parser.c
@@ -9348,7 +9348,7 @@ xmlParseStartTag2(xmlParserCtxtPtr ctxt, const xmlChar **pref,
     const xmlChar **atts = ctxt->atts;
     int maxatts = ctxt->maxatts;
     int nratts, nbatts, nbdef;
-    int i, j, nbNs, attval, oldline, oldcol;
+    int i, j, nbNs, attval, oldline, oldcol, inputNr;
     const xmlChar *base;
     unsigned long cur;
     int nsNr = ctxt->nsNr;
@@ -9367,6 +9367,7 @@ reparse:
     SHRINK;
     base = ctxt->input->base;
     cur = ctxt->input->cur - ctxt->input->base;
+    inputNr = ctxt->inputNr;
     oldline = ctxt->input->line;
     oldcol = ctxt->input->col;
     nbatts = 0;
@@ -9392,7 +9393,8 @@ reparse:
      */
     SKIP_BLANKS;
     GROW;
-    if (ctxt->input->base != base) goto base_changed;
+    if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+        goto base_changed;
 
     while (((RAW != '>') &&
 	   ((RAW != '/') || (NXT(1) != '>')) &&
@@ -9403,7 +9405,7 @@ reparse:
 
 	attname = xmlParseAttribute2(ctxt, prefix, localname,
 	                             &aprefix, &attvalue, &len, &alloc);
-	if (ctxt->input->base != base) {
+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr)) {
 	    if ((attvalue != NULL) && (alloc != 0))
 	        xmlFree(attvalue);
 	    attvalue = NULL;
@@ -9552,7 +9554,8 @@ skip_ns:
 		    break;
 		}
 		SKIP_BLANKS;
-		if (ctxt->input->base != base) goto base_changed;
+		if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+		    goto base_changed;
 		continue;
 	    }
 
@@ -9589,7 +9592,8 @@ failed:
 	GROW
         if (ctxt->instate == XML_PARSER_EOF)
             break;
-	if (ctxt->input->base != base) goto base_changed;
+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+	    goto base_changed;
 	if ((RAW == '>') || (((RAW == '/') && (NXT(1) == '>'))))
 	    break;
 	if (!IS_BLANK_CH(RAW)) {
@@ -9605,7 +9609,8 @@ failed:
 	    break;
 	}
         GROW;
-	if (ctxt->input->base != base) goto base_changed;
+	if ((ctxt->input->base != base) || (inputNr != ctxt->inputNr))
+	    goto base_changed;
     }
 
     /*
@@ -9772,6 +9777,17 @@ base_changed:
 	    if ((ctxt->attallocs[j] != 0) && (atts[i] != NULL))
 	        xmlFree((xmlChar *) atts[i]);
     }
+
+    /*
+     * We can't switch from one entity to another in the middle
+     * of a start tag
+     */
+    if (inputNr != ctxt->inputNr) {
+        xmlFatalErrMsg(ctxt, XML_ERR_ENTITY_BOUNDARY,
+		    "Start tag doesn't start and stop in the same entity\n");
+	return(NULL);
+    }
+
     ctxt->input->cur = ctxt->input->base + cur;
     ctxt->input->line = oldline;
     ctxt->input->col = oldcol;
diff --git a/result/errors/754946.xml.err b/result/errors/754946.xml.err
index 423dff56..a75088b9 100644
--- a/result/errors/754946.xml.err
+++ b/result/errors/754946.xml.err
@@ -11,6 +11,9 @@ Entity: line 1: parser error : DOCTYPE improperly terminated
 Entity: line 1: 
 A<lbbbbbbbbbbbbbbbbbbb_
 ^
+./test/errors/754946.xml:1: parser error : Start tag doesn't start and stop in the same entity
+>%SYSTEM;<![
+         ^
 ./test/errors/754946.xml:1: parser error : Extra content at the end of the document
-<!DOCTYPEA[<!ENTITY %
-  ^
+>%SYSTEM;<![
+         ^
-- 
cgit v1.2.3


From 8fb4a770075628d6441fb17a1e435100e2f3b1a2 Mon Sep 17 00:00:00 2001
From: Hugh Davenport <hugh@allthethings.co.nz>
Date: Fri, 20 Nov 2015 17:16:06 +0800
Subject: CVE-2015-8242 Buffer overead with HTML parser in push mode

For https://bugzilla.gnome.org/show_bug.cgi?id=756372
Error in the code pointing to the codepoint in the stack for the
current char value instead of the pointer in the input that the SAX
callback expects
Reported and fixed by Hugh Davenport
---
 HTMLparser.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/HTMLparser.c b/HTMLparser.c
index bdf78071..b7291972 100644
--- a/HTMLparser.c
+++ b/HTMLparser.c
@@ -5735,17 +5735,17 @@ htmlParseTryOrFinish(htmlParserCtxtPtr ctxt, int terminate) {
 				if (ctxt->keepBlanks) {
 				    if (ctxt->sax->characters != NULL)
 					ctxt->sax->characters(
-						ctxt->userData, &cur, 1);
+						ctxt->userData, &in->cur[0], 1);
 				} else {
 				    if (ctxt->sax->ignorableWhitespace != NULL)
 					ctxt->sax->ignorableWhitespace(
-						ctxt->userData, &cur, 1);
+						ctxt->userData, &in->cur[0], 1);
 				}
 			    } else {
 				htmlCheckParagraph(ctxt);
 				if (ctxt->sax->characters != NULL)
 				    ctxt->sax->characters(
-					    ctxt->userData, &cur, 1);
+					    ctxt->userData, &in->cur[0], 1);
 			    }
 			}
 			ctxt->token = 0;
-- 
cgit v1.2.3


From 6657afe83a38278f124ace71dc85f60420beb2d5 Mon Sep 17 00:00:00 2001
From: Daniel Veillard <veillard@redhat.com>
Date: Fri, 20 Nov 2015 17:55:11 +0800
Subject: Release of libxml2-2.9.3

* configure.ac: updated
* doc/*: regenerated
---
 configure.ac                  |   2 +-
 doc/APIfiles.html             |   1 +
 doc/APIsymbols.html           |   1 +
 doc/devhelp/libxml2-tree.html |   3 +-
 doc/devhelp/libxml2.devhelp   |   1 +
 doc/html/libxml-tree.html     |   1 +
 doc/libxml2-api.xml           |   8 +-
 doc/libxml2-refs.xml          |   3 +
 doc/libxml2.xsa               | 253 ++++++++++++++++++++++++++++--------------
 doc/news.html                 |  73 +++++++++++-
 doc/xml.html                  |  73 ++++++++++++
 python/setup.py               |   2 +-
 testapi.c                     |   8 +-
 13 files changed, 335 insertions(+), 94 deletions(-)

diff --git a/configure.ac b/configure.ac
index 48e0577b..02602814 100644
--- a/configure.ac
+++ b/configure.ac
@@ -8,7 +8,7 @@ AC_CANONICAL_HOST
 
 LIBXML_MAJOR_VERSION=2
 LIBXML_MINOR_VERSION=9
-LIBXML_MICRO_VERSION=2
+LIBXML_MICRO_VERSION=3
 LIBXML_MICRO_VERSION_SUFFIX=
 LIBXML_VERSION=$LIBXML_MAJOR_VERSION.$LIBXML_MINOR_VERSION.$LIBXML_MICRO_VERSION$LIBXML_MICRO_VERSION_SUFFIX
 LIBXML_VERSION_INFO=`expr $LIBXML_MAJOR_VERSION + $LIBXML_MINOR_VERSION`:$LIBXML_MICRO_VERSION:$LIBXML_MINOR_VERSION
diff --git a/doc/APIfiles.html b/doc/APIfiles.html
index 65e004be..2252a6b0 100644
--- a/doc/APIfiles.html
+++ b/doc/APIfiles.html
@@ -1309,6 +1309,7 @@ A:link, A:visited, A:active { text-decoration: underline }
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NONE">XML_ATTRIBUTE_NONE</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NOTATION">XML_ATTRIBUTE_NOTATION</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_REQUIRED">XML_ATTRIBUTE_REQUIRED</a><br />
+<a href="html/libxml-tree.html#XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_DOUBLEIT">XML_BUFFER_ALLOC_DOUBLEIT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_EXACT">XML_BUFFER_ALLOC_EXACT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a><br />
diff --git a/doc/APIsymbols.html b/doc/APIsymbols.html
index c2b82e7d..cdde358d 100644
--- a/doc/APIsymbols.html
+++ b/doc/APIsymbols.html
@@ -154,6 +154,7 @@ A:link, A:visited, A:active { text-decoration: underline }
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NONE">XML_ATTRIBUTE_NONE</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_NOTATION">XML_ATTRIBUTE_NOTATION</a><br />
 <a href="html/libxml-tree.html#XML_ATTRIBUTE_REQUIRED">XML_ATTRIBUTE_REQUIRED</a><br />
+<a href="html/libxml-tree.html#XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_DOUBLEIT">XML_BUFFER_ALLOC_DOUBLEIT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_EXACT">XML_BUFFER_ALLOC_EXACT</a><br />
 <a href="html/libxml-tree.html#XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a><br />
diff --git a/doc/devhelp/libxml2-tree.html b/doc/devhelp/libxml2-tree.html
index 3cc28c71..5f8d1f28 100644
--- a/doc/devhelp/libxml2-tree.html
+++ b/doc/devhelp/libxml2-tree.html
@@ -409,7 +409,8 @@ The content of this structure is not made public by the API.
     <a name="XML_BUFFER_ALLOC_EXACT">XML_BUFFER_ALLOC_EXACT</a> = 2 /* grow only to the minimal size */
     <a name="XML_BUFFER_ALLOC_IMMUTABLE">XML_BUFFER_ALLOC_IMMUTABLE</a> = 3 /* immutable buffer */
     <a name="XML_BUFFER_ALLOC_IO">XML_BUFFER_ALLOC_IO</a> = 4 /* special allocation scheme used for I/O */
-    <a name="XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a> = 5 /*  exact up to a threshold, and doubleit thereafter */
+    <a name="XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a> = 5 /* exact up to a threshold, and doubleit thereafter */
+    <a name="XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a> = 6 /*  limit the upper size of the buffer */
 };
 </pre><p/>
 </div>
diff --git a/doc/devhelp/libxml2.devhelp b/doc/devhelp/libxml2.devhelp
index 282546ab..fbd3ad4a 100644
--- a/doc/devhelp/libxml2.devhelp
+++ b/doc/devhelp/libxml2.devhelp
@@ -351,6 +351,7 @@
     <function name="XML_ATTRIBUTE_NONE" link="libxml2-tree.html#XML_ATTRIBUTE_NONE"/>
     <function name="XML_ATTRIBUTE_NOTATION" link="libxml2-tree.html#XML_ATTRIBUTE_NOTATION"/>
     <function name="XML_ATTRIBUTE_REQUIRED" link="libxml2-tree.html#XML_ATTRIBUTE_REQUIRED"/>
+    <function name="XML_BUFFER_ALLOC_BOUNDED" link="libxml2-tree.html#XML_BUFFER_ALLOC_BOUNDED"/>
     <function name="XML_BUFFER_ALLOC_DOUBLEIT" link="libxml2-tree.html#XML_BUFFER_ALLOC_DOUBLEIT"/>
     <function name="XML_BUFFER_ALLOC_EXACT" link="libxml2-tree.html#XML_BUFFER_ALLOC_EXACT"/>
     <function name="XML_BUFFER_ALLOC_HYBRID" link="libxml2-tree.html#XML_BUFFER_ALLOC_HYBRID"/>
diff --git a/doc/html/libxml-tree.html b/doc/html/libxml-tree.html
index e2081cc5..d1d005f6 100644
--- a/doc/html/libxml-tree.html
+++ b/doc/html/libxml-tree.html
@@ -305,6 +305,7 @@ The content of this structure is not made public by the API.
     <a name="XML_BUFFER_ALLOC_IMMUTABLE" id="XML_BUFFER_ALLOC_IMMUTABLE">XML_BUFFER_ALLOC_IMMUTABLE</a> = 3 : immutable buffer
     <a name="XML_BUFFER_ALLOC_IO" id="XML_BUFFER_ALLOC_IO">XML_BUFFER_ALLOC_IO</a> = 4 : special allocation scheme used for I/O
     <a name="XML_BUFFER_ALLOC_HYBRID" id="XML_BUFFER_ALLOC_HYBRID">XML_BUFFER_ALLOC_HYBRID</a> = 5 : exact up to a threshold, and doubleit thereafter
+    <a name="XML_BUFFER_ALLOC_BOUNDED" id="XML_BUFFER_ALLOC_BOUNDED">XML_BUFFER_ALLOC_BOUNDED</a> = 6 : limit the upper size of the buffer
 }
 </pre><h3><a name="xmlDOMWrapCtxt" id="xmlDOMWrapCtxt">Structure xmlDOMWrapCtxt</a></h3><pre class="programlisting">Structure xmlDOMWrapCtxt<br />struct _xmlDOMWrapCtxt {
     void *	_private	: * The type of this context, just in case
diff --git a/doc/libxml2-api.xml b/doc/libxml2-api.xml
index f83d14f0..5573f0c5 100644
--- a/doc/libxml2-api.xml
+++ b/doc/libxml2-api.xml
@@ -1441,12 +1441,12 @@
      <exports symbol='XML_DOC_DTDVALID' type='enum'/>
      <exports symbol='XML_ELEMENT_TYPE_ANY' type='enum'/>
      <exports symbol='XML_DOC_NSVALID' type='enum'/>
-     <exports symbol='XML_ELEMENT_CONTENT_ONCE' type='enum'/>
+     <exports symbol='XML_BUFFER_ALLOC_BOUNDED' type='enum'/>
      <exports symbol='XML_ELEMENT_CONTENT_PCDATA' type='enum'/>
      <exports symbol='XML_ATTRIBUTE_FIXED' type='enum'/>
      <exports symbol='XML_DOCUMENT_TYPE_NODE' type='enum'/>
      <exports symbol='XML_DOC_HTML' type='enum'/>
-     <exports symbol='XML_ELEMENT_CONTENT_OPT' type='enum'/>
+     <exports symbol='XML_ELEMENT_CONTENT_ONCE' type='enum'/>
      <exports symbol='XML_NAMESPACE_DECL' type='enum'/>
      <exports symbol='XML_ATTRIBUTE_NOTATION' type='enum'/>
      <exports symbol='XML_ELEMENT_TYPE_MIXED' type='enum'/>
@@ -1459,6 +1459,7 @@
      <exports symbol='XML_NOTATION_NODE' type='enum'/>
      <exports symbol='XML_ELEMENT_CONTENT_SEQ' type='enum'/>
      <exports symbol='XML_ELEMENT_TYPE_EMPTY' type='enum'/>
+     <exports symbol='XML_ELEMENT_CONTENT_OPT' type='enum'/>
      <exports symbol='XML_ATTRIBUTE_ENUMERATION' type='enum'/>
      <exports symbol='XML_DOC_OLD10' type='enum'/>
      <exports symbol='XML_HTML_DOCUMENT_NODE' type='enum'/>
@@ -4702,9 +4703,10 @@
     <enum name='XML_ATTRIBUTE_NONE' file='tree' value='1' type='xmlAttributeDefault'/>
     <enum name='XML_ATTRIBUTE_NOTATION' file='tree' value='10' type='xmlAttributeType'/>
     <enum name='XML_ATTRIBUTE_REQUIRED' file='tree' value='2' type='xmlAttributeDefault'/>
+    <enum name='XML_BUFFER_ALLOC_BOUNDED' file='tree' value='6' type='xmlBufferAllocationScheme' info=' limit the upper size of the buffer'/>
     <enum name='XML_BUFFER_ALLOC_DOUBLEIT' file='tree' value='1' type='xmlBufferAllocationScheme' info='double each time one need to grow'/>
     <enum name='XML_BUFFER_ALLOC_EXACT' file='tree' value='2' type='xmlBufferAllocationScheme' info='grow only to the minimal size'/>
-    <enum name='XML_BUFFER_ALLOC_HYBRID' file='tree' value='5' type='xmlBufferAllocationScheme' info=' exact up to a threshold, and doubleit thereafter'/>
+    <enum name='XML_BUFFER_ALLOC_HYBRID' file='tree' value='5' type='xmlBufferAllocationScheme' info='exact up to a threshold, and doubleit thereafter'/>
     <enum name='XML_BUFFER_ALLOC_IMMUTABLE' file='tree' value='3' type='xmlBufferAllocationScheme' info='immutable buffer'/>
     <enum name='XML_BUFFER_ALLOC_IO' file='tree' value='4' type='xmlBufferAllocationScheme' info='special allocation scheme used for I/O'/>
     <enum name='XML_BUF_OVERFLOW' file='xmlerror' value='7000' type='xmlParserErrors'/>
diff --git a/doc/libxml2-refs.xml b/doc/libxml2-refs.xml
index f42fab4e..71586099 100644
--- a/doc/libxml2-refs.xml
+++ b/doc/libxml2-refs.xml
@@ -148,6 +148,7 @@
     <reference name='XML_ATTRIBUTE_NONE' href='html/libxml-tree.html#XML_ATTRIBUTE_NONE'/>
     <reference name='XML_ATTRIBUTE_NOTATION' href='html/libxml-tree.html#XML_ATTRIBUTE_NOTATION'/>
     <reference name='XML_ATTRIBUTE_REQUIRED' href='html/libxml-tree.html#XML_ATTRIBUTE_REQUIRED'/>
+    <reference name='XML_BUFFER_ALLOC_BOUNDED' href='html/libxml-tree.html#XML_BUFFER_ALLOC_BOUNDED'/>
     <reference name='XML_BUFFER_ALLOC_DOUBLEIT' href='html/libxml-tree.html#XML_BUFFER_ALLOC_DOUBLEIT'/>
     <reference name='XML_BUFFER_ALLOC_EXACT' href='html/libxml-tree.html#XML_BUFFER_ALLOC_EXACT'/>
     <reference name='XML_BUFFER_ALLOC_HYBRID' href='html/libxml-tree.html#XML_BUFFER_ALLOC_HYBRID'/>
@@ -3749,6 +3750,7 @@
       <ref name='XML_ATTRIBUTE_NONE'/>
       <ref name='XML_ATTRIBUTE_NOTATION'/>
       <ref name='XML_ATTRIBUTE_REQUIRED'/>
+      <ref name='XML_BUFFER_ALLOC_BOUNDED'/>
       <ref name='XML_BUFFER_ALLOC_DOUBLEIT'/>
       <ref name='XML_BUFFER_ALLOC_EXACT'/>
       <ref name='XML_BUFFER_ALLOC_HYBRID'/>
@@ -12100,6 +12102,7 @@
       <ref name='XML_ATTRIBUTE_NONE'/>
       <ref name='XML_ATTRIBUTE_NOTATION'/>
       <ref name='XML_ATTRIBUTE_REQUIRED'/>
+      <ref name='XML_BUFFER_ALLOC_BOUNDED'/>
       <ref name='XML_BUFFER_ALLOC_DOUBLEIT'/>
       <ref name='XML_BUFFER_ALLOC_EXACT'/>
       <ref name='XML_BUFFER_ALLOC_HYBRID'/>
diff --git a/doc/libxml2.xsa b/doc/libxml2.xsa
index da61d57d..0825d53f 100644
--- a/doc/libxml2.xsa
+++ b/doc/libxml2.xsa
@@ -8,95 +8,182 @@
   </vendor>
   <product id="libxml2">
     <name>libxml2</name>
-    <version>2.9.1</version>
-    <last-release> Apr 19 2013</last-release>
+    <version>2.9.2</version>
+    <last-release> Oct 16 2014</last-release>
     <info-url>http://xmlsoft.org/</info-url>
-    <changes>   -  Features:
-    Support for Python3 (Daniel Veillard),
-    Add xmlXPathSetContextNode and xmlXPathNodeEval (Alex Bligh)
+    <changes>   - Security:
+  Fix for CVE-2014-3660 billion laugh variant (Daniel Veillard),
+  CVE-2014-0191 Do not fetch external parameter entities (Daniel Veillard)
   
-   -  Documentation:
-    Add documentation for xmllint --xpath (Daniel Veillard),
-    Fix the URL of the SAX documentation from James (Daniel Veillard),
-    Fix spelling of "length". (Michael Wood)
+   - Bug Fixes:
+  fix memory leak xml header encoding field with XML_PARSE_IGNORE_ENC (Bart De Schuymer),
+  xmlmemory: handle realloc properly (Yegor Yefremov),
+  Python generator bug raised by the const change (Daniel Veillard),
+  Windows Critical sections not released correctly (Daniel Veillard),
+  Parser error on repeated recursive entity expansion containing &amp;lt; (Daniel Veillard),
+  xpointer : fixing Null Pointers (Gaurav Gupta),
+  Remove Unnecessary Null check in xpointer.c (Gaurav Gupta),
+  parser bug on misformed namespace attributes (Dennis Filder),
+  Pointer dereferenced before null check (Daniel Veillard),
+  Leak of struct addrinfo in xmlNanoFTPConnect() (Gaurav Gupta),
+  Possible overflow in HTMLParser.c (Daniel Veillard),
+  python/tests/sync.py assumes Python dictionaries are ordered (John Beck),
+  Fix Enum check and missing break (Gaurav Gupta),
+  xmlIO: Handle error returns from dup() (Philip Withnall),
+  Fix a problem properly saving URIs (Daniel Veillard),
+  wrong error column in structured error when parsing attribute values (Juergen Keil),
+  wrong error column in structured error when skipping whitespace in xml decl (Juergen Keil),
+  no error column in structured error handler for xml schema validation errors (Juergen Keil),
+  Couple of Missing Null checks (Gaurav Gupta),
+  Add couple of missing Null checks (Daniel Veillard),
+  xmlschemastypes: Fix potential array overflow (Philip Withnall),
+  runtest: Fix a memory leak on parse failure (Philip Withnall),
+  xmlIO: Fix an FD leak on gzdopen() failure (Philip Withnall),
+  xmlcatalog: Fix a memory leak on quit (Philip Withnall),
+  HTMLparser: Correctly initialise a stack allocated structure (Philip Withnall),
+  Check for tmon in _xmlSchemaDateAdd() is incorrect (David Kilzer),
+  Avoid Possible Null Pointer in trio.c (Gaurav Gupta),
+  Fix processing in SAX2 in case of an allocation failure (Daniel Veillard),
+  XML Shell command "cd" does not handle "/" at end of path (Daniel Veillard),
+  Fix various Missing Null checks (Gaurav Gupta),
+  Fix a potential NULL dereference (Daniel Veillard),
+  Add a couple of misisng check in xmlRelaxNGCleanupTree (Gaurav Gupta),
+  Add a missing argument check (Gaurav Gupta),
+  Adding a check in case of allocation error (Gaurav Gupta),
+  xmlSaveUri() incorrectly recomposes URIs with rootless paths (Dennis Filder),
+  Adding some missing NULL checks (Gaurav),
+  Fixes for xmlInitParserCtxt (Daniel Veillard),
+  Fix regressions introduced by CVE-2014-0191 patch (Daniel Veillard),
+  erroneously ignores a validation error if no error callback set (Daniel Veillard),
+  xmllint was not parsing the --c14n11 flag (Sérgio Batista),
+  Avoid Possible null pointer dereference in memory debug mode (Gaurav),
+  Avoid Double Null Check (Gaurav),
+  Restore context size and position after XPATH_OP_ARG (Nick Wellnhofer),
+  Fix xmlParseInNodeContext() if node is not element (Daniel Veillard),
+  Avoid a possible NULL pointer dereference (Gaurav),
+  Fix xmlTextWriterWriteElement when a null content is given (Daniel Veillard),
+  Fix an typo 'onrest' in htmlScriptAttributes (Daniel Veillard),
+  fixing a ptotential uninitialized access (Daniel Veillard),
+  Fix an fd leak in an error case (Daniel Veillard),
+  Missing initialization for the catalog module (Daniel Veillard),
+  Handling of XPath function arguments in error case (Nick Wellnhofer),
+  Fix a couple of missing NULL checks (Gaurav),
+  Avoid a possibility of dangling encoding handler (Gaurav),
+  Fix HTML push parser to accept HTML_PARSE_NODEFDTD (Arnold Hendriks),
+  Fix a bug loading some compressed files (Mike Alexander),
+  Fix XPath node comparison bug (Gaurav),
+  Type mismatch in xmlschemas.c (Gaurav),
+  Type mismatch in xmlschemastypes.c (Gaurav),
+  Avoid a deadcode in catalog.c (Daniel Veillard),
+  run close socket on Solaris, same as we do on other platforms (Denis Pauk),
+  Fix pointer dereferenced before null check (Gaurav),
+  Fix a potential NULL dereference in tree code (Daniel Veillard),
+  Fix potential NULL pointer dereferences in regexp code (Gaurav),
+  xmllint --pretty crashed without following numeric argument (Tim Galeckas),
+  Fix XPath expressions of the form '@ns:*' (Nick Wellnhofer),
+  Fix XPath '//' optimization with predicates (Nick Wellnhofer),
+  Clear up a potential NULL dereference (Daniel Veillard),
+  Fix a possible NULL dereference (Gaurav),
+  Avoid crash if allocation fails (Daniel Veillard),
+  Remove occasional leading space in XPath number formatting (Daniel Veillard),
+  Fix handling of mmap errors (Daniel Veillard),
+  Catch malloc error and exit accordingly (Daniel Veillard),
+  missing else in xlink.c (Ami Fischman),
+  Fix a parsing bug on non-ascii element and CR/LF usage (Daniel Veillard),
+  Fix a regression in xmlGetDocCompressMode() (Daniel Veillard),
+  properly quote the namespace uris written out during c14n (Aleksey Sanin),
+  Remove premature XInclude check on URI being relative (Alexey Neyman),
+  Fix missing break on last() function for attributes (dcb),
+  Do not URI escape in server side includes (Romain Bondue),
+  Fix an error in xmlCleanupParser (Alexander Pastukhov)
   
-   -  Portability:
-    Fix python bindings with versions older than 2.7 (Daniel Veillard),
-    rebuild docs:Makefile.am (Roumen Petrov),
-    elfgcchack.h after rebuild in doc (Roumen Petrov),
-    elfgcchack for buf module (Roumen Petrov),
-    Fix a uneeded and wrong extra link parameter (Daniel Veillard),
-    Few cleanup patches for Windows (Denis Pauk),
-    Fix rpmbuild --nocheck (Mark Salter),
-    Fix for win32/configure.js and WITH_THREAD_ALLOC (Daniel Richard),
-    Fix Broken multi-arch support in xml2-config (Daniel Veillard),
-    Fix a portability issue for GCC &lt; 3.4.0 (Daniel Veillard),
-    Windows build fixes (Daniel Richard),
-    Fix a thread portability problem (Friedrich Haubensak),
-    Downgrade autoconf requirement to 2.63 (Daniel Veillard)
+   - Documentation:
+  typo in error messages "colon are forbidden from..." (Daniel Veillard),
+  Fix a link to James SAX documentation old page (Daniel Veillard),
+  Fix typos in relaxng.c (Jan Pokorný),
+  Fix a doc typo (Daniel Veillard),
+  Fix typos in {tree,xpath}.c (errror) (Jan Pokorný),
+  Add limitations about encoding conversion (Daniel Veillard),
+  Fix typos in xmlschemas{,types}.c (Jan Pokorný),
+  Fix incorrect spelling entites-&gt;entities (Jan Pokorný),
+  Forgot to document 2.9.1 release, regenerate docs (Daniel Veillard)
   
-   -  Bug Fixes:
-    Fix a linking error for python bindings (Daniel Veillard),
-    Fix a couple of return without value (Jüri Aedla),
-    Improve the hashing functions (Daniel Franke),
-    Improve handling of xmlStopParser() (Daniel Veillard),
-    Remove risk of lockup in dictionary initialization (Daniel Veillard),
-    Activate detection of encoding in external subset (Daniel Veillard),
-    Fix an output buffer flushing conversion bug (Mikhail Titov),
-    Fix an old bug in xmlSchemaValidateOneElement (Csaba László),
-    Fix configure cannot remove messages (Gilles Espinasse),
-    fix schema validation in combination with xsi:nil (Daniel Veillard),
-    xmlCtxtReadFile doesn't work with literal IPv6 URLs (Steve Wolf),
-    Fix a few problems with setEntityLoader (Alexey Neyman),
-    Detect excessive entities expansion upon replacement (Daniel Veillard),
-    Fix the flushing out of raw buffers on encoding conversions (Daniel,
-Veillard),
-    Fix some buffer conversion issues (Daniel Veillard),
-    When calling xmlNodeDump make sure we grow the buffer quickly (Daniel,
-Veillard),
-    Fix an error in the progressive DTD parsing code (Dan Winship),
-    xmllint should not load DTD by default when using the reader (Daniel,
-Veillard),
-    Try IBM-037 when looking for EBCDIC handlers (Petr Sumbera),
-    Fix potential out of bound access (Daniel Veillard),
-    Fix large parse of file from memory (Daniel Veillard),
-    Fix a bug in the nsclean option of the parser (Daniel Veillard),
-    Fix a regression in 2.9.0 breaking validation while streaming (Daniel,
-Veillard),
-    Remove potential calls to exit() (Daniel Veillard)
+   - Portability:
+  AC_CONFIG_FILES and executable bit (Roumen Petrov),
+  remove HAVE_CONFIG_H dependency in testlimits.c (Roumen Petrov),
+  fix some tabs mixing incompatible with python3 (Roumen Petrov),
+  Visual Studio 14 CTP defines snprintf() (Francis Dupont),
+  OS400: do not try to copy unexisting doc files (Patrick Monnerat),
+  OS400: use either configure.ac or configure.in. (Patrick Monnerat),
+  os400: make-src.sh: create physical file with target CCSID (Patrick Monnerat),
+  OS400: Add some more C macros equivalent procedures. (Patrick Monnerat),
+  OS400: use C macros to implement equivalent RPG support procedures. (Patrick Monnerat),
+  OS400: implement XPath macros as procedures for ILE/RPG support. (Patrick Monnerat),
+  OS400: include in distribution tarball. (Patrick Monnerat),
+  OS400: Add README: compilation directives and OS/400 specific stuff. (Patrick Monnerat),
+  OS400: Add compilation scripts. (Patrick Monnerat),
+  OS400: ILE RPG language header files. (Patrick Monnerat),
+  OS400: implement some macros as functions for ILE/RPG language support (that as no macros). (Patrick Monnerat),
+  OS400: UTF8&lt;--&gt;EBCDIC wrappers for system and external library calls (Patrick Monnerat),
+  OS400: Easy character transcoding support (Patrick Monnerat),
+  OS400: iconv functions compatibility wrappers and table builder. (Patrick Monnerat),
+  OS400: create architecture directory. Implement dlfcn emulation. (Patrick Monnerat),
+  Fix building when configuring without xpath and xptr (Daniel Veillard),
+  configure: Add --with-python-install-dir (Jonas Eriksson),
+  Fix compilation with minimum and xinclude. (Nicolas Le Cam),
+  Compile out use of xmlValidateNCName() when not available. (Nicolas Le Cam),
+  Fix compilation with minimum and schematron. (Nicolas Le Cam),
+  Legacy needs xmlSAX2StartElement() and xmlSAX2EndElement(). (Nicolas Le Cam),
+  Don't use xmlValidateName() when not available. (Nicolas Le Cam),
+  Fix a portability issue on Windows (Longstreth Jon),
+  Various portability patches for OpenVMS (Jacob (Jouk) Jansen),
+  Use specific macros for portability to OS/400 (Patrick Monnerat),
+  Add macros needed for OS/400 portability (Patrick Monnerat),
+  Portability patch for fopen on OS/400 (Patrick Monnerat),
+  Portability fixes for OS/400 (Patrick Monnerat),
+  Improve va_list portability (Patrick Monnerat),
+  Portability fix (Patrick Monnerat),
+  Portability fix (Patrick Monnerat),
+  Generic portability fix (Patrick Monnerat),
+  Shortening lines in headers (Patrick Monnerat),
+  build: Use pkg-config to find liblzma in preference to AC_CHECK_LIB (Philip Withnall),
+  build: Add @LZMA_LIBS@ to libxml’s pkg-config files (Philip Withnall),
+  fix some tabs mixing incompatible with python3 (Daniel Veillard),
+  add additional defines checks for support "./configure --with-minimum" (Denis Pauk),
+  Another round of fixes for older versions of Python (Arfrever Frehtes Taifersar Arahesis),
+  python: fix drv_libxml2.py for python3 compatibility (Alexandre Rostovtsev),
+  python: Fix compiler warnings when building python3 bindings (Armin K),
+  Fix for compilation with python 2.6.8 (Petr Sumbera)
   
-   -  Improvements:
-    Regenerated API, and testapi, rebuild documentation (Daniel Veillard),
-    Fix tree iterators broken by 2to3 script (Daniel Veillard),
-    update all tests for Python3 and Python2 (Daniel Veillard),
-    A few more fixes for python 3 affecting libxml2.py (Daniel Veillard),
-    Fix compilation on Python3 (Daniel Veillard),
-    Converting apibuild.py to python3 (Daniel Veillard),
-    First pass at starting porting to python3 (Daniel Veillard),
-    updated configure.in for python3 (Daniel Veillard),
-    Add support for xpathRegisterVariable in Python (Shaun McCance),
-    Added a regression tests from bug 694228 data (Daniel Veillard),
-    Cache presence of '&lt;' in entities content (Daniel Veillard),
-    Avoid extra processing on entities (Daniel Veillard),
-    Python binding for xmlRegisterInputCallback (Alexey Neyman),
-    Python bindings: DOM casts everything to xmlNode (Alexey Neyman),
-    Define LIBXML_THREAD_ALLOC_ENABLED via xmlversion.h (Tim Starling),
-    Adding streaming validation to runtest checks (Daniel Veillard),
-    Add a --pushsmall option to xmllint (Daniel Veillard)
+   - Improvements:
+  win32/libxml2.def.src after rebuild in doc (Roumen Petrov),
+  elfgcchack.h: more legacy needs xmlSAX2StartElement() and xmlSAX2EndElement() (Roumen Petrov),
+  elfgcchack.h: add xmlXPathNodeEval and xmlXPathSetContextNode (Roumen Petrov),
+  Provide cmake module (Samuel Martin),
+  Fix a couple of issues raised by make dist (Daniel Veillard),
+  Fix and add const qualifiers (Kurt Roeckx),
+  Preparing for upcoming release of 2.9.2 (Daniel Veillard),
+  Fix zlib and lzma libraries check via command line (Dmitriy),
+  wrong error column in structured error when parsing end tag (Juergen Keil),
+  doc/news.html: small update to avoid line join while generating NEWS. (Patrick Monnerat),
+  Add methods for python3 iterator (Ron Angeles),
+  Support element node traversal in document fragments. (Kyle VanderBeek),
+  xmlNodeSetName: Allow setting the name to a substring of the currently set name (Tristan Van Berkom),
+  Added macros for argument casts (Eric Zurcher),
+  adding init calls to xml and html Read parsing entry points (Daniel Veillard),
+  Get rid of 'REPLACEMENT CHARACTER' Unicode chars in xmlschemas.c (Jan Pokorný),
+  Implement choice for name classes on attributes (Shaun McCance),
+  Two small namespace tweaks (Daniel Veillard),
+  xmllint --memory should fail on empty files (Daniel Veillard),
+  Cast encoding name to char pointer to match arg type (Nikolay Sivov)
   
-   -  Cleanups:
-    Switched comment in file to UTF-8 encoding (Daniel Veillard),
-    Extend gitignore (Daniel Veillard),
-    Silent the new python test on input (Alexey Neyman),
-    Cleanup of a duplicate test (Daniel Veillard),
-    Cleanup on duplicate test expressions (Daniel Veillard),
-    Fix compiler warning after 153cf15905cf4ec080612ada6703757d10caba1e (Patrick,
-Gansterer),
-    Spec cleanups and a fix for multiarch support (Daniel Veillard),
-    Silence a clang warning (Daniel Veillard),
-    Cleanup the Copyright to be pure MIT Licence wording (Daniel Veillard),
-    rand_seed should be static in dict.c (Wouter Van Rooy),
-    Fix typos in parser comments (Jan Pokorný)
+   - Cleanups:
+  Removal of old configure.in (Daniel Veillard),
+  Unreachable code in tree.c (Gaurav Gupta),
+  Remove a couple of dead conditions (Gaurav Gupta),
+  Avoid some dead code and cleanup in relaxng.c (Gaurav),
+  Drop not needed checks (Denis Pauk),
+  Fix a wrong test (Daniel Veillard)
   
 
 </changes>
diff --git a/doc/news.html b/doc/news.html
index 5c03ba32..e76ef558 100644
--- a/doc/news.html
+++ b/doc/news.html
@@ -8,7 +8,78 @@ H2 {font-family: Verdana,Arial,Helvetica}
 H3 {font-family: Verdana,Arial,Helvetica}
 A:link, A:visited, A:active { text-decoration: underline }
 </style><title>Releases</title></head><body bgcolor="#8b7765" text="#000000" link="#a06060" vlink="#000000"><table border="0" width="100%" cellpadding="5" cellspacing="0" align="center"><tr><td width="120"><a href="http://swpat.ffii.org/"><img src="epatents.png" alt="Action against software patents" /></a></td><td width="180"><a href="http://www.gnome.org/"><img src="gnome2.png" alt="Gnome2 Logo" /></a><a href="http://www.w3.org/Status"><img src="w3c.png" alt="W3C Logo" /></a><a href="http://www.redhat.com/"><img src="redhat.gif" alt="Red Hat Logo" /></a><div align="left"><a href="http://xmlsoft.org/"><img src="Libxml2-Logo-180x168.gif" alt="Made with Libxml2 Logo" /></a></div></td><td><table border="0" width="90%" cellpadding="2" cellspacing="0" align="center" bgcolor="#000000"><tr><td><table width="100%" border="0" cellspacing="1" cellpadding="3" bgcolor="#fffacd"><tr><td align="center"><h1>The XML C parser and toolkit of Gnome</h1><h2>Releases</h2></td></tr></table></td></tr></table></td></tr></table><table border="0" cellpadding="4" cellspacing="0" width="100%" align="center"><tr><td bgcolor="#8b7765"><table border="0" cellspacing="0" cellpadding="2" width="100%"><tr><td valign="top" width="200" bgcolor="#8b7765"><table border="0" cellspacing="0" cellpadding="1" width="100%" bgcolor="#000000"><tr><td><table width="100%" border="0" cellspacing="1" cellpadding="3"><tr><td colspan="1" bgcolor="#eecfa1" align="center"><center><b>Main Menu</b></center></td></tr><tr><td bgcolor="#fffacd"><form action="search.php" enctype="application/x-www-form-urlencoded" method="get"><input name="query" type="text" size="20" value="" /><input name="submit" type="submit" value="Search ..." /></form><ul><li><a href="index.html">Home</a></li><li><a href="html/index.html">Reference Manual</a></li><li><a href="intro.html">Introduction</a></li><li><a href="FAQ.html">FAQ</a></li><li><a href="docs.html" style="font-weight:bold">Developer Menu</a></li><li><a href="bugs.html">Reporting bugs and getting help</a></li><li><a href="help.html">How to help</a></li><li><a href="downloads.html">Downloads</a></li><li><a href="news.html">Releases</a></li><li><a href="XMLinfo.html">XML</a></li><li><a href="XSLT.html">XSLT</a></li><li><a href="xmldtd.html">Validation &amp; DTDs</a></li><li><a href="encoding.html">Encodings support</a></li><li><a href="catalog.html">Catalog support</a></li><li><a href="namespaces.html">Namespaces</a></li><li><a href="contribs.html">Contributions</a></li><li><a href="examples/index.html" style="font-weight:bold">Code Examples</a></li><li><a href="html/index.html" style="font-weight:bold">API Menu</a></li><li><a href="guidelines.html">XML Guidelines</a></li><li><a href="ChangeLog.html">Recent Changes</a></li></ul></td></tr></table><table width="100%" border="0" cellspacing="1" cellpadding="3"><tr><td colspan="1" bgcolor="#eecfa1" align="center"><center><b>Related links</b></center></td></tr><tr><td bgcolor="#fffacd"><ul><li><a href="http://mail.gnome.org/archives/xml/">Mail archive</a></li><li><a href="http://xmlsoft.org/XSLT/">XSLT libxslt</a></li><li><a href="http://phd.cs.unibo.it/gdome2/">DOM gdome2</a></li><li><a href="http://www.aleksey.com/xmlsec/">XML-DSig xmlsec</a></li><li><a href="ftp://xmlsoft.org/">FTP</a></li><li><a href="http://www.zlatkovic.com/projects/libxml/">Windows binaries</a></li><li><a href="http://opencsw.org/packages/libxml2">Solaris binaries</a></li><li><a href="http://www.explain.com.au/oss/libxml2xslt.html">MacOsX binaries</a></li><li><a href="http://lxml.de/">lxml Python bindings</a></li><li><a href="http://cpan.uwinnipeg.ca/dist/XML-LibXML">Perl bindings</a></li><li><a href="http://libxmlplusplus.sourceforge.net/">C++ bindings</a></li><li><a href="http://www.zend.com/php5/articles/php5-xmlphp.php#Heading4">PHP bindings</a></li><li><a href="http://sourceforge.net/projects/libxml2-pas/">Pascal bindings</a></li><li><a href="http://libxml.rubyforge.org/">Ruby bindings</a></li><li><a href="http://tclxml.sourceforge.net/">Tcl bindings</a></li><li><a href="http://bugzilla.gnome.org/buglist.cgi?product=libxml2">Bug Tracker</a></li></ul></td></tr></table></td></tr></table></td><td valign="top" bgcolor="#8b7765"><table border="0" cellspacing="0" cellpadding="1" width="100%"><tr><td><table border="0" cellspacing="0" cellpadding="1" width="100%" bgcolor="#000000"><tr><td><table border="0" cellpadding="3" cellspacing="1" width="100%"><tr><td bgcolor="#fffacd"><p>The <a href="ChangeLog.html">change log</a> describes the recents commits
-to the <a href="http://git.gnome.org/browse/libxml2/">GIT</a> code base.</p><p>Here is the list of public releases:</p><h3>2.9.2: Oct 16 2014</h3><ul>
+to the <a href="http://git.gnome.org/browse/libxml2/">GIT</a> code base.</p><p>Here is the list of public releases:</p><h3>v2.9.3: Nov 20 2015</h3><ul>
+  <li>Security:<br />
+  CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh Davenport),<br />
+  CVE-2015-7500 Fix memory access error due to incorrect entities boundaries (Daniel Veillard),<br />
+  CVE-2015-7499-2 Detect incoherency on GROW (Daniel Veillard),<br />
+  CVE-2015-7499-1 Add xmlHaltParser() to stop the parser (Daniel Veillard),<br />
+  CVE-2015-5312 Another entity expansion issue (David Drysdale),<br />
+  CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey (David Drysdale),<br />
+  CVE-2015-7498 Avoid processing entities after encoding conversion failures (Daniel Veillard),<br />
+  CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard),<br />
+  CVE-2015-7942-2 Fix an error in previous Conditional section patch (Daniel Veillard),<br />
+  CVE-2015-7942 Another variation of overflow in Conditional sections (Daniel Veillard),<br />
+  CVE-2015-1819 Enforce the reader to run in constant memory (Daniel Veillard)<br />
+  CVE-2015-7941_2 Cleanup conditional section error handling (Daniel Veillard),<br />
+  CVE-2015-7941_1 Stop parsing on entities boundaries errors (Daniel Veillard),<br />
+  </li>
+
+  <li>Documentation:<br />
+  Correct spelling of "calling" (Alex Henrie),<br />
+  Fix a small error in xmllint --format description (Fabien Degomme),<br />
+  Avoid XSS on the search of xmlsoft.org (Daniel Veillard)<br />
+  </li>
+
+  <li>Portability:<br />
+  threads: use forward declarations only for glibc (Michael Heimpold),<br />
+  Update Win32 configure.js to search for configure.ac (Daniel Veillard)<br />
+  </li>
+
+  <li>Bug Fixes:<br />
+  Bug on creating new stream from entity (Daniel Veillard),<br />
+  Fix some loop issues embedding NEXT (Daniel Veillard),<br />
+  Do not print error context when there is none (Daniel Veillard),<br />
+  Avoid extra processing of MarkupDecl when EOF (Hugh Davenport),<br />
+  Fix parsing short unclosed comment uninitialized access (Daniel Veillard),<br />
+  Add missing Null check in xmlParseExternalEntityPrivate (Gaurav Gupta),<br />
+  Fix a bug in CData error handling in the push parser (Daniel Veillard),<br />
+  Fix a bug on name parsing at the end of current input buffer (Daniel Veillard),<br />
+  Fix the spurious ID already defined error (Daniel Veillard),<br />
+  Fix previous change to node sort order (Nick Wellnhofer),<br />
+  Fix a self assignment issue raised by clang (Scott Graham),<br />
+  Fail parsing early on if encoding conversion failed (Daniel Veillard),<br />
+  Do not process encoding values if the declaration if broken (Daniel Veillard),<br />
+  Silence clang's -Wunknown-attribute (Michael Catanzaro),<br />
+  xmlMemUsed is not thread-safe (Martin von Gagern),<br />
+  Fix support for except in nameclasses (Daniel Veillard),<br />
+  Fix order of root nodes (Nick Wellnhofer),<br />
+  Allow attributes on descendant-or-self axis (Nick Wellnhofer),<br />
+  Fix the fix to Windows locking (Steve Nairn),<br />
+  Fix timsort invariant loop re: Envisage article (Christopher Swenson),<br />
+  Don't add IDs in xmlSetTreeDoc (Nick Wellnhofer),<br />
+  Account for ID attributes in xmlSetTreeDoc (Nick Wellnhofer),<br />
+  Remove various unused value assignments (Philip Withnall),<br />
+  Fix missing entities after CVE-2014-3660 fix (Daniel Veillard),<br />
+  Revert "Missing initialization for the catalog module" (Daniel Veillard)<br />
+  </li>
+
+  <li>Improvements:<br />
+  Reuse xmlHaltParser() where it makes sense (Daniel Veillard),<br />
+  xmlStopParser reset errNo (Daniel Veillard),<br />
+  Reenable xz support by default (Daniel Veillard),<br />
+  Recover unescaped less-than character in HTML recovery parsing (Daniel Veillard),<br />
+  Allow HTML serializer to output HTML5 DOCTYPE (Shaun McCance),<br />
+  Regression test for bug #695699 (Nick Wellnhofer),<br />
+  Add a couple of XPath tests (Nick Wellnhofer),<br />
+  Add Python 3 rpm subpackage (Tomas Radej),<br />
+  libxml2-config.cmake.in: update include directories (Samuel Martin),<br />
+  Adding example from bugs 738805 to regression tests (Daniel Veillard)<br />
+  </li>
+
+  <li>Cleanups:<br />
+  </li>
+</ul><h3>2.9.2: Oct 16 2014</h3><ul>
   <li>Security:<br />
   Fix for CVE-2014-3660 billion laugh variant (Daniel Veillard),<br />
   CVE-2014-0191 Do not fetch external parameter entities (Daniel Veillard)<br />
diff --git a/doc/xml.html b/doc/xml.html
index 373285d2..51dca8c3 100644
--- a/doc/xml.html
+++ b/doc/xml.html
@@ -709,6 +709,79 @@ to the <a href="http://git.gnome.org/browse/libxml2/">GIT</a> code base.</p>
 
 <p>Here is the list of public releases:</p>
 
+<h3>v2.9.3: Nov 20 2015</h3>
+<ul>
+  <li>Security:<br/>
+  CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh Davenport),<br/>
+  CVE-2015-7500 Fix memory access error due to incorrect entities boundaries (Daniel Veillard),<br/>
+  CVE-2015-7499-2 Detect incoherency on GROW (Daniel Veillard),<br/>
+  CVE-2015-7499-1 Add xmlHaltParser() to stop the parser (Daniel Veillard),<br/>
+  CVE-2015-5312 Another entity expansion issue (David Drysdale),<br/>
+  CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey (David Drysdale),<br/>
+  CVE-2015-7498 Avoid processing entities after encoding conversion failures (Daniel Veillard),<br/>
+  CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard),<br/>
+  CVE-2015-7942-2 Fix an error in previous Conditional section patch (Daniel Veillard),<br/>
+  CVE-2015-7942 Another variation of overflow in Conditional sections (Daniel Veillard),<br/>
+  CVE-2015-1819 Enforce the reader to run in constant memory (Daniel Veillard)<br/>
+  CVE-2015-7941_2 Cleanup conditional section error handling (Daniel Veillard),<br/>
+  CVE-2015-7941_1 Stop parsing on entities boundaries errors (Daniel Veillard),<br/>
+  </li>
+
+  <li>Documentation:<br/>
+  Correct spelling of "calling" (Alex Henrie),<br/>
+  Fix a small error in xmllint --format description (Fabien Degomme),<br/>
+  Avoid XSS on the search of xmlsoft.org (Daniel Veillard)<br/>
+  </li>
+
+  <li>Portability:<br/>
+  threads: use forward declarations only for glibc (Michael Heimpold),<br/>
+  Update Win32 configure.js to search for configure.ac (Daniel Veillard)<br/>
+  </li>
+
+  <li>Bug Fixes:<br/>
+  Bug on creating new stream from entity (Daniel Veillard),<br/>
+  Fix some loop issues embedding NEXT (Daniel Veillard),<br/>
+  Do not print error context when there is none (Daniel Veillard),<br/>
+  Avoid extra processing of MarkupDecl when EOF (Hugh Davenport),<br/>
+  Fix parsing short unclosed comment uninitialized access (Daniel Veillard),<br/>
+  Add missing Null check in xmlParseExternalEntityPrivate (Gaurav Gupta),<br/>
+  Fix a bug in CData error handling in the push parser (Daniel Veillard),<br/>
+  Fix a bug on name parsing at the end of current input buffer (Daniel Veillard),<br/>
+  Fix the spurious ID already defined error (Daniel Veillard),<br/>
+  Fix previous change to node sort order (Nick Wellnhofer),<br/>
+  Fix a self assignment issue raised by clang (Scott Graham),<br/>
+  Fail parsing early on if encoding conversion failed (Daniel Veillard),<br/>
+  Do not process encoding values if the declaration if broken (Daniel Veillard),<br/>
+  Silence clang's -Wunknown-attribute (Michael Catanzaro),<br/>
+  xmlMemUsed is not thread-safe (Martin von Gagern),<br/>
+  Fix support for except in nameclasses (Daniel Veillard),<br/>
+  Fix order of root nodes (Nick Wellnhofer),<br/>
+  Allow attributes on descendant-or-self axis (Nick Wellnhofer),<br/>
+  Fix the fix to Windows locking (Steve Nairn),<br/>
+  Fix timsort invariant loop re: Envisage article (Christopher Swenson),<br/>
+  Don't add IDs in xmlSetTreeDoc (Nick Wellnhofer),<br/>
+  Account for ID attributes in xmlSetTreeDoc (Nick Wellnhofer),<br/>
+  Remove various unused value assignments (Philip Withnall),<br/>
+  Fix missing entities after CVE-2014-3660 fix (Daniel Veillard),<br/>
+  Revert "Missing initialization for the catalog module" (Daniel Veillard)<br/>
+  </li>
+
+  <li>Improvements:<br/>
+  Reuse xmlHaltParser() where it makes sense (Daniel Veillard),<br/>
+  xmlStopParser reset errNo (Daniel Veillard),<br/>
+  Reenable xz support by default (Daniel Veillard),<br/>
+  Recover unescaped less-than character in HTML recovery parsing (Daniel Veillard),<br/>
+  Allow HTML serializer to output HTML5 DOCTYPE (Shaun McCance),<br/>
+  Regression test for bug #695699 (Nick Wellnhofer),<br/>
+  Add a couple of XPath tests (Nick Wellnhofer),<br/>
+  Add Python 3 rpm subpackage (Tomas Radej),<br/>
+  libxml2-config.cmake.in: update include directories (Samuel Martin),<br/>
+  Adding example from bugs 738805 to regression tests (Daniel Veillard)<br/>
+  </li>
+
+  <li>Cleanups:<br/>
+  </li>
+</ul>
 <h3>2.9.2: Oct 16 2014</h3>
 <ul>
   <li>Security:<br/>
diff --git a/python/setup.py b/python/setup.py
index e5043237..6f7c06c7 100755
--- a/python/setup.py
+++ b/python/setup.py
@@ -226,7 +226,7 @@ else:
 setup (name = "libxml2-python",
        # On *nix, the version number is created from setup.py.in
        # On windows, it is set by configure.js
-       version = "2.9.2",
+       version = "2.9.3",
        description = descr,
        author = "Daniel Veillard",
        author_email = "veillard@redhat.com",
diff --git a/testapi.c b/testapi.c
index 0367ffd4..9205e643 100644
--- a/testapi.c
+++ b/testapi.c
@@ -1034,10 +1034,10 @@ static void des_xmlAttributeType(int no ATTRIBUTE_UNUSED, xmlAttributeType val A
 
 #define gen_nb_xmlBufferAllocationScheme 4
 static xmlBufferAllocationScheme gen_xmlBufferAllocationScheme(int no, int nr ATTRIBUTE_UNUSED) {
-    if (no == 1) return(XML_BUFFER_ALLOC_DOUBLEIT);
-    if (no == 2) return(XML_BUFFER_ALLOC_EXACT);
-    if (no == 3) return(XML_BUFFER_ALLOC_HYBRID);
-    if (no == 4) return(XML_BUFFER_ALLOC_IMMUTABLE);
+    if (no == 1) return(XML_BUFFER_ALLOC_BOUNDED);
+    if (no == 2) return(XML_BUFFER_ALLOC_DOUBLEIT);
+    if (no == 3) return(XML_BUFFER_ALLOC_EXACT);
+    if (no == 4) return(XML_BUFFER_ALLOC_HYBRID);
     return(0);
 }
 
-- 
cgit v1.2.3