From 7e71c8f5d56b7278e367b4e8cf14b5071c6229c5 Mon Sep 17 00:00:00 2001
From: James Clark <jjc@jclark.com>
Date: Sat, 2 May 1998 03:14:22 +0000
Subject: [PATCH] Fix bug with entity containing ] or ]]

---
 expat/xmlparse/xmlparse.c  | 19 +++++++++++++++++++
 expat/xmltok/xmltok.h      |  3 +++
 expat/xmltok/xmltok_impl.c |  4 ++--
 3 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/expat/xmlparse/xmlparse.c b/expat/xmlparse/xmlparse.c
index 76735f34..3aa13d0e 100755
--- a/expat/xmlparse/xmlparse.c
+++ b/expat/xmlparse/xmlparse.c
@@ -755,6 +755,25 @@ doContent(XML_Parser parser,
 	} while (s != lim);
       }
       break;
+    case XML_TOK_TRAILING_RSQB:
+      if (nextPtr) {
+	*nextPtr = s;
+	return XML_ERROR_NONE;
+      }
+      if (characterDataHandler) {
+	char *dataPtr = dataBuf;
+	XmlConvert(enc, XML_UTF8_ENCODING, &s, end, &dataPtr, dataBufEnd);
+	characterDataHandler(userData, dataBuf, dataPtr - dataBuf);
+      }
+      if (startTagLevel == 0) {
+        errorPtr = end;
+	return XML_ERROR_NO_ELEMENTS;
+      }
+      if (tagLevel != startTagLevel) {
+	errorPtr = end;
+	return XML_ERROR_ASYNC_ENTITY;
+      }
+      return XML_ERROR_NONE;
     case XML_TOK_DATA_CHARS:
       if (characterDataHandler) {
 	do {
diff --git a/expat/xmltok/xmltok.h b/expat/xmltok/xmltok.h
index d1fa5af5..25a17396 100755
--- a/expat/xmltok/xmltok.h
+++ b/expat/xmltok/xmltok.h
@@ -29,6 +29,9 @@ extern "C" {
 #define XMLTOKAPI /* as nothing */
 #endif
 
+/* The following token may be returned by XmlContentTok */
+#define XML_TOK_TRAILING_RSQB -5 /* ] or ]] at the end of the scan; might be start of
+                                    illegal ]]> sequence */
 /* The following tokens may be returned by both XmlPrologTok and XmlContentTok */
 #define XML_TOK_NONE -4    /* The string to be scanned is empty */
 #define XML_TOK_TRAILING_CR -3 /* A CR at the end of the scan;
diff --git a/expat/xmltok/xmltok_impl.c b/expat/xmltok/xmltok_impl.c
index 00475542..2207a3df 100755
--- a/expat/xmltok/xmltok_impl.c
+++ b/expat/xmltok/xmltok_impl.c
@@ -694,12 +694,12 @@ int PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
   case BT_RSQB:
     ptr += MINBPC;
     if (ptr == end)
-      return XML_TOK_PARTIAL;
+      return XML_TOK_TRAILING_RSQB;
     if (!CHAR_MATCHES(enc, ptr, ']'))
       break;
     ptr += MINBPC;
     if (ptr == end)
-      return XML_TOK_PARTIAL;
+      return XML_TOK_TRAILING_RSQB;
     if (!CHAR_MATCHES(enc, ptr, '>')) {
       ptr -= MINBPC;
       break;