 @@ -1683,27 +1683,28 @@ XML_GetBuffer(XML_Parser parser, int len
     return NULL;
+  }
   switch (ps_parsing) {
   case XML_SUSPENDED:
     errorCode = XML_ERROR_SUSPENDED;
     return NULL;
   case XML_FINISHED:
     errorCode = XML_ERROR_FINISHED;
     return NULL;
   default: ;
+  }
   if (len > bufferLim - bufferEnd) {
-    int neededSize = len + (int)(bufferEnd - bufferPtr);
+    /* Do not invoke signed arithmetic overflow: */
     int neededSize = (int) ((unsigned)len + (unsigned)(bufferEnd - bufferPtr));
     if (neededSize < 0) {
       errorCode = XML_ERROR_NO_MEMORY;
       return NULL;
+    }
 #ifdef XML_CONTEXT_BYTES
     int keep = (int)(bufferPtr - buffer);
     if (keep > XML_CONTEXT_BYTES)
       keep = XML_CONTEXT_BYTES;
     neededSize += keep;
 #endif  /* defined XML_CONTEXT_BYTES */
     if (neededSize  <= bufferLim - buffer) {
 #ifdef XML_CONTEXT_BYTES
 @@ -1715,27 +1716,28 @@ XML_GetBuffer(XML_Parser parser, int len
+      }
 #else
       memmove(buffer, bufferPtr, bufferEnd - bufferPtr);
       bufferEnd = buffer + (bufferEnd - bufferPtr);
       bufferPtr = buffer;
 #endif  /* not defined XML_CONTEXT_BYTES */
+    }
     else {
       char *newBuf;
       int bufferSize = (int)(bufferLim - bufferPtr);
       if (bufferSize == 0)
         bufferSize = INIT_BUFFER_SIZE;
       do {
-        bufferSize *= 2;
+        /* Do not invoke signed arithmetic overflow: */
         bufferSize = (int) (2U * (unsigned) bufferSize);
       } while (bufferSize < neededSize && bufferSize > 0);
       if (bufferSize <= 0) {
         errorCode = XML_ERROR_NO_MEMORY;
         return NULL;
+      }
       newBuf = (char *)MALLOC(bufferSize);
       if (newBuf == 0) {
         errorCode = XML_ERROR_NO_MEMORY;
         return NULL;
+      }
       bufferLim = newBuf + bufferSize;
 #ifdef XML_CONTEXT_BYTES
       if (bufferPtr) {
 @@ -2416,31 +2418,31 @@ doContent(XML_Parser parser,
         tagStack = tag;
         tag->name.localPart = NULL;
         tag->name.prefix = NULL;
         tag->rawName = s + enc->minBytesPerChar;
         tag->rawNameLength = XmlNameLength(enc, tag->rawName);
         ++tagLevel;
+        {
           const char *rawNameEnd = tag->rawName + tag->rawNameLength;
           const char *fromPtr = tag->rawName;
           toPtr = (XML_Char *)tag->buf;
           for (;;) {
             int bufSize;
             int convLen;
-            XmlConvert(enc,
+            const enum XML_Convert_Result convert_res = XmlConvert(enc,
                        &fromPtr, rawNameEnd,
                        (ICHAR **)&toPtr, (ICHAR *)tag->bufEnd - 1);
             convLen = (int)(toPtr - (XML_Char *)tag->buf);
-            if (fromPtr == rawNameEnd) {
+            if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) {
               tag->name.strLen = convLen;
               break;
+            }
             bufSize = (int)(tag->bufEnd - tag->buf) << 1;
+            {
               char *temp = (char *)REALLOC(tag->buf, bufSize);
               if (temp == NULL)
                 return XML_ERROR_NO_MEMORY;
               tag->buf = temp;
               tag->bufEnd = temp + bufSize;
               toPtr = (XML_Char *)temp + convLen;
+            }
+          }
 @@ -2641,31 +2643,31 @@ doContent(XML_Parser parser,
       if (tagLevel != startTagLevel) {
         *eventPP = end;
         return XML_ERROR_ASYNC_ENTITY;
+      }
       *nextPtr = end;
       return XML_ERROR_NONE;
     case XML_TOK_DATA_CHARS:
+      {
         XML_CharacterDataHandler charDataHandler = characterDataHandler;
         if (charDataHandler) {
           if (MUST_CONVERT(enc, s)) {
             for (;;) {
               ICHAR *dataPtr = (ICHAR *)dataBuf;
-              XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
+              const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
               *eventEndPP = s;
               charDataHandler(handlerArg, dataBuf,
                               (int)(dataPtr - (ICHAR *)dataBuf));
-              if (s == next)
+              if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
                 break;
               *eventPP = s;
+            }
+          }
           else
             charDataHandler(handlerArg,
                             (XML_Char *)s,
                             (int)((XML_Char *)next - (XML_Char *)s));
+        }
         else if (defaultHandler)
           reportDefault(parser, enc, s, next);
+      }
       break;
 @@ -3251,31 +3253,31 @@ doCdataSection(XML_Parser parser,
         XML_Char c = 0xA;
         characterDataHandler(handlerArg, &c, 1);
+      }
       else if (defaultHandler)
         reportDefault(parser, enc, s, next);
       break;
     case XML_TOK_DATA_CHARS:
+      {
         XML_CharacterDataHandler charDataHandler = characterDataHandler;
         if (charDataHandler) {
           if (MUST_CONVERT(enc, s)) {
             for (;;) {
               ICHAR *dataPtr = (ICHAR *)dataBuf;
-              XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
+              const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
               *eventEndPP = next;
               charDataHandler(handlerArg, dataBuf,
                               (int)(dataPtr - (ICHAR *)dataBuf));
-              if (s == next)
+              if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
                 break;
               *eventPP = s;
+            }
+          }
           else
             charDataHandler(handlerArg,
                             (XML_Char *)s,
                             (int)((XML_Char *)next - (XML_Char *)s));
+        }
         else if (defaultHandler)
           reportDefault(parser, enc, s, next);
+      }
       break;
 @@ -5332,43 +5334,44 @@ reportComment(XML_Parser parser, const E
   if (!data)
     return 0;
   normalizeLines(data);
   commentHandler(handlerArg, data);
   poolClear(&tempPool);
   return 1;
+}
 static void
 reportDefault(XML_Parser parser, const ENCODING *enc,
               const char *s, const char *end)
+{
   if (MUST_CONVERT(enc, s)) {
     enum XML_Convert_Result convert_res;
     const char **eventPP;
     const char **eventEndPP;
     if (enc == encoding) {
       eventPP = &eventPtr;
       eventEndPP = &eventEndPtr;
+    }
     else {
       eventPP = &(openInternalEntities->internalEventPtr);
       eventEndPP = &(openInternalEntities->internalEventEndPtr);
+    }
     do {
       ICHAR *dataPtr = (ICHAR *)dataBuf;
-      XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd);
+      convert_res = XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd);
       *eventEndPP = s;
       defaultHandler(handlerArg, dataBuf, (int)(dataPtr - (ICHAR *)dataBuf));
       *eventPP = s;
-    } while (s != end);
+    } while ((convert_res != XML_CONVERT_COMPLETED) && (convert_res != XML_CONVERT_INPUT_INCOMPLETE));
+  }
   else
     defaultHandler(handlerArg, (XML_Char *)s, (int)((XML_Char *)end - (XML_Char *)s));
+}
 static int
 defineAttribute(ELEMENT_TYPE *type, ATTRIBUTE_ID *attId, XML_Bool isCdata,
                 XML_Bool isId, const XML_Char *value, XML_Parser parser)
+{
   DEFAULT_ATTRIBUTE *att;
   if (value || isId) {
     /* The handling of default attributes gets messed up if we have
 @@ -6153,28 +6156,28 @@ poolDestroy(STRING_POOL *pool)
     BLOCK *tem = p->next;
     pool->mem->free_fcn(p);
     p = tem;
+  }
+}
 static XML_Char *
 poolAppend(STRING_POOL *pool, const ENCODING *enc,
            const char *ptr, const char *end)
+{
   if (!pool->ptr && !poolGrow(pool))
     return NULL;
   for (;;) {
-    XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
+    const enum XML_Convert_Result convert_res = XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
-    if (ptr == end)
+    if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
       break;
     if (!poolGrow(pool))
       return NULL;
+  }
   return pool->start;
+}
 static const XML_Char * FASTCALL
 poolCopyString(STRING_POOL *pool, const XML_Char *s)
+{
   do {
     if (!poolAppendChar(pool, *s))
       return NULL;
 @@ -6238,42 +6241,51 @@ poolGrow(STRING_POOL *pool)
       BLOCK *tem = pool->freeBlocks->next;
       pool->freeBlocks->next = pool->blocks;
       pool->blocks = pool->freeBlocks;
       pool->freeBlocks = tem;
       memcpy(pool->blocks->s, pool->start,
              (pool->end - pool->start) * sizeof(XML_Char));
       pool->ptr = pool->blocks->s + (pool->ptr - pool->start);
       pool->start = pool->blocks->s;
       pool->end = pool->start + pool->blocks->size;
       return XML_TRUE;
+    }
+  }
   if (pool->blocks && pool->start == pool->blocks->s) {
-    int blockSize = (int)(pool->end - pool->start)*2;
+    BLOCK *temp;
-    BLOCK *temp = (BLOCK *)
+    int blockSize = (int)((unsigned)(pool->end - pool->start)*2U);
     if (blockSize < 0)
       return XML_FALSE;
     temp = (BLOCK *)
       pool->mem->realloc_fcn(pool->blocks,
                              (offsetof(BLOCK, s)
                               + blockSize * sizeof(XML_Char)));
     if (temp == NULL)
       return XML_FALSE;
     pool->blocks = temp;
     pool->blocks->size = blockSize;
     pool->ptr = pool->blocks->s + (pool->ptr - pool->start);
     pool->start = pool->blocks->s;
     pool->end = pool->start + blockSize;
+  }
   else {
     BLOCK *tem;
     int blockSize = (int)(pool->end - pool->start);
     if (blockSize < 0)
       return XML_FALSE;
     if (blockSize < INIT_BLOCK_SIZE)
       blockSize = INIT_BLOCK_SIZE;
     else
       blockSize *= 2;
     tem = (BLOCK *)pool->mem->malloc_fcn(offsetof(BLOCK, s)
                                         + blockSize * sizeof(XML_Char));
     if (!tem)
       return XML_FALSE;
     tem->size = blockSize;
     tem->next = pool->blocks;
     pool->blocks = tem;
     if (pool->ptr != pool->start)
       memcpy(tem->s, pool->start,

 @@ -36,50 +36,50 @@
   PREFIX(sameName), \
   PREFIX(nameMatchesAscii), \
   PREFIX(nameLength), \
   PREFIX(skipS), \
   PREFIX(getAtts), \
   PREFIX(charRefNumber), \
   PREFIX(predefinedEntityName), \
   PREFIX(updatePosition), \
   PREFIX(isPublicId)
 #define VTABLE VTABLE1, PREFIX(toUtf8), PREFIX(toUtf16)
 #define UCS2_GET_NAMING(pages, hi, lo) \
-   (namingBitmap[(pages[hi] << 3) + ((lo) >> 5)] & (1 << ((lo) & 0x1F)))
+   (namingBitmap[(pages[hi] << 3) + ((lo) >> 5)] & (1u << ((lo) & 0x1F)))
 /* A 2 byte UTF-8 representation splits the characters 11 bits between
    the bottom 5 and 6 bits of the bytes.  We need 8 bits to index into
    pages, 3 bits to add to that index and 5 bits to generate the mask.
 */
 #define UTF8_GET_NAMING2(pages, byte) \
     (namingBitmap[((pages)[(((byte)[0]) >> 2) & 7] << 3) \
                       + ((((byte)[0]) & 3) << 1) \
                       + ((((byte)[1]) >> 5) & 1)] \
-         & (1 << (((byte)[1]) & 0x1F)))
+         & (1u << (((byte)[1]) & 0x1F)))
 /* A 3 byte UTF-8 representation splits the characters 16 bits between
    the bottom 4, 6 and 6 bits of the bytes.  We need 8 bits to index
    into pages, 3 bits to add to that index and 5 bits to generate the
    mask.
 */
 #define UTF8_GET_NAMING3(pages, byte) \
   (namingBitmap[((pages)[((((byte)[0]) & 0xF) << 4) \
                              + ((((byte)[1]) >> 2) & 0xF)] \
                        << 3) \
                       + ((((byte)[1]) & 3) << 1) \
                       + ((((byte)[2]) >> 5) & 1)] \
-         & (1 << (((byte)[2]) & 0x1F)))
+         & (1u << (((byte)[2]) & 0x1F)))
 #define UTF8_GET_NAMING(pages, p, n) \
   ((n) == 2 \
   ? UTF8_GET_NAMING2(pages, (const unsigned char *)(p)) \
   : ((n) == 3 \
      ? UTF8_GET_NAMING3(pages, (const unsigned char *)(p)) \
      : 0))
 /* Detection of invalid UTF-8 sequences is based on Table 3.1B
    of Unicode 3.2: http://www.unicode.org/unicode/reports/tr28/
    with the additional restriction of not allowing the Unicode
    code points 0xFFFF and 0xFFFE (sequences EF,BF,BF and EF,BF,BE).
    Implementation details:
 @@ -308,85 +308,108 @@ sb_charMatches(const ENCODING *enc, cons
 #undef IS_NAME_CHAR
 #undef IS_NAME_CHAR_MINBPC
 #undef IS_NMSTRT_CHAR
 #undef IS_NMSTRT_CHAR_MINBPC
 #undef IS_INVALID_CHAR
 enum {  /* UTF8_cvalN is value of masked first byte of N byte sequence */
   UTF8_cval1 = 0x00,
   UTF8_cval2 = 0xc0,
   UTF8_cval3 = 0xe0,
   UTF8_cval4 = 0xf0
 };
-static void PTRCALL
+static enum XML_Convert_Result PTRCALL
 utf8_toUtf8(const ENCODING *enc,
             const char **fromP, const char *fromLim,
             char **toP, const char *toLim)
+{
   enum XML_Convert_Result res = XML_CONVERT_COMPLETED;
   char *to;
   const char *from;
   if (fromLim - *fromP > toLim - *toP) {
     /* Avoid copying partial characters. */
     res = XML_CONVERT_OUTPUT_EXHAUSTED;
     for (fromLim = *fromP + (toLim - *toP); fromLim > *fromP; fromLim--)
       if (((unsigned char)fromLim[-1] & 0xc0) != 0x80)
         break;
+  }
-  for (to = *toP, from = *fromP; from != fromLim; from++, to++)
+  for (to = *toP, from = *fromP; (from < fromLim) && (to < toLim); from++, to++)
     *to = *from;
   *fromP = from;
   *toP = to;
   if ((to == toLim) && (from < fromLim))
     return XML_CONVERT_OUTPUT_EXHAUSTED;
   else
     return res;
+}
-static void PTRCALL
+static enum XML_Convert_Result PTRCALL
 utf8_toUtf16(const ENCODING *enc,
              const char **fromP, const char *fromLim,
              unsigned short **toP, const unsigned short *toLim)
+{
   enum XML_Convert_Result res = XML_CONVERT_COMPLETED;
   unsigned short *to = *toP;
   const char *from = *fromP;
-  while (from != fromLim && to != toLim) {
+  while (from < fromLim && to < toLim) {
     switch (((struct normal_encoding *)enc)->type[(unsigned char)*from]) {
     case BT_LEAD2:
       if (fromLim - from < 2) {
         res = XML_CONVERT_INPUT_INCOMPLETE;
         break;
+      }
       *to++ = (unsigned short)(((from[0] & 0x1f) << 6) | (from[1] & 0x3f));
       from += 2;
       break;
     case BT_LEAD3:
       if (fromLim - from < 3) {
         res = XML_CONVERT_INPUT_INCOMPLETE;
         break;
+      }
       *to++ = (unsigned short)(((from[0] & 0xf) << 12)
                                | ((from[1] & 0x3f) << 6) | (from[2] & 0x3f));
       from += 3;
       break;
     case BT_LEAD4:
+      {
         unsigned long n;
-        if (to + 1 == toLim)
+        if (toLim - to < 2) {
           res = XML_CONVERT_OUTPUT_EXHAUSTED;
           goto after;
+        }
         if (fromLim - from < 4) {
           res = XML_CONVERT_INPUT_INCOMPLETE;
           goto after;
+        }
         n = ((from[0] & 0x7) << 18) | ((from[1] & 0x3f) << 12)
             | ((from[2] & 0x3f) << 6) | (from[3] & 0x3f);
         n -= 0x10000;
         to[0] = (unsigned short)((n >> 10) | 0xD800);
         to[1] = (unsigned short)((n & 0x3FF) | 0xDC00);
         to += 2;
         from += 4;
+      }
       break;
     default:
       *to++ = *from++;
       break;
+    }
+  }
 after:
   *fromP = from;
   *toP = to;
   return res;
+}
 #ifdef XML_NS
 static const struct normal_encoding utf8_encoding_ns = {
   { VTABLE1, utf8_toUtf8, utf8_toUtf16, 1, 1, 0 },
+  {
 #include "asciitab.h"
 #include "utf8tab.h"
   },
   STANDARD_VTABLE(sb_) NORMAL_VTABLE(utf8_)
 };
 #endif
 @@ -415,91 +438,101 @@ static const struct normal_encoding inte
 #endif
 static const struct normal_encoding internal_utf8_encoding = {
   { VTABLE1, utf8_toUtf8, utf8_toUtf16, 1, 1, 0 },
+  {
 #define BT_COLON BT_NMSTRT
 #include "iasciitab.h"
 #undef BT_COLON
 #include "utf8tab.h"
   },
   STANDARD_VTABLE(sb_) NORMAL_VTABLE(utf8_)
 };
-static void PTRCALL
+static enum XML_Convert_Result PTRCALL
 latin1_toUtf8(const ENCODING *enc,
               const char **fromP, const char *fromLim,
               char **toP, const char *toLim)
+{
   for (;;) {
     unsigned char c;
     if (*fromP == fromLim)
-      break;
+      return XML_CONVERT_COMPLETED;
     c = (unsigned char)**fromP;
     if (c & 0x80) {
       if (toLim - *toP < 2)
-        break;
+        return XML_CONVERT_OUTPUT_EXHAUSTED;
       *(*toP)++ = (char)((c >> 6) | UTF8_cval2);
       *(*toP)++ = (char)((c & 0x3f) | 0x80);
       (*fromP)++;
+    }
     else {
       if (*toP == toLim)
-        break;
+        return XML_CONVERT_OUTPUT_EXHAUSTED;
       *(*toP)++ = *(*fromP)++;
+    }
+  }
+}
-static void PTRCALL
+static enum XML_Convert_Result PTRCALL
 latin1_toUtf16(const ENCODING *enc,
                const char **fromP, const char *fromLim,
                unsigned short **toP, const unsigned short *toLim)
+{
-  while (*fromP != fromLim && *toP != toLim)
+  while (*fromP < fromLim && *toP < toLim)
     *(*toP)++ = (unsigned char)*(*fromP)++;
   if ((*toP == toLim) && (*fromP < fromLim))
     return XML_CONVERT_OUTPUT_EXHAUSTED;
   else
     return XML_CONVERT_COMPLETED;
+}
 #ifdef XML_NS
 static const struct normal_encoding latin1_encoding_ns = {
   { VTABLE1, latin1_toUtf8, latin1_toUtf16, 1, 0, 0 },
+  {
 #include "asciitab.h"
 #include "latin1tab.h"
   },
   STANDARD_VTABLE(sb_)
 };
 #endif
 static const struct normal_encoding latin1_encoding = {
   { VTABLE1, latin1_toUtf8, latin1_toUtf16, 1, 0, 0 },
+  {
 #define BT_COLON BT_NMSTRT
 #include "asciitab.h"
 #undef BT_COLON
 #include "latin1tab.h"
   },
   STANDARD_VTABLE(sb_)
 };
-static void PTRCALL
+static enum XML_Convert_Result PTRCALL
 ascii_toUtf8(const ENCODING *enc,
              const char **fromP, const char *fromLim,
              char **toP, const char *toLim)
+{
-  while (*fromP != fromLim && *toP != toLim)
+  while (*fromP < fromLim && *toP < toLim)
     *(*toP)++ = *(*fromP)++;
   if ((*toP == toLim) && (*fromP < fromLim))
     return XML_CONVERT_OUTPUT_EXHAUSTED;
   else
     return XML_CONVERT_COMPLETED;
+}
 #ifdef XML_NS
 static const struct normal_encoding ascii_encoding_ns = {
   { VTABLE1, ascii_toUtf8, latin1_toUtf16, 1, 1, 0 },
+  {
 #include "asciitab.h"
 /* BT_NONXML == 0 */
   },
   STANDARD_VTABLE(sb_)
 };
 @@ -526,100 +559,117 @@ unicode_byte_type(char hi, char lo)
     return BT_TRAIL;
   case 0xFF:
     switch ((unsigned char)lo) {
     case 0xFF:
     case 0xFE:
       return BT_NONXML;
+    }
     break;
+  }
   return BT_NONASCII;
+}
 #define DEFINE_UTF16_TO_UTF8(E) \
-static void  PTRCALL \
+static enum XML_Convert_Result  PTRCALL \
 E ## toUtf8(const ENCODING *enc, \
             const char **fromP, const char *fromLim, \
             char **toP, const char *toLim) \
 { \
-  const char *from; \
+  const char *from = *fromP; \
-  for (from = *fromP; from != fromLim; from += 2) { \
+  fromLim = from + (((fromLim - from) >> 1) << 1);  /* shrink to even */ \
   for (; from < fromLim; from += 2) { \
     int plane; \
     unsigned char lo2; \
     unsigned char lo = GET_LO(from); \
     unsigned char hi = GET_HI(from); \
     switch (hi) { \
     case 0: \
       if (lo < 0x80) { \
         if (*toP == toLim) { \
           *fromP = from; \
-          return; \
+          return XML_CONVERT_OUTPUT_EXHAUSTED; \
         } \
         *(*toP)++ = lo; \
         break; \
       } \
       /* fall through */ \
     case 0x1: case 0x2: case 0x3: \
     case 0x4: case 0x5: case 0x6: case 0x7: \
       if (toLim -  *toP < 2) { \
         *fromP = from; \
-        return; \
+        return XML_CONVERT_OUTPUT_EXHAUSTED; \
       } \
       *(*toP)++ = ((lo >> 6) | (hi << 2) |  UTF8_cval2); \
       *(*toP)++ = ((lo & 0x3f) | 0x80); \
       break; \
     default: \
       if (toLim -  *toP < 3)  { \
         *fromP = from; \
-        return; \
+        return XML_CONVERT_OUTPUT_EXHAUSTED; \
       } \
       /* 16 bits divided 4, 6, 6 amongst 3 bytes */ \
       *(*toP)++ = ((hi >> 4) | UTF8_cval3); \
       *(*toP)++ = (((hi & 0xf) << 2) | (lo >> 6) | 0x80); \
       *(*toP)++ = ((lo & 0x3f) | 0x80); \
       break; \
     case 0xD8: case 0xD9: case 0xDA: case 0xDB: \
       if (toLim -  *toP < 4) { \
         *fromP = from; \
-        return; \
+        return XML_CONVERT_OUTPUT_EXHAUSTED; \
       } \
       if (from + 4 > fromLim) { \
         *fromP = from; \
         return XML_CONVERT_INPUT_INCOMPLETE; \
       } \
       plane = (((hi & 0x3) << 2) | ((lo >> 6) & 0x3)) + 1; \
       *(*toP)++ = ((plane >> 2) | UTF8_cval4); \
       *(*toP)++ = (((lo >> 2) & 0xF) | ((plane & 0x3) << 4) | 0x80); \
       from += 2; \
       lo2 = GET_LO(from); \
       *(*toP)++ = (((lo & 0x3) << 4) \
                    | ((GET_HI(from) & 0x3) << 2) \
                    | (lo2 >> 6) \
                    | 0x80); \
       *(*toP)++ = ((lo2 & 0x3f) | 0x80); \
       break; \
     } \
   } \
   *fromP = from; \
   if (from < fromLim) \
     return XML_CONVERT_INPUT_INCOMPLETE; \
   else \
     return XML_CONVERT_COMPLETED; \
+}
 #define DEFINE_UTF16_TO_UTF16(E) \
-static void  PTRCALL \
+static enum XML_Convert_Result  PTRCALL \
 E ## toUtf16(const ENCODING *enc, \
              const char **fromP, const char *fromLim, \
              unsigned short **toP, const unsigned short *toLim) \
 { \
   enum XML_Convert_Result res = XML_CONVERT_COMPLETED; \
   fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1);  /* shrink to even */ \
   /* Avoid copying first half only of surrogate */ \
   if (fromLim - *fromP > ((toLim - *toP) << 1) \
-      && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) \
+      && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) { \
     fromLim -= 2; \
-  for (; *fromP != fromLim && *toP != toLim; *fromP += 2) \
+    res = XML_CONVERT_INPUT_INCOMPLETE; \
   } \
   for (; *fromP < fromLim && *toP < toLim; *fromP += 2) \
     *(*toP)++ = (GET_HI(*fromP) << 8) | GET_LO(*fromP); \
   if ((*toP == toLim) && (*fromP < fromLim)) \
     return XML_CONVERT_OUTPUT_EXHAUSTED; \
   else \
     return res; \
+}
 #define SET2(ptr, ch) \
   (((ptr)[0] = ((ch) & 0xff)), ((ptr)[1] = ((ch) >> 8)))
 #define GET_LO(ptr) ((unsigned char)(ptr)[0])
 #define GET_HI(ptr) ((unsigned char)(ptr)[1])
 DEFINE_UTF16_TO_UTF8(little2_)
 DEFINE_UTF16_TO_UTF16(little2_)
 #undef SET2
 #undef GET_LO
 #undef GET_HI
 @@ -1278,78 +1328,83 @@ unknown_isNmstrt(const ENCODING *enc, co
   if (c & ~0xFFFF)
     return 0;
   return UCS2_GET_NAMING(nmstrtPages, c >> 8, c & 0xFF);
+}
 static int PTRFASTCALL
 unknown_isInvalid(const ENCODING *enc, const char *p)
+{
   const struct unknown_encoding *uenc = AS_UNKNOWN_ENCODING(enc);
   int c = uenc->convert(uenc->userData, p);
   return (c & ~0xFFFF) || checkCharRefNumber(c) < 0;
+}
-static void PTRCALL
+static enum XML_Convert_Result PTRCALL
 unknown_toUtf8(const ENCODING *enc,
                const char **fromP, const char *fromLim,
                char **toP, const char *toLim)
+{
   const struct unknown_encoding *uenc = AS_UNKNOWN_ENCODING(enc);
   char buf[XML_UTF8_ENCODE_MAX];
   for (;;) {
     const char *utf8;
     int n;
     if (*fromP == fromLim)
-      break;
+      return XML_CONVERT_COMPLETED;
     utf8 = uenc->utf8[(unsigned char)**fromP];
     n = *utf8++;
     if (n == 0) {
       int c = uenc->convert(uenc->userData, *fromP);
       n = XmlUtf8Encode(c, buf);
       if (n > toLim - *toP)
-        break;
+        return XML_CONVERT_OUTPUT_EXHAUSTED;
       utf8 = buf;
       *fromP += (AS_NORMAL_ENCODING(enc)->type[(unsigned char)**fromP]
                  - (BT_LEAD2 - 2));
+    }
     else {
       if (n > toLim - *toP)
-        break;
+        return XML_CONVERT_OUTPUT_EXHAUSTED;
       (*fromP)++;
+    }
     do {
       *(*toP)++ = *utf8++;
     } while (--n != 0);
+  }
+}
-static void PTRCALL
+static enum XML_Convert_Result PTRCALL
 unknown_toUtf16(const ENCODING *enc,
                 const char **fromP, const char *fromLim,
                 unsigned short **toP, const unsigned short *toLim)
+{
   const struct unknown_encoding *uenc = AS_UNKNOWN_ENCODING(enc);
-  while (*fromP != fromLim && *toP != toLim) {
+  while (*fromP < fromLim && *toP < toLim) {
     unsigned short c = uenc->utf16[(unsigned char)**fromP];
     if (c == 0) {
       c = (unsigned short)
           uenc->convert(uenc->userData, *fromP);
       *fromP += (AS_NORMAL_ENCODING(enc)->type[(unsigned char)**fromP]
                  - (BT_LEAD2 - 2));
+    }
     else
       (*fromP)++;
     *(*toP)++ = c;
+  }
   if ((*toP == toLim) && (*fromP < fromLim))
     return XML_CONVERT_OUTPUT_EXHAUSTED;
   else
     return XML_CONVERT_COMPLETED;
+}
 ENCODING *
 XmlInitUnknownEncoding(void *mem,
                        int *table,
                        CONVERTER convert,
                        void *userData)
+{
   int i;
   struct unknown_encoding *e = (struct unknown_encoding *)mem;
   for (i = 0; i < (int)sizeof(struct normal_encoding); i++)
     ((char *)mem)[i] = ((char *)&latin1_encoding)[i];
   for (i = 0; i < 128; i++)
 @@ -1493,27 +1548,27 @@ getEncodingIndex(const char *name)
 */
 static int
 initScan(const ENCODING * const *encodingTable,
          const INIT_ENCODING *enc,
          int state,
          const char *ptr,
          const char *end,
          const char **nextTokPtr)
+{
   const ENCODING **encPtr;
-  if (ptr == end)
+  if (ptr >= end)
     return XML_TOK_NONE;
   encPtr = enc->encPtr;
   if (ptr + 1 == end) {
     /* only a single byte available for auto-detection */
 #ifndef XML_DTD /* FIXME */
     /* a well-formed document entity must have more than one byte */
     if (state != XML_CONTENT_STATE)
       return XML_TOK_PARTIAL;
 #endif
     /* so we're parsing an external text entity... */
     /* if UTF-16 was externally specified, then we need at least 2 bytes */
     switch (INIT_ENC_INDEX(enc)) {
     case UTF_16_ENC:

 @@ -83,33 +83,33 @@
   CHECK_NMSTRT_CASE(3, enc, ptr, end, nextTokPtr) \
   CHECK_NMSTRT_CASE(4, enc, ptr, end, nextTokPtr)
 #ifndef PREFIX
 #define PREFIX(ident) ident
 #endif
 /* ptr points to character following "<!-" */
 static int PTRCALL
 PREFIX(scanComment)(const ENCODING *enc, const char *ptr,
                     const char *end, const char **nextTokPtr)
+{
-  if (ptr != end) {
+  if (ptr < end) {
     if (!CHAR_MATCHES(enc, ptr, ASCII_MINUS)) {
       *nextTokPtr = ptr;
       return XML_TOK_INVALID;
+    }
     ptr += MINBPC(enc);
-    while (ptr != end) {
+    while (ptr < end) {
       switch (BYTE_TYPE(enc, ptr)) {
       INVALID_CASES(ptr, nextTokPtr)
       case BT_MINUS:
         if ((ptr += MINBPC(enc)) == end)
           return XML_TOK_PARTIAL;
         if (CHAR_MATCHES(enc, ptr, ASCII_MINUS)) {
           if ((ptr += MINBPC(enc)) == end)
             return XML_TOK_PARTIAL;
           if (!CHAR_MATCHES(enc, ptr, ASCII_GT)) {
             *nextTokPtr = ptr;
             return XML_TOK_INVALID;
+          }
           *nextTokPtr = ptr + MINBPC(enc);
 @@ -137,27 +137,27 @@ PREFIX(scanDecl)(const ENCODING *enc, co
   case BT_MINUS:
     return PREFIX(scanComment)(enc, ptr + MINBPC(enc), end, nextTokPtr);
   case BT_LSQB:
     *nextTokPtr = ptr + MINBPC(enc);
     return XML_TOK_COND_SECT_OPEN;
   case BT_NMSTRT:
   case BT_HEX:
     ptr += MINBPC(enc);
     break;
   default:
     *nextTokPtr = ptr;
     return XML_TOK_INVALID;
+  }
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
     case BT_PERCNT:
       if (ptr + MINBPC(enc) == end)
         return XML_TOK_PARTIAL;
       /* don't allow <!ENTITY% foo "whatever"> */
       switch (BYTE_TYPE(enc, ptr + MINBPC(enc))) {
       case BT_S: case BT_CR: case BT_LF: case BT_PERCNT:
         *nextTokPtr = ptr;
         return XML_TOK_INVALID;
+      }
       /* fall through */
     case BT_S: case BT_CR: case BT_LF:
       *nextTokPtr = ptr;
 @@ -223,36 +223,36 @@ static int PTRCALL
 PREFIX(scanPi)(const ENCODING *enc, const char *ptr,
                const char *end, const char **nextTokPtr)
+{
   int tok;
   const char *target = ptr;
   if (ptr == end)
     return XML_TOK_PARTIAL;
   switch (BYTE_TYPE(enc, ptr)) {
   CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
   default:
     *nextTokPtr = ptr;
     return XML_TOK_INVALID;
+  }
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
     case BT_S: case BT_CR: case BT_LF:
       if (!PREFIX(checkPiTarget)(enc, target, ptr, &tok)) {
         *nextTokPtr = ptr;
         return XML_TOK_INVALID;
+      }
       ptr += MINBPC(enc);
-      while (ptr != end) {
+      while (ptr < end) {
         switch (BYTE_TYPE(enc, ptr)) {
         INVALID_CASES(ptr, nextTokPtr)
         case BT_QUEST:
           ptr += MINBPC(enc);
           if (ptr == end)
             return XML_TOK_PARTIAL;
           if (CHAR_MATCHES(enc, ptr, ASCII_GT)) {
             *nextTokPtr = ptr + MINBPC(enc);
             return tok;
+          }
           break;
         default:
           ptr += MINBPC(enc);
 @@ -295,27 +295,27 @@ PREFIX(scanCdataSection)(const ENCODING
     if (!CHAR_MATCHES(enc, ptr, CDATA_LSQB[i])) {
       *nextTokPtr = ptr;
       return XML_TOK_INVALID;
+    }
+  }
   *nextTokPtr = ptr;
   return XML_TOK_CDATA_SECT_OPEN;
+}
 static int PTRCALL
 PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr,
                         const char *end, const char **nextTokPtr)
+{
-  if (ptr == end)
+  if (ptr >= end)
     return XML_TOK_NONE;
   if (MINBPC(enc) > 1) {
     size_t n = end - ptr;
     if (n & (MINBPC(enc) - 1)) {
       n &= ~(MINBPC(enc) - 1);
       if (n == 0)
         return XML_TOK_PARTIAL;
       end = ptr + n;
+    }
+  }
   switch (BYTE_TYPE(enc, ptr)) {
   case BT_RSQB:
     ptr += MINBPC(enc);
 @@ -338,27 +338,27 @@ PREFIX(cdataSectionTok)(const ENCODING *
       return XML_TOK_PARTIAL;
     if (BYTE_TYPE(enc, ptr) == BT_LF)
       ptr += MINBPC(enc);
     *nextTokPtr = ptr;
     return XML_TOK_DATA_NEWLINE;
   case BT_LF:
     *nextTokPtr = ptr + MINBPC(enc);
     return XML_TOK_DATA_NEWLINE;
   INVALID_CASES(ptr, nextTokPtr)
   default:
     ptr += MINBPC(enc);
     break;
+  }
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
 #define LEAD_CASE(n) \
     case BT_LEAD ## n: \
       if (end - ptr < n || IS_INVALID_CHAR(enc, ptr, n)) { \
         *nextTokPtr = ptr; \
         return XML_TOK_DATA_CHARS; \
       } \
       ptr += n; \
       break;
     LEAD_CASE(2) LEAD_CASE(3) LEAD_CASE(4)
 #undef LEAD_CASE
     case BT_NONXML:
     case BT_MALFORM:
 @@ -381,31 +381,31 @@ PREFIX(cdataSectionTok)(const ENCODING *
 static int PTRCALL
 PREFIX(scanEndTag)(const ENCODING *enc, const char *ptr,
                    const char *end, const char **nextTokPtr)
+{
   if (ptr == end)
     return XML_TOK_PARTIAL;
   switch (BYTE_TYPE(enc, ptr)) {
   CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
   default:
     *nextTokPtr = ptr;
     return XML_TOK_INVALID;
+  }
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
     case BT_S: case BT_CR: case BT_LF:
-      for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
+      for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
         switch (BYTE_TYPE(enc, ptr)) {
         case BT_S: case BT_CR: case BT_LF:
           break;
         case BT_GT:
           *nextTokPtr = ptr + MINBPC(enc);
           return XML_TOK_END_TAG;
         default:
           *nextTokPtr = ptr;
           return XML_TOK_INVALID;
+        }
+      }
       return XML_TOK_PARTIAL;
 #ifdef XML_NS
 @@ -422,69 +422,69 @@ PREFIX(scanEndTag)(const ENCODING *enc,
       *nextTokPtr = ptr;
       return XML_TOK_INVALID;
+    }
+  }
   return XML_TOK_PARTIAL;
+}
 /* ptr points to character following "&#X" */
 static int PTRCALL
 PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr,
                        const char *end, const char **nextTokPtr)
+{
-  if (ptr != end) {
+  if (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
     case BT_DIGIT:
     case BT_HEX:
       break;
     default:
       *nextTokPtr = ptr;
       return XML_TOK_INVALID;
+    }
-    for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
+    for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
       switch (BYTE_TYPE(enc, ptr)) {
       case BT_DIGIT:
       case BT_HEX:
         break;
       case BT_SEMI:
         *nextTokPtr = ptr + MINBPC(enc);
         return XML_TOK_CHAR_REF;
       default:
         *nextTokPtr = ptr;
         return XML_TOK_INVALID;
+      }
+    }
+  }
   return XML_TOK_PARTIAL;
+}
 /* ptr points to character following "&#" */
 static int PTRCALL
 PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr,
                     const char *end, const char **nextTokPtr)
+{
-  if (ptr != end) {
+  if (ptr < end) {
     if (CHAR_MATCHES(enc, ptr, ASCII_x))
       return PREFIX(scanHexCharRef)(enc, ptr + MINBPC(enc), end, nextTokPtr);
     switch (BYTE_TYPE(enc, ptr)) {
     case BT_DIGIT:
       break;
     default:
       *nextTokPtr = ptr;
       return XML_TOK_INVALID;
+    }
-    for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
+    for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
       switch (BYTE_TYPE(enc, ptr)) {
       case BT_DIGIT:
         break;
       case BT_SEMI:
         *nextTokPtr = ptr + MINBPC(enc);
         return XML_TOK_CHAR_REF;
       default:
         *nextTokPtr = ptr;
         return XML_TOK_INVALID;
+      }
+    }
+  }
   return XML_TOK_PARTIAL;
 @@ -496,50 +496,50 @@ static int PTRCALL
 PREFIX(scanRef)(const ENCODING *enc, const char *ptr, const char *end,
                 const char **nextTokPtr)
+{
   if (ptr == end)
     return XML_TOK_PARTIAL;
   switch (BYTE_TYPE(enc, ptr)) {
   CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
   case BT_NUM:
     return PREFIX(scanCharRef)(enc, ptr + MINBPC(enc), end, nextTokPtr);
   default:
     *nextTokPtr = ptr;
     return XML_TOK_INVALID;
+  }
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
     case BT_SEMI:
       *nextTokPtr = ptr + MINBPC(enc);
       return XML_TOK_ENTITY_REF;
     default:
       *nextTokPtr = ptr;
       return XML_TOK_INVALID;
+    }
+  }
   return XML_TOK_PARTIAL;
+}
 /* ptr points to character following first character of attribute name */
 static int PTRCALL
 PREFIX(scanAtts)(const ENCODING *enc, const char *ptr, const char *end,
                  const char **nextTokPtr)
+{
 #ifdef XML_NS
   int hadColon = 0;
 #endif
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
 #ifdef XML_NS
     case BT_COLON:
       if (hadColon) {
         *nextTokPtr = ptr;
         return XML_TOK_INVALID;
+      }
       hadColon = 1;
       ptr += MINBPC(enc);
       if (ptr == end)
         return XML_TOK_PARTIAL;
       switch (BYTE_TYPE(enc, ptr)) {
 @@ -706,51 +706,51 @@ PREFIX(scanLt)(const ENCODING *enc, cons
     return XML_TOK_INVALID;
   case BT_QUEST:
     return PREFIX(scanPi)(enc, ptr + MINBPC(enc), end, nextTokPtr);
   case BT_SOL:
     return PREFIX(scanEndTag)(enc, ptr + MINBPC(enc), end, nextTokPtr);
   default:
     *nextTokPtr = ptr;
     return XML_TOK_INVALID;
+  }
 #ifdef XML_NS
   hadColon = 0;
 #endif
   /* we have a start-tag */
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
 #ifdef XML_NS
     case BT_COLON:
       if (hadColon) {
         *nextTokPtr = ptr;
         return XML_TOK_INVALID;
+      }
       hadColon = 1;
       ptr += MINBPC(enc);
       if (ptr == end)
         return XML_TOK_PARTIAL;
       switch (BYTE_TYPE(enc, ptr)) {
       CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
       default:
         *nextTokPtr = ptr;
         return XML_TOK_INVALID;
+      }
       break;
 #endif
     case BT_S: case BT_CR: case BT_LF:
+      {
         ptr += MINBPC(enc);
-        while (ptr != end) {
+        while (ptr < end) {
           switch (BYTE_TYPE(enc, ptr)) {
           CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
           case BT_GT:
             goto gt;
           case BT_SOL:
             goto sol;
           case BT_S: case BT_CR: case BT_LF:
             ptr += MINBPC(enc);
             continue;
           default:
             *nextTokPtr = ptr;
             return XML_TOK_INVALID;
+          }
 @@ -775,27 +775,27 @@ PREFIX(scanLt)(const ENCODING *enc, cons
       return XML_TOK_EMPTY_ELEMENT_NO_ATTS;
     default:
       *nextTokPtr = ptr;
       return XML_TOK_INVALID;
+    }
+  }
   return XML_TOK_PARTIAL;
+}
 static int PTRCALL
 PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
                    const char **nextTokPtr)
+{
-  if (ptr == end)
+  if (ptr >= end)
     return XML_TOK_NONE;
   if (MINBPC(enc) > 1) {
     size_t n = end - ptr;
     if (n & (MINBPC(enc) - 1)) {
       n &= ~(MINBPC(enc) - 1);
       if (n == 0)
         return XML_TOK_PARTIAL;
       end = ptr + n;
+    }
+  }
   switch (BYTE_TYPE(enc, ptr)) {
   case BT_LT:
     return PREFIX(scanLt)(enc, ptr + MINBPC(enc), end, nextTokPtr);
 @@ -822,27 +822,27 @@ PREFIX(contentTok)(const ENCODING *enc,
     if (ptr == end)
       return XML_TOK_TRAILING_RSQB;
     if (!CHAR_MATCHES(enc, ptr, ASCII_GT)) {
       ptr -= MINBPC(enc);
       break;
+    }
     *nextTokPtr = ptr;
     return XML_TOK_INVALID;
   INVALID_CASES(ptr, nextTokPtr)
   default:
     ptr += MINBPC(enc);
     break;
+  }
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
 #define LEAD_CASE(n) \
     case BT_LEAD ## n: \
       if (end - ptr < n || IS_INVALID_CHAR(enc, ptr, n)) { \
         *nextTokPtr = ptr; \
         return XML_TOK_DATA_CHARS; \
       } \
       ptr += n; \
       break;
     LEAD_CASE(2) LEAD_CASE(3) LEAD_CASE(4)
 #undef LEAD_CASE
     case BT_RSQB:
       if (ptr + MINBPC(enc) != end) {
 @@ -885,73 +885,73 @@ PREFIX(scanPercent)(const ENCODING *enc,
                     const char **nextTokPtr)
+{
   if (ptr == end)
     return XML_TOK_PARTIAL;
   switch (BYTE_TYPE(enc, ptr)) {
   CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
   case BT_S: case BT_LF: case BT_CR: case BT_PERCNT:
     *nextTokPtr = ptr;
     return XML_TOK_PERCENT;
   default:
     *nextTokPtr = ptr;
     return XML_TOK_INVALID;
+  }
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
     case BT_SEMI:
       *nextTokPtr = ptr + MINBPC(enc);
       return XML_TOK_PARAM_ENTITY_REF;
     default:
       *nextTokPtr = ptr;
       return XML_TOK_INVALID;
+    }
+  }
   return XML_TOK_PARTIAL;
+}
 static int PTRCALL
 PREFIX(scanPoundName)(const ENCODING *enc, const char *ptr, const char *end,
                       const char **nextTokPtr)
+{
   if (ptr == end)
     return XML_TOK_PARTIAL;
   switch (BYTE_TYPE(enc, ptr)) {
   CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
   default:
     *nextTokPtr = ptr;
     return XML_TOK_INVALID;
+  }
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
     case BT_CR: case BT_LF: case BT_S:
     case BT_RPAR: case BT_GT: case BT_PERCNT: case BT_VERBAR:
       *nextTokPtr = ptr;
       return XML_TOK_POUND_NAME;
     default:
       *nextTokPtr = ptr;
       return XML_TOK_INVALID;
+    }
+  }
   return -XML_TOK_POUND_NAME;
+}
 static int PTRCALL
 PREFIX(scanLit)(int open, const ENCODING *enc,
                 const char *ptr, const char *end,
                 const char **nextTokPtr)
+{
-  while (ptr != end) {
+  while (ptr < end) {
     int t = BYTE_TYPE(enc, ptr);
     switch (t) {
     INVALID_CASES(ptr, nextTokPtr)
     case BT_QUOT:
     case BT_APOS:
       ptr += MINBPC(enc);
       if (t != open)
         break;
       if (ptr == end)
         return -XML_TOK_LITERAL;
       *nextTokPtr = ptr;
       switch (BYTE_TYPE(enc, ptr)) {
       case BT_S: case BT_CR: case BT_LF:
 @@ -963,27 +963,27 @@ PREFIX(scanLit)(int open, const ENCODING
     default:
       ptr += MINBPC(enc);
       break;
+    }
+  }
   return XML_TOK_PARTIAL;
+}
 static int PTRCALL
 PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
                   const char **nextTokPtr)
+{
   int tok;
-  if (ptr == end)
+  if (ptr >= end)
     return XML_TOK_NONE;
   if (MINBPC(enc) > 1) {
     size_t n = end - ptr;
     if (n & (MINBPC(enc) - 1)) {
       n &= ~(MINBPC(enc) - 1);
       if (n == 0)
         return XML_TOK_PARTIAL;
       end = ptr + n;
+    }
+  }
   switch (BYTE_TYPE(enc, ptr)) {
   case BT_QUOT:
     return PREFIX(scanLit)(BT_QUOT, enc, ptr + MINBPC(enc), end, nextTokPtr);
 @@ -1131,27 +1131,27 @@ PREFIX(prologTok)(const ENCODING *enc, c
       tok = XML_TOK_NAME;
       break;
+    }
     if (IS_NAME_CHAR_MINBPC(enc, ptr)) {
       ptr += MINBPC(enc);
       tok = XML_TOK_NMTOKEN;
       break;
+    }
     /* fall through */
   default:
     *nextTokPtr = ptr;
     return XML_TOK_INVALID;
+  }
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
     case BT_GT: case BT_RPAR: case BT_COMMA:
     case BT_VERBAR: case BT_LSQB: case BT_PERCNT:
     case BT_S: case BT_CR: case BT_LF:
       *nextTokPtr = ptr;
       return tok;
 #ifdef XML_NS
     case BT_COLON:
       ptr += MINBPC(enc);
       switch (tok) {
       case XML_TOK_NAME:
         if (ptr == end)
 @@ -1194,30 +1194,30 @@ PREFIX(prologTok)(const ENCODING *enc, c
     default:
       *nextTokPtr = ptr;
       return XML_TOK_INVALID;
+    }
+  }
   return -tok;
+}
 static int PTRCALL
 PREFIX(attributeValueTok)(const ENCODING *enc, const char *ptr,
                           const char *end, const char **nextTokPtr)
+{
   const char *start;
-  if (ptr == end)
+  if (ptr >= end)
     return XML_TOK_NONE;
   start = ptr;
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
 #define LEAD_CASE(n) \
     case BT_LEAD ## n: ptr += n; break;
     LEAD_CASE(2) LEAD_CASE(3) LEAD_CASE(4)
 #undef LEAD_CASE
     case BT_AMP:
       if (ptr == start)
         return PREFIX(scanRef)(enc, ptr + MINBPC(enc), end, nextTokPtr);
       *nextTokPtr = ptr;
       return XML_TOK_DATA_CHARS;
     case BT_LT:
       /* this is for inside entity references */
       *nextTokPtr = ptr;
 @@ -1252,30 +1252,30 @@ PREFIX(attributeValueTok)(const ENCODING
       ptr += MINBPC(enc);
       break;
+    }
+  }
   *nextTokPtr = ptr;
   return XML_TOK_DATA_CHARS;
+}
 static int PTRCALL
 PREFIX(entityValueTok)(const ENCODING *enc, const char *ptr,
                        const char *end, const char **nextTokPtr)
+{
   const char *start;
-  if (ptr == end)
+  if (ptr >= end)
     return XML_TOK_NONE;
   start = ptr;
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
 #define LEAD_CASE(n) \
     case BT_LEAD ## n: ptr += n; break;
     LEAD_CASE(2) LEAD_CASE(3) LEAD_CASE(4)
 #undef LEAD_CASE
     case BT_AMP:
       if (ptr == start)
         return PREFIX(scanRef)(enc, ptr + MINBPC(enc), end, nextTokPtr);
       *nextTokPtr = ptr;
       return XML_TOK_DATA_CHARS;
     case BT_PERCNT:
       if (ptr == start) {
         int tok =  PREFIX(scanPercent)(enc, ptr + MINBPC(enc),
 @@ -1316,27 +1316,27 @@ PREFIX(entityValueTok)(const ENCODING *e
 static int PTRCALL
 PREFIX(ignoreSectionTok)(const ENCODING *enc, const char *ptr,
                          const char *end, const char **nextTokPtr)
+{
   int level = 0;
   if (MINBPC(enc) > 1) {
     size_t n = end - ptr;
     if (n & (MINBPC(enc) - 1)) {
       n &= ~(MINBPC(enc) - 1);
       end = ptr + n;
+    }
+  }
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
     INVALID_CASES(ptr, nextTokPtr)
     case BT_LT:
       if ((ptr += MINBPC(enc)) == end)
         return XML_TOK_PARTIAL;
       if (CHAR_MATCHES(enc, ptr, ASCII_EXCL)) {
         if ((ptr += MINBPC(enc)) == end)
           return XML_TOK_PARTIAL;
         if (CHAR_MATCHES(enc, ptr, ASCII_LSQB)) {
           ++level;
           ptr += MINBPC(enc);
+        }
+      }
 @@ -1363,27 +1363,27 @@ PREFIX(ignoreSectionTok)(const ENCODING
+    }
+  }
   return XML_TOK_PARTIAL;
+}
 #endif /* XML_DTD */
 static int PTRCALL
 PREFIX(isPublicId)(const ENCODING *enc, const char *ptr, const char *end,
                    const char **badPtr)
+{
   ptr += MINBPC(enc);
   end -= MINBPC(enc);
-  for (; ptr != end; ptr += MINBPC(enc)) {
+  for (; ptr < end; ptr += MINBPC(enc)) {
     switch (BYTE_TYPE(enc, ptr)) {
     case BT_DIGIT:
     case BT_HEX:
     case BT_MINUS:
     case BT_APOS:
     case BT_LPAR:
     case BT_RPAR:
     case BT_PLUS:
     case BT_COMMA:
     case BT_SOL:
     case BT_EQUALS:
     case BT_QUEST:
     case BT_CR:
 @@ -1750,27 +1750,27 @@ PREFIX(updatePosition)(const ENCODING *e
     case BT_LEAD ## n: \
       ptr += n; \
       break;
     LEAD_CASE(2) LEAD_CASE(3) LEAD_CASE(4)
 #undef LEAD_CASE
     case BT_LF:
       pos->columnNumber = (XML_Size)-1;
       pos->lineNumber++;
       ptr += MINBPC(enc);
       break;
     case BT_CR:
       pos->lineNumber++;
       ptr += MINBPC(enc);
-      if (ptr != end && BYTE_TYPE(enc, ptr) == BT_LF)
+      if (ptr < end && BYTE_TYPE(enc, ptr) == BT_LF)
         ptr += MINBPC(enc);
       pos->columnNumber = (XML_Size)-1;
       break;
     default:
       ptr += MINBPC(enc);
       break;
+    }
     pos->columnNumber++;
+  }
+}
 #undef DO_LEAD_CASE
 #undef MULTIBYTE_CASES

 @@ -1,14 +1,14 @@
-# $NetBSD: shl.mi,v 1.771 2016/05/14 14:39:39 spz Exp $
+# $NetBSD: shl.mi,v 1.772 2016/05/17 23:53:02 spz Exp $
+#
 # Note:	Don't delete entries from here - mark them as "obsolete" instead,
 #	unless otherwise stated below.
+#
 # Note:	Do not mark "old" major and major.minor shared libraries as
 #	"obsolete"; just remove the entry, as third-party applications
 #	may be linked against the old major shared library, and
 #	that is a symlink to the old major.minor shared library.
 #	e.g., "lib<name>.so.<N>" and "lib<name>.so.<N>.<M>"
 #	Exceptions to this rule may include shared libraries that
 #	are dlopen()ed at run-time, such as extra locales, etc.
+#
 # Note:	libtermcap and libtermlib are hardlinked and share the same version.
 @@ -266,27 +266,27 @@
 ./usr/lib/libevent.so.4				base-sys-shlib		compatfile
 ./usr/lib/libevent.so.4.0			base-sys-shlib		compatfile
 ./usr/lib/libevent_openssl.so			base-sys-shlib		compatfile,crypto
 ./usr/lib/libevent_openssl.so.4			base-sys-shlib		compatfile,crypto
 ./usr/lib/libevent_openssl.so.4.0		base-sys-shlib		compatfile,crypto
 ./usr/lib/libevent_pthreads.so			base-sys-shlib		compatfile
 ./usr/lib/libevent_pthreads.so.4		base-sys-shlib		compatfile
 ./usr/lib/libevent_pthreads.so.4.0		base-sys-shlib		compatfile
 ./usr/lib/libexecinfo.so			base-sys-shlib		compatfile
 ./usr/lib/libexecinfo.so.0			base-sys-shlib		compatfile
 ./usr/lib/libexecinfo.so.0.0			base-sys-shlib		compatfile
 ./usr/lib/libexpat.so				base-sys-shlib		compatfile
 ./usr/lib/libexpat.so.2				base-sys-shlib		compatfile
-./usr/lib/libexpat.so.2.2			base-sys-shlib		compatfile
+./usr/lib/libexpat.so.2.3			base-sys-shlib		compatfile
 ./usr/lib/libfetch.so				base-sys-shlib		compatfile
 ./usr/lib/libfetch.so.3				base-sys-shlib		compatfile
 ./usr/lib/libfetch.so.3.0			base-sys-shlib		compatfile
 ./usr/lib/libform.so				base-sys-shlib		compatfile
 ./usr/lib/libform.so.6				base-sys-shlib		compatfile
 ./usr/lib/libform.so.6.0			base-sys-shlib		compatfile
 ./usr/lib/libgcc_s.so				base-sys-shlib		compatfile,gcc
 ./usr/lib/libgcc_s.so.1				base-sys-shlib		compatfile,gcc
 ./usr/lib/libgcc_s.so.1.0			base-sys-shlib		compatfile,gcc
 ./usr/lib/libgnumalloc.so			base-sys-shlib		compatfile
 ./usr/lib/libgnumalloc.so.1			base-sys-shlib		compatfile
 ./usr/lib/libgnumalloc.so.1.0			base-sys-shlib		compatfile
 ./usr/lib/libgomp.so				base-sys-shlib		compatfile,gcc

 @@ -1,14 +1,14 @@
-# $NetBSD: shl.mi,v 1.133 2016/05/14 14:39:39 spz Exp $
+# $NetBSD: shl.mi,v 1.134 2016/05/17 23:53:02 spz Exp $
 ./usr/libdata/debug/lib						base-sys-usr	debug,dynamicroot,compatdir
 ./usr/libdata/debug/lib/libblacklist.so.0.0.debug		comp-sys-debug	debug,dynamicroot
 ./usr/libdata/debug/lib/libc.so.12.202.debug			comp-sys-debug	debug,dynamicroot
 ./usr/libdata/debug/lib/libcrypt.so.1.0.debug			comp-sys-debug	debug,dynamicroot
 ./usr/libdata/debug/lib/libcrypto.so.11.0.debug			comp-sys-debug	debug,dynamicroot
 ./usr/libdata/debug/lib/libdevmapper.so.1.0.debug		comp-sys-debug	debug,dynamicroot
 ./usr/libdata/debug/lib/libdm.so.0.0.debug 			comp-sys-debug	debug,dynamicroot
 ./usr/libdata/debug/lib/libedit.so.3.1.debug			comp-sys-debug	debug,dynamicroot
 ./usr/libdata/debug/lib/libevent.so.4.0.debug			comp-sys-debug	debug,dynamicroot
 ./usr/libdata/debug/lib/libgcc_s.so.1.0.debug			comp-sys-debug	debug,dynamicroot,gcc
 ./usr/libdata/debug/lib/libipsec.so.3.0.debug			comp-sys-debug	debug,dynamicroot
 ./usr/libdata/debug/lib/libkvm.so.6.0.debug			comp-sys-debug	debug,dynamicroot
 ./usr/libdata/debug/lib/liblzf.so.1.0.debug			comp-sys-debug	debug,dynamicroot
 @@ -80,27 +80,27 @@
 ./usr/libdata/debug/usr/lib/libdes.so.11.0.debug			comp-crypto-debug	debug,compatfile,crypto
 ./usr/libdata/debug/usr/lib/libdevmapper.so.1.0.debug		comp-lvm-debug	debug,compatfile,lvm
 ./usr/libdata/debug/usr/lib/libdm.so.0.0.debug 			comp-sys-debug	debug,compatfile
 ./usr/libdata/debug/usr/lib/libdns.so.8.4.debug 		comp-bind-debug debug,compatfile
 ./usr/libdata/debug/usr/lib/libdns_sd.so.0.0.debug		comp-mdns-debug	debug,compatfile,mdns
 ./usr/libdata/debug/usr/lib/libdtrace.so.3.0.debug		comp-sys-debug	debug,compatfile,dtrace
 ./usr/libdata/debug/usr/lib/libdwarf.so.2.0.debug		comp-sys-debug	debug,compatfile
 ./usr/libdata/debug/usr/lib/libedit.so.3.1.debug		comp-sys-debug	debug,compatfile
 ./usr/libdata/debug/usr/lib/libelf.so.2.0.debug			comp-sys-debug	debug,compatfile
 ./usr/libdata/debug/usr/lib/libevent.so.4.0.debug		comp-sys-debug	debug,compatfile
 ./usr/libdata/debug/usr/lib/libevent_openssl.so.4.0.debug	comp-sys-debug	debug,compatfile,crypto
 ./usr/libdata/debug/usr/lib/libevent_pthreads.so.4.0.debug	comp-sys-debug	debug,compatfile
 ./usr/libdata/debug/usr/lib/libexecinfo.so.0.0.debug		comp-sys-debug	debug,compatfile
-./usr/libdata/debug/usr/lib/libexpat.so.2.2.debug		comp-sys-debug	debug,compatfile
+./usr/libdata/debug/usr/lib/libexpat.so.2.3.debug		comp-sys-debug	debug,compatfile
 ./usr/libdata/debug/usr/lib/libfetch.so.3.0.debug		comp-sys-debug	debug,compatfile
 ./usr/libdata/debug/usr/lib/libform.so.6.0.debug		comp-sys-debug	debug,compatfile
 ./usr/libdata/debug/usr/lib/libg2c.so.2.0.debug			comp-sys-debug	obsolete
 ./usr/libdata/debug/usr/lib/libgcc_s.so.1.0.debug		comp-sys-debug	debug,compatfile,gcc
 ./usr/libdata/debug/usr/lib/libgmp.so.10.2.debug		comp-c-shlib	obsolete
 ./usr/libdata/debug/usr/lib/libgnumalloc.so.1.0.debug		comp-sys-debug	debug,compatfile
 ./usr/libdata/debug/usr/lib/libgomp.so.1.1.debug		comp-sys-debug	debug,compatfile,gcc=48
 ./usr/libdata/debug/usr/lib/libgomp.so.1.2.debug		comp-sys-debug	debug,compatfile,gcc=53
 ./usr/libdata/debug/usr/lib/libgssapi.so.10.0.debug		comp-krb5-debug	debug,compatfile,kerberos
 ./usr/libdata/debug/usr/lib/libhdb.so.14.0.debug		comp-krb5-debug	debug,compatfile,kerberos
 ./usr/libdata/debug/usr/lib/libheimbase.so.1.0.debug		comp-krb5-debug	debug,compatfile,kerberos
 ./usr/libdata/debug/usr/lib/libheimntlm.so.4.0.debug		comp-krb5-debug	debug,compatfile,kerberos
 ./usr/libdata/debug/usr/lib/libhx509.so.5.0.debug		comp-krb5-debug	debug,compatfile,kerberos

 @@ -120,26 +120,32 @@ typedef struct {
   const char *valuePtr;
   const char *valueEnd;
   char normalized;
 } ATTRIBUTE;
 struct encoding;
 typedef struct encoding ENCODING;
 typedef int (PTRCALL *SCANNER)(const ENCODING *,
                                const char *,
                                const char *,
                                const char **);
 enum XML_Convert_Result {
   XML_CONVERT_COMPLETED = 0,
   XML_CONVERT_INPUT_INCOMPLETE = 1,
   XML_CONVERT_OUTPUT_EXHAUSTED = 2  /* and therefore potentially input remaining as well */
 };
 struct encoding {
   SCANNER scanners[XML_N_STATES];
   SCANNER literalScanners[XML_N_LITERAL_TYPES];
   int (PTRCALL *sameName)(const ENCODING *,
                           const char *,
                           const char *);
   int (PTRCALL *nameMatchesAscii)(const ENCODING *,
                                   const char *,
                                   const char *,
                                   const char *);
   int (PTRFASTCALL *nameLength)(const ENCODING *, const char *);
   const char *(PTRFASTCALL *skipS)(const ENCODING *, const char *);
   int (PTRCALL *getAtts)(const ENCODING *enc,
 @@ -148,32 +154,32 @@ struct encoding {
                          ATTRIBUTE *atts);
   int (PTRFASTCALL *charRefNumber)(const ENCODING *enc, const char *ptr);
   int (PTRCALL *predefinedEntityName)(const ENCODING *,
                                       const char *,
                                       const char *);
   void (PTRCALL *updatePosition)(const ENCODING *,
                                  const char *ptr,
                                  const char *end,
                                  POSITION *);
   int (PTRCALL *isPublicId)(const ENCODING *enc,
                             const char *ptr,
                             const char *end,
                             const char **badPtr);
-  void (PTRCALL *utf8Convert)(const ENCODING *enc,
+  enum XML_Convert_Result (PTRCALL *utf8Convert)(const ENCODING *enc,
                               const char **fromP,
                               const char *fromLim,
                               char **toP,
                               const char *toLim);
-  void (PTRCALL *utf16Convert)(const ENCODING *enc,
+  enum XML_Convert_Result (PTRCALL *utf16Convert)(const ENCODING *enc,
                                const char **fromP,
                                const char *fromLim,
                                unsigned short **toP,
                                const unsigned short *toLim);
   int minBytesPerChar;
   char isUtf8;
   char isUtf16;
 };
 /* Scan the string starting at ptr until the end of the next complete
    token, but do not scan past eptr.  Return an integer giving the
    type of token.

 @@ -1,5 +1,5 @@
-#	$NetBSD: shlib_version,v 1.3 2016/05/14 14:39:39 spz Exp $
+#	$NetBSD: shlib_version,v 1.4 2016/05/17 23:53:02 spz Exp $
+#
 # XXX netbsd xsrc had major=4
 major=2
-minor=2
+minor=3