Pullup ticket #5028 - requested by he
textproc/libxml2: security update

Revisions pulled up:
- textproc/libxml2/Makefile                                     1.141
- textproc/libxml2/distinfo                                     1.110-1.112
- textproc/libxml2/patches/patch-aa                             1.29
- textproc/libxml2/patches/patch-ab                             1.29-1.30
- textproc/libxml2/patches/patch-ac                             1.9
- textproc/libxml2/patches/patch-ad                             1.19
- textproc/libxml2/patches/patch-ae                             1.15
- textproc/libxml2/patches/patch-ag                             deleted
- textproc/libxml2/patches/patch-encoding.c                     added at 1.2
- textproc/libxml2/patches/patch-runtest.c                      added at 1.2
- textproc/libxml2/patches/patch-testlimits.c                   added at 1.2
- textproc/libxml2/patches/patch-timsort.h                      added at 1.2
- textproc/libxml2/patches/patch-xmlIO.c                        added at 1.2

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	he
   Date:		Tue May 24 12:00:08 UTC 2016

   Modified Files:
   	pkgsrc/textproc/libxml2: Makefile distinfo
   	pkgsrc/textproc/libxml2/patches: patch-aa patch-ab patch-ac patch-ad
   	    patch-ae
   Added Files:
   	pkgsrc/textproc/libxml2/patches: patch-encoding.c patch-runtest.c
   	    patch-testlimits.c patch-timsort.h patch-xmlIO.c
   Removed Files:
   	pkgsrc/textproc/libxml2/patches: patch-ag

   Log Message:
   Update libxml2 to 2.9.4.

   Pkgsrc changes:
    * Add some casts to match types and format strings, plus
      fix value range of toupper() operation.
    * Merge patch-ag into the new patch-encoding.c.
    * Add comments to existing patches which lacked comments.

   Upstream changes to libxml2-2.9.4: May 23 2016

   Security:

      CVE-2016-3627 Avoid building recursive entities
      CVE-2016-1833 Heap-based buffer overread in htmlCurrentChar
      CVE-2016-1835 Heap use-after-free in xmlSAX2AttributeNs
      CVE-2016-1837 Heap use-after-free in htmlParsePubidLiteral
      	      	 and htmlParseSystemiteral
      CVE-2016-1836 Bug 759398: Heap use-after-free in xmlDictComputeFastKey
      CVE-2016-1839 Bug 758605: Heap-based buffer overread in xmlDictAddString
      CVE-2016-1838 Bug 758588: Heap-based buffer overread in
   	      	 xmlParserPrintFileContextInternal
      CVE-2016-1840 Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup
      CVE-2016-4483 Avoid an out of bound access when serializing
      		 malformed strings
      CVE-2016-1834 Bug 763071: heap-buffer-overflow in xmlStrncat
      CVE-2016-3705 Add missing increments of recursion depth counter to
      		 XML parser.
      CVE-2016-1762 Heap-based buffer overread in xmlNextChar

      More format string warnings with possible format string vulnerability
      Heap-based buffer-underreads due to xmlParseName
      Fix some format string warnings with possible format string vulnerability
      Unsigned addition may overflow in xmlMallocAtomicLoc()

   Other bugfixes:

      Detect change of encoding when parsing HTML names
      Fix inappropriate fetch of entities content
      Correct the usage of LDFLAGS
      Revert the use of SAVE_LDFLAGS in configure.ac
      libxml2 hardcodes -L/lib in zlib/lzma tests which breaks cross-compiles
      Add more debugging info to runtest
      Implement "runtest -u" mode
      Integer signed/unsigned type mismatch in xmlParserInputGrow()
      Integer overflow parsing port number in URI
      Fix apibuild for a recently added constructv2.9.4-rc2
      Use pkg-config to locate zlib when possible
      Use pkg-config to locate ICU when possible
      Fix an error with regexp on nullable counted char transition
      Fix memory leak with XPath namespace nodes
      Fix namespace axis traversal
      Add a make rule to rebuild for ASAN
      Fix null pointer deref in docs with no root element
      Portability to non C99 compliant compilers
      dict.h: Move xmlDictPtr definition before includes to allow direct
        inclusion.
      Fix XSD validation of URIs with ampersands
      xmlschemastypes.c: accept endOfDayFrag Times set to "24:00:00" mean
        "end of day" and should not cause an error. v2.9.4-rc1
      os400: tell about xmllint and xmlcatalog in README400.
      os400: properly process SGML add in XMLCATALOG command.
      os400: implement CL command XMLCATALOG.
      os400: compile and install program xmlcatalog (qshell-only).
      xmlcatalog: flush stdout before interactive shell input.
      os400: expand tabs in sources, strip trailing blanks.
      os400: implement CL command XMLLINT.
      os400: compile and install program xmllint (qshell-only).
      os400: initscript make_module(): Use options instead of
        positional parameters.
      xmllint: flush stdout before interactive shell input.
      os400: c14n.rpgle: allow *omit for nullable reference parameters.
      os400: use like() for double type.
      os400: use like() for int type.
      os400: use like() for unsigned int type.
      os400: use like() for enum types.
      Add xz to xml2-config --libs output
      Don't recurse into OP_VALUEs in xmlXPathOptimizeExpression
      Fix namespace::node() XPath expression
      Fix OOB write in xmlXPathEmptyNodeSet
      Fix parsing of NCNames in XPath
      Fix OOB read with invalid UTF-8 in xmlUTF8Strsize
      Do normalize string-based datatype value in RelaxNG facet checking
      Fix typo: s{ ec -> cr }cipt
      Fix typos: dictio{ nn -> n }ar{y,ies}
      Fix typos: PATH_{ SEAPARATOR -> SEPARATOR }
      Correct a typo.
      Bug 760921: REGRESSION (8eb55d78): doc/examples/io1 test fails after fix
        for "xmlSaveUri() incorrectly recomposes URIs with rootless paths"
      Bug 760861: REGRESSION (bf9c1dad): Missing results for
        test/schemas/regexp-char-ref_[01].xsd
      error.c: *input->cur == 0 does not mean no error
      Add missing RNG test files
      Bug 760190: configure.ac should be able to build --with-icu without
        icu-config tool
      Bug 760183: REGRESSION (v2.9.3): XML push parser fails with bogus
        UTF-8 encoding error when multi-byte character in large CDATA
        section is split across buffer
      Bug 758572: ASAN crash in make check
      Bug 721158: Missing ICU string when doing --version on xmllint
      python 3: libxml2.c wrappers create Unicode str already
      win32\VC10\config.h and VS 2015
      Add autogen.sh to distrib
      Add configure maintainer mode

   To generate a diff of this commit:
   cvs rdiff -u -r1.140 -r1.141 pkgsrc/textproc/libxml2/Makefile
   cvs rdiff -u -r1.109 -r1.110 pkgsrc/textproc/libxml2/distinfo
   cvs rdiff -u -r1.28 -r1.29 pkgsrc/textproc/libxml2/patches/patch-aa \
       pkgsrc/textproc/libxml2/patches/patch-ab
   cvs rdiff -u -r1.8 -r1.9 pkgsrc/textproc/libxml2/patches/patch-ac
   cvs rdiff -u -r1.18 -r1.19 pkgsrc/textproc/libxml2/patches/patch-ad
   cvs rdiff -u -r1.14 -r1.15 pkgsrc/textproc/libxml2/patches/patch-ae
   cvs rdiff -u -r1.12 -r0 pkgsrc/textproc/libxml2/patches/patch-ag
   cvs rdiff -u -r0 -r1.1 pkgsrc/textproc/libxml2/patches/patch-encoding.c \
       pkgsrc/textproc/libxml2/patches/patch-runtest.c \
       pkgsrc/textproc/libxml2/patches/patch-testlimits.c \
       pkgsrc/textproc/libxml2/patches/patch-timsort.h \
       pkgsrc/textproc/libxml2/patches/patch-xmlIO.c

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Tue May 24 21:08:21 UTC 2016

   Modified Files:
   	pkgsrc/textproc/libxml2: distinfo
   	pkgsrc/textproc/libxml2/patches: patch-encoding.c patch-runtest.c
   	    patch-testlimits.c patch-timsort.h patch-xmlIO.c

   Log Message:
   Add upstream bug report URLs (from he@).

   To generate a diff of this commit:
   cvs rdiff -u -r1.110 -r1.111 pkgsrc/textproc/libxml2/distinfo
   cvs rdiff -u -r1.1 -r1.2 pkgsrc/textproc/libxml2/patches/patch-encoding.c \
       pkgsrc/textproc/libxml2/patches/patch-runtest.c \
       pkgsrc/textproc/libxml2/patches/patch-testlimits.c \
       pkgsrc/textproc/libxml2/patches/patch-timsort.h \
       pkgsrc/textproc/libxml2/patches/patch-xmlIO.c

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	he
   Date:		Wed May 25 07:16:36 UTC 2016

   Modified Files:
   	pkgsrc/textproc/libxml2: distinfo
   	pkgsrc/textproc/libxml2/patches: patch-ab

   Log Message:
   Submit the typo part of configure upstream, note the bug-ID.

   To generate a diff of this commit:
   cvs rdiff -u -r1.111 -r1.112 pkgsrc/textproc/libxml2/distinfo
   cvs rdiff -u -r1.29 -r1.30 pkgsrc/textproc/libxml2/patches/patch-ab


(spz)

$NetBSD: patch-encoding.c,v 1.2.2.2 2016/05/25 19:07:28 spz Exp $

Avoid potential undefined behaviour by casting arg to toupper()
to an appropriate value range.
https://bugzilla.gnome.org/show_bug.cgi?id=766838

Also, on NetBSD, add CP1141 encoding alias.

--- encoding.c.orig	2016-05-23 07:25:25.000000000 +0000
+++ encoding.c
@@ -1018,7 +1018,7 @@ xmlGetEncodingAlias(const char *alias) {
 	return(NULL);
 
     for (i = 0;i < 99;i++) {
-        upper[i] = toupper(alias[i]);
+        upper[i] = toupper((unsigned char)alias[i]);
 	if (upper[i] == 0) break;
     }
     upper[i] = 0;
@@ -1053,7 +1053,7 @@ xmlAddEncodingAlias(const char *name, co
 	return(-1);
 
     for (i = 0;i < 99;i++) {
-        upper[i] = toupper(alias[i]);
+        upper[i] = toupper((unsigned char)alias[i]);
 	if (upper[i] == 0) break;
     }
     upper[i] = 0;
@@ -1155,7 +1155,7 @@ xmlParseCharEncoding(const char* name)
 	name = alias;
 
     for (i = 0;i < 499;i++) {
-        upper[i] = toupper(name[i]);
+        upper[i] = toupper((unsigned char)name[i]);
 	if (upper[i] == 0) break;
     }
     upper[i] = 0;
@@ -1331,7 +1331,7 @@ xmlNewCharEncodingHandler(const char *na
 	return(NULL);
     }
     for (i = 0;i < 499;i++) {
-        upper[i] = toupper(name[i]);
+        upper[i] = toupper((unsigned char)name[i]);
 	if (upper[i] == 0) break;
     }
     upper[i] = 0;
@@ -1433,6 +1433,9 @@ xmlInitCharEncodingHandlers(void) {
     xmlRegisterCharEncodingHandlersISO8859x ();
 #endif
 #endif
+#ifdef __NetBSD__ /* XXX needed by selftest */
+    xmlAddEncodingAlias("CP1141", "IBM-1141");
+#endif
 
 }
 
@@ -1660,7 +1663,7 @@ xmlFindCharEncodingHandler(const char *n
      * Check first for directly registered encoding names
      */
     for (i = 0;i < 99;i++) {
-        upper[i] = toupper(name[i]);
+        upper[i] = toupper((unsigned char)name[i]);
 	if (upper[i] == 0) break;
     }
     upper[i] = 0;

$NetBSD$

Since this is built with C90, and %zu isn't supported then, cast
the size_t argument to long to match the format.
https://bugzilla.gnome.org/show_bug.cgi?id=766839

--- runtest.c.orig	2016-05-23 07:25:25.000000000 +0000
+++ runtest.c
@@ -688,7 +688,7 @@ static int compareFileMem(const char *fi
     }
     if (info.st_size != size) {
         fprintf(stderr, "file %s is %ld bytes, result is %d bytes\n",
-	        filename, info.st_size, size);
+	        filename, (long)info.st_size, size);
         return(-1);
     }
     fd = open(filename, RD_FLAGS);

$NetBSD$

Since this is built with C90, and %zu isn't supported then, cast
the size_t argument to unsigned long to match the format.
https://bugzilla.gnome.org/show_bug.cgi?id=766839

--- testlimits.c.orig	2016-02-09 10:17:34.000000000 +0000
+++ testlimits.c
@@ -1284,13 +1284,14 @@ saxTest(const char *filename, size_t lim
         if (fail)
             res = 0;
         else {
-            fprintf(stderr, "Failed to parse '%s' %lu\n", filename, limit);
+            fprintf(stderr, "Failed to parse '%s' %lu\n", filename,
+		    (unsigned long)limit);
             res = 1;
         }
     } else {
         if (fail) {
             fprintf(stderr, "Failed to get failure for '%s' %lu\n",
-                    filename, limit);
+                    filename, (unsigned long)limit);
             res = 1;
         } else
             res = 0;
@@ -1339,7 +1340,7 @@ readerTest(const char *filename, size_t 
                         filename, crazy_indx);
             else
                 fprintf(stderr, "Failed to parse '%s' %lu\n",
-                        filename, limit);
+                        filename, (unsigned long)limit);
             res = 1;
         }
     } else {
@@ -1349,7 +1350,7 @@ readerTest(const char *filename, size_t 
                         filename, crazy_indx);
             else
                 fprintf(stderr, "Failed to get failure for '%s' %lu\n",
-                        filename, limit);
+                        filename, (unsigned long)limit);
             res = 1;
         } else
             res = 0;

$NetBSD$

Cast argument (gcc says "unsigned int") to match %lu format.
https://bugzilla.gnome.org/show_bug.cgi?id=766839

--- timsort.h.orig	2016-02-09 10:17:34.000000000 +0000
+++ timsort.h
@@ -323,7 +323,7 @@ static void TIM_SORT_RESIZE(TEMP_STORAGE
     SORT_TYPE *tempstore = (SORT_TYPE *)realloc(store->storage, new_size * sizeof(SORT_TYPE));
     if (tempstore == NULL)
     {
-      fprintf(stderr, "Error allocating temporary storage for tim sort: need %lu bytes", sizeof(SORT_TYPE) * new_size);
+      fprintf(stderr, "Error allocating temporary storage for tim sort: need %lu bytes", (unsigned long)(sizeof(SORT_TYPE) * new_size));
       exit(1);
     }
     store->storage = tempstore;

$NetBSD$

Since this is built with C90, and %zu isn't supported then, cast
the size_t argument to unsigned long to match the format.
https://bugzilla.gnome.org/show_bug.cgi?id=766839

--- xmlIO.c.orig	2016-05-23 07:25:25.000000000 +0000
+++ xmlIO.c
@@ -1674,7 +1674,7 @@ xmlZMemBuffExtend( xmlZMemBuffPtr buff, 
 	xmlStrPrintf(msg, 500,
 		    "xmlZMemBuffExtend:  %s %lu bytes.\n",
 		    "Allocation failure extending output buffer to",
-		    new_size );
+		    (unsigned long)new_size );
 	xmlIOErr(XML_IO_WRITE, (const char *) msg);
     }