From owner-svn-ports-head@FreeBSD.ORG  Fri Mar 29 14:08:49 2013
Return-Path: <owner-svn-ports-head@FreeBSD.ORG>
Delivered-To: svn-ports-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by hub.freebsd.org (Postfix) with ESMTP id CC361153;
 Fri, 29 Mar 2013 14:08:49 +0000 (UTC) (envelope-from kwm@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 by mx1.freebsd.org (Postfix) with ESMTP id BBE317B3;
 Fri, 29 Mar 2013 14:08:49 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r2TE8nvJ010248;
 Fri, 29 Mar 2013 14:08:49 GMT (envelope-from kwm@svn.freebsd.org)
Received: (from kwm@localhost)
 by svn.freebsd.org (8.14.6/8.14.5/Submit) id r2TE8lig010236;
 Fri, 29 Mar 2013 14:08:47 GMT (envelope-from kwm@svn.freebsd.org)
Message-Id: <201303291408.r2TE8lig010236@svn.freebsd.org>
From: Koop Mast <kwm@FreeBSD.org>
Date: Fri, 29 Mar 2013 14:08:47 +0000 (UTC)
To: ports-committers@freebsd.org, svn-ports-all@freebsd.org,
 svn-ports-head@freebsd.org
Subject: svn commit: r315540 - in head: security/vuxml textproc/libxml2
 textproc/libxml2/files textproc/py-libxml2
X-SVN-Group: ports-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-ports-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the ports tree for head
 <svn-ports-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-ports-head>,
 <mailto:svn-ports-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-ports-head>
List-Post: <mailto:svn-ports-head@freebsd.org>
List-Help: <mailto:svn-ports-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-ports-head>,
 <mailto:svn-ports-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 29 Mar 2013 14:08:49 -0000

Author: kwm
Date: Fri Mar 29 14:08:46 2013
New Revision: 315540
URL: http://svnweb.freebsd.org/changeset/ports/315540

Log:
  Update to 2.8.0. [1]
  Add patch to fix CVE-2013-0338 and CVE-2013-0339. [2]
  Convert to OptionsNG, rename patches to standard form. [1]
  
  Notified by:	swills@ [2]
  Obtained from:	gnome team repo [1]
  Security:	843a4641-9816-11e2-9c51-080027019be0

Added:
  head/textproc/libxml2/files/patch-Makefile.in   (contents, props changed)
     - copied, changed from r315534, head/textproc/libxml2/files/patch-aa
  head/textproc/libxml2/files/patch-include_libxml_parser.h   (contents, props changed)
  head/textproc/libxml2/files/patch-parserInternals.c   (contents, props changed)
  head/textproc/libxml2/files/patch-python_Makefile.in   (contents, props changed)
     - copied, changed from r315534, head/textproc/libxml2/files/patch-python::Makefile.in
     - copied unchanged from r315534, head/textproc/libxml2/files/patch-python::tests::Makefile.in
Directory Properties:
  head/textproc/libxml2/files/patch-python_tests_Makefile.in   (props changed)
Deleted:
  head/textproc/libxml2/files/patch-aa
  head/textproc/libxml2/files/patch-python::Makefile.in
  head/textproc/libxml2/files/patch-python::tests::Makefile.in
  head/textproc/libxml2/files/patch-xpointer.c
Modified:
  head/security/vuxml/vuln.xml
  head/textproc/libxml2/Makefile
  head/textproc/libxml2/distinfo   (contents, props changed)
  head/textproc/libxml2/files/patch-config.h.in   (contents, props changed)
  head/textproc/libxml2/files/patch-configure   (contents, props changed)
  head/textproc/libxml2/files/patch-parser.c   (contents, props changed)
  head/textproc/py-libxml2/Makefile

Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml	Fri Mar 29 12:19:27 2013	(r315539)
+++ head/security/vuxml/vuln.xml	Fri Mar 29 14:08:46 2013	(r315540)
@@ -51,6 +51,38 @@ Note:  Please add new entries to the beg
 
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="843a4641-9816-11e2-9c51-080027019be0">
+    <topic>libxml2 -- cpu consumption Dos</topic>
+    <affects>
+      <package>
+	<name>libxml2</name>
+	<range><lt>2.8.0</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Kurt Seifried reports:</p>
+	<blockquote cite="http://seclists.org/oss-sec/2013/q1/391">
+	  <p>libxml2 is affected by the expansion of internal entities
+	     (which can be used to consume resources) and external entities
+	     (which can cause a denial of service against other services,
+	     be used to port scan, etc.)..</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2013-0338</cvename>
+      <cvename>CVE-2013-0339</cvename>
+      <url>http://seclists.org/oss-sec/2013/q1/391</url>
+      <url>https://security-tracker.debian.org/tracker/CVE-2013-0338</url>
+      <url>https://security-tracker.debian.org/tracker/CVE-2013-0339</url>
+    </references>
+    <dates>
+      <discovery>2013-02-21</discovery>
+      <entry>2013-03-29</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="daf0a339-9850-11e2-879e-d43d7e0c7c02">
     <topic>asterisk -- multiple vulnerabilities</topic>
     <affects>

Modified: head/textproc/libxml2/Makefile
==============================================================================
--- head/textproc/libxml2/Makefile	Fri Mar 29 12:19:27 2013	(r315539)
+++ head/textproc/libxml2/Makefile	Fri Mar 29 14:08:46 2013	(r315540)
@@ -3,17 +3,11 @@
 # Whom:					Yukihiro Nakai <Nakai@technologist.com>
 #
 # $FreeBSD$
-#
-# WITHOUT_SCHEMA disable XML schema support
-# WITHOUT_THREADS disable threads support
-# WITH_MEM_DEBUG enable memory debugging (DEVELOPERS ONLY!)
-# WITH_XMLLINT_HIST enable history for xmllint
-# WITH_THREAD_ALLOC enable per-thread memory (DEVELOPERS ONLY!)
-#
+#    $MCom: ports/textproc/libxml2/Makefile,v 1.15 2012/11/26 19:55:23 kwm Exp $
 
 PORTNAME=	libxml2
-PORTVERSION=	2.7.8
-PORTREVISION?=	5
+PORTVERSION=	2.8.0
+PORTREVISION?=	0
 CATEGORIES?=	textproc gnome
 MASTER_SITES=	ftp://xmlsoft.org/libxml2/ \
 		ftp://gd.tuwien.ac.at/pub/libxml/
@@ -27,46 +21,52 @@ COMMENT?=	XML parser library for GNOME
 USE_CSTD=	gnu89
 USE_GMAKE=	yes
 MAKE_JOBS_SAFE=	yes
+USE_ICONV=	yes
 GNU_CONFIGURE=	yes
-USE_GNOME?=	gnomehack pkgconfig
+USES=		pathfix
+USE_GNOME?=	pkgconfig
 USE_LDCONFIG=	yes
-CONFIGURE_ARGS?=--with-html-dir=${PREFIX}/share/doc \
+CONFIGURE_ARGS?=--with-iconv=${LOCALBASE} \
+		--with-html-dir=${PREFIX}/share/doc \
 		--with-html-subdir=${PORTNAME} \
 		--without-python
 CPPFLAGS+=	-I${LOCALBASE}/include
 LDFLAGS+=	-L${LOCALBASE}/lib
 
-.if !defined(WITHOUT_ICONV)
-USE_ICONV=	yes
-CONFIGURE_ARGS+=--with-iconv=${LOCALBASE}
-.else
-CONFIGURE_ARGS+=--with-iconv=no
-.endif
-
 .if !defined(MASTERDIR)
 MAN1=		xml2-config.1 xmllint.1 xmlcatalog.1
 MAN3=		libxml.3
-.endif
 
-.if defined(WITHOUT_SCHEMA)
+OPTIONS_DEFINE= SCHEMA THREADS MEM_DEBUG XMLLINT_HIST THREAD_ALLOC
+OPTIONS_DEFAULT=SCHEMA THREADS
+SCHEMA_DESC=	XML schema support
+THREADS_DESC=	Threads support
+MEM_DEBUG_DESC= Memory debugging (DEVELOPERS ONLY!)
+XMLLINT_HIST_DESC= History for xmllint
+THREAD_ALLOC_DESc= Per-thread memory (DEVELOPERS ONLY!)
+
+.include <bsd.port.options.mk>
+
+.if ${PORT_OPTIONS:MSCHEMA}
 CONFIGURE_ARGS+=	--without-schemas
 .endif
 
-.if defined(WITHOUT_THREADS)
+.if ${PORT_OPTIONS:MTHREADS}
 CONFIGURE_ARGS+=	--without-threads
 .endif
 
-.if defined(WITH_MEM_DEBUG)
+.if ${PORT_OPTIONS:MMEM_DEBUG}
 CONFIGURE_ARGS+=	--with-mem-debug
 .endif
 
-.if defined(WITH_XMLLINT_HIST)
+.if ${PORT_OPTIONS:MXMLLINT_HIST}
 CONFIGURE_ARGS+=	--with-history
 .endif
 
-.if defined(WITH_THREAD_ALLOC)
+.if ${PORT_OPTIONS:MTHREAD_ALLOC}
 CONFIGURE_ARGS+=	--with-thread-alloc
 .endif
+.endif # !defined(MASTERDIR)
 
 post-patch:
 .for d in . doc doc/devhelp doc/examples

Modified: head/textproc/libxml2/distinfo
==============================================================================
--- head/textproc/libxml2/distinfo	Fri Mar 29 12:19:27 2013	(r315539)
+++ head/textproc/libxml2/distinfo	Fri Mar 29 14:08:46 2013	(r315540)
@@ -1,2 +1,2 @@
-SHA256 (gnome2/libxml2-2.7.8.tar.gz) = cda23bc9ebd26474ca8f3d67e7d1c4a1f1e7106364b690d822e009fdc3c417ec
-SIZE (gnome2/libxml2-2.7.8.tar.gz) = 4881808
+SHA256 (gnome2/libxml2-2.8.0.tar.gz) = f2e2d0e322685193d1affec83b21dc05d599e17a7306d7b90de95bb5b9ac622a
+SIZE (gnome2/libxml2-2.8.0.tar.gz) = 4915203

Copied and modified: head/textproc/libxml2/files/patch-Makefile.in (from r315534, head/textproc/libxml2/files/patch-aa)
==============================================================================
--- head/textproc/libxml2/files/patch-aa	Fri Mar 29 10:04:43 2013	(r315534, copy source)
+++ head/textproc/libxml2/files/patch-Makefile.in	Fri Mar 29 14:08:46 2013	(r315540)
@@ -1,17 +1,17 @@
  $FreeBSD$
 
---- Makefile.in.orig	2012-08-16 19:47:20.000000000 +0200
-+++ Makefile.in	2012-08-16 19:47:48.000000000 +0200
-@@ -564,7 +564,7 @@ top_build_prefix = @top_build_prefix@
+--- Makefile.in.orig	2012-08-16 19:38:10.000000000 +0200
++++ Makefile.in	2012-08-16 19:39:09.000000000 +0200
+@@ -586,7 +586,7 @@
  top_builddir = @top_builddir@
  top_srcdir = @top_srcdir@
  ACLOCAL_AMFLAGS = -I m4
 -SUBDIRS = include . doc example xstc @PYTHON_SUBDIR@
 +SUBDIRS = include . doc example xstc @WITH_PYTHON_TRUE@ @PYTHON_SUBDIR@
  DIST_SUBDIRS = include . doc example python xstc
- INCLUDES = -I$(top_builddir)/include -I@srcdir@/include @THREAD_CFLAGS@ @Z_CFLAGS@ 
+ INCLUDES = -I$(top_builddir)/include -I@srcdir@/include @THREAD_CFLAGS@ @Z_CFLAGS@ @LZMA_CFLAGS@
  bin_SCRIPTS = xml2-config
-@@ -574,7 +574,7 @@ libxml2_la_LIBADD = @THREAD_LIBS@ @Z_LIB
+@@ -596,7 +596,7 @@
  @USE_VERSION_SCRIPT_TRUE@LIBXML2_VERSION_SCRIPT = $(VERSION_SCRIPT_FLAGS)$(srcdir)/libxml2.syms
  libxml2_la_LDFLAGS = @CYGWIN_EXTRA_LDFLAGS@ @WIN32_EXTRA_LDFLAGS@ \
                       $(LIBXML2_VERSION_SCRIPT) \
@@ -20,7 +20,7 @@
  		     @MODULE_PLATFORM_LIBS@
  
  @WITH_TRIO_SOURCES_FALSE@libxml2_la_SOURCES = SAX.c entities.c encoding.c error.c parserInternals.c  \
-@@ -690,7 +690,7 @@ runxmlconf_LDFLAGS = 
+@@ -712,7 +712,7 @@
  runxmlconf_DEPENDENCIES = $(DEPS)
  runxmlconf_LDADD = $(LDADDS)
  CLEANFILES = xml2Conf.sh *.gcda *.gcno
@@ -29,7 +29,7 @@
  confexec_DATA = xml2Conf.sh
  CVS_EXTRA_DIST = 
  EXTRA_DIST = xml2-config.in xml2Conf.sh.in libxml.spec.in libxml2.spec \
-@@ -713,8 +713,8 @@ pkgconfig_DATA = libxml-2.0.pc
+@@ -735,8 +735,8 @@
  # Install the tests program sources as examples 
  #
  BASE_DIR = $(datadir)/doc
@@ -40,16 +40,16 @@
  
  #
  # Coverage support, largely borrowed from libvirt
-@@ -1069,7 +1069,7 @@ distclean-compile:
+@@ -1094,7 +1094,7 @@
  @am__fastdepCC_FALSE@	$(COMPILE) -c `$(CYGPATH_W) '$<'`
  
  .c.lo:
--@am__fastdepCC_TRUE@	$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-+@am__fastdepCC_TRUE@	$(LTCOMPILE) -fPIC -DPIC -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
- @am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+-@am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
++@am__fastdepCC_TRUE@	$(AM_V_CC)$(LTCOMPILE) -fPIC -DPIC -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
+ @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+ @am__fastdepCC_FALSE@	$(AM_V_CC) @AM_BACKSLASH@
  @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
- @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@@ -1548,7 +1548,7 @@ distcleancheck: distclean
+@@ -1574,7 +1574,7 @@
  	       exit 1; } >&2
  check-am: all-am
  check: check-recursive
@@ -58,3 +58,12 @@
  		config.h
  install-binPROGRAMS: install-libLTLIBRARIES
  
+@@ -1634,7 +1634,7 @@
+ 
+ info-am:
+ 
+-install-data-am: install-data-local install-m4dataDATA install-man \
++install-data-am:  install-m4dataDATA install-man \
+ 	install-pkgconfigDATA
+ 
+ install-dvi: install-dvi-recursive

Modified: head/textproc/libxml2/files/patch-config.h.in
==============================================================================
--- head/textproc/libxml2/files/patch-config.h.in	Fri Mar 29 12:19:27 2013	(r315539)
+++ head/textproc/libxml2/files/patch-config.h.in	Fri Mar 29 14:08:46 2013	(r315540)
@@ -1,11 +1,11 @@
---- config.h.in.orig	Sun Nov  3 16:55:05 2002
-+++ config.h.in	Tue Nov 19 00:06:05 2002
-@@ -1,4 +1,8 @@
+--- config.h.in.orig	2012-05-23 10:56:31.000000000 +0200
++++ config.h.in	2012-07-23 09:34:22.000000000 +0200
+@@ -1,5 +1,8 @@
  /* config.h.in.  Generated from configure.in by autoheader.  */
-+
+ 
 +/* XXX */
 +#define HAVE_VFSCANF
 +
- #undef PACKAGE
- #undef VERSION
- #undef HAVE_LIBZ
+ /* Define to 1 if you have the <ansidecl.h> header file. */
+ #undef HAVE_ANSIDECL_H
+ 

Modified: head/textproc/libxml2/files/patch-configure
==============================================================================
--- head/textproc/libxml2/files/patch-configure	Fri Mar 29 12:19:27 2013	(r315539)
+++ head/textproc/libxml2/files/patch-configure	Fri Mar 29 14:08:46 2013	(r315540)
@@ -1,15 +1,6 @@
---- configure.orig	2010-11-27 15:40:06.000000000 +0100
-+++ configure	2010-11-27 15:40:06.000000000 +0100
-@@ -11414,7 +11414,7 @@ else
-   esac
- fi
- 
-- if test -z "$VERSION_SCRIPT_FLAGS"; then
-+ if test -n "$VERSION_SCRIPT_FLAGS"; then
-   USE_VERSION_SCRIPT_TRUE=
-   USE_VERSION_SCRIPT_FALSE='#'
- else
-@@ -13501,11 +13501,12 @@ fi
+--- configure.orig	2012-08-04 11:48:19.000000000 +0200
++++ configure	2012-08-04 11:50:50.000000000 +0200
+@@ -14228,11 +14228,12 @@ fi
      fi
      if test "$PYTHON_VERSION" != ""
      then
@@ -23,7 +14,7 @@
  	else
  	    if test -r $prefix/include/python$PYTHON_VERSION/Python.h
  	    then
-@@ -13901,6 +13902,8 @@ fi
+@@ -14635,6 +14636,8 @@ fi
  	       fi
  	   fi
         ;;

Added: head/textproc/libxml2/files/patch-include_libxml_parser.h
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/textproc/libxml2/files/patch-include_libxml_parser.h	Fri Mar 29 14:08:46 2013	(r315540)
@@ -0,0 +1,10 @@
+--- include/libxml/parser.h.orig	2012-05-15 03:09:43.000000000 +0000
++++ include/libxml/parser.h	2013-03-13 09:42:57.000000000 +0000
+@@ -310,6 +310,7 @@
+     xmlParserNodeInfo *nodeInfoTab;   /* array of nodeInfos */
+ 
+     int                input_id;      /* we need to label inputs */
++    unsigned long      sizeentcopy;  /* volume of entity copy */
+ };
+ 
+ /**

Modified: head/textproc/libxml2/files/patch-parser.c
==============================================================================
--- head/textproc/libxml2/files/patch-parser.c	Fri Mar 29 12:19:27 2013	(r315539)
+++ head/textproc/libxml2/files/patch-parser.c	Fri Mar 29 14:08:46 2013	(r315540)
@@ -1,25 +1,343 @@
-Commit doesn't mention it but this fixes CVE-2011-3919
 
-From 5bd3c061823a8499b27422aee04ea20aae24f03e Mon Sep 17 00:00:00 2001
-From: Daniel Veillard <veillard@redhat.com>
-Date: Fri, 16 Dec 2011 10:53:35 +0000
-Subject: Fix an allocation error when copying entities
-
----
-(limited to 'parser.c')
-
-diff --git a/parser.c b/parser.c
-index 4e5dcb9..c55e41d 100644
---- parser.c
-+++ parser.c
-@@ -2709,7 +2709,7 @@ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
+--- parser.c.orig	2013-03-13 09:36:07.000000000 +0000
++++ parser.c	2013-03-13 09:35:54.000000000 +0000
+@@ -40,6 +40,7 @@
+ #endif
+ 
+ #include <stdlib.h>
++#include <limits.h>
+ #include <string.h>
+ #include <stdarg.h>
+ #include <libxml/xmlmemory.h>
+@@ -117,16 +118,33 @@
+  * parser option.
+  */
+ static int
+-xmlParserEntityCheck(xmlParserCtxtPtr ctxt, unsigned long size,
+-                     xmlEntityPtr ent)
++xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size,
++                     xmlEntityPtr ent, size_t replacement)
+ {
+-    unsigned long consumed = 0;
++    size_t consumed = 0;
+ 
+     if ((ctxt == NULL) || (ctxt->options & XML_PARSE_HUGE))
+         return (0);
+     if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP)
+         return (1);
+-    if (size != 0) {
++    if (replacement != 0) {
++	if (replacement < XML_MAX_TEXT_LENGTH)
++	    return(0);
++
++        /*
++	 * If the volume of entity copy reaches 10 times the
++	 * amount of parsed data and over the large text threshold
++	 * then that's very likely to be an abuse.
++	 */
++        if (ctxt->input != NULL) {
++	    consumed = ctxt->input->consumed +
++	               (ctxt->input->cur - ctxt->input->base);
++	}
++        consumed += ctxt->sizeentities;
++
++        if (replacement < XML_PARSER_NON_LINEAR * consumed)
++	    return(0);
++    } else if (size != 0) {
+         /*
+          * Do the check based on the replacement size of the entity
+          */
+@@ -172,7 +190,6 @@
+          */
+         return (0);
+     }
+-
+     xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
+     return (1);
+ }
+@@ -2589,15 +2606,17 @@
+ 
+ /*
+  * Macro used to grow the current buffer.
++ * buffer##_size is expected to be a size_t
++ * mem_error: is expected to handle memory allocation failures
+  */
+ #define growBuffer(buffer, n) {						\
+     xmlChar *tmp;							\
+-    buffer##_size *= 2;							\
+-    buffer##_size += n;							\
+-    tmp = (xmlChar *)							\
+-		xmlRealloc(buffer, buffer##_size * sizeof(xmlChar));	\
++    size_t new_size = buffer##_size * 2 + n;                            \
++    if (new_size < buffer##_size) goto mem_error;                       \
++    tmp = (xmlChar *) xmlRealloc(buffer, new_size);                     \
+     if (tmp == NULL) goto mem_error;					\
+     buffer = tmp;							\
++    buffer##_size = new_size;                                           \
+ }
+ 
+ /**
+@@ -2623,14 +2642,14 @@
+ xmlStringLenDecodeEntities(xmlParserCtxtPtr ctxt, const xmlChar *str, int len,
+ 		      int what, xmlChar end, xmlChar  end2, xmlChar end3) {
+     xmlChar *buffer = NULL;
+-    int buffer_size = 0;
++    size_t buffer_size = 0;
++    size_t nbchars = 0;
+ 
+     xmlChar *current = NULL;
+     xmlChar *rep = NULL;
+     const xmlChar *last;
+     xmlEntityPtr ent;
+     int c,l;
+-    int nbchars = 0;
+ 
+     if ((ctxt == NULL) || (str == NULL) || (len < 0))
+ 	return(NULL);
+@@ -2647,7 +2666,7 @@
+      * allocate a translation buffer.
+      */
+     buffer_size = XML_PARSER_BIG_BUFFER_SIZE;
+-    buffer = (xmlChar *) xmlMallocAtomic(buffer_size * sizeof(xmlChar));
++    buffer = (xmlChar *) xmlMallocAtomic(buffer_size);
+     if (buffer == NULL) goto mem_error;
+ 
+     /*
+@@ -2667,7 +2686,7 @@
+ 	    if (val != 0) {
+ 		COPY_BUF(0,buffer,nbchars,val);
+ 	    }
+-	    if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
++	    if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
+ 	        growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
+ 	    }
+ 	} else if ((c == '&') && (what & XML_SUBSTITUTE_REF)) {
+@@ -2685,7 +2704,7 @@
+ 		(ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
+ 		if (ent->content != NULL) {
+ 		    COPY_BUF(0,buffer,nbchars,ent->content[0]);
+-		    if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
++		    if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
+ 			growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
+ 		    }
+ 		} else {
+@@ -2702,9 +2721,8 @@
+ 		    current = rep;
+ 		    while (*current != 0) { /* non input consuming loop */
+ 			buffer[nbchars++] = *current++;
+-			if (nbchars >
+-		            buffer_size - XML_PARSER_BUFFER_SIZE) {
+-			    if (xmlParserEntityCheck(ctxt, nbchars, ent))
++			if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
++			    if (xmlParserEntityCheck(ctxt, nbchars, ent, 0))
+ 				goto int_error;
+ 			    growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
+ 			}
+@@ -2717,7 +2735,7 @@
+ 		const xmlChar *cur = ent->name;
  
  		buffer[nbchars++] = '&';
- 		if (nbchars > buffer_size - i - XML_PARSER_BUFFER_SIZE) {
--		    growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
-+		    growBuffer(buffer, i + XML_PARSER_BUFFER_SIZE);
+-		if (nbchars > buffer_size - i - XML_PARSER_BUFFER_SIZE) {
++		if (nbchars + i + XML_PARSER_BUFFER_SIZE > buffer_size) {
+ 		    growBuffer(buffer, i + XML_PARSER_BUFFER_SIZE);
  		}
  		for (;i > 0;i--)
- 		    buffer[nbchars++] = *cur++;
---
-cgit v0.9.0.2
+@@ -2745,9 +2763,8 @@
+ 		    current = rep;
+ 		    while (*current != 0) { /* non input consuming loop */
+ 			buffer[nbchars++] = *current++;
+-			if (nbchars >
+-		            buffer_size - XML_PARSER_BUFFER_SIZE) {
+-			    if (xmlParserEntityCheck(ctxt, nbchars, ent))
++			if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
++			    if (xmlParserEntityCheck(ctxt, nbchars, ent, 0))
+ 			        goto int_error;
+ 			    growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
+ 			}
+@@ -2759,8 +2776,8 @@
+ 	} else {
+ 	    COPY_BUF(l,buffer,nbchars,c);
+ 	    str += l;
+-	    if (nbchars > buffer_size - XML_PARSER_BUFFER_SIZE) {
+-	      growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
++	    if (nbchars + XML_PARSER_BUFFER_SIZE > buffer_size) {
++	        growBuffer(buffer, XML_PARSER_BUFFER_SIZE);
+ 	    }
+ 	}
+ 	if (str < last)
+@@ -3764,8 +3781,8 @@
+     xmlChar limit = 0;
+     xmlChar *buf = NULL;
+     xmlChar *rep = NULL;
+-    int len = 0;
+-    int buf_size = 0;
++    size_t len = 0;
++    size_t buf_size = 0;
+     int c, l, in_space = 0;
+     xmlChar *current = NULL;
+     xmlEntityPtr ent;
+@@ -3787,7 +3804,7 @@
+      * allocate a translation buffer.
+      */
+     buf_size = XML_PARSER_BUFFER_SIZE;
+-    buf = (xmlChar *) xmlMallocAtomic(buf_size * sizeof(xmlChar));
++    buf = (xmlChar *) xmlMallocAtomic(buf_size);
+     if (buf == NULL) goto mem_error;
+ 
+     /*
+@@ -3804,7 +3821,7 @@
+ 
+ 		if (val == '&') {
+ 		    if (ctxt->replaceEntities) {
+-			if (len > buf_size - 10) {
++			if (len + 10 > buf_size) {
+ 			    growBuffer(buf, 10);
+ 			}
+ 			buf[len++] = '&';
+@@ -3813,7 +3830,7 @@
+ 			 * The reparsing will be done in xmlStringGetNodeList()
+ 			 * called by the attribute() function in SAX.c
+ 			 */
+-			if (len > buf_size - 10) {
++			if (len + 10 > buf_size) {
+ 			    growBuffer(buf, 10);
+ 			}
+ 			buf[len++] = '&';
+@@ -3823,7 +3840,7 @@
+ 			buf[len++] = ';';
+ 		    }
+ 		} else if (val != 0) {
+-		    if (len > buf_size - 10) {
++		    if (len + 10 > buf_size) {
+ 			growBuffer(buf, 10);
+ 		    }
+ 		    len += xmlCopyChar(0, &buf[len], val);
+@@ -3835,7 +3852,7 @@
+ 		    ctxt->nbentities += ent->owner;
+ 		if ((ent != NULL) &&
+ 		    (ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
+-		    if (len > buf_size - 10) {
++		    if (len + 10 > buf_size) {
+ 			growBuffer(buf, 10);
+ 		    }
+ 		    if ((ctxt->replaceEntities == 0) &&
+@@ -3863,7 +3880,7 @@
+                                     current++;
+                                 } else
+                                     buf[len++] = *current++;
+-				if (len > buf_size - 10) {
++				if (len + 10 > buf_size) {
+ 				    growBuffer(buf, 10);
+ 				}
+ 			    }
+@@ -3871,7 +3888,7 @@
+ 			    rep = NULL;
+ 			}
+ 		    } else {
+-			if (len > buf_size - 10) {
++			if (len + 10 > buf_size) {
+ 			    growBuffer(buf, 10);
+ 			}
+ 			if (ent->content != NULL)
+@@ -3899,7 +3916,7 @@
+ 		     * Just output the reference
+ 		     */
+ 		    buf[len++] = '&';
+-		    while (len > buf_size - i - 10) {
++		    while (len + i + 10 > buf_size) {
+ 			growBuffer(buf, i + 10);
+ 		    }
+ 		    for (;i > 0;i--)
+@@ -3912,7 +3929,7 @@
+ 	        if ((len != 0) || (!normalize)) {
+ 		    if ((!normalize) || (!in_space)) {
+ 			COPY_BUF(l,buf,len,0x20);
+-			while (len > buf_size - 10) {
++			while (len + 10 > buf_size) {
+ 			    growBuffer(buf, 10);
+ 			}
+ 		    }
+@@ -3921,7 +3938,7 @@
+ 	    } else {
+ 	        in_space = 0;
+ 		COPY_BUF(l,buf,len,c);
+-		if (len > buf_size - 10) {
++		if (len + 10 > buf_size) {
+ 		    growBuffer(buf, 10);
+ 		}
+ 	    }
+@@ -3931,7 +3948,7 @@
+ 	c = CUR_CHAR(l);
+     }
+     if ((in_space) && (normalize)) {
+-        while (buf[len - 1] == 0x20) len--;
++        while ((len > 0) && (buf[len - 1] == 0x20)) len--;
+     }
+     buf[len] = 0;
+     if (RAW == '<') {
+@@ -3946,7 +3963,18 @@
+         }
+     } else
+ 	NEXT;
+-    if (attlen != NULL) *attlen = len;
++
++    /*
++     * There we potentially risk an overflow, don't allow attribute value of
++     * lenght more than INT_MAX it is a very reasonnable assumption !
++     */
++    if (len >= INT_MAX) {
++        xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
++                       "AttValue lenght too long\n");
++        goto mem_error;
++    }
++
++    if (attlen != NULL) *attlen = (int) len;
+     return(buf);
+ 
+ mem_error:
+@@ -6964,7 +6992,7 @@
+ 	    xmlFreeNodeList(list);
+ 	    return;
+ 	}
+-	if (xmlParserEntityCheck(ctxt, 0, ent)) {
++	if (xmlParserEntityCheck(ctxt, 0, ent, 0)) {
+ 	    xmlFreeNodeList(list);
+ 	    return;
+ 	}
+@@ -7124,6 +7152,13 @@
+ 		xmlNodePtr nw = NULL, cur, firstChild = NULL;
+ 
+ 		/*
++		 * We are copying here, make sure there is no abuse
++		 */
++		ctxt->sizeentcopy += ent->length;
++		if (xmlParserEntityCheck(ctxt, 0, ent, ctxt->sizeentcopy))
++		    return;
++
++		/*
+ 		 * when operating on a reader, the entities definitions
+ 		 * are always owning the entities subtree.
+ 		if (ctxt->parseMode == XML_PARSE_READER)
+@@ -7163,6 +7198,14 @@
+ 	    } else if (list == NULL) {
+ 		xmlNodePtr nw = NULL, cur, next, last,
+ 			   firstChild = NULL;
++
++		/*
++		 * We are copying here, make sure there is no abuse
++		 */
++		ctxt->sizeentcopy += ent->length;
++		if (xmlParserEntityCheck(ctxt, 0, ent, ctxt->sizeentcopy))
++		    return;
++
+ 		/*
+ 		 * Copy the entity child list and make it the new
+ 		 * entity child list. The goal is to make sure any
+@@ -14343,6 +14386,7 @@
+     ctxt->catalogs = NULL;
+     ctxt->nbentities = 0;
+     ctxt->sizeentities = 0;
++    ctxt->sizeentcopy = 0;
+     xmlInitNodeInfoSeq(&ctxt->node_seq);
+ 
+     if (ctxt->attsDefault != NULL) {

Added: head/textproc/libxml2/files/patch-parserInternals.c
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/textproc/libxml2/files/patch-parserInternals.c	Fri Mar 29 14:08:46 2013	(r315540)
@@ -0,0 +1,11 @@
+--- parserInternals.c.orig	2012-05-15 03:16:38.000000000 +0000
++++ parserInternals.c	2013-03-13 09:35:54.000000000 +0000
+@@ -1761,6 +1761,8 @@
+     ctxt->charset = XML_CHAR_ENCODING_UTF8;
+     ctxt->catalogs = NULL;
+     ctxt->nbentities = 0;
++    ctxt->sizeentities = 0;
++    ctxt->sizeentcopy = 0;
+     ctxt->input_id = 1;
+     xmlInitNodeInfoSeq(&ctxt->node_seq);
+     return(0);

Copied and modified: head/textproc/libxml2/files/patch-python_Makefile.in (from r315534, head/textproc/libxml2/files/patch-python::Makefile.in)
==============================================================================
--- head/textproc/libxml2/files/patch-python::Makefile.in	Fri Mar 29 10:04:43 2013	(r315534, copy source)
+++ head/textproc/libxml2/files/patch-python_Makefile.in	Fri Mar 29 14:08:46 2013	(r315540)
@@ -1,6 +1,6 @@
---- python/Makefile.in.orig	2008-05-23 22:39:11.000000000 -0500
-+++ python/Makefile.in	2008-05-23 22:40:42.000000000 -0500
-@@ -322,7 +322,7 @@
+--- python/Makefile.in.orig	2012-08-04 12:00:53.000000000 +0200
++++ python/Makefile.in	2012-08-04 12:02:59.000000000 +0200
+@@ -395,7 +395,7 @@
  	-I$(top_builddir)/include \
  	-I$(top_builddir)/$(subdir)
  
@@ -9,7 +9,7 @@
  # libxml2class.txt is generated
  dist_docs_DATA = TODO
  EXTRA_DIST = \
-@@ -335,7 +335,7 @@
+@@ -408,12 +408,12 @@
  
  libxml2mod_la_LDFLAGS = @CYGWIN_EXTRA_LDFLAGS@ @WIN32_EXTRA_LDFLAGS@ -module -avoid-version 
  @WITH_PYTHON_TRUE@mylibs = \
@@ -17,4 +17,10 @@
 +@WITH_PYTHON_TRUE@	-lxml2
  
  @WITH_PYTHON_TRUE@python_LTLIBRARIES = libxml2mod.la
- @WITH_PYTHON_TRUE@libxml2mod_la_SOURCES = libxml.c types.c
+ @WITH_PYTHON_TRUE@libxml2mod_la_SOURCES = $(srcdir)/libxml.c $(srcdir)/types.c
+ @WITH_PYTHON_TRUE@nodist_libxml2mod_la_SOURCES = libxml2-py.c
+-@WITH_PYTHON_TRUE@libxml2mod_la_LIBADD = $(mylibs) @CYGWIN_EXTRA_PYTHON_LIBADD@ @WIN32_EXTRA_PYTHON_LIBADD@ @PYTHON_LIBS@ -lpython$(PYTHON_VERSION)
++@WITH_PYTHON_TRUE@libxml2mod_la_LIBADD = $(mylibs) @CYGWIN_EXTRA_PYTHON_LIBADD@ @WIN32_EXTRA_PYTHON_LIBADD@ @PYTHON_LIBS@
+ @WITH_PYTHON_TRUE@python_DATA = \
+ @WITH_PYTHON_TRUE@	libxml2.py
+ 

Copied: head/textproc/libxml2/files/patch-python_tests_Makefile.in (from r315534, head/textproc/libxml2/files/patch-python::tests::Makefile.in)
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/textproc/libxml2/files/patch-python_tests_Makefile.in	Fri Mar 29 14:08:46 2013	(r315540, copy of r315534, head/textproc/libxml2/files/patch-python::tests::Makefile.in)
@@ -0,0 +1,11 @@
+--- python/tests/Makefile.in.orig	2008-05-23 22:41:49.000000000 -0500
++++ python/tests/Makefile.in	2008-05-23 22:42:12.000000000 -0500
+@@ -270,7 +270,7 @@
+ target_alias = @target_alias@
+ top_builddir = @top_builddir@
+ top_srcdir = @top_srcdir@
+-exampledir = $(datadir)/doc/libxml2-python-$(LIBXML_VERSION)/examples
++exampledir = $(datadir)/examples/py-libxml2
+ dist_example_DATA = $(PYTESTS) $(XMLS)
+ PYTESTS = \
+     build.py	\

Modified: head/textproc/py-libxml2/Makefile
==============================================================================
--- head/textproc/py-libxml2/Makefile	Fri Mar 29 12:19:27 2013	(r315539)
+++ head/textproc/py-libxml2/Makefile	Fri Mar 29 14:08:46 2013	(r315540)
@@ -1,11 +1,7 @@
-# New ports collection makefile for:	py-libxml2
-# Date created:				30 Jun 2004
-# Whom:					Alexander Nedotsukov <bland@FreeBSD.org>
-#
+# Created by: Alexander Nedotsukov <bland@FreeBSD.org>
 # $FreeBSD$
-#
 
-PORTREVISION=	2
+PORTREVISION=	0
 CATEGORIES=	textproc gnome python
 PKGNAMEPREFIX=	${PYTHON_PKGNAMEPREFIX}
 
@@ -18,7 +14,7 @@ INSTALL_WRKSRC=	${BUILD_WRKSRC}
 DESCR=		${.CURDIR}/pkg-descr
 PLIST=		${.CURDIR}/pkg-plist
 
-USE_GNOME=	gnomehack libxml2
+USE_GNOME+=	libxml2
 USE_PYTHON=	yes
 CPPFLAGS+=	`${PYTHON_VERSION}-config --cflags`
 LDFLAGS+=	`${PYTHON_VERSION}-config --libs`