1 /*
2  * valid.c : part of the code use to do the DTD handling and the validity
3  *           checking
4  *
5  * See Copyright for the status of this software.
6  *
7  * daniel@veillard.com
8  */
9 
10 #define IN_LIBXML
11 #include "libxml.h"
12 
13 #include <string.h>
14 
15 #ifdef HAVE_STDLIB_H
16 #include <stdlib.h>
17 #endif
18 
19 #include <libxml/xmlmemory.h>
20 #include <libxml/hash.h>
21 #include <libxml/uri.h>
22 #include <libxml/valid.h>
23 #include <libxml/parser.h>
24 #include <libxml/parserInternals.h>
25 #include <libxml/xmlerror.h>
26 #include <libxml/list.h>
27 #include <libxml/globals.h>
28 
29 static xmlElementPtr xmlGetDtdElementDesc2(xmlDtdPtr dtd, const xmlChar *name,
30 	                           int create);
31 /* #define DEBUG_VALID_ALGO */
32 /* #define DEBUG_REGEXP_ALGO */
33 
34 #define TODO								\
35     xmlGenericError(xmlGenericErrorContext,				\
36 	    "Unimplemented block at %s:%d\n",				\
37             __FILE__, __LINE__);
38 
39 #ifdef LIBXML_VALID_ENABLED
40 static int
41 xmlValidateAttributeValueInternal(xmlDocPtr doc, xmlAttributeType type,
42                                   const xmlChar *value);
43 #endif
44 /************************************************************************
45  *									*
46  *			Error handling routines				*
47  *									*
48  ************************************************************************/
49 
50 /**
51  * xmlVErrMemory:
52  * @ctxt:  an XML validation parser context
53  * @extra:  extra informations
54  *
55  * Handle an out of memory error
56  */
57 static void
xmlVErrMemory(xmlValidCtxtPtr ctxt,const char * extra)58 xmlVErrMemory(xmlValidCtxtPtr ctxt, const char *extra)
59 {
60     xmlGenericErrorFunc channel = NULL;
61     xmlParserCtxtPtr pctxt = NULL;
62     void *data = NULL;
63 
64     if (ctxt != NULL) {
65         channel = ctxt->error;
66         data = ctxt->userData;
67 	/* Use the special values to detect if it is part of a parsing
68 	   context */
69 	if ((ctxt->finishDtd == XML_CTXT_FINISH_DTD_0) ||
70 	    (ctxt->finishDtd == XML_CTXT_FINISH_DTD_1)) {
71 	    long delta = (char *) ctxt - (char *) ctxt->userData;
72 	    if ((delta > 0) && (delta < 250))
73 		pctxt = ctxt->userData;
74 	}
75     }
76     if (extra)
77         __xmlRaiseError(NULL, channel, data,
78                         pctxt, NULL, XML_FROM_VALID, XML_ERR_NO_MEMORY,
79                         XML_ERR_FATAL, NULL, 0, extra, NULL, NULL, 0, 0,
80                         "Memory allocation failed : %s\n", extra);
81     else
82         __xmlRaiseError(NULL, channel, data,
83                         pctxt, NULL, XML_FROM_VALID, XML_ERR_NO_MEMORY,
84                         XML_ERR_FATAL, NULL, 0, NULL, NULL, NULL, 0, 0,
85                         "Memory allocation failed\n");
86 }
87 
88 /**
89  * xmlErrValid:
90  * @ctxt:  an XML validation parser context
91  * @error:  the error number
92  * @extra:  extra informations
93  *
94  * Handle a validation error
95  */
96 static void
xmlErrValid(xmlValidCtxtPtr ctxt,xmlParserErrors error,const char * msg,const char * extra)97 xmlErrValid(xmlValidCtxtPtr ctxt, xmlParserErrors error,
98             const char *msg, const char *extra)
99 {
100     xmlGenericErrorFunc channel = NULL;
101     xmlParserCtxtPtr pctxt = NULL;
102     void *data = NULL;
103 
104     if (ctxt != NULL) {
105         channel = ctxt->error;
106         data = ctxt->userData;
107 	/* Use the special values to detect if it is part of a parsing
108 	   context */
109 	if ((ctxt->finishDtd == XML_CTXT_FINISH_DTD_0) ||
110 	    (ctxt->finishDtd == XML_CTXT_FINISH_DTD_1)) {
111 	    long delta = (char *) ctxt - (char *) ctxt->userData;
112 	    if ((delta > 0) && (delta < 250))
113 		pctxt = ctxt->userData;
114 	}
115     }
116     if (extra)
117         __xmlRaiseError(NULL, channel, data,
118                         pctxt, NULL, XML_FROM_VALID, error,
119                         XML_ERR_ERROR, NULL, 0, extra, NULL, NULL, 0, 0,
120                         msg, extra);
121     else
122         __xmlRaiseError(NULL, channel, data,
123                         pctxt, NULL, XML_FROM_VALID, error,
124                         XML_ERR_ERROR, NULL, 0, NULL, NULL, NULL, 0, 0,
125                         "%s", msg);
126 }
127 
128 #if defined(LIBXML_VALID_ENABLED) || defined(LIBXML_SCHEMAS_ENABLED)
129 /**
130  * xmlErrValidNode:
131  * @ctxt:  an XML validation parser context
132  * @node:  the node raising the error
133  * @error:  the error number
134  * @str1:  extra informations
135  * @str2:  extra informations
136  * @str3:  extra informations
137  *
138  * Handle a validation error, provide contextual informations
139  */
140 static void
xmlErrValidNode(xmlValidCtxtPtr ctxt,xmlNodePtr node,xmlParserErrors error,const char * msg,const xmlChar * str1,const xmlChar * str2,const xmlChar * str3)141 xmlErrValidNode(xmlValidCtxtPtr ctxt,
142                 xmlNodePtr node, xmlParserErrors error,
143                 const char *msg, const xmlChar * str1,
144                 const xmlChar * str2, const xmlChar * str3)
145 {
146     xmlStructuredErrorFunc schannel = NULL;
147     xmlGenericErrorFunc channel = NULL;
148     xmlParserCtxtPtr pctxt = NULL;
149     void *data = NULL;
150 
151     if (ctxt != NULL) {
152         channel = ctxt->error;
153         data = ctxt->userData;
154 	/* Use the special values to detect if it is part of a parsing
155 	   context */
156 	if ((ctxt->finishDtd == XML_CTXT_FINISH_DTD_0) ||
157 	    (ctxt->finishDtd == XML_CTXT_FINISH_DTD_1)) {
158 	    long delta = (char *) ctxt - (char *) ctxt->userData;
159 	    if ((delta > 0) && (delta < 250))
160 		pctxt = ctxt->userData;
161 	}
162     }
163     __xmlRaiseError(schannel, channel, data, pctxt, node, XML_FROM_VALID, error,
164                     XML_ERR_ERROR, NULL, 0,
165                     (const char *) str1,
166                     (const char *) str1,
167                     (const char *) str3, 0, 0, msg, str1, str2, str3);
168 }
169 #endif /* LIBXML_VALID_ENABLED or LIBXML_SCHEMAS_ENABLED */
170 
171 #ifdef LIBXML_VALID_ENABLED
172 /**
173  * xmlErrValidNodeNr:
174  * @ctxt:  an XML validation parser context
175  * @node:  the node raising the error
176  * @error:  the error number
177  * @str1:  extra informations
178  * @int2:  extra informations
179  * @str3:  extra informations
180  *
181  * Handle a validation error, provide contextual informations
182  */
183 static void
xmlErrValidNodeNr(xmlValidCtxtPtr ctxt,xmlNodePtr node,xmlParserErrors error,const char * msg,const xmlChar * str1,int int2,const xmlChar * str3)184 xmlErrValidNodeNr(xmlValidCtxtPtr ctxt,
185                 xmlNodePtr node, xmlParserErrors error,
186                 const char *msg, const xmlChar * str1,
187                 int int2, const xmlChar * str3)
188 {
189     xmlStructuredErrorFunc schannel = NULL;
190     xmlGenericErrorFunc channel = NULL;
191     xmlParserCtxtPtr pctxt = NULL;
192     void *data = NULL;
193 
194     if (ctxt != NULL) {
195         channel = ctxt->error;
196         data = ctxt->userData;
197 	/* Use the special values to detect if it is part of a parsing
198 	   context */
199 	if ((ctxt->finishDtd == XML_CTXT_FINISH_DTD_0) ||
200 	    (ctxt->finishDtd == XML_CTXT_FINISH_DTD_1)) {
201 	    long delta = (char *) ctxt - (char *) ctxt->userData;
202 	    if ((delta > 0) && (delta < 250))
203 		pctxt = ctxt->userData;
204 	}
205     }
206     __xmlRaiseError(schannel, channel, data, pctxt, node, XML_FROM_VALID, error,
207                     XML_ERR_ERROR, NULL, 0,
208                     (const char *) str1,
209                     (const char *) str3,
210                     NULL, int2, 0, msg, str1, int2, str3);
211 }
212 
213 /**
214  * xmlErrValidWarning:
215  * @ctxt:  an XML validation parser context
216  * @node:  the node raising the error
217  * @error:  the error number
218  * @str1:  extra information
219  * @str2:  extra information
220  * @str3:  extra information
221  *
222  * Handle a validation error, provide contextual information
223  */
224 static void
xmlErrValidWarning(xmlValidCtxtPtr ctxt,xmlNodePtr node,xmlParserErrors error,const char * msg,const xmlChar * str1,const xmlChar * str2,const xmlChar * str3)225 xmlErrValidWarning(xmlValidCtxtPtr ctxt,
226                 xmlNodePtr node, xmlParserErrors error,
227                 const char *msg, const xmlChar * str1,
228                 const xmlChar * str2, const xmlChar * str3)
229 {
230     xmlStructuredErrorFunc schannel = NULL;
231     xmlGenericErrorFunc channel = NULL;
232     xmlParserCtxtPtr pctxt = NULL;
233     void *data = NULL;
234 
235     if (ctxt != NULL) {
236         channel = ctxt->warning;
237         data = ctxt->userData;
238 	/* Use the special values to detect if it is part of a parsing
239 	   context */
240 	if ((ctxt->finishDtd == XML_CTXT_FINISH_DTD_0) ||
241 	    (ctxt->finishDtd == XML_CTXT_FINISH_DTD_1)) {
242 	    long delta = (char *) ctxt - (char *) ctxt->userData;
243 	    if ((delta > 0) && (delta < 250))
244 		pctxt = ctxt->userData;
245 	}
246     }
247     __xmlRaiseError(schannel, channel, data, pctxt, node, XML_FROM_VALID, error,
248                     XML_ERR_WARNING, NULL, 0,
249                     (const char *) str1,
250                     (const char *) str1,
251                     (const char *) str3, 0, 0, msg, str1, str2, str3);
252 }
253 
254 
255 
256 #ifdef LIBXML_REGEXP_ENABLED
257 /*
258  * If regexp are enabled we can do continuous validation without the
259  * need of a tree to validate the content model. this is done in each
260  * callbacks.
261  * Each xmlValidState represent the validation state associated to the
262  * set of nodes currently open from the document root to the current element.
263  */
264 
265 
266 typedef struct _xmlValidState {
267     xmlElementPtr	 elemDecl;	/* pointer to the content model */
268     xmlNodePtr           node;		/* pointer to the current node */
269     xmlRegExecCtxtPtr    exec;		/* regexp runtime */
270 } _xmlValidState;
271 
272 
273 static int
vstateVPush(xmlValidCtxtPtr ctxt,xmlElementPtr elemDecl,xmlNodePtr node)274 vstateVPush(xmlValidCtxtPtr ctxt, xmlElementPtr elemDecl, xmlNodePtr node) {
275     if ((ctxt->vstateMax == 0) || (ctxt->vstateTab == NULL)) {
276 	ctxt->vstateMax = 10;
277 	ctxt->vstateTab = (xmlValidState *) xmlMalloc(ctxt->vstateMax *
278 		              sizeof(ctxt->vstateTab[0]));
279         if (ctxt->vstateTab == NULL) {
280 	    xmlVErrMemory(ctxt, "malloc failed");
281 	    return(-1);
282 	}
283     }
284 
285     if (ctxt->vstateNr >= ctxt->vstateMax) {
286         xmlValidState *tmp;
287 
288 	tmp = (xmlValidState *) xmlRealloc(ctxt->vstateTab,
289 	             2 * ctxt->vstateMax * sizeof(ctxt->vstateTab[0]));
290         if (tmp == NULL) {
291 	    xmlVErrMemory(ctxt, "realloc failed");
292 	    return(-1);
293 	}
294 	ctxt->vstateMax *= 2;
295 	ctxt->vstateTab = tmp;
296     }
297     ctxt->vstate = &ctxt->vstateTab[ctxt->vstateNr];
298     ctxt->vstateTab[ctxt->vstateNr].elemDecl = elemDecl;
299     ctxt->vstateTab[ctxt->vstateNr].node = node;
300     if ((elemDecl != NULL) && (elemDecl->etype == XML_ELEMENT_TYPE_ELEMENT)) {
301 	if (elemDecl->contModel == NULL)
302 	    xmlValidBuildContentModel(ctxt, elemDecl);
303 	if (elemDecl->contModel != NULL) {
304 	    ctxt->vstateTab[ctxt->vstateNr].exec =
305 		xmlRegNewExecCtxt(elemDecl->contModel, NULL, NULL);
306 	} else {
307 	    ctxt->vstateTab[ctxt->vstateNr].exec = NULL;
308 	    xmlErrValidNode(ctxt, (xmlNodePtr) elemDecl,
309 	                    XML_ERR_INTERNAL_ERROR,
310 			    "Failed to build content model regexp for %s\n",
311 			    node->name, NULL, NULL);
312 	}
313     }
314     return(ctxt->vstateNr++);
315 }
316 
317 static int
vstateVPop(xmlValidCtxtPtr ctxt)318 vstateVPop(xmlValidCtxtPtr ctxt) {
319     xmlElementPtr elemDecl;
320 
321     if (ctxt->vstateNr < 1) return(-1);
322     ctxt->vstateNr--;
323     elemDecl = ctxt->vstateTab[ctxt->vstateNr].elemDecl;
324     ctxt->vstateTab[ctxt->vstateNr].elemDecl = NULL;
325     ctxt->vstateTab[ctxt->vstateNr].node = NULL;
326     if ((elemDecl != NULL) && (elemDecl->etype == XML_ELEMENT_TYPE_ELEMENT)) {
327 	xmlRegFreeExecCtxt(ctxt->vstateTab[ctxt->vstateNr].exec);
328     }
329     ctxt->vstateTab[ctxt->vstateNr].exec = NULL;
330     if (ctxt->vstateNr >= 1)
331 	ctxt->vstate = &ctxt->vstateTab[ctxt->vstateNr - 1];
332     else
333 	ctxt->vstate = NULL;
334     return(ctxt->vstateNr);
335 }
336 
337 #else /* not LIBXML_REGEXP_ENABLED */
338 /*
339  * If regexp are not enabled, it uses a home made algorithm less
340  * complex and easier to
341  * debug/maintain than a generic NFA -> DFA state based algo. The
342  * only restriction is on the deepness of the tree limited by the
343  * size of the occurs bitfield
344  *
345  * this is the content of a saved state for rollbacks
346  */
347 
348 #define ROLLBACK_OR	0
349 #define ROLLBACK_PARENT	1
350 
351 typedef struct _xmlValidState {
352     xmlElementContentPtr cont;	/* pointer to the content model subtree */
353     xmlNodePtr           node;	/* pointer to the current node in the list */
354     long                 occurs;/* bitfield for multiple occurrences */
355     unsigned char        depth; /* current depth in the overall tree */
356     unsigned char        state; /* ROLLBACK_XXX */
357 } _xmlValidState;
358 
359 #define MAX_RECURSE 25000
360 #define MAX_DEPTH ((sizeof(_xmlValidState.occurs)) * 8)
361 #define CONT ctxt->vstate->cont
362 #define NODE ctxt->vstate->node
363 #define DEPTH ctxt->vstate->depth
364 #define OCCURS ctxt->vstate->occurs
365 #define STATE ctxt->vstate->state
366 
367 #define OCCURRENCE (ctxt->vstate->occurs & (1 << DEPTH))
368 #define PARENT_OCCURRENCE (ctxt->vstate->occurs & ((1 << DEPTH) - 1))
369 
370 #define SET_OCCURRENCE ctxt->vstate->occurs |= (1 << DEPTH)
371 #define RESET_OCCURRENCE ctxt->vstate->occurs &= ((1 << DEPTH) - 1)
372 
373 static int
vstateVPush(xmlValidCtxtPtr ctxt,xmlElementContentPtr cont,xmlNodePtr node,unsigned char depth,long occurs,unsigned char state)374 vstateVPush(xmlValidCtxtPtr ctxt, xmlElementContentPtr cont,
375 	    xmlNodePtr node, unsigned char depth, long occurs,
376 	    unsigned char state) {
377     int i = ctxt->vstateNr - 1;
378 
379     if (ctxt->vstateNr > MAX_RECURSE) {
380 	return(-1);
381     }
382     if (ctxt->vstateTab == NULL) {
383 	ctxt->vstateMax = 8;
384 	ctxt->vstateTab = (xmlValidState *) xmlMalloc(
385 		     ctxt->vstateMax * sizeof(ctxt->vstateTab[0]));
386 	if (ctxt->vstateTab == NULL) {
387 	    xmlVErrMemory(ctxt, "malloc failed");
388 	    return(-1);
389 	}
390     }
391     if (ctxt->vstateNr >= ctxt->vstateMax) {
392         xmlValidState *tmp;
393 
394         tmp = (xmlValidState *) xmlRealloc(ctxt->vstateTab,
395 	             2 * ctxt->vstateMax * sizeof(ctxt->vstateTab[0]));
396         if (tmp == NULL) {
397 	    xmlVErrMemory(ctxt, "malloc failed");
398 	    return(-1);
399 	}
400 	ctxt->vstateMax *= 2;
401 	ctxt->vstateTab = tmp;
402 	ctxt->vstate = &ctxt->vstateTab[0];
403     }
404     /*
405      * Don't push on the stack a state already here
406      */
407     if ((i >= 0) && (ctxt->vstateTab[i].cont == cont) &&
408 	(ctxt->vstateTab[i].node == node) &&
409 	(ctxt->vstateTab[i].depth == depth) &&
410 	(ctxt->vstateTab[i].occurs == occurs) &&
411 	(ctxt->vstateTab[i].state == state))
412 	return(ctxt->vstateNr);
413     ctxt->vstateTab[ctxt->vstateNr].cont = cont;
414     ctxt->vstateTab[ctxt->vstateNr].node = node;
415     ctxt->vstateTab[ctxt->vstateNr].depth = depth;
416     ctxt->vstateTab[ctxt->vstateNr].occurs = occurs;
417     ctxt->vstateTab[ctxt->vstateNr].state = state;
418     return(ctxt->vstateNr++);
419 }
420 
421 static int
vstateVPop(xmlValidCtxtPtr ctxt)422 vstateVPop(xmlValidCtxtPtr ctxt) {
423     if (ctxt->vstateNr <= 1) return(-1);
424     ctxt->vstateNr--;
425     ctxt->vstate = &ctxt->vstateTab[0];
426     ctxt->vstate->cont =  ctxt->vstateTab[ctxt->vstateNr].cont;
427     ctxt->vstate->node = ctxt->vstateTab[ctxt->vstateNr].node;
428     ctxt->vstate->depth = ctxt->vstateTab[ctxt->vstateNr].depth;
429     ctxt->vstate->occurs = ctxt->vstateTab[ctxt->vstateNr].occurs;
430     ctxt->vstate->state = ctxt->vstateTab[ctxt->vstateNr].state;
431     return(ctxt->vstateNr);
432 }
433 
434 #endif /* LIBXML_REGEXP_ENABLED */
435 
436 static int
nodeVPush(xmlValidCtxtPtr ctxt,xmlNodePtr value)437 nodeVPush(xmlValidCtxtPtr ctxt, xmlNodePtr value)
438 {
439     if (ctxt->nodeMax <= 0) {
440         ctxt->nodeMax = 4;
441         ctxt->nodeTab =
442             (xmlNodePtr *) xmlMalloc(ctxt->nodeMax *
443                                      sizeof(ctxt->nodeTab[0]));
444         if (ctxt->nodeTab == NULL) {
445 	    xmlVErrMemory(ctxt, "malloc failed");
446             ctxt->nodeMax = 0;
447             return (0);
448         }
449     }
450     if (ctxt->nodeNr >= ctxt->nodeMax) {
451         xmlNodePtr *tmp;
452         tmp = (xmlNodePtr *) xmlRealloc(ctxt->nodeTab,
453 			      ctxt->nodeMax * 2 * sizeof(ctxt->nodeTab[0]));
454         if (tmp == NULL) {
455 	    xmlVErrMemory(ctxt, "realloc failed");
456             return (0);
457         }
458         ctxt->nodeMax *= 2;
459 	ctxt->nodeTab = tmp;
460     }
461     ctxt->nodeTab[ctxt->nodeNr] = value;
462     ctxt->node = value;
463     return (ctxt->nodeNr++);
464 }
465 static xmlNodePtr
nodeVPop(xmlValidCtxtPtr ctxt)466 nodeVPop(xmlValidCtxtPtr ctxt)
467 {
468     xmlNodePtr ret;
469 
470     if (ctxt->nodeNr <= 0)
471         return (NULL);
472     ctxt->nodeNr--;
473     if (ctxt->nodeNr > 0)
474         ctxt->node = ctxt->nodeTab[ctxt->nodeNr - 1];
475     else
476         ctxt->node = NULL;
477     ret = ctxt->nodeTab[ctxt->nodeNr];
478     ctxt->nodeTab[ctxt->nodeNr] = NULL;
479     return (ret);
480 }
481 
482 #ifdef DEBUG_VALID_ALGO
483 static void
xmlValidPrintNode(xmlNodePtr cur)484 xmlValidPrintNode(xmlNodePtr cur) {
485     if (cur == NULL) {
486 	xmlGenericError(xmlGenericErrorContext, "null");
487 	return;
488     }
489     switch (cur->type) {
490 	case XML_ELEMENT_NODE:
491 	    xmlGenericError(xmlGenericErrorContext, "%s ", cur->name);
492 	    break;
493 	case XML_TEXT_NODE:
494 	    xmlGenericError(xmlGenericErrorContext, "text ");
495 	    break;
496 	case XML_CDATA_SECTION_NODE:
497 	    xmlGenericError(xmlGenericErrorContext, "cdata ");
498 	    break;
499 	case XML_ENTITY_REF_NODE:
500 	    xmlGenericError(xmlGenericErrorContext, "&%s; ", cur->name);
501 	    break;
502 	case XML_PI_NODE:
503 	    xmlGenericError(xmlGenericErrorContext, "pi(%s) ", cur->name);
504 	    break;
505 	case XML_COMMENT_NODE:
506 	    xmlGenericError(xmlGenericErrorContext, "comment ");
507 	    break;
508 	case XML_ATTRIBUTE_NODE:
509 	    xmlGenericError(xmlGenericErrorContext, "?attr? ");
510 	    break;
511 	case XML_ENTITY_NODE:
512 	    xmlGenericError(xmlGenericErrorContext, "?ent? ");
513 	    break;
514 	case XML_DOCUMENT_NODE:
515 	    xmlGenericError(xmlGenericErrorContext, "?doc? ");
516 	    break;
517 	case XML_DOCUMENT_TYPE_NODE:
518 	    xmlGenericError(xmlGenericErrorContext, "?doctype? ");
519 	    break;
520 	case XML_DOCUMENT_FRAG_NODE:
521 	    xmlGenericError(xmlGenericErrorContext, "?frag? ");
522 	    break;
523 	case XML_NOTATION_NODE:
524 	    xmlGenericError(xmlGenericErrorContext, "?nota? ");
525 	    break;
526 	case XML_HTML_DOCUMENT_NODE:
527 	    xmlGenericError(xmlGenericErrorContext, "?html? ");
528 	    break;
529 #ifdef LIBXML_DOCB_ENABLED
530 	case XML_DOCB_DOCUMENT_NODE:
531 	    xmlGenericError(xmlGenericErrorContext, "?docb? ");
532 	    break;
533 #endif
534 	case XML_DTD_NODE:
535 	    xmlGenericError(xmlGenericErrorContext, "?dtd? ");
536 	    break;
537 	case XML_ELEMENT_DECL:
538 	    xmlGenericError(xmlGenericErrorContext, "?edecl? ");
539 	    break;
540 	case XML_ATTRIBUTE_DECL:
541 	    xmlGenericError(xmlGenericErrorContext, "?adecl? ");
542 	    break;
543 	case XML_ENTITY_DECL:
544 	    xmlGenericError(xmlGenericErrorContext, "?entdecl? ");
545 	    break;
546 	case XML_NAMESPACE_DECL:
547 	    xmlGenericError(xmlGenericErrorContext, "?nsdecl? ");
548 	    break;
549 	case XML_XINCLUDE_START:
550 	    xmlGenericError(xmlGenericErrorContext, "incstart ");
551 	    break;
552 	case XML_XINCLUDE_END:
553 	    xmlGenericError(xmlGenericErrorContext, "incend ");
554 	    break;
555     }
556 }
557 
558 static void
xmlValidPrintNodeList(xmlNodePtr cur)559 xmlValidPrintNodeList(xmlNodePtr cur) {
560     if (cur == NULL)
561 	xmlGenericError(xmlGenericErrorContext, "null ");
562     while (cur != NULL) {
563 	xmlValidPrintNode(cur);
564 	cur = cur->next;
565     }
566 }
567 
568 static void
xmlValidDebug(xmlNodePtr cur,xmlElementContentPtr cont)569 xmlValidDebug(xmlNodePtr cur, xmlElementContentPtr cont) {
570     char expr[5000];
571 
572     expr[0] = 0;
573     xmlGenericError(xmlGenericErrorContext, "valid: ");
574     xmlValidPrintNodeList(cur);
575     xmlGenericError(xmlGenericErrorContext, "against ");
576     xmlSnprintfElementContent(expr, 5000, cont, 1);
577     xmlGenericError(xmlGenericErrorContext, "%s\n", expr);
578 }
579 
580 static void
xmlValidDebugState(xmlValidStatePtr state)581 xmlValidDebugState(xmlValidStatePtr state) {
582     xmlGenericError(xmlGenericErrorContext, "(");
583     if (state->cont == NULL)
584 	xmlGenericError(xmlGenericErrorContext, "null,");
585     else
586 	switch (state->cont->type) {
587             case XML_ELEMENT_CONTENT_PCDATA:
588 		xmlGenericError(xmlGenericErrorContext, "pcdata,");
589 		break;
590             case XML_ELEMENT_CONTENT_ELEMENT:
591 		xmlGenericError(xmlGenericErrorContext, "%s,",
592 			        state->cont->name);
593 		break;
594             case XML_ELEMENT_CONTENT_SEQ:
595 		xmlGenericError(xmlGenericErrorContext, "seq,");
596 		break;
597             case XML_ELEMENT_CONTENT_OR:
598 		xmlGenericError(xmlGenericErrorContext, "or,");
599 		break;
600 	}
601     xmlValidPrintNode(state->node);
602     xmlGenericError(xmlGenericErrorContext, ",%d,%X,%d)",
603 	    state->depth, state->occurs, state->state);
604 }
605 
606 static void
xmlValidStateDebug(xmlValidCtxtPtr ctxt)607 xmlValidStateDebug(xmlValidCtxtPtr ctxt) {
608     int i, j;
609 
610     xmlGenericError(xmlGenericErrorContext, "state: ");
611     xmlValidDebugState(ctxt->vstate);
612     xmlGenericError(xmlGenericErrorContext, " stack: %d ",
613 	    ctxt->vstateNr - 1);
614     for (i = 0, j = ctxt->vstateNr - 1;(i < 3) && (j > 0);i++,j--)
615 	xmlValidDebugState(&ctxt->vstateTab[j]);
616     xmlGenericError(xmlGenericErrorContext, "\n");
617 }
618 
619 /*****
620 #define DEBUG_VALID_STATE(n,c) xmlValidDebug(n,c);
621  *****/
622 
623 #define DEBUG_VALID_STATE(n,c) xmlValidStateDebug(ctxt);
624 #define DEBUG_VALID_MSG(m)					\
625     xmlGenericError(xmlGenericErrorContext, "%s\n", m);
626 
627 #else
628 #define DEBUG_VALID_STATE(n,c)
629 #define DEBUG_VALID_MSG(m)
630 #endif
631 
632 /* TODO: use hash table for accesses to elem and attribute definitions */
633 
634 
635 #define CHECK_DTD						\
636    if (doc == NULL) return(0);					\
637    else if ((doc->intSubset == NULL) &&				\
638 	    (doc->extSubset == NULL)) return(0)
639 
640 #ifdef LIBXML_REGEXP_ENABLED
641 
642 /************************************************************************
643  *									*
644  *		Content model validation based on the regexps		*
645  *									*
646  ************************************************************************/
647 
648 /**
649  * xmlValidBuildAContentModel:
650  * @content:  the content model
651  * @ctxt:  the schema parser context
652  * @name:  the element name whose content is being built
653  *
654  * Generate the automata sequence needed for that type
655  *
656  * Returns 1 if successful or 0 in case of error.
657  */
658 static int
xmlValidBuildAContentModel(xmlElementContentPtr content,xmlValidCtxtPtr ctxt,const xmlChar * name)659 xmlValidBuildAContentModel(xmlElementContentPtr content,
660 		           xmlValidCtxtPtr ctxt,
661 		           const xmlChar *name) {
662     if (content == NULL) {
663 	xmlErrValidNode(ctxt, NULL, XML_ERR_INTERNAL_ERROR,
664 			"Found NULL content in content model of %s\n",
665 			name, NULL, NULL);
666 	return(0);
667     }
668     switch (content->type) {
669 	case XML_ELEMENT_CONTENT_PCDATA:
670 	    xmlErrValidNode(ctxt, NULL, XML_ERR_INTERNAL_ERROR,
671 			    "Found PCDATA in content model of %s\n",
672 		            name, NULL, NULL);
673 	    return(0);
674 	    break;
675 	case XML_ELEMENT_CONTENT_ELEMENT: {
676 	    xmlAutomataStatePtr oldstate = ctxt->state;
677 	    xmlChar fn[50];
678 	    xmlChar *fullname;
679 
680 	    fullname = xmlBuildQName(content->name, content->prefix, fn, 50);
681 	    if (fullname == NULL) {
682 	        xmlVErrMemory(ctxt, "Building content model");
683 		return(0);
684 	    }
685 
686 	    switch (content->ocur) {
687 		case XML_ELEMENT_CONTENT_ONCE:
688 		    ctxt->state = xmlAutomataNewTransition(ctxt->am,
689 			    ctxt->state, NULL, fullname, NULL);
690 		    break;
691 		case XML_ELEMENT_CONTENT_OPT:
692 		    ctxt->state = xmlAutomataNewTransition(ctxt->am,
693 			    ctxt->state, NULL, fullname, NULL);
694 		    xmlAutomataNewEpsilon(ctxt->am, oldstate, ctxt->state);
695 		    break;
696 		case XML_ELEMENT_CONTENT_PLUS:
697 		    ctxt->state = xmlAutomataNewTransition(ctxt->am,
698 			    ctxt->state, NULL, fullname, NULL);
699 		    xmlAutomataNewTransition(ctxt->am, ctxt->state,
700 			                     ctxt->state, fullname, NULL);
701 		    break;
702 		case XML_ELEMENT_CONTENT_MULT:
703 		    ctxt->state = xmlAutomataNewEpsilon(ctxt->am,
704 					    ctxt->state, NULL);
705 		    xmlAutomataNewTransition(ctxt->am,
706 			    ctxt->state, ctxt->state, fullname, NULL);
707 		    break;
708 	    }
709 	    if ((fullname != fn) && (fullname != content->name))
710 		xmlFree(fullname);
711 	    break;
712 	}
713 	case XML_ELEMENT_CONTENT_SEQ: {
714 	    xmlAutomataStatePtr oldstate, oldend;
715 	    xmlElementContentOccur ocur;
716 
717 	    /*
718 	     * Simply iterate over the content
719 	     */
720 	    oldstate = ctxt->state;
721 	    ocur = content->ocur;
722 	    if (ocur != XML_ELEMENT_CONTENT_ONCE) {
723 		ctxt->state = xmlAutomataNewEpsilon(ctxt->am, oldstate, NULL);
724 		oldstate = ctxt->state;
725 	    }
726 	    do {
727 		xmlValidBuildAContentModel(content->c1, ctxt, name);
728 		content = content->c2;
729 	    } while ((content->type == XML_ELEMENT_CONTENT_SEQ) &&
730 		     (content->ocur == XML_ELEMENT_CONTENT_ONCE));
731 	    xmlValidBuildAContentModel(content, ctxt, name);
732 	    oldend = ctxt->state;
733 	    ctxt->state = xmlAutomataNewEpsilon(ctxt->am, oldend, NULL);
734 	    switch (ocur) {
735 		case XML_ELEMENT_CONTENT_ONCE:
736 		    break;
737 		case XML_ELEMENT_CONTENT_OPT:
738 		    xmlAutomataNewEpsilon(ctxt->am, oldstate, ctxt->state);
739 		    break;
740 		case XML_ELEMENT_CONTENT_MULT:
741 		    xmlAutomataNewEpsilon(ctxt->am, oldstate, ctxt->state);
742 		    xmlAutomataNewEpsilon(ctxt->am, oldend, oldstate);
743 		    break;
744 		case XML_ELEMENT_CONTENT_PLUS:
745 		    xmlAutomataNewEpsilon(ctxt->am, oldend, oldstate);
746 		    break;
747 	    }
748 	    break;
749 	}
750 	case XML_ELEMENT_CONTENT_OR: {
751 	    xmlAutomataStatePtr oldstate, oldend;
752 	    xmlElementContentOccur ocur;
753 
754 	    ocur = content->ocur;
755 	    if ((ocur == XML_ELEMENT_CONTENT_PLUS) ||
756 		(ocur == XML_ELEMENT_CONTENT_MULT)) {
757 		ctxt->state = xmlAutomataNewEpsilon(ctxt->am,
758 			ctxt->state, NULL);
759 	    }
760 	    oldstate = ctxt->state;
761 	    oldend = xmlAutomataNewState(ctxt->am);
762 
763 	    /*
764 	     * iterate over the subtypes and remerge the end with an
765 	     * epsilon transition
766 	     */
767 	    do {
768 		ctxt->state = oldstate;
769 		xmlValidBuildAContentModel(content->c1, ctxt, name);
770 		xmlAutomataNewEpsilon(ctxt->am, ctxt->state, oldend);
771 		content = content->c2;
772 	    } while ((content->type == XML_ELEMENT_CONTENT_OR) &&
773 		     (content->ocur == XML_ELEMENT_CONTENT_ONCE));
774 	    ctxt->state = oldstate;
775 	    xmlValidBuildAContentModel(content, ctxt, name);
776 	    xmlAutomataNewEpsilon(ctxt->am, ctxt->state, oldend);
777 	    ctxt->state = xmlAutomataNewEpsilon(ctxt->am, oldend, NULL);
778 	    switch (ocur) {
779 		case XML_ELEMENT_CONTENT_ONCE:
780 		    break;
781 		case XML_ELEMENT_CONTENT_OPT:
782 		    xmlAutomataNewEpsilon(ctxt->am, oldstate, ctxt->state);
783 		    break;
784 		case XML_ELEMENT_CONTENT_MULT:
785 		    xmlAutomataNewEpsilon(ctxt->am, oldstate, ctxt->state);
786 		    xmlAutomataNewEpsilon(ctxt->am, oldend, oldstate);
787 		    break;
788 		case XML_ELEMENT_CONTENT_PLUS:
789 		    xmlAutomataNewEpsilon(ctxt->am, oldend, oldstate);
790 		    break;
791 	    }
792 	    break;
793 	}
794 	default:
795 	    xmlErrValid(ctxt, XML_ERR_INTERNAL_ERROR,
796 	                "ContentModel broken for element %s\n",
797 			(const char *) name);
798 	    return(0);
799     }
800     return(1);
801 }
802 /**
803  * xmlValidBuildContentModel:
804  * @ctxt:  a validation context
805  * @elem:  an element declaration node
806  *
807  * (Re)Build the automata associated to the content model of this
808  * element
809  *
810  * Returns 1 in case of success, 0 in case of error
811  */
812 int
xmlValidBuildContentModel(xmlValidCtxtPtr ctxt,xmlElementPtr elem)813 xmlValidBuildContentModel(xmlValidCtxtPtr ctxt, xmlElementPtr elem) {
814 
815     if ((ctxt == NULL) || (elem == NULL))
816 	return(0);
817     if (elem->type != XML_ELEMENT_DECL)
818 	return(0);
819     if (elem->etype != XML_ELEMENT_TYPE_ELEMENT)
820 	return(1);
821     /* TODO: should we rebuild in this case ? */
822     if (elem->contModel != NULL) {
823 	if (!xmlRegexpIsDeterminist(elem->contModel)) {
824 	    ctxt->valid = 0;
825 	    return(0);
826 	}
827 	return(1);
828     }
829 
830     ctxt->am = xmlNewAutomata();
831     if (ctxt->am == NULL) {
832 	xmlErrValidNode(ctxt, (xmlNodePtr) elem,
833 	                XML_ERR_INTERNAL_ERROR,
834 	                "Cannot create automata for element %s\n",
835 		        elem->name, NULL, NULL);
836 	return(0);
837     }
838     ctxt->state = xmlAutomataGetInitState(ctxt->am);
839     xmlValidBuildAContentModel(elem->content, ctxt, elem->name);
840     xmlAutomataSetFinalState(ctxt->am, ctxt->state);
841     elem->contModel = xmlAutomataCompile(ctxt->am);
842     if (xmlRegexpIsDeterminist(elem->contModel) != 1) {
843 	char expr[5000];
844 	expr[0] = 0;
845 	xmlSnprintfElementContent(expr, 5000, elem->content, 1);
846 	xmlErrValidNode(ctxt, (xmlNodePtr) elem,
847 	                XML_DTD_CONTENT_NOT_DETERMINIST,
848 	       "Content model of %s is not determinist: %s\n",
849 	       elem->name, BAD_CAST expr, NULL);
850 #ifdef DEBUG_REGEXP_ALGO
851         xmlRegexpPrint(stderr, elem->contModel);
852 #endif
853         ctxt->valid = 0;
854 	ctxt->state = NULL;
855 	xmlFreeAutomata(ctxt->am);
856 	ctxt->am = NULL;
857 	return(0);
858     }
859     ctxt->state = NULL;
860     xmlFreeAutomata(ctxt->am);
861     ctxt->am = NULL;
862     return(1);
863 }
864 
865 #endif /* LIBXML_REGEXP_ENABLED */
866 
867 /****************************************************************
868  *								*
869  *	Util functions for data allocation/deallocation		*
870  *								*
871  ****************************************************************/
872 
873 /**
874  * xmlNewValidCtxt:
875  *
876  * Allocate a validation context structure.
877  *
878  * Returns NULL if not, otherwise the new validation context structure
879  */
xmlNewValidCtxt(void)880 xmlValidCtxtPtr xmlNewValidCtxt(void) {
881     xmlValidCtxtPtr ret;
882 
883     if ((ret = xmlMalloc(sizeof (xmlValidCtxt))) == NULL) {
884 	xmlVErrMemory(NULL, "malloc failed");
885 	return (NULL);
886     }
887 
888     (void) memset(ret, 0, sizeof (xmlValidCtxt));
889 
890     return (ret);
891 }
892 
893 /**
894  * xmlFreeValidCtxt:
895  * @cur:  the validation context to free
896  *
897  * Free a validation context structure.
898  */
899 void
xmlFreeValidCtxt(xmlValidCtxtPtr cur)900 xmlFreeValidCtxt(xmlValidCtxtPtr cur) {
901     if (cur->vstateTab != NULL)
902         xmlFree(cur->vstateTab);
903     if (cur->nodeTab != NULL)
904         xmlFree(cur->nodeTab);
905     xmlFree(cur);
906 }
907 
908 #endif /* LIBXML_VALID_ENABLED */
909 
910 /**
911  * xmlNewDocElementContent:
912  * @doc:  the document
913  * @name:  the subelement name or NULL
914  * @type:  the type of element content decl
915  *
916  * Allocate an element content structure for the document.
917  *
918  * Returns NULL if not, otherwise the new element content structure
919  */
920 xmlElementContentPtr
xmlNewDocElementContent(xmlDocPtr doc,const xmlChar * name,xmlElementContentType type)921 xmlNewDocElementContent(xmlDocPtr doc, const xmlChar *name,
922                         xmlElementContentType type) {
923     xmlElementContentPtr ret;
924     xmlDictPtr dict = NULL;
925 
926     if (doc != NULL)
927         dict = doc->dict;
928 
929     switch(type) {
930 	case XML_ELEMENT_CONTENT_ELEMENT:
931 	    if (name == NULL) {
932 	        xmlErrValid(NULL, XML_ERR_INTERNAL_ERROR,
933 			"xmlNewElementContent : name == NULL !\n",
934 			NULL);
935 	    }
936 	    break;
937         case XML_ELEMENT_CONTENT_PCDATA:
938 	case XML_ELEMENT_CONTENT_SEQ:
939 	case XML_ELEMENT_CONTENT_OR:
940 	    if (name != NULL) {
941 	        xmlErrValid(NULL, XML_ERR_INTERNAL_ERROR,
942 			"xmlNewElementContent : name != NULL !\n",
943 			NULL);
944 	    }
945 	    break;
946 	default:
947 	    xmlErrValid(NULL, XML_ERR_INTERNAL_ERROR,
948 		    "Internal: ELEMENT content corrupted invalid type\n",
949 		    NULL);
950 	    return(NULL);
951     }
952     ret = (xmlElementContentPtr) xmlMalloc(sizeof(xmlElementContent));
953     if (ret == NULL) {
954 	xmlVErrMemory(NULL, "malloc failed");
955 	return(NULL);
956     }
957     memset(ret, 0, sizeof(xmlElementContent));
958     ret->type = type;
959     ret->ocur = XML_ELEMENT_CONTENT_ONCE;
960     if (name != NULL) {
961         int l;
962 	const xmlChar *tmp;
963 
964 	tmp = xmlSplitQName3(name, &l);
965 	if (tmp == NULL) {
966 	    if (dict == NULL)
967 		ret->name = xmlStrdup(name);
968 	    else
969 	        ret->name = xmlDictLookup(dict, name, -1);
970 	} else {
971 	    if (dict == NULL) {
972 		ret->prefix = xmlStrndup(name, l);
973 		ret->name = xmlStrdup(tmp);
974 	    } else {
975 	        ret->prefix = xmlDictLookup(dict, name, l);
976 		ret->name = xmlDictLookup(dict, tmp, -1);
977 	    }
978 	}
979     }
980     return(ret);
981 }
982 
983 /**
984  * xmlNewElementContent:
985  * @name:  the subelement name or NULL
986  * @type:  the type of element content decl
987  *
988  * Allocate an element content structure.
989  * Deprecated in favor of xmlNewDocElementContent
990  *
991  * Returns NULL if not, otherwise the new element content structure
992  */
993 xmlElementContentPtr
xmlNewElementContent(const xmlChar * name,xmlElementContentType type)994 xmlNewElementContent(const xmlChar *name, xmlElementContentType type) {
995     return(xmlNewDocElementContent(NULL, name, type));
996 }
997 
998 /**
999  * xmlCopyDocElementContent:
1000  * @doc:  the document owning the element declaration
1001  * @cur:  An element content pointer.
1002  *
1003  * Build a copy of an element content description.
1004  *
1005  * Returns the new xmlElementContentPtr or NULL in case of error.
1006  */
1007 xmlElementContentPtr
xmlCopyDocElementContent(xmlDocPtr doc,xmlElementContentPtr cur)1008 xmlCopyDocElementContent(xmlDocPtr doc, xmlElementContentPtr cur) {
1009     xmlElementContentPtr ret = NULL, prev = NULL, tmp;
1010     xmlDictPtr dict = NULL;
1011 
1012     if (cur == NULL) return(NULL);
1013 
1014     if (doc != NULL)
1015         dict = doc->dict;
1016 
1017     ret = (xmlElementContentPtr) xmlMalloc(sizeof(xmlElementContent));
1018     if (ret == NULL) {
1019 	xmlVErrMemory(NULL, "malloc failed");
1020 	return(NULL);
1021     }
1022     memset(ret, 0, sizeof(xmlElementContent));
1023     ret->type = cur->type;
1024     ret->ocur = cur->ocur;
1025     if (cur->name != NULL) {
1026 	if (dict)
1027 	    ret->name = xmlDictLookup(dict, cur->name, -1);
1028 	else
1029 	    ret->name = xmlStrdup(cur->name);
1030     }
1031 
1032     if (cur->prefix != NULL) {
1033 	if (dict)
1034 	    ret->prefix = xmlDictLookup(dict, cur->prefix, -1);
1035 	else
1036 	    ret->prefix = xmlStrdup(cur->prefix);
1037     }
1038     if (cur->c1 != NULL)
1039         ret->c1 = xmlCopyDocElementContent(doc, cur->c1);
1040     if (ret->c1 != NULL)
1041 	ret->c1->parent = ret;
1042     if (cur->c2 != NULL) {
1043         prev = ret;
1044 	cur = cur->c2;
1045 	while (cur != NULL) {
1046 	    tmp = (xmlElementContentPtr) xmlMalloc(sizeof(xmlElementContent));
1047 	    if (tmp == NULL) {
1048 		xmlVErrMemory(NULL, "malloc failed");
1049 		return(ret);
1050 	    }
1051 	    memset(tmp, 0, sizeof(xmlElementContent));
1052 	    tmp->type = cur->type;
1053 	    tmp->ocur = cur->ocur;
1054 	    prev->c2 = tmp;
1055 	    if (cur->name != NULL) {
1056 		if (dict)
1057 		    tmp->name = xmlDictLookup(dict, cur->name, -1);
1058 		else
1059 		    tmp->name = xmlStrdup(cur->name);
1060 	    }
1061 
1062 	    if (cur->prefix != NULL) {
1063 		if (dict)
1064 		    tmp->prefix = xmlDictLookup(dict, cur->prefix, -1);
1065 		else
1066 		    tmp->prefix = xmlStrdup(cur->prefix);
1067 	    }
1068 	    if (cur->c1 != NULL)
1069 	        tmp->c1 = xmlCopyDocElementContent(doc,cur->c1);
1070 	    if (tmp->c1 != NULL)
1071 		tmp->c1->parent = ret;
1072 	    prev = tmp;
1073 	    cur = cur->c2;
1074 	}
1075     }
1076     return(ret);
1077 }
1078 
1079 /**
1080  * xmlCopyElementContent:
1081  * @cur:  An element content pointer.
1082  *
1083  * Build a copy of an element content description.
1084  * Deprecated, use xmlCopyDocElementContent instead
1085  *
1086  * Returns the new xmlElementContentPtr or NULL in case of error.
1087  */
1088 xmlElementContentPtr
xmlCopyElementContent(xmlElementContentPtr cur)1089 xmlCopyElementContent(xmlElementContentPtr cur) {
1090     return(xmlCopyDocElementContent(NULL, cur));
1091 }
1092 
1093 /**
1094  * xmlFreeDocElementContent:
1095  * @doc: the document owning the element declaration
1096  * @cur:  the element content tree to free
1097  *
1098  * Free an element content structure. The whole subtree is removed.
1099  */
1100 void
xmlFreeDocElementContent(xmlDocPtr doc,xmlElementContentPtr cur)1101 xmlFreeDocElementContent(xmlDocPtr doc, xmlElementContentPtr cur) {
1102     xmlElementContentPtr next;
1103     xmlDictPtr dict = NULL;
1104 
1105     if (doc != NULL)
1106         dict = doc->dict;
1107 
1108     while (cur != NULL) {
1109         next = cur->c2;
1110 	switch (cur->type) {
1111 	    case XML_ELEMENT_CONTENT_PCDATA:
1112 	    case XML_ELEMENT_CONTENT_ELEMENT:
1113 	    case XML_ELEMENT_CONTENT_SEQ:
1114 	    case XML_ELEMENT_CONTENT_OR:
1115 		break;
1116 	    default:
1117 		xmlErrValid(NULL, XML_ERR_INTERNAL_ERROR,
1118 			"Internal: ELEMENT content corrupted invalid type\n",
1119 			NULL);
1120 		return;
1121 	}
1122 	if (cur->c1 != NULL) xmlFreeDocElementContent(doc, cur->c1);
1123 	if (dict) {
1124 	    if ((cur->name != NULL) && (!xmlDictOwns(dict, cur->name)))
1125 	        xmlFree((xmlChar *) cur->name);
1126 	    if ((cur->prefix != NULL) && (!xmlDictOwns(dict, cur->prefix)))
1127 	        xmlFree((xmlChar *) cur->prefix);
1128 	} else {
1129 	    if (cur->name != NULL) xmlFree((xmlChar *) cur->name);
1130 	    if (cur->prefix != NULL) xmlFree((xmlChar *) cur->prefix);
1131 	}
1132 	xmlFree(cur);
1133 	cur = next;
1134     }
1135 }
1136 
1137 /**
1138  * xmlFreeElementContent:
1139  * @cur:  the element content tree to free
1140  *
1141  * Free an element content structure. The whole subtree is removed.
1142  * Deprecated, use xmlFreeDocElementContent instead
1143  */
1144 void
xmlFreeElementContent(xmlElementContentPtr cur)1145 xmlFreeElementContent(xmlElementContentPtr cur) {
1146     xmlFreeDocElementContent(NULL, cur);
1147 }
1148 
1149 #ifdef LIBXML_OUTPUT_ENABLED
1150 /**
1151  * xmlDumpElementContent:
1152  * @buf:  An XML buffer
1153  * @content:  An element table
1154  * @glob: 1 if one must print the englobing parenthesis, 0 otherwise
1155  *
1156  * This will dump the content of the element table as an XML DTD definition
1157  */
1158 static void
xmlDumpElementContent(xmlBufferPtr buf,xmlElementContentPtr content,int glob)1159 xmlDumpElementContent(xmlBufferPtr buf, xmlElementContentPtr content, int glob) {
1160     if (content == NULL) return;
1161 
1162     if (glob) xmlBufferWriteChar(buf, "(");
1163     switch (content->type) {
1164         case XML_ELEMENT_CONTENT_PCDATA:
1165             xmlBufferWriteChar(buf, "#PCDATA");
1166 	    break;
1167 	case XML_ELEMENT_CONTENT_ELEMENT:
1168 	    if (content->prefix != NULL) {
1169 		xmlBufferWriteCHAR(buf, content->prefix);
1170 		xmlBufferWriteChar(buf, ":");
1171 	    }
1172 	    xmlBufferWriteCHAR(buf, content->name);
1173 	    break;
1174 	case XML_ELEMENT_CONTENT_SEQ:
1175 	    if ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
1176 	        (content->c1->type == XML_ELEMENT_CONTENT_SEQ))
1177 		xmlDumpElementContent(buf, content->c1, 1);
1178 	    else
1179 		xmlDumpElementContent(buf, content->c1, 0);
1180             xmlBufferWriteChar(buf, " , ");
1181 	    if ((content->c2->type == XML_ELEMENT_CONTENT_OR) ||
1182 	        ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) &&
1183 		 (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE)))
1184 		xmlDumpElementContent(buf, content->c2, 1);
1185 	    else
1186 		xmlDumpElementContent(buf, content->c2, 0);
1187 	    break;
1188 	case XML_ELEMENT_CONTENT_OR:
1189 	    if ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
1190 	        (content->c1->type == XML_ELEMENT_CONTENT_SEQ))
1191 		xmlDumpElementContent(buf, content->c1, 1);
1192 	    else
1193 		xmlDumpElementContent(buf, content->c1, 0);
1194             xmlBufferWriteChar(buf, " | ");
1195 	    if ((content->c2->type == XML_ELEMENT_CONTENT_SEQ) ||
1196 	        ((content->c2->type == XML_ELEMENT_CONTENT_OR) &&
1197 		 (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE)))
1198 		xmlDumpElementContent(buf, content->c2, 1);
1199 	    else
1200 		xmlDumpElementContent(buf, content->c2, 0);
1201 	    break;
1202 	default:
1203 	    xmlErrValid(NULL, XML_ERR_INTERNAL_ERROR,
1204 		    "Internal: ELEMENT content corrupted invalid type\n",
1205 		    NULL);
1206     }
1207     if (glob)
1208         xmlBufferWriteChar(buf, ")");
1209     switch (content->ocur) {
1210         case XML_ELEMENT_CONTENT_ONCE:
1211 	    break;
1212         case XML_ELEMENT_CONTENT_OPT:
1213 	    xmlBufferWriteChar(buf, "?");
1214 	    break;
1215         case XML_ELEMENT_CONTENT_MULT:
1216 	    xmlBufferWriteChar(buf, "*");
1217 	    break;
1218         case XML_ELEMENT_CONTENT_PLUS:
1219 	    xmlBufferWriteChar(buf, "+");
1220 	    break;
1221     }
1222 }
1223 
1224 /**
1225  * xmlSprintfElementContent:
1226  * @buf:  an output buffer
1227  * @content:  An element table
1228  * @englob: 1 if one must print the englobing parenthesis, 0 otherwise
1229  *
1230  * Deprecated, unsafe, use xmlSnprintfElementContent
1231  */
1232 void
xmlSprintfElementContent(char * buf ATTRIBUTE_UNUSED,xmlElementContentPtr content ATTRIBUTE_UNUSED,int englob ATTRIBUTE_UNUSED)1233 xmlSprintfElementContent(char *buf ATTRIBUTE_UNUSED,
1234 	                 xmlElementContentPtr content ATTRIBUTE_UNUSED,
1235 			 int englob ATTRIBUTE_UNUSED) {
1236 }
1237 #endif /* LIBXML_OUTPUT_ENABLED */
1238 
1239 /**
1240  * xmlSnprintfElementContent:
1241  * @buf:  an output buffer
1242  * @size:  the buffer size
1243  * @content:  An element table
1244  * @englob: 1 if one must print the englobing parenthesis, 0 otherwise
1245  *
1246  * This will dump the content of the element content definition
1247  * Intended just for the debug routine
1248  */
1249 void
xmlSnprintfElementContent(char * buf,int size,xmlElementContentPtr content,int englob)1250 xmlSnprintfElementContent(char *buf, int size, xmlElementContentPtr content, int englob) {
1251     int len;
1252 
1253     if (content == NULL) return;
1254     len = strlen(buf);
1255     if (size - len < 50) {
1256 	if ((size - len > 4) && (buf[len - 1] != '.'))
1257 	    strcat(buf, " ...");
1258 	return;
1259     }
1260     if (englob) strcat(buf, "(");
1261     switch (content->type) {
1262         case XML_ELEMENT_CONTENT_PCDATA:
1263             strcat(buf, "#PCDATA");
1264 	    break;
1265 	case XML_ELEMENT_CONTENT_ELEMENT:
1266 	    if (content->prefix != NULL) {
1267 		if (size - len < xmlStrlen(content->prefix) + 10) {
1268 		    strcat(buf, " ...");
1269 		    return;
1270 		}
1271 		strcat(buf, (char *) content->prefix);
1272 		strcat(buf, ":");
1273 	    }
1274 	    if (size - len < xmlStrlen(content->name) + 10) {
1275 		strcat(buf, " ...");
1276 		return;
1277 	    }
1278 	    if (content->name != NULL)
1279 		strcat(buf, (char *) content->name);
1280 	    break;
1281 	case XML_ELEMENT_CONTENT_SEQ:
1282 	    if ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
1283 	        (content->c1->type == XML_ELEMENT_CONTENT_SEQ))
1284 		xmlSnprintfElementContent(buf, size, content->c1, 1);
1285 	    else
1286 		xmlSnprintfElementContent(buf, size, content->c1, 0);
1287 	    len = strlen(buf);
1288 	    if (size - len < 50) {
1289 		if ((size - len > 4) && (buf[len - 1] != '.'))
1290 		    strcat(buf, " ...");
1291 		return;
1292 	    }
1293             strcat(buf, " , ");
1294 	    if (((content->c2->type == XML_ELEMENT_CONTENT_OR) ||
1295 		 (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE)) &&
1296 		(content->c2->type != XML_ELEMENT_CONTENT_ELEMENT))
1297 		xmlSnprintfElementContent(buf, size, content->c2, 1);
1298 	    else
1299 		xmlSnprintfElementContent(buf, size, content->c2, 0);
1300 	    break;
1301 	case XML_ELEMENT_CONTENT_OR:
1302 	    if ((content->c1->type == XML_ELEMENT_CONTENT_OR) ||
1303 	        (content->c1->type == XML_ELEMENT_CONTENT_SEQ))
1304 		xmlSnprintfElementContent(buf, size, content->c1, 1);
1305 	    else
1306 		xmlSnprintfElementContent(buf, size, content->c1, 0);
1307 	    len = strlen(buf);
1308 	    if (size - len < 50) {
1309 		if ((size - len > 4) && (buf[len - 1] != '.'))
1310 		    strcat(buf, " ...");
1311 		return;
1312 	    }
1313             strcat(buf, " | ");
1314 	    if (((content->c2->type == XML_ELEMENT_CONTENT_SEQ) ||
1315 		 (content->c2->ocur != XML_ELEMENT_CONTENT_ONCE)) &&
1316 		(content->c2->type != XML_ELEMENT_CONTENT_ELEMENT))
1317 		xmlSnprintfElementContent(buf, size, content->c2, 1);
1318 	    else
1319 		xmlSnprintfElementContent(buf, size, content->c2, 0);
1320 	    break;
1321     }
1322     if (englob)
1323         strcat(buf, ")");
1324     switch (content->ocur) {
1325         case XML_ELEMENT_CONTENT_ONCE:
1326 	    break;
1327         case XML_ELEMENT_CONTENT_OPT:
1328 	    strcat(buf, "?");
1329 	    break;
1330         case XML_ELEMENT_CONTENT_MULT:
1331 	    strcat(buf, "*");
1332 	    break;
1333         case XML_ELEMENT_CONTENT_PLUS:
1334 	    strcat(buf, "+");
1335 	    break;
1336     }
1337 }
1338 
1339 /****************************************************************
1340  *								*
1341  *	Registration of DTD declarations			*
1342  *								*
1343  ****************************************************************/
1344 
1345 /**
1346  * xmlFreeElement:
1347  * @elem:  An element
1348  *
1349  * Deallocate the memory used by an element definition
1350  */
1351 static void
xmlFreeElement(xmlElementPtr elem)1352 xmlFreeElement(xmlElementPtr elem) {
1353     if (elem == NULL) return;
1354     xmlUnlinkNode((xmlNodePtr) elem);
1355     xmlFreeDocElementContent(elem->doc, elem->content);
1356     if (elem->name != NULL)
1357 	xmlFree((xmlChar *) elem->name);
1358     if (elem->prefix != NULL)
1359 	xmlFree((xmlChar *) elem->prefix);
1360 #ifdef LIBXML_REGEXP_ENABLED
1361     if (elem->contModel != NULL)
1362 	xmlRegFreeRegexp(elem->contModel);
1363 #endif
1364     xmlFree(elem);
1365 }
1366 
1367 
1368 /**
1369  * xmlAddElementDecl:
1370  * @ctxt:  the validation context
1371  * @dtd:  pointer to the DTD
1372  * @name:  the entity name
1373  * @type:  the element type
1374  * @content:  the element content tree or NULL
1375  *
1376  * Register a new element declaration
1377  *
1378  * Returns NULL if not, otherwise the entity
1379  */
1380 xmlElementPtr
xmlAddElementDecl(xmlValidCtxtPtr ctxt,xmlDtdPtr dtd,const xmlChar * name,xmlElementTypeVal type,xmlElementContentPtr content)1381 xmlAddElementDecl(xmlValidCtxtPtr ctxt,
1382                   xmlDtdPtr dtd, const xmlChar *name,
1383                   xmlElementTypeVal type,
1384 		  xmlElementContentPtr content) {
1385     xmlElementPtr ret;
1386     xmlElementTablePtr table;
1387     xmlAttributePtr oldAttributes = NULL;
1388     xmlChar *ns, *uqname;
1389 
1390     if (dtd == NULL) {
1391 	return(NULL);
1392     }
1393     if (name == NULL) {
1394 	return(NULL);
1395     }
1396 
1397     switch (type) {
1398         case XML_ELEMENT_TYPE_EMPTY:
1399 	    if (content != NULL) {
1400 		xmlErrValid(ctxt, XML_ERR_INTERNAL_ERROR,
1401 		        "xmlAddElementDecl: content != NULL for EMPTY\n",
1402 			NULL);
1403 		return(NULL);
1404 	    }
1405 	    break;
1406 	case XML_ELEMENT_TYPE_ANY:
1407 	    if (content != NULL) {
1408 		xmlErrValid(ctxt, XML_ERR_INTERNAL_ERROR,
1409 		        "xmlAddElementDecl: content != NULL for ANY\n",
1410 			NULL);
1411 		return(NULL);
1412 	    }
1413 	    break;
1414 	case XML_ELEMENT_TYPE_MIXED:
1415 	    if (content == NULL) {
1416 		xmlErrValid(ctxt, XML_ERR_INTERNAL_ERROR,
1417 		        "xmlAddElementDecl: content == NULL for MIXED\n",
1418 			NULL);
1419 		return(NULL);
1420 	    }
1421 	    break;
1422 	case XML_ELEMENT_TYPE_ELEMENT:
1423 	    if (content == NULL) {
1424 		xmlErrValid(ctxt, XML_ERR_INTERNAL_ERROR,
1425 		        "xmlAddElementDecl: content == NULL for ELEMENT\n",
1426 			NULL);
1427 		return(NULL);
1428 	    }
1429 	    break;
1430 	default:
1431 	    xmlErrValid(ctxt, XML_ERR_INTERNAL_ERROR,
1432 		    "Internal: ELEMENT decl corrupted invalid type\n",
1433 		    NULL);
1434 	    return(NULL);
1435     }
1436 
1437     /*
1438      * check if name is a QName
1439      */
1440     uqname = xmlSplitQName2(name, &ns);
1441     if (uqname != NULL)
1442 	name = uqname;
1443 
1444     /*
1445      * Create the Element table if needed.
1446      */
1447     table = (xmlElementTablePtr) dtd->elements;
1448     if (table == NULL) {
1449 	xmlDictPtr dict = NULL;
1450 
1451 	if (dtd->doc != NULL)
1452 	    dict = dtd->doc->dict;
1453         table = xmlHashCreateDict(0, dict);
1454 	dtd->elements = (void *) table;
1455     }
1456     if (table == NULL) {
1457 	xmlVErrMemory(ctxt,
1458             "xmlAddElementDecl: Table creation failed!\n");
1459 	if (uqname != NULL)
1460 	    xmlFree(uqname);
1461 	if (ns != NULL)
1462 	    xmlFree(ns);
1463         return(NULL);
1464     }
1465 
1466     /*
1467      * lookup old attributes inserted on an undefined element in the
1468      * internal subset.
1469      */
1470     if ((dtd->doc != NULL) && (dtd->doc->intSubset != NULL)) {
1471 	ret = xmlHashLookup2(dtd->doc->intSubset->elements, name, ns);
1472 	if ((ret != NULL) && (ret->etype == XML_ELEMENT_TYPE_UNDEFINED)) {
1473 	    oldAttributes = ret->attributes;
1474 	    ret->attributes = NULL;
1475 	    xmlHashRemoveEntry2(dtd->doc->intSubset->elements, name, ns, NULL);
1476 	    xmlFreeElement(ret);
1477 	}
1478     }
1479 
1480     /*
1481      * The element may already be present if one of its attribute
1482      * was registered first
1483      */
1484     ret = xmlHashLookup2(table, name, ns);
1485     if (ret != NULL) {
1486 	if (ret->etype != XML_ELEMENT_TYPE_UNDEFINED) {
1487 #ifdef LIBXML_VALID_ENABLED
1488 	    /*
1489 	     * The element is already defined in this DTD.
1490 	     */
1491 	    xmlErrValidNode(ctxt, (xmlNodePtr) dtd, XML_DTD_ELEM_REDEFINED,
1492 	                    "Redefinition of element %s\n",
1493 			    name, NULL, NULL);
1494 #endif /* LIBXML_VALID_ENABLED */
1495 	    if (uqname != NULL)
1496 		xmlFree(uqname);
1497             if (ns != NULL)
1498 	        xmlFree(ns);
1499 	    return(NULL);
1500 	}
1501 	if (ns != NULL) {
1502 	    xmlFree(ns);
1503 	    ns = NULL;
1504 	}
1505     } else {
1506 	ret = (xmlElementPtr) xmlMalloc(sizeof(xmlElement));
1507 	if (ret == NULL) {
1508 	    xmlVErrMemory(ctxt, "malloc failed");
1509 	    if (uqname != NULL)
1510 		xmlFree(uqname);
1511             if (ns != NULL)
1512 	        xmlFree(ns);
1513 	    return(NULL);
1514 	}
1515 	memset(ret, 0, sizeof(xmlElement));
1516 	ret->type = XML_ELEMENT_DECL;
1517 
1518 	/*
1519 	 * fill the structure.
1520 	 */
1521 	ret->name = xmlStrdup(name);
1522 	if (ret->name == NULL) {
1523 	    xmlVErrMemory(ctxt, "malloc failed");
1524 	    if (uqname != NULL)
1525 		xmlFree(uqname);
1526             if (ns != NULL)
1527 	        xmlFree(ns);
1528 	    xmlFree(ret);
1529 	    return(NULL);
1530 	}
1531 	ret->prefix = ns;
1532 
1533 	/*
1534 	 * Validity Check:
1535 	 * Insertion must not fail
1536 	 */
1537 	if (xmlHashAddEntry2(table, name, ns, ret)) {
1538 #ifdef LIBXML_VALID_ENABLED
1539 	    /*
1540 	     * The element is already defined in this DTD.
1541 	     */
1542 	    xmlErrValidNode(ctxt, (xmlNodePtr) dtd, XML_DTD_ELEM_REDEFINED,
1543 	                    "Redefinition of element %s\n",
1544 			    name, NULL, NULL);
1545 #endif /* LIBXML_VALID_ENABLED */
1546 	    xmlFreeElement(ret);
1547 	    if (uqname != NULL)
1548 		xmlFree(uqname);
1549 	    return(NULL);
1550 	}
1551 	/*
1552 	 * For new element, may have attributes from earlier
1553 	 * definition in internal subset
1554 	 */
1555 	ret->attributes = oldAttributes;
1556     }
1557 
1558     /*
1559      * Finish to fill the structure.
1560      */
1561     ret->etype = type;
1562     /*
1563      * Avoid a stupid copy when called by the parser
1564      * and flag it by setting a special parent value
1565      * so the parser doesn't unallocate it.
1566      */
1567     if ((ctxt != NULL) &&
1568         ((ctxt->finishDtd == XML_CTXT_FINISH_DTD_0) ||
1569          (ctxt->finishDtd == XML_CTXT_FINISH_DTD_1))) {
1570 	ret->content = content;
1571 	if (content != NULL)
1572 	    content->parent = (xmlElementContentPtr) 1;
1573     } else {
1574 	ret->content = xmlCopyDocElementContent(dtd->doc, content);
1575     }
1576 
1577     /*
1578      * Link it to the DTD
1579      */
1580     ret->parent = dtd;
1581     ret->doc = dtd->doc;
1582     if (dtd->last == NULL) {
1583 	dtd->children = dtd->last = (xmlNodePtr) ret;
1584     } else {
1585         dtd->last->next = (xmlNodePtr) ret;
1586 	ret->prev = dtd->last;
1587 	dtd->last = (xmlNodePtr) ret;
1588     }
1589     if (uqname != NULL)
1590 	xmlFree(uqname);
1591     return(ret);
1592 }
1593 
1594 /**
1595  * xmlFreeElementTable:
1596  * @table:  An element table
1597  *
1598  * Deallocate the memory used by an element hash table.
1599  */
1600 void
xmlFreeElementTable(xmlElementTablePtr table)1601 xmlFreeElementTable(xmlElementTablePtr table) {
1602     xmlHashFree(table, (xmlHashDeallocator) xmlFreeElement);
1603 }
1604 
1605 #ifdef LIBXML_TREE_ENABLED
1606 /**
1607  * xmlCopyElement:
1608  * @elem:  An element
1609  *
1610  * Build a copy of an element.
1611  *
1612  * Returns the new xmlElementPtr or NULL in case of error.
1613  */
1614 static xmlElementPtr
xmlCopyElement(xmlElementPtr elem)1615 xmlCopyElement(xmlElementPtr elem) {
1616     xmlElementPtr cur;
1617 
1618     cur = (xmlElementPtr) xmlMalloc(sizeof(xmlElement));
1619     if (cur == NULL) {
1620 	xmlVErrMemory(NULL, "malloc failed");
1621 	return(NULL);
1622     }
1623     memset(cur, 0, sizeof(xmlElement));
1624     cur->type = XML_ELEMENT_DECL;
1625     cur->etype = elem->etype;
1626     if (elem->name != NULL)
1627 	cur->name = xmlStrdup(elem->name);
1628     else
1629 	cur->name = NULL;
1630     if (elem->prefix != NULL)
1631 	cur->prefix = xmlStrdup(elem->prefix);
1632     else
1633 	cur->prefix = NULL;
1634     cur->content = xmlCopyElementContent(elem->content);
1635     /* TODO : rebuild the attribute list on the copy */
1636     cur->attributes = NULL;
1637     return(cur);
1638 }
1639 
1640 /**
1641  * xmlCopyElementTable:
1642  * @table:  An element table
1643  *
1644  * Build a copy of an element table.
1645  *
1646  * Returns the new xmlElementTablePtr or NULL in case of error.
1647  */
1648 xmlElementTablePtr
xmlCopyElementTable(xmlElementTablePtr table)1649 xmlCopyElementTable(xmlElementTablePtr table) {
1650     return((xmlElementTablePtr) xmlHashCopy(table,
1651 		                            (xmlHashCopier) xmlCopyElement));
1652 }
1653 #endif /* LIBXML_TREE_ENABLED */
1654 
1655 #ifdef LIBXML_OUTPUT_ENABLED
1656 /**
1657  * xmlDumpElementDecl:
1658  * @buf:  the XML buffer output
1659  * @elem:  An element table
1660  *
1661  * This will dump the content of the element declaration as an XML
1662  * DTD definition
1663  */
1664 void
xmlDumpElementDecl(xmlBufferPtr buf,xmlElementPtr elem)1665 xmlDumpElementDecl(xmlBufferPtr buf, xmlElementPtr elem) {
1666     if ((buf == NULL) || (elem == NULL))
1667         return;
1668     switch (elem->etype) {
1669 	case XML_ELEMENT_TYPE_EMPTY:
1670 	    xmlBufferWriteChar(buf, "<!ELEMENT ");
1671 	    if (elem->prefix != NULL) {
1672 		xmlBufferWriteCHAR(buf, elem->prefix);
1673 		xmlBufferWriteChar(buf, ":");
1674 	    }
1675 	    xmlBufferWriteCHAR(buf, elem->name);
1676 	    xmlBufferWriteChar(buf, " EMPTY>\n");
1677 	    break;
1678 	case XML_ELEMENT_TYPE_ANY:
1679 	    xmlBufferWriteChar(buf, "<!ELEMENT ");
1680 	    if (elem->prefix != NULL) {
1681 		xmlBufferWriteCHAR(buf, elem->prefix);
1682 		xmlBufferWriteChar(buf, ":");
1683 	    }
1684 	    xmlBufferWriteCHAR(buf, elem->name);
1685 	    xmlBufferWriteChar(buf, " ANY>\n");
1686 	    break;
1687 	case XML_ELEMENT_TYPE_MIXED:
1688 	    xmlBufferWriteChar(buf, "<!ELEMENT ");
1689 	    if (elem->prefix != NULL) {
1690 		xmlBufferWriteCHAR(buf, elem->prefix);
1691 		xmlBufferWriteChar(buf, ":");
1692 	    }
1693 	    xmlBufferWriteCHAR(buf, elem->name);
1694 	    xmlBufferWriteChar(buf, " ");
1695 	    xmlDumpElementContent(buf, elem->content, 1);
1696 	    xmlBufferWriteChar(buf, ">\n");
1697 	    break;
1698 	case XML_ELEMENT_TYPE_ELEMENT:
1699 	    xmlBufferWriteChar(buf, "<!ELEMENT ");
1700 	    if (elem->prefix != NULL) {
1701 		xmlBufferWriteCHAR(buf, elem->prefix);
1702 		xmlBufferWriteChar(buf, ":");
1703 	    }
1704 	    xmlBufferWriteCHAR(buf, elem->name);
1705 	    xmlBufferWriteChar(buf, " ");
1706 	    xmlDumpElementContent(buf, elem->content, 1);
1707 	    xmlBufferWriteChar(buf, ">\n");
1708 	    break;
1709 	default:
1710 	    xmlErrValid(NULL, XML_ERR_INTERNAL_ERROR,
1711 		    "Internal: ELEMENT struct corrupted invalid type\n",
1712 		    NULL);
1713     }
1714 }
1715 
1716 /**
1717  * xmlDumpElementDeclScan:
1718  * @elem:  An element table
1719  * @buf:  the XML buffer output
1720  *
1721  * This routine is used by the hash scan function.  It just reverses
1722  * the arguments.
1723  */
1724 static void
xmlDumpElementDeclScan(xmlElementPtr elem,xmlBufferPtr buf)1725 xmlDumpElementDeclScan(xmlElementPtr elem, xmlBufferPtr buf) {
1726     xmlDumpElementDecl(buf, elem);
1727 }
1728 
1729 /**
1730  * xmlDumpElementTable:
1731  * @buf:  the XML buffer output
1732  * @table:  An element table
1733  *
1734  * This will dump the content of the element table as an XML DTD definition
1735  */
1736 void
xmlDumpElementTable(xmlBufferPtr buf,xmlElementTablePtr table)1737 xmlDumpElementTable(xmlBufferPtr buf, xmlElementTablePtr table) {
1738     if ((buf == NULL) || (table == NULL))
1739         return;
1740     xmlHashScan(table, (xmlHashScanner) xmlDumpElementDeclScan, buf);
1741 }
1742 #endif /* LIBXML_OUTPUT_ENABLED */
1743 
1744 /**
1745  * xmlCreateEnumeration:
1746  * @name:  the enumeration name or NULL
1747  *
1748  * create and initialize an enumeration attribute node.
1749  *
1750  * Returns the xmlEnumerationPtr just created or NULL in case
1751  *                of error.
1752  */
1753 xmlEnumerationPtr
xmlCreateEnumeration(const xmlChar * name)1754 xmlCreateEnumeration(const xmlChar *name) {
1755     xmlEnumerationPtr ret;
1756 
1757     ret = (xmlEnumerationPtr) xmlMalloc(sizeof(xmlEnumeration));
1758     if (ret == NULL) {
1759 	xmlVErrMemory(NULL, "malloc failed");
1760         return(NULL);
1761     }
1762     memset(ret, 0, sizeof(xmlEnumeration));
1763 
1764     if (name != NULL)
1765         ret->name = xmlStrdup(name);
1766     return(ret);
1767 }
1768 
1769 /**
1770  * xmlFreeEnumeration:
1771  * @cur:  the tree to free.
1772  *
1773  * free an enumeration attribute node (recursive).
1774  */
1775 void
xmlFreeEnumeration(xmlEnumerationPtr cur)1776 xmlFreeEnumeration(xmlEnumerationPtr cur) {
1777     if (cur == NULL) return;
1778 
1779     if (cur->next != NULL) xmlFreeEnumeration(cur->next);
1780 
1781     if (cur->name != NULL) xmlFree((xmlChar *) cur->name);
1782     xmlFree(cur);
1783 }
1784 
1785 #ifdef LIBXML_TREE_ENABLED
1786 /**
1787  * xmlCopyEnumeration:
1788  * @cur:  the tree to copy.
1789  *
1790  * Copy an enumeration attribute node (recursive).
1791  *
1792  * Returns the xmlEnumerationPtr just created or NULL in case
1793  *                of error.
1794  */
1795 xmlEnumerationPtr
xmlCopyEnumeration(xmlEnumerationPtr cur)1796 xmlCopyEnumeration(xmlEnumerationPtr cur) {
1797     xmlEnumerationPtr ret;
1798 
1799     if (cur == NULL) return(NULL);
1800     ret = xmlCreateEnumeration((xmlChar *) cur->name);
1801     if (ret == NULL) return(NULL);
1802 
1803     if (cur->next != NULL) ret->next = xmlCopyEnumeration(cur->next);
1804     else ret->next = NULL;
1805 
1806     return(ret);
1807 }
1808 #endif /* LIBXML_TREE_ENABLED */
1809 
1810 #ifdef LIBXML_OUTPUT_ENABLED
1811 /**
1812  * xmlDumpEnumeration:
1813  * @buf:  the XML buffer output
1814  * @enum:  An enumeration
1815  *
1816  * This will dump the content of the enumeration
1817  */
1818 static void
xmlDumpEnumeration(xmlBufferPtr buf,xmlEnumerationPtr cur)1819 xmlDumpEnumeration(xmlBufferPtr buf, xmlEnumerationPtr cur) {
1820     if ((buf == NULL) || (cur == NULL))
1821         return;
1822 
1823     xmlBufferWriteCHAR(buf, cur->name);
1824     if (cur->next == NULL)
1825 	xmlBufferWriteChar(buf, ")");
1826     else {
1827 	xmlBufferWriteChar(buf, " | ");
1828 	xmlDumpEnumeration(buf, cur->next);
1829     }
1830 }
1831 #endif /* LIBXML_OUTPUT_ENABLED */
1832 
1833 #ifdef LIBXML_VALID_ENABLED
1834 /**
1835  * xmlScanIDAttributeDecl:
1836  * @ctxt:  the validation context
1837  * @elem:  the element name
1838  * @err: whether to raise errors here
1839  *
1840  * Verify that the element don't have too many ID attributes
1841  * declared.
1842  *
1843  * Returns the number of ID attributes found.
1844  */
1845 static int
xmlScanIDAttributeDecl(xmlValidCtxtPtr ctxt,xmlElementPtr elem,int err)1846 xmlScanIDAttributeDecl(xmlValidCtxtPtr ctxt, xmlElementPtr elem, int err) {
1847     xmlAttributePtr cur;
1848     int ret = 0;
1849 
1850     if (elem == NULL) return(0);
1851     cur = elem->attributes;
1852     while (cur != NULL) {
1853         if (cur->atype == XML_ATTRIBUTE_ID) {
1854 	    ret ++;
1855 	    if ((ret > 1) && (err))
1856 		xmlErrValidNode(ctxt, (xmlNodePtr) elem, XML_DTD_MULTIPLE_ID,
1857 	       "Element %s has too many ID attributes defined : %s\n",
1858 		       elem->name, cur->name, NULL);
1859 	}
1860 	cur = cur->nexth;
1861     }
1862     return(ret);
1863 }
1864 #endif /* LIBXML_VALID_ENABLED */
1865 
1866 /**
1867  * xmlFreeAttribute:
1868  * @elem:  An attribute
1869  *
1870  * Deallocate the memory used by an attribute definition
1871  */
1872 static void
xmlFreeAttribute(xmlAttributePtr attr)1873 xmlFreeAttribute(xmlAttributePtr attr) {
1874     xmlDictPtr dict;
1875 
1876     if (attr == NULL) return;
1877     if (attr->doc != NULL)
1878 	dict = attr->doc->dict;
1879     else
1880 	dict = NULL;
1881     xmlUnlinkNode((xmlNodePtr) attr);
1882     if (attr->tree != NULL)
1883         xmlFreeEnumeration(attr->tree);
1884     if (dict) {
1885         if ((attr->elem != NULL) && (!xmlDictOwns(dict, attr->elem)))
1886 	    xmlFree((xmlChar *) attr->elem);
1887         if ((attr->name != NULL) && (!xmlDictOwns(dict, attr->name)))
1888 	    xmlFree((xmlChar *) attr->name);
1889         if ((attr->prefix != NULL) && (!xmlDictOwns(dict, attr->prefix)))
1890 	    xmlFree((xmlChar *) attr->prefix);
1891         if ((attr->defaultValue != NULL) &&
1892 	    (!xmlDictOwns(dict, attr->defaultValue)))
1893 	    xmlFree((xmlChar *) attr->defaultValue);
1894     } else {
1895 	if (attr->elem != NULL)
1896 	    xmlFree((xmlChar *) attr->elem);
1897 	if (attr->name != NULL)
1898 	    xmlFree((xmlChar *) attr->name);
1899 	if (attr->defaultValue != NULL)
1900 	    xmlFree((xmlChar *) attr->defaultValue);
1901 	if (attr->prefix != NULL)
1902 	    xmlFree((xmlChar *) attr->prefix);
1903     }
1904     xmlFree(attr);
1905 }
1906 
1907 
1908 /**
1909  * xmlAddAttributeDecl:
1910  * @ctxt:  the validation context
1911  * @dtd:  pointer to the DTD
1912  * @elem:  the element name
1913  * @name:  the attribute name
1914  * @ns:  the attribute namespace prefix
1915  * @type:  the attribute type
1916  * @def:  the attribute default type
1917  * @defaultValue:  the attribute default value
1918  * @tree:  if it's an enumeration, the associated list
1919  *
1920  * Register a new attribute declaration
1921  * Note that @tree becomes the ownership of the DTD
1922  *
1923  * Returns NULL if not new, otherwise the attribute decl
1924  */
1925 xmlAttributePtr
xmlAddAttributeDecl(xmlValidCtxtPtr ctxt,xmlDtdPtr dtd,const xmlChar * elem,const xmlChar * name,const xmlChar * ns,xmlAttributeType type,xmlAttributeDefault def,const xmlChar * defaultValue,xmlEnumerationPtr tree)1926 xmlAddAttributeDecl(xmlValidCtxtPtr ctxt,
1927                     xmlDtdPtr dtd, const xmlChar *elem,
1928                     const xmlChar *name, const xmlChar *ns,
1929 		    xmlAttributeType type, xmlAttributeDefault def,
1930 		    const xmlChar *defaultValue, xmlEnumerationPtr tree) {
1931     xmlAttributePtr ret;
1932     xmlAttributeTablePtr table;
1933     xmlElementPtr elemDef;
1934     xmlDictPtr dict = NULL;
1935 
1936     if (dtd == NULL) {
1937 	xmlFreeEnumeration(tree);
1938 	return(NULL);
1939     }
1940     if (name == NULL) {
1941 	xmlFreeEnumeration(tree);
1942 	return(NULL);
1943     }
1944     if (elem == NULL) {
1945 	xmlFreeEnumeration(tree);
1946 	return(NULL);
1947     }
1948     if (dtd->doc != NULL)
1949 	dict = dtd->doc->dict;
1950 
1951 #ifdef LIBXML_VALID_ENABLED
1952     /*
1953      * Check the type and possibly the default value.
1954      */
1955     switch (type) {
1956         case XML_ATTRIBUTE_CDATA:
1957 	    break;
1958         case XML_ATTRIBUTE_ID:
1959 	    break;
1960         case XML_ATTRIBUTE_IDREF:
1961 	    break;
1962         case XML_ATTRIBUTE_IDREFS:
1963 	    break;
1964         case XML_ATTRIBUTE_ENTITY:
1965 	    break;
1966         case XML_ATTRIBUTE_ENTITIES:
1967 	    break;
1968         case XML_ATTRIBUTE_NMTOKEN:
1969 	    break;
1970         case XML_ATTRIBUTE_NMTOKENS:
1971 	    break;
1972         case XML_ATTRIBUTE_ENUMERATION:
1973 	    break;
1974         case XML_ATTRIBUTE_NOTATION:
1975 	    break;
1976 	default:
1977 	    xmlErrValid(ctxt, XML_ERR_INTERNAL_ERROR,
1978 		    "Internal: ATTRIBUTE struct corrupted invalid type\n",
1979 		    NULL);
1980 	    xmlFreeEnumeration(tree);
1981 	    return(NULL);
1982     }
1983     if ((defaultValue != NULL) &&
1984         (!xmlValidateAttributeValueInternal(dtd->doc, type, defaultValue))) {
1985 	xmlErrValidNode(ctxt, (xmlNodePtr) dtd, XML_DTD_ATTRIBUTE_DEFAULT,
1986 	                "Attribute %s of %s: invalid default value\n",
1987 	                elem, name, defaultValue);
1988 	defaultValue = NULL;
1989 	if (ctxt != NULL)
1990 	    ctxt->valid = 0;
1991     }
1992 #endif /* LIBXML_VALID_ENABLED */
1993 
1994     /*
1995      * Check first that an attribute defined in the external subset wasn't
1996      * already defined in the internal subset
1997      */
1998     if ((dtd->doc != NULL) && (dtd->doc->extSubset == dtd) &&
1999 	(dtd->doc->intSubset != NULL) &&
2000 	(dtd->doc->intSubset->attributes != NULL)) {
2001         ret = xmlHashLookup3(dtd->doc->intSubset->attributes, name, ns, elem);
2002 	if (ret != NULL) {
2003 	    xmlFreeEnumeration(tree);
2004 	    return(NULL);
2005 	}
2006     }
2007 
2008     /*
2009      * Create the Attribute table if needed.
2010      */
2011     table = (xmlAttributeTablePtr) dtd->attributes;
2012     if (table == NULL) {
2013         table = xmlHashCreateDict(0, dict);
2014 	dtd->attributes = (void *) table;
2015     }
2016     if (table == NULL) {
2017 	xmlVErrMemory(ctxt,
2018             "xmlAddAttributeDecl: Table creation failed!\n");
2019 	xmlFreeEnumeration(tree);
2020         return(NULL);
2021     }
2022 
2023 
2024     ret = (xmlAttributePtr) xmlMalloc(sizeof(xmlAttribute));
2025     if (ret == NULL) {
2026 	xmlVErrMemory(ctxt, "malloc failed");
2027 	xmlFreeEnumeration(tree);
2028 	return(NULL);
2029     }
2030     memset(ret, 0, sizeof(xmlAttribute));
2031     ret->type = XML_ATTRIBUTE_DECL;
2032 
2033     /*
2034      * fill the structure.
2035      */
2036     ret->atype = type;
2037     /*
2038      * doc must be set before possible error causes call
2039      * to xmlFreeAttribute (because it's used to check on
2040      * dict use)
2041      */
2042     ret->doc = dtd->doc;
2043     if (dict) {
2044 	ret->name = xmlDictLookup(dict, name, -1);
2045 	ret->prefix = xmlDictLookup(dict, ns, -1);
2046 	ret->elem = xmlDictLookup(dict, elem, -1);
2047     } else {
2048 	ret->name = xmlStrdup(name);
2049 	ret->prefix = xmlStrdup(ns);
2050 	ret->elem = xmlStrdup(elem);
2051     }
2052     ret->def = def;
2053     ret->tree = tree;
2054     if (defaultValue != NULL) {
2055         if (dict)
2056 	    ret->defaultValue = xmlDictLookup(dict, defaultValue, -1);
2057 	else
2058 	    ret->defaultValue = xmlStrdup(defaultValue);
2059     }
2060 
2061     /*
2062      * Validity Check:
2063      * Search the DTD for previous declarations of the ATTLIST
2064      */
2065     if (xmlHashAddEntry3(table, ret->name, ret->prefix, ret->elem, ret) < 0) {
2066 #ifdef LIBXML_VALID_ENABLED
2067 	/*
2068 	 * The attribute is already defined in this DTD.
2069 	 */
2070 	xmlErrValidWarning(ctxt, (xmlNodePtr) dtd, XML_DTD_ATTRIBUTE_REDEFINED,
2071 		 "Attribute %s of element %s: already defined\n",
2072 		 name, elem, NULL);
2073 #endif /* LIBXML_VALID_ENABLED */
2074 	xmlFreeAttribute(ret);
2075 	return(NULL);
2076     }
2077 
2078     /*
2079      * Validity Check:
2080      * Multiple ID per element
2081      */
2082     elemDef = xmlGetDtdElementDesc2(dtd, elem, 1);
2083     if (elemDef != NULL) {
2084 
2085 #ifdef LIBXML_VALID_ENABLED
2086         if ((type == XML_ATTRIBUTE_ID) &&
2087 	    (xmlScanIDAttributeDecl(NULL, elemDef, 1) != 0)) {
2088 	    xmlErrValidNode(ctxt, (xmlNodePtr) dtd, XML_DTD_MULTIPLE_ID,
2089 	   "Element %s has too may ID attributes defined : %s\n",
2090 		   elem, name, NULL);
2091 	    if (ctxt != NULL)
2092 		ctxt->valid = 0;
2093 	}
2094 #endif /* LIBXML_VALID_ENABLED */
2095 
2096 	/*
2097 	 * Insert namespace default def first they need to be
2098 	 * processed first.
2099 	 */
2100 	if ((xmlStrEqual(ret->name, BAD_CAST "xmlns")) ||
2101 	    ((ret->prefix != NULL &&
2102 	     (xmlStrEqual(ret->prefix, BAD_CAST "xmlns"))))) {
2103 	    ret->nexth = elemDef->attributes;
2104 	    elemDef->attributes = ret;
2105 	} else {
2106 	    xmlAttributePtr tmp = elemDef->attributes;
2107 
2108 	    while ((tmp != NULL) &&
2109 		   ((xmlStrEqual(tmp->name, BAD_CAST "xmlns")) ||
2110 		    ((ret->prefix != NULL &&
2111 		     (xmlStrEqual(ret->prefix, BAD_CAST "xmlns")))))) {
2112 		if (tmp->nexth == NULL)
2113 		    break;
2114 		tmp = tmp->nexth;
2115 	    }
2116 	    if (tmp != NULL) {
2117 		ret->nexth = tmp->nexth;
2118 	        tmp->nexth = ret;
2119 	    } else {
2120 		ret->nexth = elemDef->attributes;
2121 		elemDef->attributes = ret;
2122 	    }
2123 	}
2124     }
2125 
2126     /*
2127      * Link it to the DTD
2128      */
2129     ret->parent = dtd;
2130     if (dtd->last == NULL) {
2131 	dtd->children = dtd->last = (xmlNodePtr) ret;
2132     } else {
2133         dtd->last->next = (xmlNodePtr) ret;
2134 	ret->prev = dtd->last;
2135 	dtd->last = (xmlNodePtr) ret;
2136     }
2137     return(ret);
2138 }
2139 
2140 /**
2141  * xmlFreeAttributeTable:
2142  * @table:  An attribute table
2143  *
2144  * Deallocate the memory used by an entities hash table.
2145  */
2146 void
xmlFreeAttributeTable(xmlAttributeTablePtr table)2147 xmlFreeAttributeTable(xmlAttributeTablePtr table) {
2148     xmlHashFree(table, (xmlHashDeallocator) xmlFreeAttribute);
2149 }
2150 
2151 #ifdef LIBXML_TREE_ENABLED
2152 /**
2153  * xmlCopyAttribute:
2154  * @attr:  An attribute
2155  *
2156  * Build a copy of an attribute.
2157  *
2158  * Returns the new xmlAttributePtr or NULL in case of error.
2159  */
2160 static xmlAttributePtr
xmlCopyAttribute(xmlAttributePtr attr)2161 xmlCopyAttribute(xmlAttributePtr attr) {
2162     xmlAttributePtr cur;
2163 
2164     cur = (xmlAttributePtr) xmlMalloc(sizeof(xmlAttribute));
2165     if (cur == NULL) {
2166 	xmlVErrMemory(NULL, "malloc failed");
2167 	return(NULL);
2168     }
2169     memset(cur, 0, sizeof(xmlAttribute));
2170     cur->type = XML_ATTRIBUTE_DECL;
2171     cur->atype = attr->atype;
2172     cur->def = attr->def;
2173     cur->tree = xmlCopyEnumeration(attr->tree);
2174     if (attr->elem != NULL)
2175 	cur->elem = xmlStrdup(attr->elem);
2176     if (attr->name != NULL)
2177 	cur->name = xmlStrdup(attr->name);
2178     if (attr->prefix != NULL)
2179 	cur->prefix = xmlStrdup(attr->prefix);
2180     if (attr->defaultValue != NULL)
2181 	cur->defaultValue = xmlStrdup(attr->defaultValue);
2182     return(cur);
2183 }
2184 
2185 /**
2186  * xmlCopyAttributeTable:
2187  * @table:  An attribute table
2188  *
2189  * Build a copy of an attribute table.
2190  *
2191  * Returns the new xmlAttributeTablePtr or NULL in case of error.
2192  */
2193 xmlAttributeTablePtr
xmlCopyAttributeTable(xmlAttributeTablePtr table)2194 xmlCopyAttributeTable(xmlAttributeTablePtr table) {
2195     return((xmlAttributeTablePtr) xmlHashCopy(table,
2196 				    (xmlHashCopier) xmlCopyAttribute));
2197 }
2198 #endif /* LIBXML_TREE_ENABLED */
2199 
2200 #ifdef LIBXML_OUTPUT_ENABLED
2201 /**
2202  * xmlDumpAttributeDecl:
2203  * @buf:  the XML buffer output
2204  * @attr:  An attribute declaration
2205  *
2206  * This will dump the content of the attribute declaration as an XML
2207  * DTD definition
2208  */
2209 void
xmlDumpAttributeDecl(xmlBufferPtr buf,xmlAttributePtr attr)2210 xmlDumpAttributeDecl(xmlBufferPtr buf, xmlAttributePtr attr) {
2211     if ((buf == NULL) || (attr == NULL))
2212         return;
2213     xmlBufferWriteChar(buf, "<!ATTLIST ");
2214     xmlBufferWriteCHAR(buf, attr->elem);
2215     xmlBufferWriteChar(buf, " ");
2216     if (attr->prefix != NULL) {
2217 	xmlBufferWriteCHAR(buf, attr->prefix);
2218 	xmlBufferWriteChar(buf, ":");
2219     }
2220     xmlBufferWriteCHAR(buf, attr->name);
2221     switch (attr->atype) {
2222 	case XML_ATTRIBUTE_CDATA:
2223 	    xmlBufferWriteChar(buf, " CDATA");
2224 	    break;
2225 	case XML_ATTRIBUTE_ID:
2226 	    xmlBufferWriteChar(buf, " ID");
2227 	    break;
2228 	case XML_ATTRIBUTE_IDREF:
2229 	    xmlBufferWriteChar(buf, " IDREF");
2230 	    break;
2231 	case XML_ATTRIBUTE_IDREFS:
2232 	    xmlBufferWriteChar(buf, " IDREFS");
2233 	    break;
2234 	case XML_ATTRIBUTE_ENTITY:
2235 	    xmlBufferWriteChar(buf, " ENTITY");
2236 	    break;
2237 	case XML_ATTRIBUTE_ENTITIES:
2238 	    xmlBufferWriteChar(buf, " ENTITIES");
2239 	    break;
2240 	case XML_ATTRIBUTE_NMTOKEN:
2241 	    xmlBufferWriteChar(buf, " NMTOKEN");
2242 	    break;
2243 	case XML_ATTRIBUTE_NMTOKENS:
2244 	    xmlBufferWriteChar(buf, " NMTOKENS");
2245 	    break;
2246 	case XML_ATTRIBUTE_ENUMERATION:
2247 	    xmlBufferWriteChar(buf, " (");
2248 	    xmlDumpEnumeration(buf, attr->tree);
2249 	    break;
2250 	case XML_ATTRIBUTE_NOTATION:
2251 	    xmlBufferWriteChar(buf, " NOTATION (");
2252 	    xmlDumpEnumeration(buf, attr->tree);
2253 	    break;
2254 	default:
2255 	    xmlErrValid(NULL, XML_ERR_INTERNAL_ERROR,
2256 		    "Internal: ATTRIBUTE struct corrupted invalid type\n",
2257 		    NULL);
2258     }
2259     switch (attr->def) {
2260 	case XML_ATTRIBUTE_NONE:
2261 	    break;
2262 	case XML_ATTRIBUTE_REQUIRED:
2263 	    xmlBufferWriteChar(buf, " #REQUIRED");
2264 	    break;
2265 	case XML_ATTRIBUTE_IMPLIED:
2266 	    xmlBufferWriteChar(buf, " #IMPLIED");
2267 	    break;
2268 	case XML_ATTRIBUTE_FIXED:
2269 	    xmlBufferWriteChar(buf, " #FIXED");
2270 	    break;
2271 	default:
2272 	    xmlErrValid(NULL, XML_ERR_INTERNAL_ERROR,
2273 		    "Internal: ATTRIBUTE struct corrupted invalid def\n",
2274 		    NULL);
2275     }
2276     if (attr->defaultValue != NULL) {
2277 	xmlBufferWriteChar(buf, " ");
2278 	xmlBufferWriteQuotedString(buf, attr->defaultValue);
2279     }
2280     xmlBufferWriteChar(buf, ">\n");
2281 }
2282 
2283 /**
2284  * xmlDumpAttributeDeclScan:
2285  * @attr:  An attribute declaration
2286  * @buf:  the XML buffer output
2287  *
2288  * This is used with the hash scan function - just reverses arguments
2289  */
2290 static void
xmlDumpAttributeDeclScan(xmlAttributePtr attr,xmlBufferPtr buf)2291 xmlDumpAttributeDeclScan(xmlAttributePtr attr, xmlBufferPtr buf) {
2292     xmlDumpAttributeDecl(buf, attr);
2293 }
2294 
2295 /**
2296  * xmlDumpAttributeTable:
2297  * @buf:  the XML buffer output
2298  * @table:  An attribute table
2299  *
2300  * This will dump the content of the attribute table as an XML DTD definition
2301  */
2302 void
xmlDumpAttributeTable(xmlBufferPtr buf,xmlAttributeTablePtr table)2303 xmlDumpAttributeTable(xmlBufferPtr buf, xmlAttributeTablePtr table) {
2304     if ((buf == NULL) || (table == NULL))
2305         return;
2306     xmlHashScan(table, (xmlHashScanner) xmlDumpAttributeDeclScan, buf);
2307 }
2308 #endif /* LIBXML_OUTPUT_ENABLED */
2309 
2310 /************************************************************************
2311  *									*
2312  *				NOTATIONs				*
2313  *									*
2314  ************************************************************************/
2315 /**
2316  * xmlFreeNotation:
2317  * @not:  A notation
2318  *
2319  * Deallocate the memory used by an notation definition
2320  */
2321 static void
xmlFreeNotation(xmlNotationPtr nota)2322 xmlFreeNotation(xmlNotationPtr nota) {
2323     if (nota == NULL) return;
2324     if (nota->name != NULL)
2325 	xmlFree((xmlChar *) nota->name);
2326     if (nota->PublicID != NULL)
2327 	xmlFree((xmlChar *) nota->PublicID);
2328     if (nota->SystemID != NULL)
2329 	xmlFree((xmlChar *) nota->SystemID);
2330     xmlFree(nota);
2331 }
2332 
2333 
2334 /**
2335  * xmlAddNotationDecl:
2336  * @dtd:  pointer to the DTD
2337  * @ctxt:  the validation context
2338  * @name:  the entity name
2339  * @PublicID:  the public identifier or NULL
2340  * @SystemID:  the system identifier or NULL
2341  *
2342  * Register a new notation declaration
2343  *
2344  * Returns NULL if not, otherwise the entity
2345  */
2346 xmlNotationPtr
xmlAddNotationDecl(xmlValidCtxtPtr ctxt,xmlDtdPtr dtd,const xmlChar * name,const xmlChar * PublicID,const xmlChar * SystemID)2347 xmlAddNotationDecl(xmlValidCtxtPtr ctxt, xmlDtdPtr dtd,
2348 	           const xmlChar *name,
2349                    const xmlChar *PublicID, const xmlChar *SystemID) {
2350     xmlNotationPtr ret;
2351     xmlNotationTablePtr table;
2352 
2353     if (dtd == NULL) {
2354 	return(NULL);
2355     }
2356     if (name == NULL) {
2357 	return(NULL);
2358     }
2359     if ((PublicID == NULL) && (SystemID == NULL)) {
2360 	return(NULL);
2361     }
2362 
2363     /*
2364      * Create the Notation table if needed.
2365      */
2366     table = (xmlNotationTablePtr) dtd->notations;
2367     if (table == NULL) {
2368 	xmlDictPtr dict = NULL;
2369 	if (dtd->doc != NULL)
2370 	    dict = dtd->doc->dict;
2371 
2372         dtd->notations = table = xmlHashCreateDict(0, dict);
2373     }
2374     if (table == NULL) {
2375 	xmlVErrMemory(ctxt,
2376 		"xmlAddNotationDecl: Table creation failed!\n");
2377         return(NULL);
2378     }
2379 
2380     ret = (xmlNotationPtr) xmlMalloc(sizeof(xmlNotation));
2381     if (ret == NULL) {
2382 	xmlVErrMemory(ctxt, "malloc failed");
2383 	return(NULL);
2384     }
2385     memset(ret, 0, sizeof(xmlNotation));
2386 
2387     /*
2388      * fill the structure.
2389      */
2390     ret->name = xmlStrdup(name);
2391     if (SystemID != NULL)
2392         ret->SystemID = xmlStrdup(SystemID);
2393     if (PublicID != NULL)
2394         ret->PublicID = xmlStrdup(PublicID);
2395 
2396     /*
2397      * Validity Check:
2398      * Check the DTD for previous declarations of the ATTLIST
2399      */
2400     if (xmlHashAddEntry(table, name, ret)) {
2401 #ifdef LIBXML_VALID_ENABLED
2402 	xmlErrValid(NULL, XML_DTD_NOTATION_REDEFINED,
2403 		    "xmlAddNotationDecl: %s already defined\n",
2404 		    (const char *) name);
2405 #endif /* LIBXML_VALID_ENABLED */
2406 	xmlFreeNotation(ret);
2407 	return(NULL);
2408     }
2409     return(ret);
2410 }
2411 
2412 /**
2413  * xmlFreeNotationTable:
2414  * @table:  An notation table
2415  *
2416  * Deallocate the memory used by an entities hash table.
2417  */
2418 void
xmlFreeNotationTable(xmlNotationTablePtr table)2419 xmlFreeNotationTable(xmlNotationTablePtr table) {
2420     xmlHashFree(table, (xmlHashDeallocator) xmlFreeNotation);
2421 }
2422 
2423 #ifdef LIBXML_TREE_ENABLED
2424 /**
2425  * xmlCopyNotation:
2426  * @nota:  A notation
2427  *
2428  * Build a copy of a notation.
2429  *
2430  * Returns the new xmlNotationPtr or NULL in case of error.
2431  */
2432 static xmlNotationPtr
xmlCopyNotation(xmlNotationPtr nota)2433 xmlCopyNotation(xmlNotationPtr nota) {
2434     xmlNotationPtr cur;
2435 
2436     cur = (xmlNotationPtr) xmlMalloc(sizeof(xmlNotation));
2437     if (cur == NULL) {
2438 	xmlVErrMemory(NULL, "malloc failed");
2439 	return(NULL);
2440     }
2441     if (nota->name != NULL)
2442 	cur->name = xmlStrdup(nota->name);
2443     else
2444 	cur->name = NULL;
2445     if (nota->PublicID != NULL)
2446 	cur->PublicID = xmlStrdup(nota->PublicID);
2447     else
2448 	cur->PublicID = NULL;
2449     if (nota->SystemID != NULL)
2450 	cur->SystemID = xmlStrdup(nota->SystemID);
2451     else
2452 	cur->SystemID = NULL;
2453     return(cur);
2454 }
2455 
2456 /**
2457  * xmlCopyNotationTable:
2458  * @table:  A notation table
2459  *
2460  * Build a copy of a notation table.
2461  *
2462  * Returns the new xmlNotationTablePtr or NULL in case of error.
2463  */
2464 xmlNotationTablePtr
xmlCopyNotationTable(xmlNotationTablePtr table)2465 xmlCopyNotationTable(xmlNotationTablePtr table) {
2466     return((xmlNotationTablePtr) xmlHashCopy(table,
2467 				    (xmlHashCopier) xmlCopyNotation));
2468 }
2469 #endif /* LIBXML_TREE_ENABLED */
2470 
2471 #ifdef LIBXML_OUTPUT_ENABLED
2472 /**
2473  * xmlDumpNotationDecl:
2474  * @buf:  the XML buffer output
2475  * @nota:  A notation declaration
2476  *
2477  * This will dump the content the notation declaration as an XML DTD definition
2478  */
2479 void
xmlDumpNotationDecl(xmlBufferPtr buf,xmlNotationPtr nota)2480 xmlDumpNotationDecl(xmlBufferPtr buf, xmlNotationPtr nota) {
2481     if ((buf == NULL) || (nota == NULL))
2482         return;
2483     xmlBufferWriteChar(buf, "<!NOTATION ");
2484     xmlBufferWriteCHAR(buf, nota->name);
2485     if (nota->PublicID != NULL) {
2486 	xmlBufferWriteChar(buf, " PUBLIC ");
2487 	xmlBufferWriteQuotedString(buf, nota->PublicID);
2488 	if (nota->SystemID != NULL) {
2489 	    xmlBufferWriteChar(buf, " ");
2490 	    xmlBufferWriteQuotedString(buf, nota->SystemID);
2491 	}
2492     } else {
2493 	xmlBufferWriteChar(buf, " SYSTEM ");
2494 	xmlBufferWriteQuotedString(buf, nota->SystemID);
2495     }
2496     xmlBufferWriteChar(buf, " >\n");
2497 }
2498 
2499 /**
2500  * xmlDumpNotationDeclScan:
2501  * @nota:  A notation declaration
2502  * @buf:  the XML buffer output
2503  *
2504  * This is called with the hash scan function, and just reverses args
2505  */
2506 static void
xmlDumpNotationDeclScan(xmlNotationPtr nota,xmlBufferPtr buf)2507 xmlDumpNotationDeclScan(xmlNotationPtr nota, xmlBufferPtr buf) {
2508     xmlDumpNotationDecl(buf, nota);
2509 }
2510 
2511 /**
2512  * xmlDumpNotationTable:
2513  * @buf:  the XML buffer output
2514  * @table:  A notation table
2515  *
2516  * This will dump the content of the notation table as an XML DTD definition
2517  */
2518 void
xmlDumpNotationTable(xmlBufferPtr buf,xmlNotationTablePtr table)2519 xmlDumpNotationTable(xmlBufferPtr buf, xmlNotationTablePtr table) {
2520     if ((buf == NULL) || (table == NULL))
2521         return;
2522     xmlHashScan(table, (xmlHashScanner) xmlDumpNotationDeclScan, buf);
2523 }
2524 #endif /* LIBXML_OUTPUT_ENABLED */
2525 
2526 /************************************************************************
2527  *									*
2528  *				IDs					*
2529  *									*
2530  ************************************************************************/
2531 /**
2532  * DICT_FREE:
2533  * @str:  a string
2534  *
2535  * Free a string if it is not owned by the "dict" dictionnary in the
2536  * current scope
2537  */
2538 #define DICT_FREE(str)						\
2539 	if ((str) && ((!dict) ||				\
2540 	    (xmlDictOwns(dict, (const xmlChar *)(str)) == 0)))	\
2541 	    xmlFree((char *)(str));
2542 
2543 /**
2544  * xmlFreeID:
2545  * @not:  A id
2546  *
2547  * Deallocate the memory used by an id definition
2548  */
2549 static void
xmlFreeID(xmlIDPtr id)2550 xmlFreeID(xmlIDPtr id) {
2551     xmlDictPtr dict = NULL;
2552 
2553     if (id == NULL) return;
2554 
2555     if (id->doc != NULL)
2556         dict = id->doc->dict;
2557 
2558     if (id->value != NULL)
2559 	DICT_FREE(id->value)
2560     if (id->name != NULL)
2561 	DICT_FREE(id->name)
2562     xmlFree(id);
2563 }
2564 
2565 
2566 /**
2567  * xmlAddID:
2568  * @ctxt:  the validation context
2569  * @doc:  pointer to the document
2570  * @value:  the value name
2571  * @attr:  the attribute holding the ID
2572  *
2573  * Register a new id declaration
2574  *
2575  * Returns NULL if not, otherwise the new xmlIDPtr
2576  */
2577 xmlIDPtr
xmlAddID(xmlValidCtxtPtr ctxt,xmlDocPtr doc,const xmlChar * value,xmlAttrPtr attr)2578 xmlAddID(xmlValidCtxtPtr ctxt, xmlDocPtr doc, const xmlChar *value,
2579          xmlAttrPtr attr) {
2580     xmlIDPtr ret;
2581     xmlIDTablePtr table;
2582 
2583     if (doc == NULL) {
2584 	return(NULL);
2585     }
2586     if (value == NULL) {
2587 	return(NULL);
2588     }
2589     if (attr == NULL) {
2590 	return(NULL);
2591     }
2592 
2593     /*
2594      * Create the ID table if needed.
2595      */
2596     table = (xmlIDTablePtr) doc->ids;
2597     if (table == NULL)  {
2598         doc->ids = table = xmlHashCreateDict(0, doc->dict);
2599     }
2600     if (table == NULL) {
2601 	xmlVErrMemory(ctxt,
2602 		"xmlAddID: Table creation failed!\n");
2603         return(NULL);
2604     }
2605 
2606     ret = (xmlIDPtr) xmlMalloc(sizeof(xmlID));
2607     if (ret == NULL) {
2608 	xmlVErrMemory(ctxt, "malloc failed");
2609 	return(NULL);
2610     }
2611 
2612     /*
2613      * fill the structure.
2614      */
2615     ret->value = xmlStrdup(value);
2616     ret->doc = doc;
2617     if ((ctxt != NULL) && (ctxt->vstateNr != 0)) {
2618 	/*
2619 	 * Operating in streaming mode, attr is gonna disapear
2620 	 */
2621 	if (doc->dict != NULL)
2622 	    ret->name = xmlDictLookup(doc->dict, attr->name, -1);
2623 	else
2624 	    ret->name = xmlStrdup(attr->name);
2625 	ret->attr = NULL;
2626     } else {
2627 	ret->attr = attr;
2628 	ret->name = NULL;
2629     }
2630     ret->lineno = xmlGetLineNo(attr->parent);
2631 
2632     if (xmlHashAddEntry(table, value, ret) < 0) {
2633 #ifdef LIBXML_VALID_ENABLED
2634 	/*
2635 	 * The id is already defined in this DTD.
2636 	 */
2637 	xmlErrValidNode(ctxt, attr->parent, XML_DTD_ID_REDEFINED,
2638 			"ID %s already defined\n", value, NULL, NULL);
2639 #endif /* LIBXML_VALID_ENABLED */
2640 	xmlFreeID(ret);
2641 	return(NULL);
2642     }
2643     if (attr != NULL)
2644 	attr->atype = XML_ATTRIBUTE_ID;
2645     return(ret);
2646 }
2647 
2648 /**
2649  * xmlFreeIDTable:
2650  * @table:  An id table
2651  *
2652  * Deallocate the memory used by an ID hash table.
2653  */
2654 void
xmlFreeIDTable(xmlIDTablePtr table)2655 xmlFreeIDTable(xmlIDTablePtr table) {
2656     xmlHashFree(table, (xmlHashDeallocator) xmlFreeID);
2657 }
2658 
2659 /**
2660  * xmlIsID:
2661  * @doc:  the document
2662  * @elem:  the element carrying the attribute
2663  * @attr:  the attribute
2664  *
2665  * Determine whether an attribute is of type ID. In case we have DTD(s)
2666  * then this is done if DTD loading has been requested. In the case
2667  * of HTML documents parsed with the HTML parser, then ID detection is
2668  * done systematically.
2669  *
2670  * Returns 0 or 1 depending on the lookup result
2671  */
2672 int
xmlIsID(xmlDocPtr doc,xmlNodePtr elem,xmlAttrPtr attr)2673 xmlIsID(xmlDocPtr doc, xmlNodePtr elem, xmlAttrPtr attr) {
2674     if ((attr == NULL) || (attr->name == NULL)) return(0);
2675     if ((attr->ns != NULL) && (attr->ns->prefix != NULL) &&
2676         (!strcmp((char *) attr->name, "id")) &&
2677         (!strcmp((char *) attr->ns->prefix, "xml")))
2678 	return(1);
2679     if (doc == NULL) return(0);
2680     if ((doc->intSubset == NULL) && (doc->extSubset == NULL) &&
2681         (doc->type != XML_HTML_DOCUMENT_NODE)) {
2682 	return(0);
2683     } else if (doc->type == XML_HTML_DOCUMENT_NODE) {
2684         if ((xmlStrEqual(BAD_CAST "id", attr->name)) ||
2685 	    ((xmlStrEqual(BAD_CAST "name", attr->name)) &&
2686 	    ((elem == NULL) || (xmlStrEqual(elem->name, BAD_CAST "a")))))
2687 	    return(1);
2688 	return(0);
2689     } else if (elem == NULL) {
2690 	return(0);
2691     } else {
2692 	xmlAttributePtr attrDecl = NULL;
2693 
2694 	xmlChar felem[50], fattr[50];
2695 	xmlChar *fullelemname, *fullattrname;
2696 
2697 	fullelemname = (elem->ns != NULL && elem->ns->prefix != NULL) ?
2698 	    xmlBuildQName(elem->name, elem->ns->prefix, felem, 50) :
2699 	    (xmlChar *)elem->name;
2700 
2701 	fullattrname = (attr->ns != NULL && attr->ns->prefix != NULL) ?
2702 	    xmlBuildQName(attr->name, attr->ns->prefix, fattr, 50) :
2703 	    (xmlChar *)attr->name;
2704 
2705 	if (fullelemname != NULL && fullattrname != NULL) {
2706 	    attrDecl = xmlGetDtdAttrDesc(doc->intSubset, fullelemname,
2707 		                         fullattrname);
2708 	    if ((attrDecl == NULL) && (doc->extSubset != NULL))
2709 		attrDecl = xmlGetDtdAttrDesc(doc->extSubset, fullelemname,
2710 					     fullattrname);
2711 	}
2712 
2713 	if ((fullattrname != fattr) && (fullattrname != attr->name))
2714 	    xmlFree(fullattrname);
2715 	if ((fullelemname != felem) && (fullelemname != elem->name))
2716 	    xmlFree(fullelemname);
2717 
2718         if ((attrDecl != NULL) && (attrDecl->atype == XML_ATTRIBUTE_ID))
2719 	    return(1);
2720     }
2721     return(0);
2722 }
2723 
2724 /**
2725  * xmlRemoveID:
2726  * @doc:  the document
2727  * @attr:  the attribute
2728  *
2729  * Remove the given attribute from the ID table maintained internally.
2730  *
2731  * Returns -1 if the lookup failed and 0 otherwise
2732  */
2733 int
xmlRemoveID(xmlDocPtr doc,xmlAttrPtr attr)2734 xmlRemoveID(xmlDocPtr doc, xmlAttrPtr attr) {
2735     xmlIDTablePtr table;
2736     xmlIDPtr id;
2737     xmlChar *ID;
2738 
2739     if (doc == NULL) return(-1);
2740     if (attr == NULL) return(-1);
2741 
2742     table = (xmlIDTablePtr) doc->ids;
2743     if (table == NULL)
2744         return(-1);
2745 
2746     ID = xmlNodeListGetString(doc, attr->children, 1);
2747     if (ID == NULL)
2748         return(-1);
2749 
2750     id = xmlHashLookup(table, ID);
2751     if (id == NULL || id->attr != attr) {
2752         xmlFree(ID);
2753         return(-1);
2754     }
2755 
2756     xmlHashRemoveEntry(table, ID, (xmlHashDeallocator) xmlFreeID);
2757     xmlFree(ID);
2758     attr->atype = 0;
2759     return(0);
2760 }
2761 
2762 /**
2763  * xmlGetID:
2764  * @doc:  pointer to the document
2765  * @ID:  the ID value
2766  *
2767  * Search the attribute declaring the given ID
2768  *
2769  * Returns NULL if not found, otherwise the xmlAttrPtr defining the ID
2770  */
2771 xmlAttrPtr
xmlGetID(xmlDocPtr doc,const xmlChar * ID)2772 xmlGetID(xmlDocPtr doc, const xmlChar *ID) {
2773     xmlIDTablePtr table;
2774     xmlIDPtr id;
2775 
2776     if (doc == NULL) {
2777 	return(NULL);
2778     }
2779 
2780     if (ID == NULL) {
2781 	return(NULL);
2782     }
2783 
2784     table = (xmlIDTablePtr) doc->ids;
2785     if (table == NULL)
2786         return(NULL);
2787 
2788     id = xmlHashLookup(table, ID);
2789     if (id == NULL)
2790 	return(NULL);
2791     if (id->attr == NULL) {
2792 	/*
2793 	 * We are operating on a stream, return a well known reference
2794 	 * since the attribute node doesn't exist anymore
2795 	 */
2796 	return((xmlAttrPtr) doc);
2797     }
2798     return(id->attr);
2799 }
2800 
2801 /************************************************************************
2802  *									*
2803  *				Refs					*
2804  *									*
2805  ************************************************************************/
2806 typedef struct xmlRemoveMemo_t
2807 {
2808 	xmlListPtr l;
2809 	xmlAttrPtr ap;
2810 } xmlRemoveMemo;
2811 
2812 typedef xmlRemoveMemo *xmlRemoveMemoPtr;
2813 
2814 typedef struct xmlValidateMemo_t
2815 {
2816     xmlValidCtxtPtr ctxt;
2817     const xmlChar *name;
2818 } xmlValidateMemo;
2819 
2820 typedef xmlValidateMemo *xmlValidateMemoPtr;
2821 
2822 /**
2823  * xmlFreeRef:
2824  * @lk:  A list link
2825  *
2826  * Deallocate the memory used by a ref definition
2827  */
2828 static void
xmlFreeRef(xmlLinkPtr lk)2829 xmlFreeRef(xmlLinkPtr lk) {
2830     xmlRefPtr ref = (xmlRefPtr)xmlLinkGetData(lk);
2831     if (ref == NULL) return;
2832     if (ref->value != NULL)
2833         xmlFree((xmlChar *)ref->value);
2834     if (ref->name != NULL)
2835         xmlFree((xmlChar *)ref->name);
2836     xmlFree(ref);
2837 }
2838 
2839 /**
2840  * xmlFreeRefList:
2841  * @list_ref:  A list of references.
2842  *
2843  * Deallocate the memory used by a list of references
2844  */
2845 static void
xmlFreeRefList(xmlListPtr list_ref)2846 xmlFreeRefList(xmlListPtr list_ref) {
2847     if (list_ref == NULL) return;
2848     xmlListDelete(list_ref);
2849 }
2850 
2851 /**
2852  * xmlWalkRemoveRef:
2853  * @data:  Contents of current link
2854  * @user:  Value supplied by the user
2855  *
2856  * Returns 0 to abort the walk or 1 to continue
2857  */
2858 static int
xmlWalkRemoveRef(const void * data,const void * user)2859 xmlWalkRemoveRef(const void *data, const void *user)
2860 {
2861     xmlAttrPtr attr0 = ((xmlRefPtr)data)->attr;
2862     xmlAttrPtr attr1 = ((xmlRemoveMemoPtr)user)->ap;
2863     xmlListPtr ref_list = ((xmlRemoveMemoPtr)user)->l;
2864 
2865     if (attr0 == attr1) { /* Matched: remove and terminate walk */
2866         xmlListRemoveFirst(ref_list, (void *)data);
2867         return 0;
2868     }
2869     return 1;
2870 }
2871 
2872 /**
2873  * xmlDummyCompare
2874  * @data0:  Value supplied by the user
2875  * @data1:  Value supplied by the user
2876  *
2877  * Do nothing, return 0. Used to create unordered lists.
2878  */
2879 static int
xmlDummyCompare(const void * data0 ATTRIBUTE_UNUSED,const void * data1 ATTRIBUTE_UNUSED)2880 xmlDummyCompare(const void *data0 ATTRIBUTE_UNUSED,
2881                 const void *data1 ATTRIBUTE_UNUSED)
2882 {
2883     return (0);
2884 }
2885 
2886 /**
2887  * xmlAddRef:
2888  * @ctxt:  the validation context
2889  * @doc:  pointer to the document
2890  * @value:  the value name
2891  * @attr:  the attribute holding the Ref
2892  *
2893  * Register a new ref declaration
2894  *
2895  * Returns NULL if not, otherwise the new xmlRefPtr
2896  */
2897 xmlRefPtr
xmlAddRef(xmlValidCtxtPtr ctxt,xmlDocPtr doc,const xmlChar * value,xmlAttrPtr attr)2898 xmlAddRef(xmlValidCtxtPtr ctxt, xmlDocPtr doc, const xmlChar *value,
2899     xmlAttrPtr attr) {
2900     xmlRefPtr ret;
2901     xmlRefTablePtr table;
2902     xmlListPtr ref_list;
2903 
2904     if (doc == NULL) {
2905         return(NULL);
2906     }
2907     if (value == NULL) {
2908         return(NULL);
2909     }
2910     if (attr == NULL) {
2911         return(NULL);
2912     }
2913 
2914     /*
2915      * Create the Ref table if needed.
2916      */
2917     table = (xmlRefTablePtr) doc->refs;
2918     if (table == NULL) {
2919         doc->refs = table = xmlHashCreateDict(0, doc->dict);
2920     }
2921     if (table == NULL) {
2922 	xmlVErrMemory(ctxt,
2923             "xmlAddRef: Table creation failed!\n");
2924         return(NULL);
2925     }
2926 
2927     ret = (xmlRefPtr) xmlMalloc(sizeof(xmlRef));
2928     if (ret == NULL) {
2929 	xmlVErrMemory(ctxt, "malloc failed");
2930         return(NULL);
2931     }
2932 
2933     /*
2934      * fill the structure.
2935      */
2936     ret->value = xmlStrdup(value);
2937     if ((ctxt != NULL) && (ctxt->vstateNr != 0)) {
2938 	/*
2939 	 * Operating in streaming mode, attr is gonna disapear
2940 	 */
2941 	ret->name = xmlStrdup(attr->name);
2942 	ret->attr = NULL;
2943     } else {
2944 	ret->name = NULL;
2945 	ret->attr = attr;
2946     }
2947     ret->lineno = xmlGetLineNo(attr->parent);
2948 
2949     /* To add a reference :-
2950      * References are maintained as a list of references,
2951      * Lookup the entry, if no entry create new nodelist
2952      * Add the owning node to the NodeList
2953      * Return the ref
2954      */
2955 
2956     if (NULL == (ref_list = xmlHashLookup(table, value))) {
2957         if (NULL == (ref_list = xmlListCreate(xmlFreeRef, xmlDummyCompare))) {
2958 	    xmlErrValid(NULL, XML_ERR_INTERNAL_ERROR,
2959 		    "xmlAddRef: Reference list creation failed!\n",
2960 		    NULL);
2961 	    goto failed;
2962         }
2963         if (xmlHashAddEntry(table, value, ref_list) < 0) {
2964             xmlListDelete(ref_list);
2965 	    xmlErrValid(NULL, XML_ERR_INTERNAL_ERROR,
2966 		    "xmlAddRef: Reference list insertion failed!\n",
2967 		    NULL);
2968 	    goto failed;
2969         }
2970     }
2971     if (xmlListAppend(ref_list, ret) != 0) {
2972 	xmlErrValid(NULL, XML_ERR_INTERNAL_ERROR,
2973 		    "xmlAddRef: Reference list insertion failed!\n",
2974 		    NULL);
2975         goto failed;
2976     }
2977     return(ret);
2978 failed:
2979     if (ret != NULL) {
2980         if (ret->value != NULL)
2981 	    xmlFree((char *)ret->value);
2982         if (ret->name != NULL)
2983 	    xmlFree((char *)ret->name);
2984         xmlFree(ret);
2985     }
2986     return(NULL);
2987 }
2988 
2989 /**
2990  * xmlFreeRefTable:
2991  * @table:  An ref table
2992  *
2993  * Deallocate the memory used by an Ref hash table.
2994  */
2995 void
xmlFreeRefTable(xmlRefTablePtr table)2996 xmlFreeRefTable(xmlRefTablePtr table) {
2997     xmlHashFree(table, (xmlHashDeallocator) xmlFreeRefList);
2998 }
2999 
3000 /**
3001  * xmlIsRef:
3002  * @doc:  the document
3003  * @elem:  the element carrying the attribute
3004  * @attr:  the attribute
3005  *
3006  * Determine whether an attribute is of type Ref. In case we have DTD(s)
3007  * then this is simple, otherwise we use an heuristic: name Ref (upper
3008  * or lowercase).
3009  *
3010  * Returns 0 or 1 depending on the lookup result
3011  */
3012 int
xmlIsRef(xmlDocPtr doc,xmlNodePtr elem,xmlAttrPtr attr)3013 xmlIsRef(xmlDocPtr doc, xmlNodePtr elem, xmlAttrPtr attr) {
3014     if (attr == NULL)
3015         return(0);
3016     if (doc == NULL) {
3017         doc = attr->doc;
3018 	if (doc == NULL) return(0);
3019     }
3020 
3021     if ((doc->intSubset == NULL) && (doc->extSubset == NULL)) {
3022         return(0);
3023     } else if (doc->type == XML_HTML_DOCUMENT_NODE) {
3024         /* TODO @@@ */
3025         return(0);
3026     } else {
3027         xmlAttributePtr attrDecl;
3028 
3029         if (elem == NULL) return(0);
3030         attrDecl = xmlGetDtdAttrDesc(doc->intSubset, elem->name, attr->name);
3031         if ((attrDecl == NULL) && (doc->extSubset != NULL))
3032             attrDecl = xmlGetDtdAttrDesc(doc->extSubset,
3033 		                         elem->name, attr->name);
3034 
3035 	if ((attrDecl != NULL) &&
3036 	    (attrDecl->atype == XML_ATTRIBUTE_IDREF ||
3037 	     attrDecl->atype == XML_ATTRIBUTE_IDREFS))
3038 	return(1);
3039     }
3040     return(0);
3041 }
3042 
3043 /**
3044  * xmlRemoveRef:
3045  * @doc:  the document
3046  * @attr:  the attribute
3047  *
3048  * Remove the given attribute from the Ref table maintained internally.
3049  *
3050  * Returns -1 if the lookup failed and 0 otherwise
3051  */
3052 int
xmlRemoveRef(xmlDocPtr doc,xmlAttrPtr attr)3053 xmlRemoveRef(xmlDocPtr doc, xmlAttrPtr attr) {
3054     xmlListPtr ref_list;
3055     xmlRefTablePtr table;
3056     xmlChar *ID;
3057     xmlRemoveMemo target;
3058 
3059     if (doc == NULL) return(-1);
3060     if (attr == NULL) return(-1);
3061 
3062     table = (xmlRefTablePtr) doc->refs;
3063     if (table == NULL)
3064         return(-1);
3065 
3066     ID = xmlNodeListGetString(doc, attr->children, 1);
3067     if (ID == NULL)
3068         return(-1);
3069 
3070     ref_list = xmlHashLookup(table, ID);
3071     if(ref_list == NULL) {
3072         xmlFree(ID);
3073         return (-1);
3074     }
3075 
3076     /* At this point, ref_list refers to a list of references which
3077      * have the same key as the supplied attr. Our list of references
3078      * is ordered by reference address and we don't have that information
3079      * here to use when removing. We'll have to walk the list and
3080      * check for a matching attribute, when we find one stop the walk
3081      * and remove the entry.
3082      * The list is ordered by reference, so that means we don't have the
3083      * key. Passing the list and the reference to the walker means we
3084      * will have enough data to be able to remove the entry.
3085      */
3086     target.l = ref_list;
3087     target.ap = attr;
3088 
3089     /* Remove the supplied attr from our list */
3090     xmlListWalk(ref_list, xmlWalkRemoveRef, &target);
3091 
3092     /*If the list is empty then remove the list entry in the hash */
3093     if (xmlListEmpty(ref_list))
3094         xmlHashUpdateEntry(table, ID, NULL, (xmlHashDeallocator)
3095         xmlFreeRefList);
3096     xmlFree(ID);
3097     return(0);
3098 }
3099 
3100 /**
3101  * xmlGetRefs:
3102  * @doc:  pointer to the document
3103  * @ID:  the ID value
3104  *
3105  * Find the set of references for the supplied ID.
3106  *
3107  * Returns NULL if not found, otherwise node set for the ID.
3108  */
3109 xmlListPtr
xmlGetRefs(xmlDocPtr doc,const xmlChar * ID)3110 xmlGetRefs(xmlDocPtr doc, const xmlChar *ID) {
3111     xmlRefTablePtr table;
3112 
3113     if (doc == NULL) {
3114         return(NULL);
3115     }
3116 
3117     if (ID == NULL) {
3118         return(NULL);
3119     }
3120 
3121     table = (xmlRefTablePtr) doc->refs;
3122     if (table == NULL)
3123         return(NULL);
3124 
3125     return (xmlHashLookup(table, ID));
3126 }
3127 
3128 /************************************************************************
3129  *									*
3130  *		Routines for validity checking				*
3131  *									*
3132  ************************************************************************/
3133 
3134 /**
3135  * xmlGetDtdElementDesc:
3136  * @dtd:  a pointer to the DtD to search
3137  * @name:  the element name
3138  *
3139  * Search the DTD for the description of this element
3140  *
3141  * returns the xmlElementPtr if found or NULL
3142  */
3143 
3144 xmlElementPtr
xmlGetDtdElementDesc(xmlDtdPtr dtd,const xmlChar * name)3145 xmlGetDtdElementDesc(xmlDtdPtr dtd, const xmlChar *name) {
3146     xmlElementTablePtr table;
3147     xmlElementPtr cur;
3148     xmlChar *uqname = NULL, *prefix = NULL;
3149 
3150     if ((dtd == NULL) || (name == NULL)) return(NULL);
3151     if (dtd->elements == NULL)
3152 	return(NULL);
3153     table = (xmlElementTablePtr) dtd->elements;
3154 
3155     uqname = xmlSplitQName2(name, &prefix);
3156     if (uqname != NULL)
3157         name = uqname;
3158     cur = xmlHashLookup2(table, name, prefix);
3159     if (prefix != NULL) xmlFree(prefix);
3160     if (uqname != NULL) xmlFree(uqname);
3161     return(cur);
3162 }
3163 /**
3164  * xmlGetDtdElementDesc2:
3165  * @dtd:  a pointer to the DtD to search
3166  * @name:  the element name
3167  * @create:  create an empty description if not found
3168  *
3169  * Search the DTD for the description of this element
3170  *
3171  * returns the xmlElementPtr if found or NULL
3172  */
3173 
3174 static xmlElementPtr
xmlGetDtdElementDesc2(xmlDtdPtr dtd,const xmlChar * name,int create)3175 xmlGetDtdElementDesc2(xmlDtdPtr dtd, const xmlChar *name, int create) {
3176     xmlElementTablePtr table;
3177     xmlElementPtr cur;
3178     xmlChar *uqname = NULL, *prefix = NULL;
3179 
3180     if (dtd == NULL) return(NULL);
3181     if (dtd->elements == NULL) {
3182 	xmlDictPtr dict = NULL;
3183 
3184 	if (dtd->doc != NULL)
3185 	    dict = dtd->doc->dict;
3186 
3187 	if (!create)
3188 	    return(NULL);
3189 	/*
3190 	 * Create the Element table if needed.
3191 	 */
3192 	table = (xmlElementTablePtr) dtd->elements;
3193 	if (table == NULL) {
3194 	    table = xmlHashCreateDict(0, dict);
3195 	    dtd->elements = (void *) table;
3196 	}
3197 	if (table == NULL) {
3198 	    xmlVErrMemory(NULL, "element table allocation failed");
3199 	    return(NULL);
3200 	}
3201     }
3202     table = (xmlElementTablePtr) dtd->elements;
3203 
3204     uqname = xmlSplitQName2(name, &prefix);
3205     if (uqname != NULL)
3206         name = uqname;
3207     cur = xmlHashLookup2(table, name, prefix);
3208     if ((cur == NULL) && (create)) {
3209 	cur = (xmlElementPtr) xmlMalloc(sizeof(xmlElement));
3210 	if (cur == NULL) {
3211 	    xmlVErrMemory(NULL, "malloc failed");
3212 	    return(NULL);
3213 	}
3214 	memset(cur, 0, sizeof(xmlElement));
3215 	cur->type = XML_ELEMENT_DECL;
3216 
3217 	/*
3218 	 * fill the structure.
3219 	 */
3220 	cur->name = xmlStrdup(name);
3221 	cur->prefix = xmlStrdup(prefix);
3222 	cur->etype = XML_ELEMENT_TYPE_UNDEFINED;
3223 
3224 	xmlHashAddEntry2(table, name, prefix, cur);
3225     }
3226     if (prefix != NULL) xmlFree(prefix);
3227     if (uqname != NULL) xmlFree(uqname);
3228     return(cur);
3229 }
3230 
3231 /**
3232  * xmlGetDtdQElementDesc:
3233  * @dtd:  a pointer to the DtD to search
3234  * @name:  the element name
3235  * @prefix:  the element namespace prefix
3236  *
3237  * Search the DTD for the description of this element
3238  *
3239  * returns the xmlElementPtr if found or NULL
3240  */
3241 
3242 xmlElementPtr
xmlGetDtdQElementDesc(xmlDtdPtr dtd,const xmlChar * name,const xmlChar * prefix)3243 xmlGetDtdQElementDesc(xmlDtdPtr dtd, const xmlChar *name,
3244 	              const xmlChar *prefix) {
3245     xmlElementTablePtr table;
3246 
3247     if (dtd == NULL) return(NULL);
3248     if (dtd->elements == NULL) return(NULL);
3249     table = (xmlElementTablePtr) dtd->elements;
3250 
3251     return(xmlHashLookup2(table, name, prefix));
3252 }
3253 
3254 /**
3255  * xmlGetDtdAttrDesc:
3256  * @dtd:  a pointer to the DtD to search
3257  * @elem:  the element name
3258  * @name:  the attribute name
3259  *
3260  * Search the DTD for the description of this attribute on
3261  * this element.
3262  *
3263  * returns the xmlAttributePtr if found or NULL
3264  */
3265 
3266 xmlAttributePtr
xmlGetDtdAttrDesc(xmlDtdPtr dtd,const xmlChar * elem,const xmlChar * name)3267 xmlGetDtdAttrDesc(xmlDtdPtr dtd, const xmlChar *elem, const xmlChar *name) {
3268     xmlAttributeTablePtr table;
3269     xmlAttributePtr cur;
3270     xmlChar *uqname = NULL, *prefix = NULL;
3271 
3272     if (dtd == NULL) return(NULL);
3273     if (dtd->attributes == NULL) return(NULL);
3274 
3275     table = (xmlAttributeTablePtr) dtd->attributes;
3276     if (table == NULL)
3277 	return(NULL);
3278 
3279     uqname = xmlSplitQName2(name, &prefix);
3280 
3281     if (uqname != NULL) {
3282 	cur = xmlHashLookup3(table, uqname, prefix, elem);
3283 	if (prefix != NULL) xmlFree(prefix);
3284 	if (uqname != NULL) xmlFree(uqname);
3285     } else
3286 	cur = xmlHashLookup3(table, name, NULL, elem);
3287     return(cur);
3288 }
3289 
3290 /**
3291  * xmlGetDtdQAttrDesc:
3292  * @dtd:  a pointer to the DtD to search
3293  * @elem:  the element name
3294  * @name:  the attribute name
3295  * @prefix:  the attribute namespace prefix
3296  *
3297  * Search the DTD for the description of this qualified attribute on
3298  * this element.
3299  *
3300  * returns the xmlAttributePtr if found or NULL
3301  */
3302 
3303 xmlAttributePtr
xmlGetDtdQAttrDesc(xmlDtdPtr dtd,const xmlChar * elem,const xmlChar * name,const xmlChar * prefix)3304 xmlGetDtdQAttrDesc(xmlDtdPtr dtd, const xmlChar *elem, const xmlChar *name,
3305 	          const xmlChar *prefix) {
3306     xmlAttributeTablePtr table;
3307 
3308     if (dtd == NULL) return(NULL);
3309     if (dtd->attributes == NULL) return(NULL);
3310     table = (xmlAttributeTablePtr) dtd->attributes;
3311 
3312     return(xmlHashLookup3(table, name, prefix, elem));
3313 }
3314 
3315 /**
3316  * xmlGetDtdNotationDesc:
3317  * @dtd:  a pointer to the DtD to search
3318  * @name:  the notation name
3319  *
3320  * Search the DTD for the description of this notation
3321  *
3322  * returns the xmlNotationPtr if found or NULL
3323  */
3324 
3325 xmlNotationPtr
xmlGetDtdNotationDesc(xmlDtdPtr dtd,const xmlChar * name)3326 xmlGetDtdNotationDesc(xmlDtdPtr dtd, const xmlChar *name) {
3327     xmlNotationTablePtr table;
3328 
3329     if (dtd == NULL) return(NULL);
3330     if (dtd->notations == NULL) return(NULL);
3331     table = (xmlNotationTablePtr) dtd->notations;
3332 
3333     return(xmlHashLookup(table, name));
3334 }
3335 
3336 #if defined(LIBXML_VALID_ENABLED) || defined(LIBXML_SCHEMAS_ENABLED)
3337 /**
3338  * xmlValidateNotationUse:
3339  * @ctxt:  the validation context
3340  * @doc:  the document
3341  * @notationName:  the notation name to check
3342  *
3343  * Validate that the given name match a notation declaration.
3344  * - [ VC: Notation Declared ]
3345  *
3346  * returns 1 if valid or 0 otherwise
3347  */
3348 
3349 int
xmlValidateNotationUse(xmlValidCtxtPtr ctxt,xmlDocPtr doc,const xmlChar * notationName)3350 xmlValidateNotationUse(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
3351                        const xmlChar *notationName) {
3352     xmlNotationPtr notaDecl;
3353     if ((doc == NULL) || (doc->intSubset == NULL) ||
3354         (notationName == NULL)) return(-1);
3355 
3356     notaDecl = xmlGetDtdNotationDesc(doc->intSubset, notationName);
3357     if ((notaDecl == NULL) && (doc->extSubset != NULL))
3358 	notaDecl = xmlGetDtdNotationDesc(doc->extSubset, notationName);
3359 
3360     if ((notaDecl == NULL) && (ctxt != NULL)) {
3361 	xmlErrValidNode(ctxt, (xmlNodePtr) doc, XML_DTD_UNKNOWN_NOTATION,
3362 	                "NOTATION %s is not declared\n",
3363 		        notationName, NULL, NULL);
3364 	return(0);
3365     }
3366     return(1);
3367 }
3368 #endif /* LIBXML_VALID_ENABLED or LIBXML_SCHEMAS_ENABLED */
3369 
3370 /**
3371  * xmlIsMixedElement:
3372  * @doc:  the document
3373  * @name:  the element name
3374  *
3375  * Search in the DtDs whether an element accept Mixed content (or ANY)
3376  * basically if it is supposed to accept text childs
3377  *
3378  * returns 0 if no, 1 if yes, and -1 if no element description is available
3379  */
3380 
3381 int
xmlIsMixedElement(xmlDocPtr doc,const xmlChar * name)3382 xmlIsMixedElement(xmlDocPtr doc, const xmlChar *name) {
3383     xmlElementPtr elemDecl;
3384 
3385     if ((doc == NULL) || (doc->intSubset == NULL)) return(-1);
3386 
3387     elemDecl = xmlGetDtdElementDesc(doc->intSubset, name);
3388     if ((elemDecl == NULL) && (doc->extSubset != NULL))
3389 	elemDecl = xmlGetDtdElementDesc(doc->extSubset, name);
3390     if (elemDecl == NULL) return(-1);
3391     switch (elemDecl->etype) {
3392 	case XML_ELEMENT_TYPE_UNDEFINED:
3393 	    return(-1);
3394 	case XML_ELEMENT_TYPE_ELEMENT:
3395 	    return(0);
3396         case XML_ELEMENT_TYPE_EMPTY:
3397 	    /*
3398 	     * return 1 for EMPTY since we want VC error to pop up
3399 	     * on <empty>     </empty> for example
3400 	     */
3401 	case XML_ELEMENT_TYPE_ANY:
3402 	case XML_ELEMENT_TYPE_MIXED:
3403 	    return(1);
3404     }
3405     return(1);
3406 }
3407 
3408 #ifdef LIBXML_VALID_ENABLED
3409 
3410 static int
xmlIsDocNameStartChar(xmlDocPtr doc,int c)3411 xmlIsDocNameStartChar(xmlDocPtr doc, int c) {
3412     if ((doc == NULL) || (doc->properties & XML_DOC_OLD10) == 0) {
3413         /*
3414 	 * Use the new checks of production [4] [4a] amd [5] of the
3415 	 * Update 5 of XML-1.0
3416 	 */
3417 	if (((c >= 'a') && (c <= 'z')) ||
3418 	    ((c >= 'A') && (c <= 'Z')) ||
3419 	    (c == '_') || (c == ':') ||
3420 	    ((c >= 0xC0) && (c <= 0xD6)) ||
3421 	    ((c >= 0xD8) && (c <= 0xF6)) ||
3422 	    ((c >= 0xF8) && (c <= 0x2FF)) ||
3423 	    ((c >= 0x370) && (c <= 0x37D)) ||
3424 	    ((c >= 0x37F) && (c <= 0x1FFF)) ||
3425 	    ((c >= 0x200C) && (c <= 0x200D)) ||
3426 	    ((c >= 0x2070) && (c <= 0x218F)) ||
3427 	    ((c >= 0x2C00) && (c <= 0x2FEF)) ||
3428 	    ((c >= 0x3001) && (c <= 0xD7FF)) ||
3429 	    ((c >= 0xF900) && (c <= 0xFDCF)) ||
3430 	    ((c >= 0xFDF0) && (c <= 0xFFFD)) ||
3431 	    ((c >= 0x10000) && (c <= 0xEFFFF)))
3432 	    return(1);
3433     } else {
3434         if (IS_LETTER(c) || (c == '_') || (c == ':'))
3435 	    return(1);
3436     }
3437     return(0);
3438 }
3439 
3440 static int
xmlIsDocNameChar(xmlDocPtr doc,int c)3441 xmlIsDocNameChar(xmlDocPtr doc, int c) {
3442     if ((doc == NULL) || (doc->properties & XML_DOC_OLD10) == 0) {
3443         /*
3444 	 * Use the new checks of production [4] [4a] amd [5] of the
3445 	 * Update 5 of XML-1.0
3446 	 */
3447 	if (((c >= 'a') && (c <= 'z')) ||
3448 	    ((c >= 'A') && (c <= 'Z')) ||
3449 	    ((c >= '0') && (c <= '9')) || /* !start */
3450 	    (c == '_') || (c == ':') ||
3451 	    (c == '-') || (c == '.') || (c == 0xB7) || /* !start */
3452 	    ((c >= 0xC0) && (c <= 0xD6)) ||
3453 	    ((c >= 0xD8) && (c <= 0xF6)) ||
3454 	    ((c >= 0xF8) && (c <= 0x2FF)) ||
3455 	    ((c >= 0x300) && (c <= 0x36F)) || /* !start */
3456 	    ((c >= 0x370) && (c <= 0x37D)) ||
3457 	    ((c >= 0x37F) && (c <= 0x1FFF)) ||
3458 	    ((c >= 0x200C) && (c <= 0x200D)) ||
3459 	    ((c >= 0x203F) && (c <= 0x2040)) || /* !start */
3460 	    ((c >= 0x2070) && (c <= 0x218F)) ||
3461 	    ((c >= 0x2C00) && (c <= 0x2FEF)) ||
3462 	    ((c >= 0x3001) && (c <= 0xD7FF)) ||
3463 	    ((c >= 0xF900) && (c <= 0xFDCF)) ||
3464 	    ((c >= 0xFDF0) && (c <= 0xFFFD)) ||
3465 	    ((c >= 0x10000) && (c <= 0xEFFFF)))
3466 	     return(1);
3467     } else {
3468         if ((IS_LETTER(c)) || (IS_DIGIT(c)) ||
3469             (c == '.') || (c == '-') ||
3470 	    (c == '_') || (c == ':') ||
3471 	    (IS_COMBINING(c)) ||
3472 	    (IS_EXTENDER(c)))
3473 	    return(1);
3474     }
3475     return(0);
3476 }
3477 
3478 /**
3479  * xmlValidateNameValue:
3480  * @doc:  pointer to the document or NULL
3481  * @value:  an Name value
3482  *
3483  * Validate that the given value match Name production
3484  *
3485  * returns 1 if valid or 0 otherwise
3486  */
3487 
3488 static int
xmlValidateNameValueInternal(xmlDocPtr doc,const xmlChar * value)3489 xmlValidateNameValueInternal(xmlDocPtr doc, const xmlChar *value) {
3490     const xmlChar *cur;
3491     int val, len;
3492 
3493     if (value == NULL) return(0);
3494     cur = value;
3495     val = xmlStringCurrentChar(NULL, cur, &len);
3496     cur += len;
3497     if (!xmlIsDocNameStartChar(doc, val))
3498 	return(0);
3499 
3500     val = xmlStringCurrentChar(NULL, cur, &len);
3501     cur += len;
3502     while (xmlIsDocNameChar(doc, val)) {
3503 	val = xmlStringCurrentChar(NULL, cur, &len);
3504 	cur += len;
3505     }
3506 
3507     if (val != 0) return(0);
3508 
3509     return(1);
3510 }
3511 
3512 /**
3513  * xmlValidateNameValue:
3514  * @value:  an Name value
3515  *
3516  * Validate that the given value match Name production
3517  *
3518  * returns 1 if valid or 0 otherwise
3519  */
3520 
3521 int
xmlValidateNameValue(const xmlChar * value)3522 xmlValidateNameValue(const xmlChar *value) {
3523     return(xmlValidateNameValueInternal(NULL, value));
3524 }
3525 
3526 /**
3527  * xmlValidateNamesValueInternal:
3528  * @doc:  pointer to the document or NULL
3529  * @value:  an Names value
3530  *
3531  * Validate that the given value match Names production
3532  *
3533  * returns 1 if valid or 0 otherwise
3534  */
3535 
3536 static int
xmlValidateNamesValueInternal(xmlDocPtr doc,const xmlChar * value)3537 xmlValidateNamesValueInternal(xmlDocPtr doc, const xmlChar *value) {
3538     const xmlChar *cur;
3539     int val, len;
3540 
3541     if (value == NULL) return(0);
3542     cur = value;
3543     val = xmlStringCurrentChar(NULL, cur, &len);
3544     cur += len;
3545 
3546     if (!xmlIsDocNameStartChar(doc, val))
3547 	return(0);
3548 
3549     val = xmlStringCurrentChar(NULL, cur, &len);
3550     cur += len;
3551     while (xmlIsDocNameChar(doc, val)) {
3552 	val = xmlStringCurrentChar(NULL, cur, &len);
3553 	cur += len;
3554     }
3555 
3556     /* Should not test IS_BLANK(val) here -- see erratum E20*/
3557     while (val == 0x20) {
3558 	while (val == 0x20) {
3559 	    val = xmlStringCurrentChar(NULL, cur, &len);
3560 	    cur += len;
3561 	}
3562 
3563 	if (!xmlIsDocNameStartChar(doc, val))
3564 	    return(0);
3565 
3566 	val = xmlStringCurrentChar(NULL, cur, &len);
3567 	cur += len;
3568 
3569 	while (xmlIsDocNameChar(doc, val)) {
3570 	    val = xmlStringCurrentChar(NULL, cur, &len);
3571 	    cur += len;
3572 	}
3573     }
3574 
3575     if (val != 0) return(0);
3576 
3577     return(1);
3578 }
3579 
3580 /**
3581  * xmlValidateNamesValue:
3582  * @value:  an Names value
3583  *
3584  * Validate that the given value match Names production
3585  *
3586  * returns 1 if valid or 0 otherwise
3587  */
3588 
3589 int
xmlValidateNamesValue(const xmlChar * value)3590 xmlValidateNamesValue(const xmlChar *value) {
3591     return(xmlValidateNamesValueInternal(NULL, value));
3592 }
3593 
3594 /**
3595  * xmlValidateNmtokenValueInternal:
3596  * @doc:  pointer to the document or NULL
3597  * @value:  an Nmtoken value
3598  *
3599  * Validate that the given value match Nmtoken production
3600  *
3601  * [ VC: Name Token ]
3602  *
3603  * returns 1 if valid or 0 otherwise
3604  */
3605 
3606 static int
xmlValidateNmtokenValueInternal(xmlDocPtr doc,const xmlChar * value)3607 xmlValidateNmtokenValueInternal(xmlDocPtr doc, const xmlChar *value) {
3608     const xmlChar *cur;
3609     int val, len;
3610 
3611     if (value == NULL) return(0);
3612     cur = value;
3613     val = xmlStringCurrentChar(NULL, cur, &len);
3614     cur += len;
3615 
3616     if (!xmlIsDocNameChar(doc, val))
3617 	return(0);
3618 
3619     val = xmlStringCurrentChar(NULL, cur, &len);
3620     cur += len;
3621     while (xmlIsDocNameChar(doc, val)) {
3622 	val = xmlStringCurrentChar(NULL, cur, &len);
3623 	cur += len;
3624     }
3625 
3626     if (val != 0) return(0);
3627 
3628     return(1);
3629 }
3630 
3631 /**
3632  * xmlValidateNmtokenValue:
3633  * @value:  an Nmtoken value
3634  *
3635  * Validate that the given value match Nmtoken production
3636  *
3637  * [ VC: Name Token ]
3638  *
3639  * returns 1 if valid or 0 otherwise
3640  */
3641 
3642 int
xmlValidateNmtokenValue(const xmlChar * value)3643 xmlValidateNmtokenValue(const xmlChar *value) {
3644     return(xmlValidateNmtokenValueInternal(NULL, value));
3645 }
3646 
3647 /**
3648  * xmlValidateNmtokensValueInternal:
3649  * @doc:  pointer to the document or NULL
3650  * @value:  an Nmtokens value
3651  *
3652  * Validate that the given value match Nmtokens production
3653  *
3654  * [ VC: Name Token ]
3655  *
3656  * returns 1 if valid or 0 otherwise
3657  */
3658 
3659 static int
xmlValidateNmtokensValueInternal(xmlDocPtr doc,const xmlChar * value)3660 xmlValidateNmtokensValueInternal(xmlDocPtr doc, const xmlChar *value) {
3661     const xmlChar *cur;
3662     int val, len;
3663 
3664     if (value == NULL) return(0);
3665     cur = value;
3666     val = xmlStringCurrentChar(NULL, cur, &len);
3667     cur += len;
3668 
3669     while (IS_BLANK(val)) {
3670 	val = xmlStringCurrentChar(NULL, cur, &len);
3671 	cur += len;
3672     }
3673 
3674     if (!xmlIsDocNameChar(doc, val))
3675 	return(0);
3676 
3677     while (xmlIsDocNameChar(doc, val)) {
3678 	val = xmlStringCurrentChar(NULL, cur, &len);
3679 	cur += len;
3680     }
3681 
3682     /* Should not test IS_BLANK(val) here -- see erratum E20*/
3683     while (val == 0x20) {
3684 	while (val == 0x20) {
3685 	    val = xmlStringCurrentChar(NULL, cur, &len);
3686 	    cur += len;
3687 	}
3688 	if (val == 0) return(1);
3689 
3690 	if (!xmlIsDocNameChar(doc, val))
3691 	    return(0);
3692 
3693 	val = xmlStringCurrentChar(NULL, cur, &len);
3694 	cur += len;
3695 
3696 	while (xmlIsDocNameChar(doc, val)) {
3697 	    val = xmlStringCurrentChar(NULL, cur, &len);
3698 	    cur += len;
3699 	}
3700     }
3701 
3702     if (val != 0) return(0);
3703 
3704     return(1);
3705 }
3706 
3707 /**
3708  * xmlValidateNmtokensValue:
3709  * @value:  an Nmtokens value
3710  *
3711  * Validate that the given value match Nmtokens production
3712  *
3713  * [ VC: Name Token ]
3714  *
3715  * returns 1 if valid or 0 otherwise
3716  */
3717 
3718 int
xmlValidateNmtokensValue(const xmlChar * value)3719 xmlValidateNmtokensValue(const xmlChar *value) {
3720     return(xmlValidateNmtokensValueInternal(NULL, value));
3721 }
3722 
3723 /**
3724  * xmlValidateNotationDecl:
3725  * @ctxt:  the validation context
3726  * @doc:  a document instance
3727  * @nota:  a notation definition
3728  *
3729  * Try to validate a single notation definition
3730  * basically it does the following checks as described by the
3731  * XML-1.0 recommendation:
3732  *  - it seems that no validity constraint exists on notation declarations
3733  * But this function get called anyway ...
3734  *
3735  * returns 1 if valid or 0 otherwise
3736  */
3737 
3738 int
xmlValidateNotationDecl(xmlValidCtxtPtr ctxt ATTRIBUTE_UNUSED,xmlDocPtr doc ATTRIBUTE_UNUSED,xmlNotationPtr nota ATTRIBUTE_UNUSED)3739 xmlValidateNotationDecl(xmlValidCtxtPtr ctxt ATTRIBUTE_UNUSED, xmlDocPtr doc ATTRIBUTE_UNUSED,
3740                          xmlNotationPtr nota ATTRIBUTE_UNUSED) {
3741     int ret = 1;
3742 
3743     return(ret);
3744 }
3745 
3746 /**
3747  * xmlValidateAttributeValueInternal:
3748  * @doc: the document
3749  * @type:  an attribute type
3750  * @value:  an attribute value
3751  *
3752  * Validate that the given attribute value match  the proper production
3753  *
3754  * returns 1 if valid or 0 otherwise
3755  */
3756 
3757 static int
xmlValidateAttributeValueInternal(xmlDocPtr doc,xmlAttributeType type,const xmlChar * value)3758 xmlValidateAttributeValueInternal(xmlDocPtr doc, xmlAttributeType type,
3759                                   const xmlChar *value) {
3760     switch (type) {
3761 	case XML_ATTRIBUTE_ENTITIES:
3762 	case XML_ATTRIBUTE_IDREFS:
3763 	    return(xmlValidateNamesValueInternal(doc, value));
3764 	case XML_ATTRIBUTE_ENTITY:
3765 	case XML_ATTRIBUTE_IDREF:
3766 	case XML_ATTRIBUTE_ID:
3767 	case XML_ATTRIBUTE_NOTATION:
3768 	    return(xmlValidateNameValueInternal(doc, value));
3769 	case XML_ATTRIBUTE_NMTOKENS:
3770 	case XML_ATTRIBUTE_ENUMERATION:
3771 	    return(xmlValidateNmtokensValueInternal(doc, value));
3772 	case XML_ATTRIBUTE_NMTOKEN:
3773 	    return(xmlValidateNmtokenValueInternal(doc, value));
3774         case XML_ATTRIBUTE_CDATA:
3775 	    break;
3776     }
3777     return(1);
3778 }
3779 
3780 /**
3781  * xmlValidateAttributeValue:
3782  * @type:  an attribute type
3783  * @value:  an attribute value
3784  *
3785  * Validate that the given attribute value match  the proper production
3786  *
3787  * [ VC: ID ]
3788  * Values of type ID must match the Name production....
3789  *
3790  * [ VC: IDREF ]
3791  * Values of type IDREF must match the Name production, and values
3792  * of type IDREFS must match Names ...
3793  *
3794  * [ VC: Entity Name ]
3795  * Values of type ENTITY must match the Name production, values
3796  * of type ENTITIES must match Names ...
3797  *
3798  * [ VC: Name Token ]
3799  * Values of type NMTOKEN must match the Nmtoken production; values
3800  * of type NMTOKENS must match Nmtokens.
3801  *
3802  * returns 1 if valid or 0 otherwise
3803  */
3804 int
xmlValidateAttributeValue(xmlAttributeType type,const xmlChar * value)3805 xmlValidateAttributeValue(xmlAttributeType type, const xmlChar *value) {
3806     return(xmlValidateAttributeValueInternal(NULL, type, value));
3807 }
3808 
3809 /**
3810  * xmlValidateAttributeValue2:
3811  * @ctxt:  the validation context
3812  * @doc:  the document
3813  * @name:  the attribute name (used for error reporting only)
3814  * @type:  the attribute type
3815  * @value:  the attribute value
3816  *
3817  * Validate that the given attribute value match a given type.
3818  * This typically cannot be done before having finished parsing
3819  * the subsets.
3820  *
3821  * [ VC: IDREF ]
3822  * Values of type IDREF must match one of the declared IDs
3823  * Values of type IDREFS must match a sequence of the declared IDs
3824  * each Name must match the value of an ID attribute on some element
3825  * in the XML document; i.e. IDREF values must match the value of
3826  * some ID attribute
3827  *
3828  * [ VC: Entity Name ]
3829  * Values of type ENTITY must match one declared entity
3830  * Values of type ENTITIES must match a sequence of declared entities
3831  *
3832  * [ VC: Notation Attributes ]
3833  * all notation names in the declaration must be declared.
3834  *
3835  * returns 1 if valid or 0 otherwise
3836  */
3837 
3838 static int
xmlValidateAttributeValue2(xmlValidCtxtPtr ctxt,xmlDocPtr doc,const xmlChar * name,xmlAttributeType type,const xmlChar * value)3839 xmlValidateAttributeValue2(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
3840       const xmlChar *name, xmlAttributeType type, const xmlChar *value) {
3841     int ret = 1;
3842     switch (type) {
3843 	case XML_ATTRIBUTE_IDREFS:
3844 	case XML_ATTRIBUTE_IDREF:
3845 	case XML_ATTRIBUTE_ID:
3846 	case XML_ATTRIBUTE_NMTOKENS:
3847 	case XML_ATTRIBUTE_ENUMERATION:
3848 	case XML_ATTRIBUTE_NMTOKEN:
3849         case XML_ATTRIBUTE_CDATA:
3850 	    break;
3851 	case XML_ATTRIBUTE_ENTITY: {
3852 	    xmlEntityPtr ent;
3853 
3854 	    ent = xmlGetDocEntity(doc, value);
3855 	    /* yeah it's a bit messy... */
3856 	    if ((ent == NULL) && (doc->standalone == 1)) {
3857 		doc->standalone = 0;
3858 		ent = xmlGetDocEntity(doc, value);
3859 	    }
3860 	    if (ent == NULL) {
3861 		xmlErrValidNode(ctxt, (xmlNodePtr) doc,
3862 				XML_DTD_UNKNOWN_ENTITY,
3863    "ENTITY attribute %s reference an unknown entity \"%s\"\n",
3864 		       name, value, NULL);
3865 		ret = 0;
3866 	    } else if (ent->etype != XML_EXTERNAL_GENERAL_UNPARSED_ENTITY) {
3867 		xmlErrValidNode(ctxt, (xmlNodePtr) doc,
3868 				XML_DTD_ENTITY_TYPE,
3869    "ENTITY attribute %s reference an entity \"%s\" of wrong type\n",
3870 		       name, value, NULL);
3871 		ret = 0;
3872 	    }
3873 	    break;
3874         }
3875 	case XML_ATTRIBUTE_ENTITIES: {
3876 	    xmlChar *dup, *nam = NULL, *cur, save;
3877 	    xmlEntityPtr ent;
3878 
3879 	    dup = xmlStrdup(value);
3880 	    if (dup == NULL)
3881 		return(0);
3882 	    cur = dup;
3883 	    while (*cur != 0) {
3884 		nam = cur;
3885 		while ((*cur != 0) && (!IS_BLANK_CH(*cur))) cur++;
3886 		save = *cur;
3887 		*cur = 0;
3888 		ent = xmlGetDocEntity(doc, nam);
3889 		if (ent == NULL) {
3890 		    xmlErrValidNode(ctxt, (xmlNodePtr) doc,
3891 				    XML_DTD_UNKNOWN_ENTITY,
3892        "ENTITIES attribute %s reference an unknown entity \"%s\"\n",
3893 			   name, nam, NULL);
3894 		    ret = 0;
3895 		} else if (ent->etype != XML_EXTERNAL_GENERAL_UNPARSED_ENTITY) {
3896 		    xmlErrValidNode(ctxt, (xmlNodePtr) doc,
3897 				    XML_DTD_ENTITY_TYPE,
3898        "ENTITIES attribute %s reference an entity \"%s\" of wrong type\n",
3899 			   name, nam, NULL);
3900 		    ret = 0;
3901 		}
3902 		if (save == 0)
3903 		    break;
3904 		*cur = save;
3905 		while (IS_BLANK_CH(*cur)) cur++;
3906 	    }
3907 	    xmlFree(dup);
3908 	    break;
3909 	}
3910 	case XML_ATTRIBUTE_NOTATION: {
3911 	    xmlNotationPtr nota;
3912 
3913 	    nota = xmlGetDtdNotationDesc(doc->intSubset, value);
3914 	    if ((nota == NULL) && (doc->extSubset != NULL))
3915 		nota = xmlGetDtdNotationDesc(doc->extSubset, value);
3916 
3917 	    if (nota == NULL) {
3918 		xmlErrValidNode(ctxt, (xmlNodePtr) doc,
3919 		                XML_DTD_UNKNOWN_NOTATION,
3920        "NOTATION attribute %s reference an unknown notation \"%s\"\n",
3921 		       name, value, NULL);
3922 		ret = 0;
3923 	    }
3924 	    break;
3925         }
3926     }
3927     return(ret);
3928 }
3929 
3930 /**
3931  * xmlValidCtxtNormalizeAttributeValue:
3932  * @ctxt: the validation context
3933  * @doc:  the document
3934  * @elem:  the parent
3935  * @name:  the attribute name
3936  * @value:  the attribute value
3937  * @ctxt:  the validation context or NULL
3938  *
3939  * Does the validation related extra step of the normalization of attribute
3940  * values:
3941  *
3942  * If the declared value is not CDATA, then the XML processor must further
3943  * process the normalized attribute value by discarding any leading and
3944  * trailing space (#x20) characters, and by replacing sequences of space
3945  * (#x20) characters by single space (#x20) character.
3946  *
3947  * Also  check VC: Standalone Document Declaration in P32, and update
3948  *  ctxt->valid accordingly
3949  *
3950  * returns a new normalized string if normalization is needed, NULL otherwise
3951  *      the caller must free the returned value.
3952  */
3953 
3954 xmlChar *
xmlValidCtxtNormalizeAttributeValue(xmlValidCtxtPtr ctxt,xmlDocPtr doc,xmlNodePtr elem,const xmlChar * name,const xmlChar * value)3955 xmlValidCtxtNormalizeAttributeValue(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
3956 	     xmlNodePtr elem, const xmlChar *name, const xmlChar *value) {
3957     xmlChar *ret, *dst;
3958     const xmlChar *src;
3959     xmlAttributePtr attrDecl = NULL;
3960     int extsubset = 0;
3961 
3962     if (doc == NULL) return(NULL);
3963     if (elem == NULL) return(NULL);
3964     if (name == NULL) return(NULL);
3965     if (value == NULL) return(NULL);
3966 
3967     if ((elem->ns != NULL) && (elem->ns->prefix != NULL)) {
3968 	xmlChar fn[50];
3969 	xmlChar *fullname;
3970 
3971 	fullname = xmlBuildQName(elem->name, elem->ns->prefix, fn, 50);
3972 	if (fullname == NULL)
3973 	    return(NULL);
3974 	attrDecl = xmlGetDtdAttrDesc(doc->intSubset, fullname, name);
3975 	if ((attrDecl == NULL) && (doc->extSubset != NULL)) {
3976 	    attrDecl = xmlGetDtdAttrDesc(doc->extSubset, fullname, name);
3977 	    if (attrDecl != NULL)
3978 		extsubset = 1;
3979 	}
3980 	if ((fullname != fn) && (fullname != elem->name))
3981 	    xmlFree(fullname);
3982     }
3983     if ((attrDecl == NULL) && (doc->intSubset != NULL))
3984 	attrDecl = xmlGetDtdAttrDesc(doc->intSubset, elem->name, name);
3985     if ((attrDecl == NULL) && (doc->extSubset != NULL)) {
3986 	attrDecl = xmlGetDtdAttrDesc(doc->extSubset, elem->name, name);
3987 	if (attrDecl != NULL)
3988 	    extsubset = 1;
3989     }
3990 
3991     if (attrDecl == NULL)
3992 	return(NULL);
3993     if (attrDecl->atype == XML_ATTRIBUTE_CDATA)
3994 	return(NULL);
3995 
3996     ret = xmlStrdup(value);
3997     if (ret == NULL)
3998 	return(NULL);
3999     src = value;
4000     dst = ret;
4001     while (*src == 0x20) src++;
4002     while (*src != 0) {
4003 	if (*src == 0x20) {
4004 	    while (*src == 0x20) src++;
4005 	    if (*src != 0)
4006 		*dst++ = 0x20;
4007 	} else {
4008 	    *dst++ = *src++;
4009 	}
4010     }
4011     *dst = 0;
4012     if ((doc->standalone) && (extsubset == 1) && (!xmlStrEqual(value, ret))) {
4013 	xmlErrValidNode(ctxt, elem, XML_DTD_NOT_STANDALONE,
4014 "standalone: %s on %s value had to be normalized based on external subset declaration\n",
4015 	       name, elem->name, NULL);
4016 	ctxt->valid = 0;
4017     }
4018     return(ret);
4019 }
4020 
4021 /**
4022  * xmlValidNormalizeAttributeValue:
4023  * @doc:  the document
4024  * @elem:  the parent
4025  * @name:  the attribute name
4026  * @value:  the attribute value
4027  *
4028  * Does the validation related extra step of the normalization of attribute
4029  * values:
4030  *
4031  * If the declared value is not CDATA, then the XML processor must further
4032  * process the normalized attribute value by discarding any leading and
4033  * trailing space (#x20) characters, and by replacing sequences of space
4034  * (#x20) characters by single space (#x20) character.
4035  *
4036  * Returns a new normalized string if normalization is needed, NULL otherwise
4037  *      the caller must free the returned value.
4038  */
4039 
4040 xmlChar *
xmlValidNormalizeAttributeValue(xmlDocPtr doc,xmlNodePtr elem,const xmlChar * name,const xmlChar * value)4041 xmlValidNormalizeAttributeValue(xmlDocPtr doc, xmlNodePtr elem,
4042 			        const xmlChar *name, const xmlChar *value) {
4043     xmlChar *ret, *dst;
4044     const xmlChar *src;
4045     xmlAttributePtr attrDecl = NULL;
4046 
4047     if (doc == NULL) return(NULL);
4048     if (elem == NULL) return(NULL);
4049     if (name == NULL) return(NULL);
4050     if (value == NULL) return(NULL);
4051 
4052     if ((elem->ns != NULL) && (elem->ns->prefix != NULL)) {
4053 	xmlChar fn[50];
4054 	xmlChar *fullname;
4055 
4056 	fullname = xmlBuildQName(elem->name, elem->ns->prefix, fn, 50);
4057 	if (fullname == NULL)
4058 	    return(NULL);
4059 	if ((fullname != fn) && (fullname != elem->name))
4060 	    xmlFree(fullname);
4061     }
4062     attrDecl = xmlGetDtdAttrDesc(doc->intSubset, elem->name, name);
4063     if ((attrDecl == NULL) && (doc->extSubset != NULL))
4064 	attrDecl = xmlGetDtdAttrDesc(doc->extSubset, elem->name, name);
4065 
4066     if (attrDecl == NULL)
4067 	return(NULL);
4068     if (attrDecl->atype == XML_ATTRIBUTE_CDATA)
4069 	return(NULL);
4070 
4071     ret = xmlStrdup(value);
4072     if (ret == NULL)
4073 	return(NULL);
4074     src = value;
4075     dst = ret;
4076     while (*src == 0x20) src++;
4077     while (*src != 0) {
4078 	if (*src == 0x20) {
4079 	    while (*src == 0x20) src++;
4080 	    if (*src != 0)
4081 		*dst++ = 0x20;
4082 	} else {
4083 	    *dst++ = *src++;
4084 	}
4085     }
4086     *dst = 0;
4087     return(ret);
4088 }
4089 
4090 static void
xmlValidateAttributeIdCallback(xmlAttributePtr attr,int * count,const xmlChar * name ATTRIBUTE_UNUSED)4091 xmlValidateAttributeIdCallback(xmlAttributePtr attr, int *count,
4092 	                       const xmlChar* name ATTRIBUTE_UNUSED) {
4093     if (attr->atype == XML_ATTRIBUTE_ID) (*count)++;
4094 }
4095 
4096 /**
4097  * xmlValidateAttributeDecl:
4098  * @ctxt:  the validation context
4099  * @doc:  a document instance
4100  * @attr:  an attribute definition
4101  *
4102  * Try to validate a single attribute definition
4103  * basically it does the following checks as described by the
4104  * XML-1.0 recommendation:
4105  *  - [ VC: Attribute Default Legal ]
4106  *  - [ VC: Enumeration ]
4107  *  - [ VC: ID Attribute Default ]
4108  *
4109  * The ID/IDREF uniqueness and matching are done separately
4110  *
4111  * returns 1 if valid or 0 otherwise
4112  */
4113 
4114 int
xmlValidateAttributeDecl(xmlValidCtxtPtr ctxt,xmlDocPtr doc,xmlAttributePtr attr)4115 xmlValidateAttributeDecl(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
4116                          xmlAttributePtr attr) {
4117     int ret = 1;
4118     int val;
4119     CHECK_DTD;
4120     if(attr == NULL) return(1);
4121 
4122     /* Attribute Default Legal */
4123     /* Enumeration */
4124     if (attr->defaultValue != NULL) {
4125 	val = xmlValidateAttributeValueInternal(doc, attr->atype,
4126 	                                        attr->defaultValue);
4127 	if (val == 0) {
4128 	    xmlErrValidNode(ctxt, (xmlNodePtr) attr, XML_DTD_ATTRIBUTE_DEFAULT,
4129 	       "Syntax of default value for attribute %s of %s is not valid\n",
4130 	           attr->name, attr->elem, NULL);
4131 	}
4132         ret &= val;
4133     }
4134 
4135     /* ID Attribute Default */
4136     if ((attr->atype == XML_ATTRIBUTE_ID)&&
4137         (attr->def != XML_ATTRIBUTE_IMPLIED) &&
4138 	(attr->def != XML_ATTRIBUTE_REQUIRED)) {
4139 	xmlErrValidNode(ctxt, (xmlNodePtr) attr, XML_DTD_ID_FIXED,
4140           "ID attribute %s of %s is not valid must be #IMPLIED or #REQUIRED\n",
4141 	       attr->name, attr->elem, NULL);
4142 	ret = 0;
4143     }
4144 
4145     /* One ID per Element Type */
4146     if (attr->atype == XML_ATTRIBUTE_ID) {
4147         int nbId;
4148 
4149 	/* the trick is that we parse DtD as their own internal subset */
4150         xmlElementPtr elem = xmlGetDtdElementDesc(doc->intSubset,
4151 	                                          attr->elem);
4152 	if (elem != NULL) {
4153 	    nbId = xmlScanIDAttributeDecl(NULL, elem, 0);
4154 	} else {
4155 	    xmlAttributeTablePtr table;
4156 
4157 	    /*
4158 	     * The attribute may be declared in the internal subset and the
4159 	     * element in the external subset.
4160 	     */
4161 	    nbId = 0;
4162 	    if (doc->intSubset != NULL) {
4163 		table = (xmlAttributeTablePtr) doc->intSubset->attributes;
4164 		xmlHashScan3(table, NULL, NULL, attr->elem, (xmlHashScanner)
4165 			     xmlValidateAttributeIdCallback, &nbId);
4166 	    }
4167 	}
4168 	if (nbId > 1) {
4169 
4170 	    xmlErrValidNodeNr(ctxt, (xmlNodePtr) attr, XML_DTD_ID_SUBSET,
4171        "Element %s has %d ID attribute defined in the internal subset : %s\n",
4172 		   attr->elem, nbId, attr->name);
4173 	} else if (doc->extSubset != NULL) {
4174 	    int extId = 0;
4175 	    elem = xmlGetDtdElementDesc(doc->extSubset, attr->elem);
4176 	    if (elem != NULL) {
4177 		extId = xmlScanIDAttributeDecl(NULL, elem, 0);
4178 	    }
4179 	    if (extId > 1) {
4180 		xmlErrValidNodeNr(ctxt, (xmlNodePtr) attr, XML_DTD_ID_SUBSET,
4181        "Element %s has %d ID attribute defined in the external subset : %s\n",
4182 		       attr->elem, extId, attr->name);
4183 	    } else if (extId + nbId > 1) {
4184 		xmlErrValidNode(ctxt, (xmlNodePtr) attr, XML_DTD_ID_SUBSET,
4185 "Element %s has ID attributes defined in the internal and external subset : %s\n",
4186 		       attr->elem, attr->name, NULL);
4187 	    }
4188 	}
4189     }
4190 
4191     /* Validity Constraint: Enumeration */
4192     if ((attr->defaultValue != NULL) && (attr->tree != NULL)) {
4193         xmlEnumerationPtr tree = attr->tree;
4194 	while (tree != NULL) {
4195 	    if (xmlStrEqual(tree->name, attr->defaultValue)) break;
4196 	    tree = tree->next;
4197 	}
4198 	if (tree == NULL) {
4199 	    xmlErrValidNode(ctxt, (xmlNodePtr) attr, XML_DTD_ATTRIBUTE_VALUE,
4200 "Default value \"%s\" for attribute %s of %s is not among the enumerated set\n",
4201 		   attr->defaultValue, attr->name, attr->elem);
4202 	    ret = 0;
4203 	}
4204     }
4205 
4206     return(ret);
4207 }
4208 
4209 /**
4210  * xmlValidateElementDecl:
4211  * @ctxt:  the validation context
4212  * @doc:  a document instance
4213  * @elem:  an element definition
4214  *
4215  * Try to validate a single element definition
4216  * basically it does the following checks as described by the
4217  * XML-1.0 recommendation:
4218  *  - [ VC: One ID per Element Type ]
4219  *  - [ VC: No Duplicate Types ]
4220  *  - [ VC: Unique Element Type Declaration ]
4221  *
4222  * returns 1 if valid or 0 otherwise
4223  */
4224 
4225 int
xmlValidateElementDecl(xmlValidCtxtPtr ctxt,xmlDocPtr doc,xmlElementPtr elem)4226 xmlValidateElementDecl(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
4227                        xmlElementPtr elem) {
4228     int ret = 1;
4229     xmlElementPtr tst;
4230 
4231     CHECK_DTD;
4232 
4233     if (elem == NULL) return(1);
4234 
4235 #if 0
4236 #ifdef LIBXML_REGEXP_ENABLED
4237     /* Build the regexp associated to the content model */
4238     ret = xmlValidBuildContentModel(ctxt, elem);
4239 #endif
4240 #endif
4241 
4242     /* No Duplicate Types */
4243     if (elem->etype == XML_ELEMENT_TYPE_MIXED) {
4244 	xmlElementContentPtr cur, next;
4245         const xmlChar *name;
4246 
4247 	cur = elem->content;
4248 	while (cur != NULL) {
4249 	    if (cur->type != XML_ELEMENT_CONTENT_OR) break;
4250 	    if (cur->c1 == NULL) break;
4251 	    if (cur->c1->type == XML_ELEMENT_CONTENT_ELEMENT) {
4252 		name = cur->c1->name;
4253 		next = cur->c2;
4254 		while (next != NULL) {
4255 		    if (next->type == XML_ELEMENT_CONTENT_ELEMENT) {
4256 		        if ((xmlStrEqual(next->name, name)) &&
4257 			    (xmlStrEqual(next->prefix, cur->c1->prefix))) {
4258 			    if (cur->c1->prefix == NULL) {
4259 				xmlErrValidNode(ctxt, (xmlNodePtr) elem, XML_DTD_CONTENT_ERROR,
4260 		   "Definition of %s has duplicate references of %s\n",
4261 				       elem->name, name, NULL);
4262 			    } else {
4263 				xmlErrValidNode(ctxt, (xmlNodePtr) elem, XML_DTD_CONTENT_ERROR,
4264 		   "Definition of %s has duplicate references of %s:%s\n",
4265 				       elem->name, cur->c1->prefix, name);
4266 			    }
4267 			    ret = 0;
4268 			}
4269 			break;
4270 		    }
4271 		    if (next->c1 == NULL) break;
4272 		    if (next->c1->type != XML_ELEMENT_CONTENT_ELEMENT) break;
4273 		    if ((xmlStrEqual(next->c1->name, name)) &&
4274 		        (xmlStrEqual(next->c1->prefix, cur->c1->prefix))) {
4275 			if (cur->c1->prefix == NULL) {
4276 			    xmlErrValidNode(ctxt, (xmlNodePtr) elem, XML_DTD_CONTENT_ERROR,
4277 	       "Definition of %s has duplicate references to %s\n",
4278 				   elem->name, name, NULL);
4279 			} else {
4280 			    xmlErrValidNode(ctxt, (xmlNodePtr) elem, XML_DTD_CONTENT_ERROR,
4281 	       "Definition of %s has duplicate references to %s:%s\n",
4282 				   elem->name, cur->c1->prefix, name);
4283 			}
4284 			ret = 0;
4285 		    }
4286 		    next = next->c2;
4287 		}
4288 	    }
4289 	    cur = cur->c2;
4290 	}
4291     }
4292 
4293     /* VC: Unique Element Type Declaration */
4294     tst = xmlGetDtdElementDesc(doc->intSubset, elem->name);
4295     if ((tst != NULL ) && (tst != elem) &&
4296 	((tst->prefix == elem->prefix) ||
4297 	 (xmlStrEqual(tst->prefix, elem->prefix))) &&
4298 	(tst->etype != XML_ELEMENT_TYPE_UNDEFINED)) {
4299 	xmlErrValidNode(ctxt, (xmlNodePtr) elem, XML_DTD_ELEM_REDEFINED,
4300 	                "Redefinition of element %s\n",
4301 		       elem->name, NULL, NULL);
4302 	ret = 0;
4303     }
4304     tst = xmlGetDtdElementDesc(doc->extSubset, elem->name);
4305     if ((tst != NULL ) && (tst != elem) &&
4306 	((tst->prefix == elem->prefix) ||
4307 	 (xmlStrEqual(tst->prefix, elem->prefix))) &&
4308 	(tst->etype != XML_ELEMENT_TYPE_UNDEFINED)) {
4309 	xmlErrValidNode(ctxt, (xmlNodePtr) elem, XML_DTD_ELEM_REDEFINED,
4310 	                "Redefinition of element %s\n",
4311 		       elem->name, NULL, NULL);
4312 	ret = 0;
4313     }
4314     /* One ID per Element Type
4315      * already done when registering the attribute
4316     if (xmlScanIDAttributeDecl(ctxt, elem) > 1) {
4317 	ret = 0;
4318     } */
4319     return(ret);
4320 }
4321 
4322 /**
4323  * xmlValidateOneAttribute:
4324  * @ctxt:  the validation context
4325  * @doc:  a document instance
4326  * @elem:  an element instance
4327  * @attr:  an attribute instance
4328  * @value:  the attribute value (without entities processing)
4329  *
4330  * Try to validate a single attribute for an element
4331  * basically it does the following checks as described by the
4332  * XML-1.0 recommendation:
4333  *  - [ VC: Attribute Value Type ]
4334  *  - [ VC: Fixed Attribute Default ]
4335  *  - [ VC: Entity Name ]
4336  *  - [ VC: Name Token ]
4337  *  - [ VC: ID ]
4338  *  - [ VC: IDREF ]
4339  *  - [ VC: Entity Name ]
4340  *  - [ VC: Notation Attributes ]
4341  *
4342  * The ID/IDREF uniqueness and matching are done separately
4343  *
4344  * returns 1 if valid or 0 otherwise
4345  */
4346 
4347 int
xmlValidateOneAttribute(xmlValidCtxtPtr ctxt,xmlDocPtr doc,xmlNodePtr elem,xmlAttrPtr attr,const xmlChar * value)4348 xmlValidateOneAttribute(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
4349                         xmlNodePtr elem, xmlAttrPtr attr, const xmlChar *value)
4350 {
4351     xmlAttributePtr attrDecl =  NULL;
4352     int val;
4353     int ret = 1;
4354 
4355     CHECK_DTD;
4356     if ((elem == NULL) || (elem->name == NULL)) return(0);
4357     if ((attr == NULL) || (attr->name == NULL)) return(0);
4358 
4359     if ((elem->ns != NULL) && (elem->ns->prefix != NULL)) {
4360 	xmlChar fn[50];
4361 	xmlChar *fullname;
4362 
4363 	fullname = xmlBuildQName(elem->name, elem->ns->prefix, fn, 50);
4364 	if (fullname == NULL)
4365 	    return(0);
4366 	if (attr->ns != NULL) {
4367 	    attrDecl = xmlGetDtdQAttrDesc(doc->intSubset, fullname,
4368 		                          attr->name, attr->ns->prefix);
4369 	    if ((attrDecl == NULL) && (doc->extSubset != NULL))
4370 		attrDecl = xmlGetDtdQAttrDesc(doc->extSubset, fullname,
4371 					      attr->name, attr->ns->prefix);
4372 	} else {
4373 	    attrDecl = xmlGetDtdAttrDesc(doc->intSubset, fullname, attr->name);
4374 	    if ((attrDecl == NULL) && (doc->extSubset != NULL))
4375 		attrDecl = xmlGetDtdAttrDesc(doc->extSubset,
4376 					     fullname, attr->name);
4377 	}
4378 	if ((fullname != fn) && (fullname != elem->name))
4379 	    xmlFree(fullname);
4380     }
4381     if (attrDecl == NULL) {
4382 	if (attr->ns != NULL) {
4383 	    attrDecl = xmlGetDtdQAttrDesc(doc->intSubset, elem->name,
4384 		                          attr->name, attr->ns->prefix);
4385 	    if ((attrDecl == NULL) && (doc->extSubset != NULL))
4386 		attrDecl = xmlGetDtdQAttrDesc(doc->extSubset, elem->name,
4387 					      attr->name, attr->ns->prefix);
4388 	} else {
4389 	    attrDecl = xmlGetDtdAttrDesc(doc->intSubset,
4390 		                         elem->name, attr->name);
4391 	    if ((attrDecl == NULL) && (doc->extSubset != NULL))
4392 		attrDecl = xmlGetDtdAttrDesc(doc->extSubset,
4393 					     elem->name, attr->name);
4394 	}
4395     }
4396 
4397 
4398     /* Validity Constraint: Attribute Value Type */
4399     if (attrDecl == NULL) {
4400 	xmlErrValidNode(ctxt, elem, XML_DTD_UNKNOWN_ATTRIBUTE,
4401 	       "No declaration for attribute %s of element %s\n",
4402 	       attr->name, elem->name, NULL);
4403 	return(0);
4404     }
4405     attr->atype = attrDecl->atype;
4406 
4407     val = xmlValidateAttributeValueInternal(doc, attrDecl->atype, value);
4408     if (val == 0) {
4409 	    xmlErrValidNode(ctxt, elem, XML_DTD_ATTRIBUTE_VALUE,
4410 	   "Syntax of value for attribute %s of %s is not valid\n",
4411 	       attr->name, elem->name, NULL);
4412         ret = 0;
4413     }
4414 
4415     /* Validity constraint: Fixed Attribute Default */
4416     if (attrDecl->def == XML_ATTRIBUTE_FIXED) {
4417 	if (!xmlStrEqual(value, attrDecl->defaultValue)) {
4418 	    xmlErrValidNode(ctxt, elem, XML_DTD_ATTRIBUTE_DEFAULT,
4419 	   "Value for attribute %s of %s is different from default \"%s\"\n",
4420 		   attr->name, elem->name, attrDecl->defaultValue);
4421 	    ret = 0;
4422 	}
4423     }
4424 
4425     /* Validity Constraint: ID uniqueness */
4426     if (attrDecl->atype == XML_ATTRIBUTE_ID) {
4427         if (xmlAddID(ctxt, doc, value, attr) == NULL)
4428 	    ret = 0;
4429     }
4430 
4431     if ((attrDecl->atype == XML_ATTRIBUTE_IDREF) ||
4432 	(attrDecl->atype == XML_ATTRIBUTE_IDREFS)) {
4433         if (xmlAddRef(ctxt, doc, value, attr) == NULL)
4434 	    ret = 0;
4435     }
4436 
4437     /* Validity Constraint: Notation Attributes */
4438     if (attrDecl->atype == XML_ATTRIBUTE_NOTATION) {
4439         xmlEnumerationPtr tree = attrDecl->tree;
4440         xmlNotationPtr nota;
4441 
4442         /* First check that the given NOTATION was declared */
4443 	nota = xmlGetDtdNotationDesc(doc->intSubset, value);
4444 	if (nota == NULL)
4445 	    nota = xmlGetDtdNotationDesc(doc->extSubset, value);
4446 
4447 	if (nota == NULL) {
4448 	    xmlErrValidNode(ctxt, elem, XML_DTD_UNKNOWN_NOTATION,
4449        "Value \"%s\" for attribute %s of %s is not a declared Notation\n",
4450 		   value, attr->name, elem->name);
4451 	    ret = 0;
4452         }
4453 
4454 	/* Second, verify that it's among the list */
4455 	while (tree != NULL) {
4456 	    if (xmlStrEqual(tree->name, value)) break;
4457 	    tree = tree->next;
4458 	}
4459 	if (tree == NULL) {
4460 	    xmlErrValidNode(ctxt, elem, XML_DTD_NOTATION_VALUE,
4461 "Value \"%s\" for attribute %s of %s is not among the enumerated notations\n",
4462 		   value, attr->name, elem->name);
4463 	    ret = 0;
4464 	}
4465     }
4466 
4467     /* Validity Constraint: Enumeration */
4468     if (attrDecl->atype == XML_ATTRIBUTE_ENUMERATION) {
4469         xmlEnumerationPtr tree = attrDecl->tree;
4470 	while (tree != NULL) {
4471 	    if (xmlStrEqual(tree->name, value)) break;
4472 	    tree = tree->next;
4473 	}
4474 	if (tree == NULL) {
4475 	    xmlErrValidNode(ctxt, elem, XML_DTD_ATTRIBUTE_VALUE,
4476        "Value \"%s\" for attribute %s of %s is not among the enumerated set\n",
4477 		   value, attr->name, elem->name);
4478 	    ret = 0;
4479 	}
4480     }
4481 
4482     /* Fixed Attribute Default */
4483     if ((attrDecl->def == XML_ATTRIBUTE_FIXED) &&
4484         (!xmlStrEqual(attrDecl->defaultValue, value))) {
4485 	xmlErrValidNode(ctxt, elem, XML_DTD_ATTRIBUTE_VALUE,
4486 	   "Value for attribute %s of %s must be \"%s\"\n",
4487 	       attr->name, elem->name, attrDecl->defaultValue);
4488         ret = 0;
4489     }
4490 
4491     /* Extra check for the attribute value */
4492     ret &= xmlValidateAttributeValue2(ctxt, doc, attr->name,
4493 				      attrDecl->atype, value);
4494 
4495     return(ret);
4496 }
4497 
4498 /**
4499  * xmlValidateOneNamespace:
4500  * @ctxt:  the validation context
4501  * @doc:  a document instance
4502  * @elem:  an element instance
4503  * @prefix:  the namespace prefix
4504  * @ns:  an namespace declaration instance
4505  * @value:  the attribute value (without entities processing)
4506  *
4507  * Try to validate a single namespace declaration for an element
4508  * basically it does the following checks as described by the
4509  * XML-1.0 recommendation:
4510  *  - [ VC: Attribute Value Type ]
4511  *  - [ VC: Fixed Attribute Default ]
4512  *  - [ VC: Entity Name ]
4513  *  - [ VC: Name Token ]
4514  *  - [ VC: ID ]
4515  *  - [ VC: IDREF ]
4516  *  - [ VC: Entity Name ]
4517  *  - [ VC: Notation Attributes ]
4518  *
4519  * The ID/IDREF uniqueness and matching are done separately
4520  *
4521  * returns 1 if valid or 0 otherwise
4522  */
4523 
4524 int
xmlValidateOneNamespace(xmlValidCtxtPtr ctxt,xmlDocPtr doc,xmlNodePtr elem,const xmlChar * prefix,xmlNsPtr ns,const xmlChar * value)4525 xmlValidateOneNamespace(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
4526 xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) {
4527     /* xmlElementPtr elemDecl; */
4528     xmlAttributePtr attrDecl =  NULL;
4529     int val;
4530     int ret = 1;
4531 
4532     CHECK_DTD;
4533     if ((elem == NULL) || (elem->name == NULL)) return(0);
4534     if ((ns == NULL) || (ns->href == NULL)) return(0);
4535 
4536     if (prefix != NULL) {
4537 	xmlChar fn[50];
4538 	xmlChar *fullname;
4539 
4540 	fullname = xmlBuildQName(elem->name, prefix, fn, 50);
4541 	if (fullname == NULL) {
4542 	    xmlVErrMemory(ctxt, "Validating namespace");
4543 	    return(0);
4544 	}
4545 	if (ns->prefix != NULL) {
4546 	    attrDecl = xmlGetDtdQAttrDesc(doc->intSubset, fullname,
4547 		                          ns->prefix, BAD_CAST "xmlns");
4548 	    if ((attrDecl == NULL) && (doc->extSubset != NULL))
4549 		attrDecl = xmlGetDtdQAttrDesc(doc->extSubset, fullname,
4550 					  ns->prefix, BAD_CAST "xmlns");
4551 	} else {
4552 	    attrDecl = xmlGetDtdAttrDesc(doc->intSubset, fullname,
4553 		                         BAD_CAST "xmlns");
4554 	    if ((attrDecl == NULL) && (doc->extSubset != NULL))
4555 		attrDecl = xmlGetDtdAttrDesc(doc->extSubset, fullname,
4556 			                 BAD_CAST "xmlns");
4557 	}
4558 	if ((fullname != fn) && (fullname != elem->name))
4559 	    xmlFree(fullname);
4560     }
4561     if (attrDecl == NULL) {
4562 	if (ns->prefix != NULL) {
4563 	    attrDecl = xmlGetDtdQAttrDesc(doc->intSubset, elem->name,
4564 		                          ns->prefix, BAD_CAST "xmlns");
4565 	    if ((attrDecl == NULL) && (doc->extSubset != NULL))
4566 		attrDecl = xmlGetDtdQAttrDesc(doc->extSubset, elem->name,
4567 					      ns->prefix, BAD_CAST "xmlns");
4568 	} else {
4569 	    attrDecl = xmlGetDtdAttrDesc(doc->intSubset,
4570 		                         elem->name, BAD_CAST "xmlns");
4571 	    if ((attrDecl == NULL) && (doc->extSubset != NULL))
4572 		attrDecl = xmlGetDtdAttrDesc(doc->extSubset,
4573 					     elem->name, BAD_CAST "xmlns");
4574 	}
4575     }
4576 
4577 
4578     /* Validity Constraint: Attribute Value Type */
4579     if (attrDecl == NULL) {
4580 	if (ns->prefix != NULL) {
4581 	    xmlErrValidNode(ctxt, elem, XML_DTD_UNKNOWN_ATTRIBUTE,
4582 		   "No declaration for attribute xmlns:%s of element %s\n",
4583 		   ns->prefix, elem->name, NULL);
4584 	} else {
4585 	    xmlErrValidNode(ctxt, elem, XML_DTD_UNKNOWN_ATTRIBUTE,
4586 		   "No declaration for attribute xmlns of element %s\n",
4587 		   elem->name, NULL, NULL);
4588 	}
4589 	return(0);
4590     }
4591 
4592     val = xmlValidateAttributeValueInternal(doc, attrDecl->atype, value);
4593     if (val == 0) {
4594 	if (ns->prefix != NULL) {
4595 	    xmlErrValidNode(ctxt, elem, XML_DTD_INVALID_DEFAULT,
4596 	       "Syntax of value for attribute xmlns:%s of %s is not valid\n",
4597 		   ns->prefix, elem->name, NULL);
4598 	} else {
4599 	    xmlErrValidNode(ctxt, elem, XML_DTD_INVALID_DEFAULT,
4600 	       "Syntax of value for attribute xmlns of %s is not valid\n",
4601 		   elem->name, NULL, NULL);
4602 	}
4603         ret = 0;
4604     }
4605 
4606     /* Validity constraint: Fixed Attribute Default */
4607     if (attrDecl->def == XML_ATTRIBUTE_FIXED) {
4608 	if (!xmlStrEqual(value, attrDecl->defaultValue)) {
4609 	    if (ns->prefix != NULL) {
4610 		xmlErrValidNode(ctxt, elem, XML_DTD_ATTRIBUTE_DEFAULT,
4611        "Value for attribute xmlns:%s of %s is different from default \"%s\"\n",
4612 		       ns->prefix, elem->name, attrDecl->defaultValue);
4613 	    } else {
4614 		xmlErrValidNode(ctxt, elem, XML_DTD_ATTRIBUTE_DEFAULT,
4615        "Value for attribute xmlns of %s is different from default \"%s\"\n",
4616 		       elem->name, attrDecl->defaultValue, NULL);
4617 	    }
4618 	    ret = 0;
4619 	}
4620     }
4621 
4622     /* Validity Constraint: ID uniqueness */
4623     if (attrDecl->atype == XML_ATTRIBUTE_ID) {
4624         if (xmlAddID(ctxt, doc, value, (xmlAttrPtr) ns) == NULL)
4625 	    ret = 0;
4626     }
4627 
4628     if ((attrDecl->atype == XML_ATTRIBUTE_IDREF) ||
4629 	(attrDecl->atype == XML_ATTRIBUTE_IDREFS)) {
4630         if (xmlAddRef(ctxt, doc, value, (xmlAttrPtr) ns) == NULL)
4631 	    ret = 0;
4632     }
4633 
4634     /* Validity Constraint: Notation Attributes */
4635     if (attrDecl->atype == XML_ATTRIBUTE_NOTATION) {
4636         xmlEnumerationPtr tree = attrDecl->tree;
4637         xmlNotationPtr nota;
4638 
4639         /* First check that the given NOTATION was declared */
4640 	nota = xmlGetDtdNotationDesc(doc->intSubset, value);
4641 	if (nota == NULL)
4642 	    nota = xmlGetDtdNotationDesc(doc->extSubset, value);
4643 
4644 	if (nota == NULL) {
4645 	    if (ns->prefix != NULL) {
4646 		xmlErrValidNode(ctxt, elem, XML_DTD_UNKNOWN_NOTATION,
4647        "Value \"%s\" for attribute xmlns:%s of %s is not a declared Notation\n",
4648 		       value, ns->prefix, elem->name);
4649 	    } else {
4650 		xmlErrValidNode(ctxt, elem, XML_DTD_UNKNOWN_NOTATION,
4651        "Value \"%s\" for attribute xmlns of %s is not a declared Notation\n",
4652 		       value, elem->name, NULL);
4653 	    }
4654 	    ret = 0;
4655         }
4656 
4657 	/* Second, verify that it's among the list */
4658 	while (tree != NULL) {
4659 	    if (xmlStrEqual(tree->name, value)) break;
4660 	    tree = tree->next;
4661 	}
4662 	if (tree == NULL) {
4663 	    if (ns->prefix != NULL) {
4664 		xmlErrValidNode(ctxt, elem, XML_DTD_NOTATION_VALUE,
4665 "Value \"%s\" for attribute xmlns:%s of %s is not among the enumerated notations\n",
4666 		       value, ns->prefix, elem->name);
4667 	    } else {
4668 		xmlErrValidNode(ctxt, elem, XML_DTD_NOTATION_VALUE,
4669 "Value \"%s\" for attribute xmlns of %s is not among the enumerated notations\n",
4670 		       value, elem->name, NULL);
4671 	    }
4672 	    ret = 0;
4673 	}
4674     }
4675 
4676     /* Validity Constraint: Enumeration */
4677     if (attrDecl->atype == XML_ATTRIBUTE_ENUMERATION) {
4678         xmlEnumerationPtr tree = attrDecl->tree;
4679 	while (tree != NULL) {
4680 	    if (xmlStrEqual(tree->name, value)) break;
4681 	    tree = tree->next;
4682 	}
4683 	if (tree == NULL) {
4684 	    if (ns->prefix != NULL) {
4685 		xmlErrValidNode(ctxt, elem, XML_DTD_ATTRIBUTE_VALUE,
4686 "Value \"%s\" for attribute xmlns:%s of %s is not among the enumerated set\n",
4687 		       value, ns->prefix, elem->name);
4688 	    } else {
4689 		xmlErrValidNode(ctxt, elem, XML_DTD_ATTRIBUTE_VALUE,
4690 "Value \"%s\" for attribute xmlns of %s is not among the enumerated set\n",
4691 		       value, elem->name, NULL);
4692 	    }
4693 	    ret = 0;
4694 	}
4695     }
4696 
4697     /* Fixed Attribute Default */
4698     if ((attrDecl->def == XML_ATTRIBUTE_FIXED) &&
4699         (!xmlStrEqual(attrDecl->defaultValue, value))) {
4700 	if (ns->prefix != NULL) {
4701 	    xmlErrValidNode(ctxt, elem, XML_DTD_ELEM_NAMESPACE,
4702 		   "Value for attribute xmlns:%s of %s must be \"%s\"\n",
4703 		   ns->prefix, elem->name, attrDecl->defaultValue);
4704 	} else {
4705 	    xmlErrValidNode(ctxt, elem, XML_DTD_ELEM_NAMESPACE,
4706 		   "Value for attribute xmlns of %s must be \"%s\"\n",
4707 		   elem->name, attrDecl->defaultValue, NULL);
4708 	}
4709         ret = 0;
4710     }
4711 
4712     /* Extra check for the attribute value */
4713     if (ns->prefix != NULL) {
4714 	ret &= xmlValidateAttributeValue2(ctxt, doc, ns->prefix,
4715 					  attrDecl->atype, value);
4716     } else {
4717 	ret &= xmlValidateAttributeValue2(ctxt, doc, BAD_CAST "xmlns",
4718 					  attrDecl->atype, value);
4719     }
4720 
4721     return(ret);
4722 }
4723 
4724 #ifndef  LIBXML_REGEXP_ENABLED
4725 /**
4726  * xmlValidateSkipIgnorable:
4727  * @ctxt:  the validation context
4728  * @child:  the child list
4729  *
4730  * Skip ignorable elements w.r.t. the validation process
4731  *
4732  * returns the first element to consider for validation of the content model
4733  */
4734 
4735 static xmlNodePtr
xmlValidateSkipIgnorable(xmlNodePtr child)4736 xmlValidateSkipIgnorable(xmlNodePtr child) {
4737     while (child != NULL) {
4738 	switch (child->type) {
4739 	    /* These things are ignored (skipped) during validation.  */
4740 	    case XML_PI_NODE:
4741 	    case XML_COMMENT_NODE:
4742 	    case XML_XINCLUDE_START:
4743 	    case XML_XINCLUDE_END:
4744 		child = child->next;
4745 		break;
4746 	    case XML_TEXT_NODE:
4747 		if (xmlIsBlankNode(child))
4748 		    child = child->next;
4749 		else
4750 		    return(child);
4751 		break;
4752 	    /* keep current node */
4753 	    default:
4754 		return(child);
4755 	}
4756     }
4757     return(child);
4758 }
4759 
4760 /**
4761  * xmlValidateElementType:
4762  * @ctxt:  the validation context
4763  *
4764  * Try to validate the content model of an element internal function
4765  *
4766  * returns 1 if valid or 0 ,-1 in case of error, -2 if an entity
4767  *           reference is found and -3 if the validation succeeded but
4768  *           the content model is not determinist.
4769  */
4770 
4771 static int
xmlValidateElementType(xmlValidCtxtPtr ctxt)4772 xmlValidateElementType(xmlValidCtxtPtr ctxt) {
4773     int ret = -1;
4774     int determinist = 1;
4775 
4776     NODE = xmlValidateSkipIgnorable(NODE);
4777     if ((NODE == NULL) && (CONT == NULL))
4778 	return(1);
4779     if ((NODE == NULL) &&
4780 	((CONT->ocur == XML_ELEMENT_CONTENT_MULT) ||
4781 	 (CONT->ocur == XML_ELEMENT_CONTENT_OPT))) {
4782 	return(1);
4783     }
4784     if (CONT == NULL) return(-1);
4785     if ((NODE != NULL) && (NODE->type == XML_ENTITY_REF_NODE))
4786 	return(-2);
4787 
4788     /*
4789      * We arrive here when more states need to be examined
4790      */
4791 cont:
4792 
4793     /*
4794      * We just recovered from a rollback generated by a possible
4795      * epsilon transition, go directly to the analysis phase
4796      */
4797     if (STATE == ROLLBACK_PARENT) {
4798 	DEBUG_VALID_MSG("restored parent branch");
4799 	DEBUG_VALID_STATE(NODE, CONT)
4800 	ret = 1;
4801 	goto analyze;
4802     }
4803 
4804     DEBUG_VALID_STATE(NODE, CONT)
4805     /*
4806      * we may have to save a backup state here. This is the equivalent
4807      * of handling epsilon transition in NFAs.
4808      */
4809     if ((CONT != NULL) &&
4810 	((CONT->parent == NULL) ||
4811 	 (CONT->parent->type != XML_ELEMENT_CONTENT_OR)) &&
4812 	((CONT->ocur == XML_ELEMENT_CONTENT_MULT) ||
4813 	 (CONT->ocur == XML_ELEMENT_CONTENT_OPT) ||
4814 	 ((CONT->ocur == XML_ELEMENT_CONTENT_PLUS) && (OCCURRENCE)))) {
4815 	DEBUG_VALID_MSG("saving parent branch");
4816 	if (vstateVPush(ctxt, CONT, NODE, DEPTH, OCCURS, ROLLBACK_PARENT) < 0)
4817 	    return(0);
4818     }
4819 
4820 
4821     /*
4822      * Check first if the content matches
4823      */
4824     switch (CONT->type) {
4825 	case XML_ELEMENT_CONTENT_PCDATA:
4826 	    if (NODE == NULL) {
4827 		DEBUG_VALID_MSG("pcdata failed no node");
4828 		ret = 0;
4829 		break;
4830 	    }
4831 	    if (NODE->type == XML_TEXT_NODE) {
4832 		DEBUG_VALID_MSG("pcdata found, skip to next");
4833 		/*
4834 		 * go to next element in the content model
4835 		 * skipping ignorable elems
4836 		 */
4837 		do {
4838 		    NODE = NODE->next;
4839 		    NODE = xmlValidateSkipIgnorable(NODE);
4840 		    if ((NODE != NULL) &&
4841 			(NODE->type == XML_ENTITY_REF_NODE))
4842 			return(-2);
4843 		} while ((NODE != NULL) &&
4844 			 ((NODE->type != XML_ELEMENT_NODE) &&
4845 			  (NODE->type != XML_TEXT_NODE) &&
4846 			  (NODE->type != XML_CDATA_SECTION_NODE)));
4847                 ret = 1;
4848 		break;
4849 	    } else {
4850 		DEBUG_VALID_MSG("pcdata failed");
4851 		ret = 0;
4852 		break;
4853 	    }
4854 	    break;
4855 	case XML_ELEMENT_CONTENT_ELEMENT:
4856 	    if (NODE == NULL) {
4857 		DEBUG_VALID_MSG("element failed no node");
4858 		ret = 0;
4859 		break;
4860 	    }
4861 	    ret = ((NODE->type == XML_ELEMENT_NODE) &&
4862 		   (xmlStrEqual(NODE->name, CONT->name)));
4863 	    if (ret == 1) {
4864 		if ((NODE->ns == NULL) || (NODE->ns->prefix == NULL)) {
4865 		    ret = (CONT->prefix == NULL);
4866 		} else if (CONT->prefix == NULL) {
4867 		    ret = 0;
4868 		} else {
4869 		    ret = xmlStrEqual(NODE->ns->prefix, CONT->prefix);
4870 		}
4871 	    }
4872 	    if (ret == 1) {
4873 		DEBUG_VALID_MSG("element found, skip to next");
4874 		/*
4875 		 * go to next element in the content model
4876 		 * skipping ignorable elems
4877 		 */
4878 		do {
4879 		    NODE = NODE->next;
4880 		    NODE = xmlValidateSkipIgnorable(NODE);
4881 		    if ((NODE != NULL) &&
4882 			(NODE->type == XML_ENTITY_REF_NODE))
4883 			return(-2);
4884 		} while ((NODE != NULL) &&
4885 			 ((NODE->type != XML_ELEMENT_NODE) &&
4886 			  (NODE->type != XML_TEXT_NODE) &&
4887 			  (NODE->type != XML_CDATA_SECTION_NODE)));
4888 	    } else {
4889 		DEBUG_VALID_MSG("element failed");
4890 		ret = 0;
4891 		break;
4892 	    }
4893 	    break;
4894 	case XML_ELEMENT_CONTENT_OR:
4895 	    /*
4896 	     * Small optimization.
4897 	     */
4898 	    if (CONT->c1->type == XML_ELEMENT_CONTENT_ELEMENT) {
4899 		if ((NODE == NULL) ||
4900 		    (!xmlStrEqual(NODE->name, CONT->c1->name))) {
4901 		    DEPTH++;
4902 		    CONT = CONT->c2;
4903 		    goto cont;
4904 		}
4905 		if ((NODE->ns == NULL) || (NODE->ns->prefix == NULL)) {
4906 		    ret = (CONT->c1->prefix == NULL);
4907 		} else if (CONT->c1->prefix == NULL) {
4908 		    ret = 0;
4909 		} else {
4910 		    ret = xmlStrEqual(NODE->ns->prefix, CONT->c1->prefix);
4911 		}
4912 		if (ret == 0) {
4913 		    DEPTH++;
4914 		    CONT = CONT->c2;
4915 		    goto cont;
4916 		}
4917 	    }
4918 
4919 	    /*
4920 	     * save the second branch 'or' branch
4921 	     */
4922 	    DEBUG_VALID_MSG("saving 'or' branch");
4923 	    if (vstateVPush(ctxt, CONT->c2, NODE, (unsigned char)(DEPTH + 1),
4924 			    OCCURS, ROLLBACK_OR) < 0)
4925 		return(-1);
4926 	    DEPTH++;
4927 	    CONT = CONT->c1;
4928 	    goto cont;
4929 	case XML_ELEMENT_CONTENT_SEQ:
4930 	    /*
4931 	     * Small optimization.
4932 	     */
4933 	    if ((CONT->c1->type == XML_ELEMENT_CONTENT_ELEMENT) &&
4934 		((CONT->c1->ocur == XML_ELEMENT_CONTENT_OPT) ||
4935 		 (CONT->c1->ocur == XML_ELEMENT_CONTENT_MULT))) {
4936 		if ((NODE == NULL) ||
4937 		    (!xmlStrEqual(NODE->name, CONT->c1->name))) {
4938 		    DEPTH++;
4939 		    CONT = CONT->c2;
4940 		    goto cont;
4941 		}
4942 		if ((NODE->ns == NULL) || (NODE->ns->prefix == NULL)) {
4943 		    ret = (CONT->c1->prefix == NULL);
4944 		} else if (CONT->c1->prefix == NULL) {
4945 		    ret = 0;
4946 		} else {
4947 		    ret = xmlStrEqual(NODE->ns->prefix, CONT->c1->prefix);
4948 		}
4949 		if (ret == 0) {
4950 		    DEPTH++;
4951 		    CONT = CONT->c2;
4952 		    goto cont;
4953 		}
4954 	    }
4955 	    DEPTH++;
4956 	    CONT = CONT->c1;
4957 	    goto cont;
4958     }
4959 
4960     /*
4961      * At this point handle going up in the tree
4962      */
4963     if (ret == -1) {
4964 	DEBUG_VALID_MSG("error found returning");
4965 	return(ret);
4966     }
4967 analyze:
4968     while (CONT != NULL) {
4969 	/*
4970 	 * First do the analysis depending on the occurrence model at
4971 	 * this level.
4972 	 */
4973 	if (ret == 0) {
4974 	    switch (CONT->ocur) {
4975 		xmlNodePtr cur;
4976 
4977 		case XML_ELEMENT_CONTENT_ONCE:
4978 		    cur = ctxt->vstate->node;
4979 		    DEBUG_VALID_MSG("Once branch failed, rollback");
4980 		    if (vstateVPop(ctxt) < 0 ) {
4981 			DEBUG_VALID_MSG("exhaustion, failed");
4982 			return(0);
4983 		    }
4984 		    if (cur != ctxt->vstate->node)
4985 			determinist = -3;
4986 		    goto cont;
4987 		case XML_ELEMENT_CONTENT_PLUS:
4988 		    if (OCCURRENCE == 0) {
4989 			cur = ctxt->vstate->node;
4990 			DEBUG_VALID_MSG("Plus branch failed, rollback");
4991 			if (vstateVPop(ctxt) < 0 ) {
4992 			    DEBUG_VALID_MSG("exhaustion, failed");
4993 			    return(0);
4994 			}
4995 			if (cur != ctxt->vstate->node)
4996 			    determinist = -3;
4997 			goto cont;
4998 		    }
4999 		    DEBUG_VALID_MSG("Plus branch found");
5000 		    ret = 1;
5001 		    break;
5002 		case XML_ELEMENT_CONTENT_MULT:
5003 #ifdef DEBUG_VALID_ALGO
5004 		    if (OCCURRENCE == 0) {
5005 			DEBUG_VALID_MSG("Mult branch failed");
5006 		    } else {
5007 			DEBUG_VALID_MSG("Mult branch found");
5008 		    }
5009 #endif
5010 		    ret = 1;
5011 		    break;
5012 		case XML_ELEMENT_CONTENT_OPT:
5013 		    DEBUG_VALID_MSG("Option branch failed");
5014 		    ret = 1;
5015 		    break;
5016 	    }
5017 	} else {
5018 	    switch (CONT->ocur) {
5019 		case XML_ELEMENT_CONTENT_OPT:
5020 		    DEBUG_VALID_MSG("Option branch succeeded");
5021 		    ret = 1;
5022 		    break;
5023 		case XML_ELEMENT_CONTENT_ONCE:
5024 		    DEBUG_VALID_MSG("Once branch succeeded");
5025 		    ret = 1;
5026 		    break;
5027 		case XML_ELEMENT_CONTENT_PLUS:
5028 		    if (STATE == ROLLBACK_PARENT) {
5029 			DEBUG_VALID_MSG("Plus branch rollback");
5030 			ret = 1;
5031 			break;
5032 		    }
5033 		    if (NODE == NULL) {
5034 			DEBUG_VALID_MSG("Plus branch exhausted");
5035 			ret = 1;
5036 			break;
5037 		    }
5038 		    DEBUG_VALID_MSG("Plus branch succeeded, continuing");
5039 		    SET_OCCURRENCE;
5040 		    goto cont;
5041 		case XML_ELEMENT_CONTENT_MULT:
5042 		    if (STATE == ROLLBACK_PARENT) {
5043 			DEBUG_VALID_MSG("Mult branch rollback");
5044 			ret = 1;
5045 			break;
5046 		    }
5047 		    if (NODE == NULL) {
5048 			DEBUG_VALID_MSG("Mult branch exhausted");
5049 			ret = 1;
5050 			break;
5051 		    }
5052 		    DEBUG_VALID_MSG("Mult branch succeeded, continuing");
5053 		    /* SET_OCCURRENCE; */
5054 		    goto cont;
5055 	    }
5056 	}
5057 	STATE = 0;
5058 
5059 	/*
5060 	 * Then act accordingly at the parent level
5061 	 */
5062 	RESET_OCCURRENCE;
5063 	if (CONT->parent == NULL)
5064 	    break;
5065 
5066 	switch (CONT->parent->type) {
5067 	    case XML_ELEMENT_CONTENT_PCDATA:
5068 		DEBUG_VALID_MSG("Error: parent pcdata");
5069 		return(-1);
5070 	    case XML_ELEMENT_CONTENT_ELEMENT:
5071 		DEBUG_VALID_MSG("Error: parent element");
5072 		return(-1);
5073 	    case XML_ELEMENT_CONTENT_OR:
5074 		if (ret == 1) {
5075 		    DEBUG_VALID_MSG("Or succeeded");
5076 		    CONT = CONT->parent;
5077 		    DEPTH--;
5078 		} else {
5079 		    DEBUG_VALID_MSG("Or failed");
5080 		    CONT = CONT->parent;
5081 		    DEPTH--;
5082 		}
5083 		break;
5084 	    case XML_ELEMENT_CONTENT_SEQ:
5085 		if (ret == 0) {
5086 		    DEBUG_VALID_MSG("Sequence failed");
5087 		    CONT = CONT->parent;
5088 		    DEPTH--;
5089 		} else if (CONT == CONT->parent->c1) {
5090 		    DEBUG_VALID_MSG("Sequence testing 2nd branch");
5091 		    CONT = CONT->parent->c2;
5092 		    goto cont;
5093 		} else {
5094 		    DEBUG_VALID_MSG("Sequence succeeded");
5095 		    CONT = CONT->parent;
5096 		    DEPTH--;
5097 		}
5098 	}
5099     }
5100     if (NODE != NULL) {
5101 	xmlNodePtr cur;
5102 
5103 	cur = ctxt->vstate->node;
5104 	DEBUG_VALID_MSG("Failed, remaining input, rollback");
5105 	if (vstateVPop(ctxt) < 0 ) {
5106 	    DEBUG_VALID_MSG("exhaustion, failed");
5107 	    return(0);
5108 	}
5109 	if (cur != ctxt->vstate->node)
5110 	    determinist = -3;
5111 	goto cont;
5112     }
5113     if (ret == 0) {
5114 	xmlNodePtr cur;
5115 
5116 	cur = ctxt->vstate->node;
5117 	DEBUG_VALID_MSG("Failure, rollback");
5118 	if (vstateVPop(ctxt) < 0 ) {
5119 	    DEBUG_VALID_MSG("exhaustion, failed");
5120 	    return(0);
5121 	}
5122 	if (cur != ctxt->vstate->node)
5123 	    determinist = -3;
5124 	goto cont;
5125     }
5126     return(determinist);
5127 }
5128 #endif
5129 
5130 /**
5131  * xmlSnprintfElements:
5132  * @buf:  an output buffer
5133  * @size:  the size of the buffer
5134  * @content:  An element
5135  * @glob: 1 if one must print the englobing parenthesis, 0 otherwise
5136  *
5137  * This will dump the list of elements to the buffer
5138  * Intended just for the debug routine
5139  */
5140 static void
xmlSnprintfElements(char * buf,int size,xmlNodePtr node,int glob)5141 xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) {
5142     xmlNodePtr cur;
5143     int len;
5144 
5145     if (node == NULL) return;
5146     if (glob) strcat(buf, "(");
5147     cur = node;
5148     while (cur != NULL) {
5149 	len = strlen(buf);
5150 	if (size - len < 50) {
5151 	    if ((size - len > 4) && (buf[len - 1] != '.'))
5152 		strcat(buf, " ...");
5153 	    return;
5154 	}
5155         switch (cur->type) {
5156             case XML_ELEMENT_NODE:
5157 		if ((cur->ns != NULL) && (cur->ns->prefix != NULL)) {
5158 		    if (size - len < xmlStrlen(cur->ns->prefix) + 10) {
5159 			if ((size - len > 4) && (buf[len - 1] != '.'))
5160 			    strcat(buf, " ...");
5161 			return;
5162 		    }
5163 		    strcat(buf, (char *) cur->ns->prefix);
5164 		    strcat(buf, ":");
5165 		}
5166                 if (size - len < xmlStrlen(cur->name) + 10) {
5167 		    if ((size - len > 4) && (buf[len - 1] != '.'))
5168 			strcat(buf, " ...");
5169 		    return;
5170 		}
5171 	        strcat(buf, (char *) cur->name);
5172 		if (cur->next != NULL)
5173 		    strcat(buf, " ");
5174 		break;
5175             case XML_TEXT_NODE:
5176 		if (xmlIsBlankNode(cur))
5177 		    break;
5178             case XML_CDATA_SECTION_NODE:
5179             case XML_ENTITY_REF_NODE:
5180 	        strcat(buf, "CDATA");
5181 		if (cur->next != NULL)
5182 		    strcat(buf, " ");
5183 		break;
5184             case XML_ATTRIBUTE_NODE:
5185             case XML_DOCUMENT_NODE:
5186 #ifdef LIBXML_DOCB_ENABLED
5187 	    case XML_DOCB_DOCUMENT_NODE:
5188 #endif
5189 	    case XML_HTML_DOCUMENT_NODE:
5190             case XML_DOCUMENT_TYPE_NODE:
5191             case XML_DOCUMENT_FRAG_NODE:
5192             case XML_NOTATION_NODE:
5193 	    case XML_NAMESPACE_DECL:
5194 	        strcat(buf, "???");
5195 		if (cur->next != NULL)
5196 		    strcat(buf, " ");
5197 		break;
5198             case XML_ENTITY_NODE:
5199             case XML_PI_NODE:
5200             case XML_DTD_NODE:
5201             case XML_COMMENT_NODE:
5202 	    case XML_ELEMENT_DECL:
5203 	    case XML_ATTRIBUTE_DECL:
5204 	    case XML_ENTITY_DECL:
5205 	    case XML_XINCLUDE_START:
5206 	    case XML_XINCLUDE_END:
5207 		break;
5208 	}
5209 	cur = cur->next;
5210     }
5211     if (glob) strcat(buf, ")");
5212 }
5213 
5214 /**
5215  * xmlValidateElementContent:
5216  * @ctxt:  the validation context
5217  * @child:  the child list
5218  * @elemDecl:  pointer to the element declaration
5219  * @warn:  emit the error message
5220  * @parent: the parent element (for error reporting)
5221  *
5222  * Try to validate the content model of an element
5223  *
5224  * returns 1 if valid or 0 if not and -1 in case of error
5225  */
5226 
5227 static int
xmlValidateElementContent(xmlValidCtxtPtr ctxt,xmlNodePtr child,xmlElementPtr elemDecl,int warn,xmlNodePtr parent)5228 xmlValidateElementContent(xmlValidCtxtPtr ctxt, xmlNodePtr child,
5229        xmlElementPtr elemDecl, int warn, xmlNodePtr parent) {
5230     int ret = 1;
5231 #ifndef  LIBXML_REGEXP_ENABLED
5232     xmlNodePtr repl = NULL, last = NULL, tmp;
5233 #endif
5234     xmlNodePtr cur;
5235     xmlElementContentPtr cont;
5236     const xmlChar *name;
5237 
5238     if ((elemDecl == NULL) || (parent == NULL) || (ctxt == NULL))
5239 	return(-1);
5240     cont = elemDecl->content;
5241     name = elemDecl->name;
5242 
5243 #ifdef LIBXML_REGEXP_ENABLED
5244     /* Build the regexp associated to the content model */
5245     if (elemDecl->contModel == NULL)
5246 	ret = xmlValidBuildContentModel(ctxt, elemDecl);
5247     if (elemDecl->contModel == NULL) {
5248 	return(-1);
5249     } else {
5250 	xmlRegExecCtxtPtr exec;
5251 
5252 	if (!xmlRegexpIsDeterminist(elemDecl->contModel)) {
5253 	    return(-1);
5254 	}
5255 	ctxt->nodeMax = 0;
5256 	ctxt->nodeNr = 0;
5257 	ctxt->nodeTab = NULL;
5258 	exec = xmlRegNewExecCtxt(elemDecl->contModel, NULL, NULL);
5259 	if (exec != NULL) {
5260 	    cur = child;
5261 	    while (cur != NULL) {
5262 		switch (cur->type) {
5263 		    case XML_ENTITY_REF_NODE:
5264 			/*
5265 			 * Push the current node to be able to roll back
5266 			 * and process within the entity
5267 			 */
5268 			if ((cur->children != NULL) &&
5269 			    (cur->children->children != NULL)) {
5270 			    nodeVPush(ctxt, cur);
5271 			    cur = cur->children->children;
5272 			    continue;
5273 			}
5274 			break;
5275 		    case XML_TEXT_NODE:
5276 			if (xmlIsBlankNode(cur))
5277 			    break;
5278 			ret = 0;
5279 			goto fail;
5280 		    case XML_CDATA_SECTION_NODE:
5281 			/* TODO */
5282 			ret = 0;
5283 			goto fail;
5284 		    case XML_ELEMENT_NODE:
5285 			if ((cur->ns != NULL) && (cur->ns->prefix != NULL)) {
5286 			    xmlChar fn[50];
5287 			    xmlChar *fullname;
5288 
5289 			    fullname = xmlBuildQName(cur->name,
5290 				                     cur->ns->prefix, fn, 50);
5291 			    if (fullname == NULL) {
5292 				ret = -1;
5293 				goto fail;
5294 			    }
5295                             ret = xmlRegExecPushString(exec, fullname, NULL);
5296 			    if ((fullname != fn) && (fullname != cur->name))
5297 				xmlFree(fullname);
5298 			} else {
5299 			    ret = xmlRegExecPushString(exec, cur->name, NULL);
5300 			}
5301 			break;
5302 		    default:
5303 			break;
5304 		}
5305 		/*
5306 		 * Switch to next element
5307 		 */
5308 		cur = cur->next;
5309 		while (cur == NULL) {
5310 		    cur = nodeVPop(ctxt);
5311 		    if (cur == NULL)
5312 			break;
5313 		    cur = cur->next;
5314 		}
5315 	    }
5316 	    ret = xmlRegExecPushString(exec, NULL, NULL);
5317 fail:
5318 	    xmlRegFreeExecCtxt(exec);
5319 	}
5320     }
5321 #else  /* LIBXML_REGEXP_ENABLED */
5322     /*
5323      * Allocate the stack
5324      */
5325     ctxt->vstateMax = 8;
5326     ctxt->vstateTab = (xmlValidState *) xmlMalloc(
5327 		 ctxt->vstateMax * sizeof(ctxt->vstateTab[0]));
5328     if (ctxt->vstateTab == NULL) {
5329 	xmlVErrMemory(ctxt, "malloc failed");
5330 	return(-1);
5331     }
5332     /*
5333      * The first entry in the stack is reserved to the current state
5334      */
5335     ctxt->nodeMax = 0;
5336     ctxt->nodeNr = 0;
5337     ctxt->nodeTab = NULL;
5338     ctxt->vstate = &ctxt->vstateTab[0];
5339     ctxt->vstateNr = 1;
5340     CONT = cont;
5341     NODE = child;
5342     DEPTH = 0;
5343     OCCURS = 0;
5344     STATE = 0;
5345     ret = xmlValidateElementType(ctxt);
5346     if ((ret == -3) && (warn)) {
5347 	xmlErrValidWarning(ctxt, child, XML_DTD_CONTENT_NOT_DETERMINIST,
5348 	       "Content model for Element %s is ambiguous\n",
5349 	                   name, NULL, NULL);
5350     } else if (ret == -2) {
5351 	/*
5352 	 * An entities reference appeared at this level.
5353 	 * Buid a minimal representation of this node content
5354 	 * sufficient to run the validation process on it
5355 	 */
5356 	DEBUG_VALID_MSG("Found an entity reference, linearizing");
5357 	cur = child;
5358 	while (cur != NULL) {
5359 	    switch (cur->type) {
5360 		case XML_ENTITY_REF_NODE:
5361 		    /*
5362 		     * Push the current node to be able to roll back
5363 		     * and process within the entity
5364 		     */
5365 		    if ((cur->children != NULL) &&
5366 			(cur->children->children != NULL)) {
5367 			nodeVPush(ctxt, cur);
5368 			cur = cur->children->children;
5369 			continue;
5370 		    }
5371 		    break;
5372 		case XML_TEXT_NODE:
5373 		    if (xmlIsBlankNode(cur))
5374 			break;
5375 		    /* no break on purpose */
5376 		case XML_CDATA_SECTION_NODE:
5377 		    /* no break on purpose */
5378 		case XML_ELEMENT_NODE:
5379 		    /*
5380 		     * Allocate a new node and minimally fills in
5381 		     * what's required
5382 		     */
5383 		    tmp = (xmlNodePtr) xmlMalloc(sizeof(xmlNode));
5384 		    if (tmp == NULL) {
5385 			xmlVErrMemory(ctxt, "malloc failed");
5386 			xmlFreeNodeList(repl);
5387 			ret = -1;
5388 			goto done;
5389 		    }
5390 		    tmp->type = cur->type;
5391 		    tmp->name = cur->name;
5392 		    tmp->ns = cur->ns;
5393 		    tmp->next = NULL;
5394 		    tmp->content = NULL;
5395 		    if (repl == NULL)
5396 			repl = last = tmp;
5397 		    else {
5398 			last->next = tmp;
5399 			last = tmp;
5400 		    }
5401 		    if (cur->type == XML_CDATA_SECTION_NODE) {
5402 			/*
5403 			 * E59 spaces in CDATA does not match the
5404 			 * nonterminal S
5405 			 */
5406 			tmp->content = xmlStrdup(BAD_CAST "CDATA");
5407 		    }
5408 		    break;
5409 		default:
5410 		    break;
5411 	    }
5412 	    /*
5413 	     * Switch to next element
5414 	     */
5415 	    cur = cur->next;
5416 	    while (cur == NULL) {
5417 		cur = nodeVPop(ctxt);
5418 		if (cur == NULL)
5419 		    break;
5420 		cur = cur->next;
5421 	    }
5422 	}
5423 
5424 	/*
5425 	 * Relaunch the validation
5426 	 */
5427 	ctxt->vstate = &ctxt->vstateTab[0];
5428 	ctxt->vstateNr = 1;
5429 	CONT = cont;
5430 	NODE = repl;
5431 	DEPTH = 0;
5432 	OCCURS = 0;
5433 	STATE = 0;
5434 	ret = xmlValidateElementType(ctxt);
5435     }
5436 #endif /* LIBXML_REGEXP_ENABLED */
5437     if ((warn) && ((ret != 1) && (ret != -3))) {
5438 	if (ctxt != NULL) {
5439 	    char expr[5000];
5440 	    char list[5000];
5441 
5442 	    expr[0] = 0;
5443 	    xmlSnprintfElementContent(&expr[0], 5000, cont, 1);
5444 	    list[0] = 0;
5445 #ifndef LIBXML_REGEXP_ENABLED
5446 	    if (repl != NULL)
5447 		xmlSnprintfElements(&list[0], 5000, repl, 1);
5448 	    else
5449 #endif /* LIBXML_REGEXP_ENABLED */
5450 		xmlSnprintfElements(&list[0], 5000, child, 1);
5451 
5452 	    if (name != NULL) {
5453 		xmlErrValidNode(ctxt, parent, XML_DTD_CONTENT_MODEL,
5454 	   "Element %s content does not follow the DTD, expecting %s, got %s\n",
5455 		       name, BAD_CAST expr, BAD_CAST list);
5456 	    } else {
5457 		xmlErrValidNode(ctxt, parent, XML_DTD_CONTENT_MODEL,
5458 	   "Element content does not follow the DTD, expecting %s, got %s\n",
5459 		       BAD_CAST expr, BAD_CAST list, NULL);
5460 	    }
5461 	} else {
5462 	    if (name != NULL) {
5463 		xmlErrValidNode(ctxt, parent, XML_DTD_CONTENT_MODEL,
5464 		       "Element %s content does not follow the DTD\n",
5465 		       name, NULL, NULL);
5466 	    } else {
5467 		xmlErrValidNode(ctxt, parent, XML_DTD_CONTENT_MODEL,
5468 		       "Element content does not follow the DTD\n",
5469 		                NULL, NULL, NULL);
5470 	    }
5471 	}
5472 	ret = 0;
5473     }
5474     if (ret == -3)
5475 	ret = 1;
5476 
5477 #ifndef  LIBXML_REGEXP_ENABLED
5478 done:
5479     /*
5480      * Deallocate the copy if done, and free up the validation stack
5481      */
5482     while (repl != NULL) {
5483 	tmp = repl->next;
5484 	xmlFree(repl);
5485 	repl = tmp;
5486     }
5487     ctxt->vstateMax = 0;
5488     if (ctxt->vstateTab != NULL) {
5489 	xmlFree(ctxt->vstateTab);
5490 	ctxt->vstateTab = NULL;
5491     }
5492 #endif
5493     ctxt->nodeMax = 0;
5494     ctxt->nodeNr = 0;
5495     if (ctxt->nodeTab != NULL) {
5496 	xmlFree(ctxt->nodeTab);
5497 	ctxt->nodeTab = NULL;
5498     }
5499     return(ret);
5500 
5501 }
5502 
5503 /**
5504  * xmlValidateCdataElement:
5505  * @ctxt:  the validation context
5506  * @doc:  a document instance
5507  * @elem:  an element instance
5508  *
5509  * Check that an element follows #CDATA
5510  *
5511  * returns 1 if valid or 0 otherwise
5512  */
5513 static int
xmlValidateOneCdataElement(xmlValidCtxtPtr ctxt,xmlDocPtr doc,xmlNodePtr elem)5514 xmlValidateOneCdataElement(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
5515                            xmlNodePtr elem) {
5516     int ret = 1;
5517     xmlNodePtr cur, child;
5518 
5519     if ((ctxt == NULL) || (doc == NULL) || (elem == NULL) ||
5520         (elem->type != XML_ELEMENT_NODE))
5521 	return(0);
5522 
5523     child = elem->children;
5524 
5525     cur = child;
5526     while (cur != NULL) {
5527 	switch (cur->type) {
5528 	    case XML_ENTITY_REF_NODE:
5529 		/*
5530 		 * Push the current node to be able to roll back
5531 		 * and process within the entity
5532 		 */
5533 		if ((cur->children != NULL) &&
5534 		    (cur->children->children != NULL)) {
5535 		    nodeVPush(ctxt, cur);
5536 		    cur = cur->children->children;
5537 		    continue;
5538 		}
5539 		break;
5540 	    case XML_COMMENT_NODE:
5541 	    case XML_PI_NODE:
5542 	    case XML_TEXT_NODE:
5543 	    case XML_CDATA_SECTION_NODE:
5544 		break;
5545 	    default:
5546 		ret = 0;
5547 		goto done;
5548 	}
5549 	/*
5550 	 * Switch to next element
5551 	 */
5552 	cur = cur->next;
5553 	while (cur == NULL) {
5554 	    cur = nodeVPop(ctxt);
5555 	    if (cur == NULL)
5556 		break;
5557 	    cur = cur->next;
5558 	}
5559     }
5560 done:
5561     ctxt->nodeMax = 0;
5562     ctxt->nodeNr = 0;
5563     if (ctxt->nodeTab != NULL) {
5564 	xmlFree(ctxt->nodeTab);
5565 	ctxt->nodeTab = NULL;
5566     }
5567     return(ret);
5568 }
5569 
5570 /**
5571  * xmlValidateCheckMixed:
5572  * @ctxt:  the validation context
5573  * @cont:  the mixed content model
5574  * @qname:  the qualified name as appearing in the serialization
5575  *
5576  * Check if the given node is part of the content model.
5577  *
5578  * Returns 1 if yes, 0 if no, -1 in case of error
5579  */
5580 static int
xmlValidateCheckMixed(xmlValidCtxtPtr ctxt,xmlElementContentPtr cont,const xmlChar * qname)5581 xmlValidateCheckMixed(xmlValidCtxtPtr ctxt,
5582 	              xmlElementContentPtr cont, const xmlChar *qname) {
5583     const xmlChar *name;
5584     int plen;
5585     name = xmlSplitQName3(qname, &plen);
5586 
5587     if (name == NULL) {
5588 	while (cont != NULL) {
5589 	    if (cont->type == XML_ELEMENT_CONTENT_ELEMENT) {
5590 		if ((cont->prefix == NULL) && (xmlStrEqual(cont->name, qname)))
5591 		    return(1);
5592 	    } else if ((cont->type == XML_ELEMENT_CONTENT_OR) &&
5593 	       (cont->c1 != NULL) &&
5594 	       (cont->c1->type == XML_ELEMENT_CONTENT_ELEMENT)){
5595 		if ((cont->c1->prefix == NULL) &&
5596 		    (xmlStrEqual(cont->c1->name, qname)))
5597 		    return(1);
5598 	    } else if ((cont->type != XML_ELEMENT_CONTENT_OR) ||
5599 		(cont->c1 == NULL) ||
5600 		(cont->c1->type != XML_ELEMENT_CONTENT_PCDATA)){
5601 		xmlErrValid(NULL, XML_DTD_MIXED_CORRUPT,
5602 			"Internal: MIXED struct corrupted\n",
5603 			NULL);
5604 		break;
5605 	    }
5606 	    cont = cont->c2;
5607 	}
5608     } else {
5609 	while (cont != NULL) {
5610 	    if (cont->type == XML_ELEMENT_CONTENT_ELEMENT) {
5611 		if ((cont->prefix != NULL) &&
5612 		    (xmlStrncmp(cont->prefix, qname, plen) == 0) &&
5613 		    (xmlStrEqual(cont->name, name)))
5614 		    return(1);
5615 	    } else if ((cont->type == XML_ELEMENT_CONTENT_OR) &&
5616 	       (cont->c1 != NULL) &&
5617 	       (cont->c1->type == XML_ELEMENT_CONTENT_ELEMENT)){
5618 		if ((cont->c1->prefix != NULL) &&
5619 		    (xmlStrncmp(cont->c1->prefix, qname, plen) == 0) &&
5620 		    (xmlStrEqual(cont->c1->name, name)))
5621 		    return(1);
5622 	    } else if ((cont->type != XML_ELEMENT_CONTENT_OR) ||
5623 		(cont->c1 == NULL) ||
5624 		(cont->c1->type != XML_ELEMENT_CONTENT_PCDATA)){
5625 		xmlErrValid(ctxt, XML_DTD_MIXED_CORRUPT,
5626 			"Internal: MIXED struct corrupted\n",
5627 			NULL);
5628 		break;
5629 	    }
5630 	    cont = cont->c2;
5631 	}
5632     }
5633     return(0);
5634 }
5635 
5636 /**
5637  * xmlValidGetElemDecl:
5638  * @ctxt:  the validation context
5639  * @doc:  a document instance
5640  * @elem:  an element instance
5641  * @extsubset:  pointer, (out) indicate if the declaration was found
5642  *              in the external subset.
5643  *
5644  * Finds a declaration associated to an element in the document.
5645  *
5646  * returns the pointer to the declaration or NULL if not found.
5647  */
5648 static xmlElementPtr
xmlValidGetElemDecl(xmlValidCtxtPtr ctxt,xmlDocPtr doc,xmlNodePtr elem,int * extsubset)5649 xmlValidGetElemDecl(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
5650 	            xmlNodePtr elem, int *extsubset) {
5651     xmlElementPtr elemDecl = NULL;
5652     const xmlChar *prefix = NULL;
5653 
5654     if ((ctxt == NULL) || (doc == NULL) ||
5655         (elem == NULL) || (elem->name == NULL))
5656         return(NULL);
5657     if (extsubset != NULL)
5658 	*extsubset = 0;
5659 
5660     /*
5661      * Fetch the declaration for the qualified name
5662      */
5663     if ((elem->ns != NULL) && (elem->ns->prefix != NULL))
5664 	prefix = elem->ns->prefix;
5665 
5666     if (prefix != NULL) {
5667 	elemDecl = xmlGetDtdQElementDesc(doc->intSubset,
5668 		                         elem->name, prefix);
5669 	if ((elemDecl == NULL) && (doc->extSubset != NULL)) {
5670 	    elemDecl = xmlGetDtdQElementDesc(doc->extSubset,
5671 		                             elem->name, prefix);
5672 	    if ((elemDecl != NULL) && (extsubset != NULL))
5673 		*extsubset = 1;
5674 	}
5675     }
5676 
5677     /*
5678      * Fetch the declaration for the non qualified name
5679      * This is "non-strict" validation should be done on the
5680      * full QName but in that case being flexible makes sense.
5681      */
5682     if (elemDecl == NULL) {
5683 	elemDecl = xmlGetDtdElementDesc(doc->intSubset, elem->name);
5684 	if ((elemDecl == NULL) && (doc->extSubset != NULL)) {
5685 	    elemDecl = xmlGetDtdElementDesc(doc->extSubset, elem->name);
5686 	    if ((elemDecl != NULL) && (extsubset != NULL))
5687 		*extsubset = 1;
5688 	}
5689     }
5690     if (elemDecl == NULL) {
5691 	xmlErrValidNode(ctxt, elem,
5692 			XML_DTD_UNKNOWN_ELEM,
5693 	       "No declaration for element %s\n",
5694 	       elem->name, NULL, NULL);
5695     }
5696     return(elemDecl);
5697 }
5698 
5699 #ifdef LIBXML_REGEXP_ENABLED
5700 /**
5701  * xmlValidatePushElement:
5702  * @ctxt:  the validation context
5703  * @doc:  a document instance
5704  * @elem:  an element instance
5705  * @qname:  the qualified name as appearing in the serialization
5706  *
5707  * Push a new element start on the validation stack.
5708  *
5709  * returns 1 if no validation problem was found or 0 otherwise
5710  */
5711 int
xmlValidatePushElement(xmlValidCtxtPtr ctxt,xmlDocPtr doc,xmlNodePtr elem,const xmlChar * qname)5712 xmlValidatePushElement(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
5713                        xmlNodePtr elem, const xmlChar *qname) {
5714     int ret = 1;
5715     xmlElementPtr eDecl;
5716     int extsubset = 0;
5717 
5718     if (ctxt == NULL)
5719         return(0);
5720 /* printf("PushElem %s\n", qname); */
5721     if ((ctxt->vstateNr > 0) && (ctxt->vstate != NULL)) {
5722 	xmlValidStatePtr state = ctxt->vstate;
5723 	xmlElementPtr elemDecl;
5724 
5725 	/*
5726 	 * Check the new element agaisnt the content model of the new elem.
5727 	 */
5728 	if (state->elemDecl != NULL) {
5729 	    elemDecl = state->elemDecl;
5730 
5731 	    switch(elemDecl->etype) {
5732 		case XML_ELEMENT_TYPE_UNDEFINED:
5733 		    ret = 0;
5734 		    break;
5735 		case XML_ELEMENT_TYPE_EMPTY:
5736 		    xmlErrValidNode(ctxt, state->node,
5737 				    XML_DTD_NOT_EMPTY,
5738 	       "Element %s was declared EMPTY this one has content\n",
5739 			   state->node->name, NULL, NULL);
5740 		    ret = 0;
5741 		    break;
5742 		case XML_ELEMENT_TYPE_ANY:
5743 		    /* I don't think anything is required then */
5744 		    break;
5745 		case XML_ELEMENT_TYPE_MIXED:
5746 		    /* simple case of declared as #PCDATA */
5747 		    if ((elemDecl->content != NULL) &&
5748 			(elemDecl->content->type ==
5749 			 XML_ELEMENT_CONTENT_PCDATA)) {
5750 			xmlErrValidNode(ctxt, state->node,
5751 					XML_DTD_NOT_PCDATA,
5752 	       "Element %s was declared #PCDATA but contains non text nodes\n",
5753 				state->node->name, NULL, NULL);
5754 			ret = 0;
5755 		    } else {
5756 			ret = xmlValidateCheckMixed(ctxt, elemDecl->content,
5757 				                    qname);
5758 			if (ret != 1) {
5759 			    xmlErrValidNode(ctxt, state->node,
5760 					    XML_DTD_INVALID_CHILD,
5761 	       "Element %s is not declared in %s list of possible children\n",
5762 				    qname, state->node->name, NULL);
5763 			}
5764 		    }
5765 		    break;
5766 		case XML_ELEMENT_TYPE_ELEMENT:
5767 		    /*
5768 		     * TODO:
5769 		     * VC: Standalone Document Declaration
5770 		     *     - element types with element content, if white space
5771 		     *       occurs directly within any instance of those types.
5772 		     */
5773 		    if (state->exec != NULL) {
5774 			ret = xmlRegExecPushString(state->exec, qname, NULL);
5775 			if (ret < 0) {
5776 			    xmlErrValidNode(ctxt, state->node,
5777 					    XML_DTD_CONTENT_MODEL,
5778 	       "Element %s content does not follow the DTD, Misplaced %s\n",
5779 				   state->node->name, qname, NULL);
5780 			    ret = 0;
5781 			} else {
5782 			    ret = 1;
5783 			}
5784 		    }
5785 		    break;
5786 	    }
5787 	}
5788     }
5789     eDecl = xmlValidGetElemDecl(ctxt, doc, elem, &extsubset);
5790     vstateVPush(ctxt, eDecl, elem);
5791     return(ret);
5792 }
5793 
5794 /**
5795  * xmlValidatePushCData:
5796  * @ctxt:  the validation context
5797  * @data:  some character data read
5798  * @len:  the length of the data
5799  *
5800  * check the CData parsed for validation in the current stack
5801  *
5802  * returns 1 if no validation problem was found or 0 otherwise
5803  */
5804 int
xmlValidatePushCData(xmlValidCtxtPtr ctxt,const xmlChar * data,int len)5805 xmlValidatePushCData(xmlValidCtxtPtr ctxt, const xmlChar *data, int len) {
5806     int ret = 1;
5807 
5808 /* printf("CDATA %s %d\n", data, len); */
5809     if (ctxt == NULL)
5810         return(0);
5811     if (len <= 0)
5812 	return(ret);
5813     if ((ctxt->vstateNr > 0) && (ctxt->vstate != NULL)) {
5814 	xmlValidStatePtr state = ctxt->vstate;
5815 	xmlElementPtr elemDecl;
5816 
5817 	/*
5818 	 * Check the new element agaisnt the content model of the new elem.
5819 	 */
5820 	if (state->elemDecl != NULL) {
5821 	    elemDecl = state->elemDecl;
5822 
5823 	    switch(elemDecl->etype) {
5824 		case XML_ELEMENT_TYPE_UNDEFINED:
5825 		    ret = 0;
5826 		    break;
5827 		case XML_ELEMENT_TYPE_EMPTY:
5828 		    xmlErrValidNode(ctxt, state->node,
5829 				    XML_DTD_NOT_EMPTY,
5830 	       "Element %s was declared EMPTY this one has content\n",
5831 			   state->node->name, NULL, NULL);
5832 		    ret = 0;
5833 		    break;
5834 		case XML_ELEMENT_TYPE_ANY:
5835 		    break;
5836 		case XML_ELEMENT_TYPE_MIXED:
5837 		    break;
5838 		case XML_ELEMENT_TYPE_ELEMENT:
5839 		    if (len > 0) {
5840 			int i;
5841 
5842 			for (i = 0;i < len;i++) {
5843 			    if (!IS_BLANK_CH(data[i])) {
5844 				xmlErrValidNode(ctxt, state->node,
5845 						XML_DTD_CONTENT_MODEL,
5846 	   "Element %s content does not follow the DTD, Text not allowed\n",
5847 				       state->node->name, NULL, NULL);
5848 				ret = 0;
5849 				goto done;
5850 			    }
5851 			}
5852 			/*
5853 			 * TODO:
5854 			 * VC: Standalone Document Declaration
5855 			 *  element types with element content, if white space
5856 			 *  occurs directly within any instance of those types.
5857 			 */
5858 		    }
5859 		    break;
5860 	    }
5861 	}
5862     }
5863 done:
5864     return(ret);
5865 }
5866 
5867 /**
5868  * xmlValidatePopElement:
5869  * @ctxt:  the validation context
5870  * @doc:  a document instance
5871  * @elem:  an element instance
5872  * @qname:  the qualified name as appearing in the serialization
5873  *
5874  * Pop the element end from the validation stack.
5875  *
5876  * returns 1 if no validation problem was found or 0 otherwise
5877  */
5878 int
xmlValidatePopElement(xmlValidCtxtPtr ctxt,xmlDocPtr doc ATTRIBUTE_UNUSED,xmlNodePtr elem ATTRIBUTE_UNUSED,const xmlChar * qname ATTRIBUTE_UNUSED)5879 xmlValidatePopElement(xmlValidCtxtPtr ctxt, xmlDocPtr doc ATTRIBUTE_UNUSED,
5880                       xmlNodePtr elem ATTRIBUTE_UNUSED,
5881 		      const xmlChar *qname ATTRIBUTE_UNUSED) {
5882     int ret = 1;
5883 
5884     if (ctxt == NULL)
5885         return(0);
5886 /* printf("PopElem %s\n", qname); */
5887     if ((ctxt->vstateNr > 0) && (ctxt->vstate != NULL)) {
5888 	xmlValidStatePtr state = ctxt->vstate;
5889 	xmlElementPtr elemDecl;
5890 
5891 	/*
5892 	 * Check the new element agaisnt the content model of the new elem.
5893 	 */
5894 	if (state->elemDecl != NULL) {
5895 	    elemDecl = state->elemDecl;
5896 
5897 	    if (elemDecl->etype == XML_ELEMENT_TYPE_ELEMENT) {
5898 		if (state->exec != NULL) {
5899 		    ret = xmlRegExecPushString(state->exec, NULL, NULL);
5900 		    if (ret == 0) {
5901 			xmlErrValidNode(ctxt, state->node,
5902 			                XML_DTD_CONTENT_MODEL,
5903 	   "Element %s content does not follow the DTD, Expecting more child\n",
5904 			       state->node->name, NULL,NULL);
5905 		    } else {
5906 			/*
5907 			 * previous validation errors should not generate
5908 			 * a new one here
5909 			 */
5910 			ret = 1;
5911 		    }
5912 		}
5913 	    }
5914 	}
5915 	vstateVPop(ctxt);
5916     }
5917     return(ret);
5918 }
5919 #endif /* LIBXML_REGEXP_ENABLED */
5920 
5921 /**
5922  * xmlValidateOneElement:
5923  * @ctxt:  the validation context
5924  * @doc:  a document instance
5925  * @elem:  an element instance
5926  *
5927  * Try to validate a single element and it's attributes,
5928  * basically it does the following checks as described by the
5929  * XML-1.0 recommendation:
5930  *  - [ VC: Element Valid ]
5931  *  - [ VC: Required Attribute ]
5932  * Then call xmlValidateOneAttribute() for each attribute present.
5933  *
5934  * The ID/IDREF checkings are done separately
5935  *
5936  * returns 1 if valid or 0 otherwise
5937  */
5938 
5939 int
xmlValidateOneElement(xmlValidCtxtPtr ctxt,xmlDocPtr doc,xmlNodePtr elem)5940 xmlValidateOneElement(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
5941                       xmlNodePtr elem) {
5942     xmlElementPtr elemDecl = NULL;
5943     xmlElementContentPtr cont;
5944     xmlAttributePtr attr;
5945     xmlNodePtr child;
5946     int ret = 1, tmp;
5947     const xmlChar *name;
5948     int extsubset = 0;
5949 
5950     CHECK_DTD;
5951 
5952     if (elem == NULL) return(0);
5953     switch (elem->type) {
5954         case XML_ATTRIBUTE_NODE:
5955 	    xmlErrValidNode(ctxt, elem, XML_ERR_INTERNAL_ERROR,
5956 		   "Attribute element not expected\n", NULL, NULL ,NULL);
5957 	    return(0);
5958         case XML_TEXT_NODE:
5959 	    if (elem->children != NULL) {
5960 		xmlErrValidNode(ctxt, elem, XML_ERR_INTERNAL_ERROR,
5961 		                "Text element has children !\n",
5962 				NULL,NULL,NULL);
5963 		return(0);
5964 	    }
5965 	    if (elem->ns != NULL) {
5966 		xmlErrValidNode(ctxt, elem, XML_ERR_INTERNAL_ERROR,
5967 		                "Text element has namespace !\n",
5968 				NULL,NULL,NULL);
5969 		return(0);
5970 	    }
5971 	    if (elem->content == NULL) {
5972 		xmlErrValidNode(ctxt, elem, XML_ERR_INTERNAL_ERROR,
5973 		                "Text element has no content !\n",
5974 				NULL,NULL,NULL);
5975 		return(0);
5976 	    }
5977 	    return(1);
5978         case XML_XINCLUDE_START:
5979         case XML_XINCLUDE_END:
5980             return(1);
5981         case XML_CDATA_SECTION_NODE:
5982         case XML_ENTITY_REF_NODE:
5983         case XML_PI_NODE:
5984         case XML_COMMENT_NODE:
5985 	    return(1);
5986         case XML_ENTITY_NODE:
5987 	    xmlErrValidNode(ctxt, elem, XML_ERR_INTERNAL_ERROR,
5988 		   "Entity element not expected\n", NULL, NULL ,NULL);
5989 	    return(0);
5990         case XML_NOTATION_NODE:
5991 	    xmlErrValidNode(ctxt, elem, XML_ERR_INTERNAL_ERROR,
5992 		   "Notation element not expected\n", NULL, NULL ,NULL);
5993 	    return(0);
5994         case XML_DOCUMENT_NODE:
5995         case XML_DOCUMENT_TYPE_NODE:
5996         case XML_DOCUMENT_FRAG_NODE:
5997 	    xmlErrValidNode(ctxt, elem, XML_ERR_INTERNAL_ERROR,
5998 		   "Document element not expected\n", NULL, NULL ,NULL);
5999 	    return(0);
6000         case XML_HTML_DOCUMENT_NODE:
6001 	    xmlErrValidNode(ctxt, elem, XML_ERR_INTERNAL_ERROR,
6002 		   "HTML Document not expected\n", NULL, NULL ,NULL);
6003 	    return(0);
6004         case XML_ELEMENT_NODE:
6005 	    break;
6006 	default:
6007 	    xmlErrValidNode(ctxt, elem, XML_ERR_INTERNAL_ERROR,
6008 		   "unknown element type\n", NULL, NULL ,NULL);
6009 	    return(0);
6010     }
6011 
6012     /*
6013      * Fetch the declaration
6014      */
6015     elemDecl = xmlValidGetElemDecl(ctxt, doc, elem, &extsubset);
6016     if (elemDecl == NULL)
6017 	return(0);
6018 
6019     /*
6020      * If vstateNr is not zero that means continuous validation is
6021      * activated, do not try to check the content model at that level.
6022      */
6023     if (ctxt->vstateNr == 0) {
6024     /* Check that the element content matches the definition */
6025     switch (elemDecl->etype) {
6026         case XML_ELEMENT_TYPE_UNDEFINED:
6027 	    xmlErrValidNode(ctxt, elem, XML_DTD_UNKNOWN_ELEM,
6028 	                    "No declaration for element %s\n",
6029 		   elem->name, NULL, NULL);
6030 	    return(0);
6031         case XML_ELEMENT_TYPE_EMPTY:
6032 	    if (elem->children != NULL) {
6033 		xmlErrValidNode(ctxt, elem, XML_DTD_NOT_EMPTY,
6034 	       "Element %s was declared EMPTY this one has content\n",
6035 	               elem->name, NULL, NULL);
6036 		ret = 0;
6037 	    }
6038 	    break;
6039         case XML_ELEMENT_TYPE_ANY:
6040 	    /* I don't think anything is required then */
6041 	    break;
6042         case XML_ELEMENT_TYPE_MIXED:
6043 
6044 	    /* simple case of declared as #PCDATA */
6045 	    if ((elemDecl->content != NULL) &&
6046 		(elemDecl->content->type == XML_ELEMENT_CONTENT_PCDATA)) {
6047 		ret = xmlValidateOneCdataElement(ctxt, doc, elem);
6048 		if (!ret) {
6049 		    xmlErrValidNode(ctxt, elem, XML_DTD_NOT_PCDATA,
6050 	       "Element %s was declared #PCDATA but contains non text nodes\n",
6051 			   elem->name, NULL, NULL);
6052 		}
6053 		break;
6054 	    }
6055 	    child = elem->children;
6056 	    /* Hum, this start to get messy */
6057 	    while (child != NULL) {
6058 	        if (child->type == XML_ELEMENT_NODE) {
6059 		    name = child->name;
6060 		    if ((child->ns != NULL) && (child->ns->prefix != NULL)) {
6061 			xmlChar fn[50];
6062 			xmlChar *fullname;
6063 
6064 			fullname = xmlBuildQName(child->name, child->ns->prefix,
6065 				                 fn, 50);
6066 			if (fullname == NULL)
6067 			    return(0);
6068 			cont = elemDecl->content;
6069 			while (cont != NULL) {
6070 			    if (cont->type == XML_ELEMENT_CONTENT_ELEMENT) {
6071 				if (xmlStrEqual(cont->name, fullname))
6072 				    break;
6073 			    } else if ((cont->type == XML_ELEMENT_CONTENT_OR) &&
6074 			       (cont->c1 != NULL) &&
6075 			       (cont->c1->type == XML_ELEMENT_CONTENT_ELEMENT)){
6076 				if (xmlStrEqual(cont->c1->name, fullname))
6077 				    break;
6078 			    } else if ((cont->type != XML_ELEMENT_CONTENT_OR) ||
6079 				(cont->c1 == NULL) ||
6080 				(cont->c1->type != XML_ELEMENT_CONTENT_PCDATA)){
6081 				xmlErrValid(NULL, XML_DTD_MIXED_CORRUPT,
6082 					"Internal: MIXED struct corrupted\n",
6083 					NULL);
6084 				break;
6085 			    }
6086 			    cont = cont->c2;
6087 			}
6088 			if ((fullname != fn) && (fullname != child->name))
6089 			    xmlFree(fullname);
6090 			if (cont != NULL)
6091 			    goto child_ok;
6092 		    }
6093 		    cont = elemDecl->content;
6094 		    while (cont != NULL) {
6095 		        if (cont->type == XML_ELEMENT_CONTENT_ELEMENT) {
6096 			    if (xmlStrEqual(cont->name, name)) break;
6097 			} else if ((cont->type == XML_ELEMENT_CONTENT_OR) &&
6098 			   (cont->c1 != NULL) &&
6099 			   (cont->c1->type == XML_ELEMENT_CONTENT_ELEMENT)) {
6100 			    if (xmlStrEqual(cont->c1->name, name)) break;
6101 			} else if ((cont->type != XML_ELEMENT_CONTENT_OR) ||
6102 			    (cont->c1 == NULL) ||
6103 			    (cont->c1->type != XML_ELEMENT_CONTENT_PCDATA)) {
6104 			    xmlErrValid(ctxt, XML_DTD_MIXED_CORRUPT,
6105 				    "Internal: MIXED struct corrupted\n",
6106 				    NULL);
6107 			    break;
6108 			}
6109 			cont = cont->c2;
6110 		    }
6111 		    if (cont == NULL) {
6112 			xmlErrValidNode(ctxt, elem, XML_DTD_INVALID_CHILD,
6113 	       "Element %s is not declared in %s list of possible children\n",
6114 			       name, elem->name, NULL);
6115 			ret = 0;
6116 		    }
6117 		}
6118 child_ok:
6119 	        child = child->next;
6120 	    }
6121 	    break;
6122         case XML_ELEMENT_TYPE_ELEMENT:
6123 	    if ((doc->standalone == 1) && (extsubset == 1)) {
6124 		/*
6125 		 * VC: Standalone Document Declaration
6126 		 *     - element types with element content, if white space
6127 		 *       occurs directly within any instance of those types.
6128 		 */
6129 		child = elem->children;
6130 		while (child != NULL) {
6131 		    if (child->type == XML_TEXT_NODE) {
6132 			const xmlChar *content = child->content;
6133 
6134 			while (IS_BLANK_CH(*content))
6135 			    content++;
6136 			if (*content == 0) {
6137 			    xmlErrValidNode(ctxt, elem,
6138 			                    XML_DTD_STANDALONE_WHITE_SPACE,
6139 "standalone: %s declared in the external subset contains white spaces nodes\n",
6140 				   elem->name, NULL, NULL);
6141 			    ret = 0;
6142 			    break;
6143 			}
6144 		    }
6145 		    child =child->next;
6146 		}
6147 	    }
6148 	    child = elem->children;
6149 	    cont = elemDecl->content;
6150 	    tmp = xmlValidateElementContent(ctxt, child, elemDecl, 1, elem);
6151 	    if (tmp <= 0)
6152 		ret = tmp;
6153 	    break;
6154     }
6155     } /* not continuous */
6156 
6157     /* [ VC: Required Attribute ] */
6158     attr = elemDecl->attributes;
6159     while (attr != NULL) {
6160 	if (attr->def == XML_ATTRIBUTE_REQUIRED) {
6161 	    int qualified = -1;
6162 
6163 	    if ((attr->prefix == NULL) &&
6164 		(xmlStrEqual(attr->name, BAD_CAST "xmlns"))) {
6165 		xmlNsPtr ns;
6166 
6167 		ns = elem->nsDef;
6168 		while (ns != NULL) {
6169 		    if (ns->prefix == NULL)
6170 			goto found;
6171 		    ns = ns->next;
6172 		}
6173 	    } else if (xmlStrEqual(attr->prefix, BAD_CAST "xmlns")) {
6174 		xmlNsPtr ns;
6175 
6176 		ns = elem->nsDef;
6177 		while (ns != NULL) {
6178 		    if (xmlStrEqual(attr->name, ns->prefix))
6179 			goto found;
6180 		    ns = ns->next;
6181 		}
6182 	    } else {
6183 		xmlAttrPtr attrib;
6184 
6185 		attrib = elem->properties;
6186 		while (attrib != NULL) {
6187 		    if (xmlStrEqual(attrib->name, attr->name)) {
6188 			if (attr->prefix != NULL) {
6189 			    xmlNsPtr nameSpace = attrib->ns;
6190 
6191 			    if (nameSpace == NULL)
6192 				nameSpace = elem->ns;
6193 			    /*
6194 			     * qualified names handling is problematic, having a
6195 			     * different prefix should be possible but DTDs don't
6196 			     * allow to define the URI instead of the prefix :-(
6197 			     */
6198 			    if (nameSpace == NULL) {
6199 				if (qualified < 0)
6200 				    qualified = 0;
6201 			    } else if (!xmlStrEqual(nameSpace->prefix,
6202 						    attr->prefix)) {
6203 				if (qualified < 1)
6204 				    qualified = 1;
6205 			    } else
6206 				goto found;
6207 			} else {
6208 			    /*
6209 			     * We should allow applications to define namespaces
6210 			     * for their application even if the DTD doesn't
6211 			     * carry one, otherwise, basically we would always
6212 			     * break.
6213 			     */
6214 			    goto found;
6215 			}
6216 		    }
6217 		    attrib = attrib->next;
6218 		}
6219 	    }
6220 	    if (qualified == -1) {
6221 		if (attr->prefix == NULL) {
6222 		    xmlErrValidNode(ctxt, elem, XML_DTD_MISSING_ATTRIBUTE,
6223 		       "Element %s does not carry attribute %s\n",
6224 			   elem->name, attr->name, NULL);
6225 		    ret = 0;
6226 	        } else {
6227 		    xmlErrValidNode(ctxt, elem, XML_DTD_MISSING_ATTRIBUTE,
6228 		       "Element %s does not carry attribute %s:%s\n",
6229 			   elem->name, attr->prefix,attr->name);
6230 		    ret = 0;
6231 		}
6232 	    } else if (qualified == 0) {
6233 		xmlErrValidWarning(ctxt, elem, XML_DTD_NO_PREFIX,
6234 		   "Element %s required attribute %s:%s has no prefix\n",
6235 		       elem->name, attr->prefix, attr->name);
6236 	    } else if (qualified == 1) {
6237 		xmlErrValidWarning(ctxt, elem, XML_DTD_DIFFERENT_PREFIX,
6238 		   "Element %s required attribute %s:%s has different prefix\n",
6239 		       elem->name, attr->prefix, attr->name);
6240 	    }
6241 	} else if (attr->def == XML_ATTRIBUTE_FIXED) {
6242 	    /*
6243 	     * Special tests checking #FIXED namespace declarations
6244 	     * have the right value since this is not done as an
6245 	     * attribute checking
6246 	     */
6247 	    if ((attr->prefix == NULL) &&
6248 		(xmlStrEqual(attr->name, BAD_CAST "xmlns"))) {
6249 		xmlNsPtr ns;
6250 
6251 		ns = elem->nsDef;
6252 		while (ns != NULL) {
6253 		    if (ns->prefix == NULL) {
6254 			if (!xmlStrEqual(attr->defaultValue, ns->href)) {
6255 			    xmlErrValidNode(ctxt, elem,
6256 			           XML_DTD_ELEM_DEFAULT_NAMESPACE,
6257    "Element %s namespace name for default namespace does not match the DTD\n",
6258 				   elem->name, NULL, NULL);
6259 			    ret = 0;
6260 			}
6261 			goto found;
6262 		    }
6263 		    ns = ns->next;
6264 		}
6265 	    } else if (xmlStrEqual(attr->prefix, BAD_CAST "xmlns")) {
6266 		xmlNsPtr ns;
6267 
6268 		ns = elem->nsDef;
6269 		while (ns != NULL) {
6270 		    if (xmlStrEqual(attr->name, ns->prefix)) {
6271 			if (!xmlStrEqual(attr->defaultValue, ns->href)) {
6272 			    xmlErrValidNode(ctxt, elem, XML_DTD_ELEM_NAMESPACE,
6273 		   "Element %s namespace name for %s does not match the DTD\n",
6274 				   elem->name, ns->prefix, NULL);
6275 			    ret = 0;
6276 			}
6277 			goto found;
6278 		    }
6279 		    ns = ns->next;
6280 		}
6281 	    }
6282 	}
6283 found:
6284         attr = attr->nexth;
6285     }
6286     return(ret);
6287 }
6288 
6289 /**
6290  * xmlValidateRoot:
6291  * @ctxt:  the validation context
6292  * @doc:  a document instance
6293  *
6294  * Try to validate a the root element
6295  * basically it does the following check as described by the
6296  * XML-1.0 recommendation:
6297  *  - [ VC: Root Element Type ]
6298  * it doesn't try to recurse or apply other check to the element
6299  *
6300  * returns 1 if valid or 0 otherwise
6301  */
6302 
6303 int
xmlValidateRoot(xmlValidCtxtPtr ctxt,xmlDocPtr doc)6304 xmlValidateRoot(xmlValidCtxtPtr ctxt, xmlDocPtr doc) {
6305     xmlNodePtr root;
6306     int ret;
6307 
6308     if (doc == NULL) return(0);
6309 
6310     root = xmlDocGetRootElement(doc);
6311     if ((root == NULL) || (root->name == NULL)) {
6312 	xmlErrValid(ctxt, XML_DTD_NO_ROOT,
6313 	            "no root element\n", NULL);
6314         return(0);
6315     }
6316 
6317     /*
6318      * When doing post validation against a separate DTD, those may
6319      * no internal subset has been generated
6320      */
6321     if ((doc->intSubset != NULL) &&
6322 	(doc->intSubset->name != NULL)) {
6323 	/*
6324 	 * Check first the document root against the NQName
6325 	 */
6326 	if (!xmlStrEqual(doc->intSubset->name, root->name)) {
6327 	    if ((root->ns != NULL) && (root->ns->prefix != NULL)) {
6328 		xmlChar fn[50];
6329 		xmlChar *fullname;
6330 
6331 		fullname = xmlBuildQName(root->name, root->ns->prefix, fn, 50);
6332 		if (fullname == NULL) {
6333 		    xmlVErrMemory(ctxt, NULL);
6334 		    return(0);
6335 		}
6336 		ret = xmlStrEqual(doc->intSubset->name, fullname);
6337 		if ((fullname != fn) && (fullname != root->name))
6338 		    xmlFree(fullname);
6339 		if (ret == 1)
6340 		    goto name_ok;
6341 	    }
6342 	    if ((xmlStrEqual(doc->intSubset->name, BAD_CAST "HTML")) &&
6343 		(xmlStrEqual(root->name, BAD_CAST "html")))
6344 		goto name_ok;
6345 	    xmlErrValidNode(ctxt, root, XML_DTD_ROOT_NAME,
6346 		   "root and DTD name do not match '%s' and '%s'\n",
6347 		   root->name, doc->intSubset->name, NULL);
6348 	    return(0);
6349 	}
6350     }
6351 name_ok:
6352     return(1);
6353 }
6354 
6355 
6356 /**
6357  * xmlValidateElement:
6358  * @ctxt:  the validation context
6359  * @doc:  a document instance
6360  * @elem:  an element instance
6361  *
6362  * Try to validate the subtree under an element
6363  *
6364  * returns 1 if valid or 0 otherwise
6365  */
6366 
6367 int
xmlValidateElement(xmlValidCtxtPtr ctxt,xmlDocPtr doc,xmlNodePtr elem)6368 xmlValidateElement(xmlValidCtxtPtr ctxt, xmlDocPtr doc, xmlNodePtr elem) {
6369     xmlNodePtr child;
6370     xmlAttrPtr attr;
6371     xmlNsPtr ns;
6372     const xmlChar *value;
6373     int ret = 1;
6374 
6375     if (elem == NULL) return(0);
6376 
6377     /*
6378      * XInclude elements were added after parsing in the infoset,
6379      * they don't really mean anything validation wise.
6380      */
6381     if ((elem->type == XML_XINCLUDE_START) ||
6382 	(elem->type == XML_XINCLUDE_END) ||
6383 	(elem->type == XML_NAMESPACE_DECL))
6384 	return(1);
6385 
6386     CHECK_DTD;
6387 
6388     /*
6389      * Entities references have to be handled separately
6390      */
6391     if (elem->type == XML_ENTITY_REF_NODE) {
6392 	return(1);
6393     }
6394 
6395     ret &= xmlValidateOneElement(ctxt, doc, elem);
6396     if (elem->type == XML_ELEMENT_NODE) {
6397 	attr = elem->properties;
6398 	while (attr != NULL) {
6399 	    value = xmlNodeListGetString(doc, attr->children, 0);
6400 	    ret &= xmlValidateOneAttribute(ctxt, doc, elem, attr, value);
6401 	    if (value != NULL)
6402 		xmlFree((char *)value);
6403 	    attr= attr->next;
6404 	}
6405 	ns = elem->nsDef;
6406 	while (ns != NULL) {
6407 	    if (elem->ns == NULL)
6408 		ret &= xmlValidateOneNamespace(ctxt, doc, elem, NULL,
6409 					       ns, ns->href);
6410 	    else
6411 		ret &= xmlValidateOneNamespace(ctxt, doc, elem,
6412 		                               elem->ns->prefix, ns, ns->href);
6413 	    ns = ns->next;
6414 	}
6415     }
6416     child = elem->children;
6417     while (child != NULL) {
6418         ret &= xmlValidateElement(ctxt, doc, child);
6419         child = child->next;
6420     }
6421 
6422     return(ret);
6423 }
6424 
6425 /**
6426  * xmlValidateRef:
6427  * @ref:   A reference to be validated
6428  * @ctxt:  Validation context
6429  * @name:  Name of ID we are searching for
6430  *
6431  */
6432 static void
xmlValidateRef(xmlRefPtr ref,xmlValidCtxtPtr ctxt,const xmlChar * name)6433 xmlValidateRef(xmlRefPtr ref, xmlValidCtxtPtr ctxt,
6434 	                   const xmlChar *name) {
6435     xmlAttrPtr id;
6436     xmlAttrPtr attr;
6437 
6438     if (ref == NULL)
6439 	return;
6440     if ((ref->attr == NULL) && (ref->name == NULL))
6441 	return;
6442     attr = ref->attr;
6443     if (attr == NULL) {
6444 	xmlChar *dup, *str = NULL, *cur, save;
6445 
6446 	dup = xmlStrdup(name);
6447 	if (dup == NULL) {
6448 	    ctxt->valid = 0;
6449 	    return;
6450 	}
6451 	cur = dup;
6452 	while (*cur != 0) {
6453 	    str = cur;
6454 	    while ((*cur != 0) && (!IS_BLANK_CH(*cur))) cur++;
6455 	    save = *cur;
6456 	    *cur = 0;
6457 	    id = xmlGetID(ctxt->doc, str);
6458 	    if (id == NULL) {
6459 		xmlErrValidNodeNr(ctxt, NULL, XML_DTD_UNKNOWN_ID,
6460 	   "attribute %s line %d references an unknown ID \"%s\"\n",
6461 		       ref->name, ref->lineno, str);
6462 		ctxt->valid = 0;
6463 	    }
6464 	    if (save == 0)
6465 		break;
6466 	    *cur = save;
6467 	    while (IS_BLANK_CH(*cur)) cur++;
6468 	}
6469 	xmlFree(dup);
6470     } else if (attr->atype == XML_ATTRIBUTE_IDREF) {
6471 	id = xmlGetID(ctxt->doc, name);
6472 	if (id == NULL) {
6473 	    xmlErrValidNode(ctxt, attr->parent, XML_DTD_UNKNOWN_ID,
6474 	   "IDREF attribute %s references an unknown ID \"%s\"\n",
6475 		   attr->name, name, NULL);
6476 	    ctxt->valid = 0;
6477 	}
6478     } else if (attr->atype == XML_ATTRIBUTE_IDREFS) {
6479 	xmlChar *dup, *str = NULL, *cur, save;
6480 
6481 	dup = xmlStrdup(name);
6482 	if (dup == NULL) {
6483 	    xmlVErrMemory(ctxt, "IDREFS split");
6484 	    ctxt->valid = 0;
6485 	    return;
6486 	}
6487 	cur = dup;
6488 	while (*cur != 0) {
6489 	    str = cur;
6490 	    while ((*cur != 0) && (!IS_BLANK_CH(*cur))) cur++;
6491 	    save = *cur;
6492 	    *cur = 0;
6493 	    id = xmlGetID(ctxt->doc, str);
6494 	    if (id == NULL) {
6495 		xmlErrValidNode(ctxt, attr->parent, XML_DTD_UNKNOWN_ID,
6496 	   "IDREFS attribute %s references an unknown ID \"%s\"\n",
6497 			     attr->name, str, NULL);
6498 		ctxt->valid = 0;
6499 	    }
6500 	    if (save == 0)
6501 		break;
6502 	    *cur = save;
6503 	    while (IS_BLANK_CH(*cur)) cur++;
6504 	}
6505 	xmlFree(dup);
6506     }
6507 }
6508 
6509 /**
6510  * xmlWalkValidateList:
6511  * @data:  Contents of current link
6512  * @user:  Value supplied by the user
6513  *
6514  * Returns 0 to abort the walk or 1 to continue
6515  */
6516 static int
xmlWalkValidateList(const void * data,const void * user)6517 xmlWalkValidateList(const void *data, const void *user)
6518 {
6519 	xmlValidateMemoPtr memo = (xmlValidateMemoPtr)user;
6520 	xmlValidateRef((xmlRefPtr)data, memo->ctxt, memo->name);
6521 	return 1;
6522 }
6523 
6524 /**
6525  * xmlValidateCheckRefCallback:
6526  * @ref_list:  List of references
6527  * @ctxt:  Validation context
6528  * @name:  Name of ID we are searching for
6529  *
6530  */
6531 static void
xmlValidateCheckRefCallback(xmlListPtr ref_list,xmlValidCtxtPtr ctxt,const xmlChar * name)6532 xmlValidateCheckRefCallback(xmlListPtr ref_list, xmlValidCtxtPtr ctxt,
6533 	                   const xmlChar *name) {
6534     xmlValidateMemo memo;
6535 
6536     if (ref_list == NULL)
6537 	return;
6538     memo.ctxt = ctxt;
6539     memo.name = name;
6540 
6541     xmlListWalk(ref_list, xmlWalkValidateList, &memo);
6542 
6543 }
6544 
6545 /**
6546  * xmlValidateDocumentFinal:
6547  * @ctxt:  the validation context
6548  * @doc:  a document instance
6549  *
6550  * Does the final step for the document validation once all the
6551  * incremental validation steps have been completed
6552  *
6553  * basically it does the following checks described by the XML Rec
6554  *
6555  * Check all the IDREF/IDREFS attributes definition for validity
6556  *
6557  * returns 1 if valid or 0 otherwise
6558  */
6559 
6560 int
xmlValidateDocumentFinal(xmlValidCtxtPtr ctxt,xmlDocPtr doc)6561 xmlValidateDocumentFinal(xmlValidCtxtPtr ctxt, xmlDocPtr doc) {
6562     xmlRefTablePtr table;
6563     unsigned int save;
6564 
6565     if (ctxt == NULL)
6566         return(0);
6567     if (doc == NULL) {
6568         xmlErrValid(ctxt, XML_DTD_NO_DOC,
6569 		"xmlValidateDocumentFinal: doc == NULL\n", NULL);
6570 	return(0);
6571     }
6572 
6573     /* trick to get correct line id report */
6574     save = ctxt->finishDtd;
6575     ctxt->finishDtd = 0;
6576 
6577     /*
6578      * Check all the NOTATION/NOTATIONS attributes
6579      */
6580     /*
6581      * Check all the ENTITY/ENTITIES attributes definition for validity
6582      */
6583     /*
6584      * Check all the IDREF/IDREFS attributes definition for validity
6585      */
6586     table = (xmlRefTablePtr) doc->refs;
6587     ctxt->doc = doc;
6588     ctxt->valid = 1;
6589     xmlHashScan(table, (xmlHashScanner) xmlValidateCheckRefCallback, ctxt);
6590 
6591     ctxt->finishDtd = save;
6592     return(ctxt->valid);
6593 }
6594 
6595 /**
6596  * xmlValidateDtd:
6597  * @ctxt:  the validation context
6598  * @doc:  a document instance
6599  * @dtd:  a dtd instance
6600  *
6601  * Try to validate the document against the dtd instance
6602  *
6603  * Basically it does check all the definitions in the DtD.
6604  * Note the the internal subset (if present) is de-coupled
6605  * (i.e. not used), which could give problems if ID or IDREF
6606  * is present.
6607  *
6608  * returns 1 if valid or 0 otherwise
6609  */
6610 
6611 int
xmlValidateDtd(xmlValidCtxtPtr ctxt,xmlDocPtr doc,xmlDtdPtr dtd)6612 xmlValidateDtd(xmlValidCtxtPtr ctxt, xmlDocPtr doc, xmlDtdPtr dtd) {
6613     int ret;
6614     xmlDtdPtr oldExt, oldInt;
6615     xmlNodePtr root;
6616 
6617     if (dtd == NULL) return(0);
6618     if (doc == NULL) return(0);
6619     oldExt = doc->extSubset;
6620     oldInt = doc->intSubset;
6621     doc->extSubset = dtd;
6622     doc->intSubset = NULL;
6623     ret = xmlValidateRoot(ctxt, doc);
6624     if (ret == 0) {
6625 	doc->extSubset = oldExt;
6626 	doc->intSubset = oldInt;
6627 	return(ret);
6628     }
6629     if (doc->ids != NULL) {
6630           xmlFreeIDTable(doc->ids);
6631           doc->ids = NULL;
6632     }
6633     if (doc->refs != NULL) {
6634           xmlFreeRefTable(doc->refs);
6635           doc->refs = NULL;
6636     }
6637     root = xmlDocGetRootElement(doc);
6638     ret = xmlValidateElement(ctxt, doc, root);
6639     ret &= xmlValidateDocumentFinal(ctxt, doc);
6640     doc->extSubset = oldExt;
6641     doc->intSubset = oldInt;
6642     return(ret);
6643 }
6644 
6645 static void
xmlValidateNotationCallback(xmlEntityPtr cur,xmlValidCtxtPtr ctxt,const xmlChar * name ATTRIBUTE_UNUSED)6646 xmlValidateNotationCallback(xmlEntityPtr cur, xmlValidCtxtPtr ctxt,
6647 	                    const xmlChar *name ATTRIBUTE_UNUSED) {
6648     if (cur == NULL)
6649 	return;
6650     if (cur->etype == XML_EXTERNAL_GENERAL_UNPARSED_ENTITY) {
6651 	xmlChar *notation = cur->content;
6652 
6653 	if (notation != NULL) {
6654 	    int ret;
6655 
6656 	    ret = xmlValidateNotationUse(ctxt, cur->doc, notation);
6657 	    if (ret != 1) {
6658 		ctxt->valid = 0;
6659 	    }
6660 	}
6661     }
6662 }
6663 
6664 static void
xmlValidateAttributeCallback(xmlAttributePtr cur,xmlValidCtxtPtr ctxt,const xmlChar * name ATTRIBUTE_UNUSED)6665 xmlValidateAttributeCallback(xmlAttributePtr cur, xmlValidCtxtPtr ctxt,
6666 	                    const xmlChar *name ATTRIBUTE_UNUSED) {
6667     int ret;
6668     xmlDocPtr doc;
6669     xmlElementPtr elem = NULL;
6670 
6671     if (cur == NULL)
6672 	return;
6673     switch (cur->atype) {
6674 	case XML_ATTRIBUTE_CDATA:
6675 	case XML_ATTRIBUTE_ID:
6676 	case XML_ATTRIBUTE_IDREF	:
6677 	case XML_ATTRIBUTE_IDREFS:
6678 	case XML_ATTRIBUTE_NMTOKEN:
6679 	case XML_ATTRIBUTE_NMTOKENS:
6680 	case XML_ATTRIBUTE_ENUMERATION:
6681 	    break;
6682 	case XML_ATTRIBUTE_ENTITY:
6683 	case XML_ATTRIBUTE_ENTITIES:
6684 	case XML_ATTRIBUTE_NOTATION:
6685 	    if (cur->defaultValue != NULL) {
6686 
6687 		ret = xmlValidateAttributeValue2(ctxt, ctxt->doc, cur->name,
6688 			                         cur->atype, cur->defaultValue);
6689 		if ((ret == 0) && (ctxt->valid == 1))
6690 		    ctxt->valid = 0;
6691 	    }
6692 	    if (cur->tree != NULL) {
6693 		xmlEnumerationPtr tree = cur->tree;
6694 		while (tree != NULL) {
6695 		    ret = xmlValidateAttributeValue2(ctxt, ctxt->doc,
6696 				    cur->name, cur->atype, tree->name);
6697 		    if ((ret == 0) && (ctxt->valid == 1))
6698 			ctxt->valid = 0;
6699 		    tree = tree->next;
6700 		}
6701 	    }
6702     }
6703     if (cur->atype == XML_ATTRIBUTE_NOTATION) {
6704 	doc = cur->doc;
6705 	if (cur->elem == NULL) {
6706 	    xmlErrValid(ctxt, XML_ERR_INTERNAL_ERROR,
6707 		   "xmlValidateAttributeCallback(%s): internal error\n",
6708 		   (const char *) cur->name);
6709 	    return;
6710 	}
6711 
6712 	if (doc != NULL)
6713 	    elem = xmlGetDtdElementDesc(doc->intSubset, cur->elem);
6714 	if ((elem == NULL) && (doc != NULL))
6715 	    elem = xmlGetDtdElementDesc(doc->extSubset, cur->elem);
6716 	if ((elem == NULL) && (cur->parent != NULL) &&
6717 	    (cur->parent->type == XML_DTD_NODE))
6718 	    elem = xmlGetDtdElementDesc((xmlDtdPtr) cur->parent, cur->elem);
6719 	if (elem == NULL) {
6720 	    xmlErrValidNode(ctxt, NULL, XML_DTD_UNKNOWN_ELEM,
6721 		   "attribute %s: could not find decl for element %s\n",
6722 		   cur->name, cur->elem, NULL);
6723 	    return;
6724 	}
6725 	if (elem->etype == XML_ELEMENT_TYPE_EMPTY) {
6726 	    xmlErrValidNode(ctxt, NULL, XML_DTD_EMPTY_NOTATION,
6727 		   "NOTATION attribute %s declared for EMPTY element %s\n",
6728 		   cur->name, cur->elem, NULL);
6729 	    ctxt->valid = 0;
6730 	}
6731     }
6732 }
6733 
6734 /**
6735  * xmlValidateDtdFinal:
6736  * @ctxt:  the validation context
6737  * @doc:  a document instance
6738  *
6739  * Does the final step for the dtds validation once all the
6740  * subsets have been parsed
6741  *
6742  * basically it does the following checks described by the XML Rec
6743  * - check that ENTITY and ENTITIES type attributes default or
6744  *   possible values matches one of the defined entities.
6745  * - check that NOTATION type attributes default or
6746  *   possible values matches one of the defined notations.
6747  *
6748  * returns 1 if valid or 0 if invalid and -1 if not well-formed
6749  */
6750 
6751 int
xmlValidateDtdFinal(xmlValidCtxtPtr ctxt,xmlDocPtr doc)6752 xmlValidateDtdFinal(xmlValidCtxtPtr ctxt, xmlDocPtr doc) {
6753     xmlDtdPtr dtd;
6754     xmlAttributeTablePtr table;
6755     xmlEntitiesTablePtr entities;
6756 
6757     if ((doc == NULL) || (ctxt == NULL)) return(0);
6758     if ((doc->intSubset == NULL) && (doc->extSubset == NULL))
6759 	return(0);
6760     ctxt->doc = doc;
6761     ctxt->valid = 1;
6762     dtd = doc->intSubset;
6763     if ((dtd != NULL) && (dtd->attributes != NULL)) {
6764 	table = (xmlAttributeTablePtr) dtd->attributes;
6765 	xmlHashScan(table, (xmlHashScanner) xmlValidateAttributeCallback, ctxt);
6766     }
6767     if ((dtd != NULL) && (dtd->entities != NULL)) {
6768 	entities = (xmlEntitiesTablePtr) dtd->entities;
6769 	xmlHashScan(entities, (xmlHashScanner) xmlValidateNotationCallback,
6770 		    ctxt);
6771     }
6772     dtd = doc->extSubset;
6773     if ((dtd != NULL) && (dtd->attributes != NULL)) {
6774 	table = (xmlAttributeTablePtr) dtd->attributes;
6775 	xmlHashScan(table, (xmlHashScanner) xmlValidateAttributeCallback, ctxt);
6776     }
6777     if ((dtd != NULL) && (dtd->entities != NULL)) {
6778 	entities = (xmlEntitiesTablePtr) dtd->entities;
6779 	xmlHashScan(entities, (xmlHashScanner) xmlValidateNotationCallback,
6780 		    ctxt);
6781     }
6782     return(ctxt->valid);
6783 }
6784 
6785 /**
6786  * xmlValidateDocument:
6787  * @ctxt:  the validation context
6788  * @doc:  a document instance
6789  *
6790  * Try to validate the document instance
6791  *
6792  * basically it does the all the checks described by the XML Rec
6793  * i.e. validates the internal and external subset (if present)
6794  * and validate the document tree.
6795  *
6796  * returns 1 if valid or 0 otherwise
6797  */
6798 
6799 int
xmlValidateDocument(xmlValidCtxtPtr ctxt,xmlDocPtr doc)6800 xmlValidateDocument(xmlValidCtxtPtr ctxt, xmlDocPtr doc) {
6801     int ret;
6802     xmlNodePtr root;
6803 
6804     if (doc == NULL)
6805         return(0);
6806     if ((doc->intSubset == NULL) && (doc->extSubset == NULL)) {
6807         xmlErrValid(ctxt, XML_DTD_NO_DTD,
6808 	            "no DTD found!\n", NULL);
6809 	return(0);
6810     }
6811     if ((doc->intSubset != NULL) && ((doc->intSubset->SystemID != NULL) ||
6812 	(doc->intSubset->ExternalID != NULL)) && (doc->extSubset == NULL)) {
6813 	xmlChar *sysID;
6814 	if (doc->intSubset->SystemID != NULL) {
6815 	    sysID = xmlBuildURI(doc->intSubset->SystemID,
6816 			doc->URL);
6817 	    if (sysID == NULL) {
6818 	        xmlErrValid(ctxt, XML_DTD_LOAD_ERROR,
6819 			"Could not build URI for external subset \"%s\"\n",
6820 			(const char *) doc->intSubset->SystemID);
6821 		return 0;
6822 	    }
6823 	} else
6824 	    sysID = NULL;
6825         doc->extSubset = xmlParseDTD(doc->intSubset->ExternalID,
6826 			(const xmlChar *)sysID);
6827 	if (sysID != NULL)
6828 	    xmlFree(sysID);
6829         if (doc->extSubset == NULL) {
6830 	    if (doc->intSubset->SystemID != NULL) {
6831 		xmlErrValid(ctxt, XML_DTD_LOAD_ERROR,
6832 		       "Could not load the external subset \"%s\"\n",
6833 		       (const char *) doc->intSubset->SystemID);
6834 	    } else {
6835 		xmlErrValid(ctxt, XML_DTD_LOAD_ERROR,
6836 		       "Could not load the external subset \"%s\"\n",
6837 		       (const char *) doc->intSubset->ExternalID);
6838 	    }
6839 	    return(0);
6840 	}
6841     }
6842 
6843     if (doc->ids != NULL) {
6844           xmlFreeIDTable(doc->ids);
6845           doc->ids = NULL;
6846     }
6847     if (doc->refs != NULL) {
6848           xmlFreeRefTable(doc->refs);
6849           doc->refs = NULL;
6850     }
6851     ret = xmlValidateDtdFinal(ctxt, doc);
6852     if (!xmlValidateRoot(ctxt, doc)) return(0);
6853 
6854     root = xmlDocGetRootElement(doc);
6855     ret &= xmlValidateElement(ctxt, doc, root);
6856     ret &= xmlValidateDocumentFinal(ctxt, doc);
6857     return(ret);
6858 }
6859 
6860 /************************************************************************
6861  *									*
6862  *		Routines for dynamic validation editing			*
6863  *									*
6864  ************************************************************************/
6865 
6866 /**
6867  * xmlValidGetPotentialChildren:
6868  * @ctree:  an element content tree
6869  * @names:  an array to store the list of child names
6870  * @len:  a pointer to the number of element in the list
6871  * @max:  the size of the array
6872  *
6873  * Build/extend a list of  potential children allowed by the content tree
6874  *
6875  * returns the number of element in the list, or -1 in case of error.
6876  */
6877 
6878 int
xmlValidGetPotentialChildren(xmlElementContent * ctree,const xmlChar ** names,int * len,int max)6879 xmlValidGetPotentialChildren(xmlElementContent *ctree,
6880                              const xmlChar **names,
6881                              int *len, int max) {
6882     int i;
6883 
6884     if ((ctree == NULL) || (names == NULL) || (len == NULL))
6885         return(-1);
6886     if (*len >= max) return(*len);
6887 
6888     switch (ctree->type) {
6889 	case XML_ELEMENT_CONTENT_PCDATA:
6890 	    for (i = 0; i < *len;i++)
6891 		if (xmlStrEqual(BAD_CAST "#PCDATA", names[i])) return(*len);
6892 	    names[(*len)++] = BAD_CAST "#PCDATA";
6893 	    break;
6894 	case XML_ELEMENT_CONTENT_ELEMENT:
6895 	    for (i = 0; i < *len;i++)
6896 		if (xmlStrEqual(ctree->name, names[i])) return(*len);
6897 	    names[(*len)++] = ctree->name;
6898 	    break;
6899 	case XML_ELEMENT_CONTENT_SEQ:
6900 	    xmlValidGetPotentialChildren(ctree->c1, names, len, max);
6901 	    xmlValidGetPotentialChildren(ctree->c2, names, len, max);
6902 	    break;
6903 	case XML_ELEMENT_CONTENT_OR:
6904 	    xmlValidGetPotentialChildren(ctree->c1, names, len, max);
6905 	    xmlValidGetPotentialChildren(ctree->c2, names, len, max);
6906 	    break;
6907    }
6908 
6909    return(*len);
6910 }
6911 
6912 /*
6913  * Dummy function to suppress messages while we try out valid elements
6914  */
xmlNoValidityErr(void * ctx ATTRIBUTE_UNUSED,const char * msg ATTRIBUTE_UNUSED,...)6915 static void XMLCDECL xmlNoValidityErr(void *ctx ATTRIBUTE_UNUSED,
6916                                 const char *msg ATTRIBUTE_UNUSED, ...) {
6917     return;
6918 }
6919 
6920 /**
6921  * xmlValidGetValidElements:
6922  * @prev:  an element to insert after
6923  * @next:  an element to insert next
6924  * @names:  an array to store the list of child names
6925  * @max:  the size of the array
6926  *
6927  * This function returns the list of authorized children to insert
6928  * within an existing tree while respecting the validity constraints
6929  * forced by the Dtd. The insertion point is defined using @prev and
6930  * @next in the following ways:
6931  *  to insert before 'node': xmlValidGetValidElements(node->prev, node, ...
6932  *  to insert next 'node': xmlValidGetValidElements(node, node->next, ...
6933  *  to replace 'node': xmlValidGetValidElements(node->prev, node->next, ...
6934  *  to prepend a child to 'node': xmlValidGetValidElements(NULL, node->childs,
6935  *  to append a child to 'node': xmlValidGetValidElements(node->last, NULL, ...
6936  *
6937  * pointers to the element names are inserted at the beginning of the array
6938  * and do not need to be freed.
6939  *
6940  * returns the number of element in the list, or -1 in case of error. If
6941  *    the function returns the value @max the caller is invited to grow the
6942  *    receiving array and retry.
6943  */
6944 
6945 int
xmlValidGetValidElements(xmlNode * prev,xmlNode * next,const xmlChar ** names,int max)6946 xmlValidGetValidElements(xmlNode *prev, xmlNode *next, const xmlChar **names,
6947                          int max) {
6948     xmlValidCtxt vctxt;
6949     int nb_valid_elements = 0;
6950     const xmlChar *elements[256]={0};
6951     int nb_elements = 0, i;
6952     const xmlChar *name;
6953 
6954     xmlNode *ref_node;
6955     xmlNode *parent;
6956     xmlNode *test_node;
6957 
6958     xmlNode *prev_next;
6959     xmlNode *next_prev;
6960     xmlNode *parent_childs;
6961     xmlNode *parent_last;
6962 
6963     xmlElement *element_desc;
6964 
6965     if (prev == NULL && next == NULL)
6966         return(-1);
6967 
6968     if (names == NULL) return(-1);
6969     if (max <= 0) return(-1);
6970 
6971     memset(&vctxt, 0, sizeof (xmlValidCtxt));
6972     vctxt.error = xmlNoValidityErr;	/* this suppresses err/warn output */
6973 
6974     nb_valid_elements = 0;
6975     ref_node = prev ? prev : next;
6976     parent = ref_node->parent;
6977 
6978     /*
6979      * Retrieves the parent element declaration
6980      */
6981     element_desc = xmlGetDtdElementDesc(parent->doc->intSubset,
6982                                          parent->name);
6983     if ((element_desc == NULL) && (parent->doc->extSubset != NULL))
6984         element_desc = xmlGetDtdElementDesc(parent->doc->extSubset,
6985                                              parent->name);
6986     if (element_desc == NULL) return(-1);
6987 
6988     /*
6989      * Do a backup of the current tree structure
6990      */
6991     prev_next = prev ? prev->next : NULL;
6992     next_prev = next ? next->prev : NULL;
6993     parent_childs = parent->children;
6994     parent_last = parent->last;
6995 
6996     /*
6997      * Creates a dummy node and insert it into the tree
6998      */
6999     test_node = xmlNewDocNode (ref_node->doc, NULL, BAD_CAST "<!dummy?>", NULL);
7000     if (test_node == NULL)
7001         return(-1);
7002 
7003     test_node->parent = parent;
7004     test_node->prev = prev;
7005     test_node->next = next;
7006     name = test_node->name;
7007 
7008     if (prev) prev->next = test_node;
7009     else parent->children = test_node;
7010 
7011     if (next) next->prev = test_node;
7012     else parent->last = test_node;
7013 
7014     /*
7015      * Insert each potential child node and check if the parent is
7016      * still valid
7017      */
7018     nb_elements = xmlValidGetPotentialChildren(element_desc->content,
7019 		       elements, &nb_elements, 256);
7020 
7021     for (i = 0;i < nb_elements;i++) {
7022 	test_node->name = elements[i];
7023 	if (xmlValidateOneElement(&vctxt, parent->doc, parent)) {
7024 	    int j;
7025 
7026 	    for (j = 0; j < nb_valid_elements;j++)
7027 		if (xmlStrEqual(elements[i], names[j])) break;
7028 	    names[nb_valid_elements++] = elements[i];
7029 	    if (nb_valid_elements >= max) break;
7030 	}
7031     }
7032 
7033     /*
7034      * Restore the tree structure
7035      */
7036     if (prev) prev->next = prev_next;
7037     if (next) next->prev = next_prev;
7038     parent->children = parent_childs;
7039     parent->last = parent_last;
7040 
7041     /*
7042      * Free up the dummy node
7043      */
7044     test_node->name = name;
7045     xmlFreeNode(test_node);
7046 
7047     return(nb_valid_elements);
7048 }
7049 #endif /* LIBXML_VALID_ENABLED */
7050 
7051 #define bottom_valid
7052 #include "elfgcchack.h"
7053