444994 HTML chunked failure for attribute with <>

* HTMLparser.c: fix htmlParseLookupSequence to not save ctxt->checkIndex
  when the current buffer ends within an attribute value, as this
  information would be missed in next pass.

HTMLparser.c

@@ -4632,7 +4632,8 @@ htmlCreateDocParserCtxt(const xmlChar *cur, const char *encoding) {
 static int
 htmlParseLookupSequence(htmlParserCtxtPtr ctxt, xmlChar first,
                         xmlChar next, xmlChar third, int iscomment,
-						int ignoreattrval) {
+                        int ignoreattrval)
+{
     int base, len;
     htmlParserInputPtr in;
     const xmlChar *buf;
@@ -4641,94 +4642,105 @@ htmlParseLookupSequence(htmlParserCtxtPtr ctxt, xmlChar first,
     char valdellim = 0x0;
 
     in = ctxt->input;
-    if (in == NULL) return(-1);
+    if (in == NULL)
+        return (-1);
+
     base = in->cur - in->base;
-    if (base < 0) return(-1);
+    if (base < 0)
+        return (-1);
+
     if (ctxt->checkIndex > base)
         base = ctxt->checkIndex;
+
     if (in->buf == NULL) {
-	buf = in->base;
+        buf = in->base;
-	len = in->length;
+        len = in->length;
     } else {
-	buf = in->buf->buffer->content;
+        buf = in->buf->buffer->content;
-	len = in->buf->buffer->use;
+        len = in->buf->buffer->use;
     }
+
     /* take into account the sequence length */
-    if (third) len -= 2;
+    if (third)
-    else if (next) len --;
+        len -= 2;
-    for (;base < len;base++) {
+    else if (next)
-	if (!incomment && (base + 4 < len) && !iscomment) {
+        len--;
-	    if ((buf[base] == '<') && (buf[base + 1] == '!') &&
+    for (; base < len; base++) {
-		(buf[base + 2] == '-') && (buf[base + 3] == '-')) {
+        if ((!incomment) && (base + 4 < len) && (!iscomment)) {
-		incomment = 1;
+            if ((buf[base] == '<') && (buf[base + 1] == '!') &&
-		/* do not increment past <! - some people use <!--> */
+                (buf[base + 2] == '-') && (buf[base + 3] == '-')) {
-		base += 2;
+                incomment = 1;
-	    }
+                /* do not increment past <! - some people use <!--> */
-	}
+                base += 2;
-	if (ignoreattrval) {
+            }
-		if (buf[base] == '"' || buf[base] == '\'') {
+        }
-			if (invalue) {
+        if (ignoreattrval) {
-				if (buf[base] == valdellim) {
+            if (buf[base] == '"' || buf[base] == '\'') {
-					invalue = 0;
+                if (invalue) {
-					continue;
+                    if (buf[base] == valdellim) {
-				}
+                        invalue = 0;
-			} else {
+                        continue;
-				valdellim = buf[base];
+                    }
-				invalue = 1;
+                } else {
-				continue;
+                    valdellim = buf[base];
-			}
+                    invalue = 1;
-		} else if (invalue) {
+                    continue;
-			continue;
+                }
-		}
+            } else if (invalue) {
-	}
+                continue;
-	if (incomment) {
+            }
-	    if (base + 3 > len)
+        }
-		return(-1);
+        if (incomment) {
-	    if ((buf[base] == '-') && (buf[base + 1] == '-') &&
+            if (base + 3 > len)
-		(buf[base + 2] == '>')) {
+                return (-1);
-		incomment = 0;
+            if ((buf[base] == '-') && (buf[base + 1] == '-') &&
-		base += 2;
+                (buf[base + 2] == '>')) {
-	    }
+                incomment = 0;
-	    continue;
+                base += 2;
-	}
+            }
+            continue;
+        }
         if (buf[base] == first) {
-	    if (third != 0) {
+            if (third != 0) {
-		if ((buf[base + 1] != next) ||
+                if ((buf[base + 1] != next) || (buf[base + 2] != third))
-		    (buf[base + 2] != third)) continue;
+                    continue;
-	    } else if (next != 0) {
+            } else if (next != 0) {
-		if (buf[base + 1] != next) continue;
+                if (buf[base + 1] != next)
-	    }
+                    continue;
-	    ctxt->checkIndex = 0;
+            }
+            ctxt->checkIndex = 0;
 #ifdef DEBUG_PUSH
-	    if (next == 0)
+            if (next == 0)
-		xmlGenericError(xmlGenericErrorContext,
+                xmlGenericError(xmlGenericErrorContext,
-			"HPP: lookup '%c' found at %d\n",
+                                "HPP: lookup '%c' found at %d\n",
-			first, base);
+                                first, base);
-	    else if (third == 0)
+            else if (third == 0)
-		xmlGenericError(xmlGenericErrorContext,
+                xmlGenericError(xmlGenericErrorContext,
-			"HPP: lookup '%c%c' found at %d\n",
+                                "HPP: lookup '%c%c' found at %d\n",
-			first, next, base);
+                                first, next, base);
-	    else
+            else
-		xmlGenericError(xmlGenericErrorContext,
+                xmlGenericError(xmlGenericErrorContext,
-			"HPP: lookup '%c%c%c' found at %d\n",
+                                "HPP: lookup '%c%c%c' found at %d\n",
-			first, next, third, base);
+                                first, next, third, base);
 #endif
-	    return(base - (in->cur - in->base));
+            return (base - (in->cur - in->base));
-	}
+        }
     }
-    ctxt->checkIndex = base;
+    if ((!incomment) && (!invalue))
+        ctxt->checkIndex = base;
 #ifdef DEBUG_PUSH
     if (next == 0)
-	xmlGenericError(xmlGenericErrorContext,
+        xmlGenericError(xmlGenericErrorContext,
-		"HPP: lookup '%c' failed\n", first);
+                        "HPP: lookup '%c' failed\n", first);
     else if (third == 0)
-	xmlGenericError(xmlGenericErrorContext,
+        xmlGenericError(xmlGenericErrorContext,
-		"HPP: lookup '%c%c' failed\n", first, next);
+                        "HPP: lookup '%c%c' failed\n", first, next);
     else
-	xmlGenericError(xmlGenericErrorContext,
+        xmlGenericError(xmlGenericErrorContext,
-		"HPP: lookup '%c%c%c' failed\n", first, next, third);
+                        "HPP: lookup '%c%c%c' failed\n", first, next,
+                        third);
 #endif
-    return(-1);
+    return (-1);
 }
 
 /**