Added patch for CVE-2009-2625 (bug #280613).

(Portage version: 2.2_rc36/cvs/Linux x86_64)

3 files changed, 745 insertions, 1 deletions

diff --git a/dev-libs/xerces-c/ChangeLog b/dev-libs/xerces-c/ChangeLog
index 2818f44c75af..4f7d06ddcd85 100644
--- a/dev-libs/xerces-c/ChangeLog
+++ b/dev-libs/xerces-c/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for dev-libs/xerces-c
 # Copyright 1999-2009 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-libs/xerces-c/ChangeLog,v 1.79 2009/03/02 08:58:57 dev-zero Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/xerces-c/ChangeLog,v 1.80 2009/08/07 05:37:03 dev-zero Exp $
+
+*xerces-c-3.0.1-r1 (07 Aug 2009)
+
+  07 Aug 2009; Tiziano Müller <dev-zero@gentoo.org>
+  +xerces-c-3.0.1-r1.ebuild, +files/xerces-c-3.0.1-CVE-2009-2625.patch:
+  Added patch for CVE-2009-2625 (bug #280613).
 
 *xerces-c-3.0.1 (02 Mar 2009)
 
diff --git a/dev-libs/xerces-c/files/xerces-c-3.0.1-CVE-2009-2625.patch b/dev-libs/xerces-c/files/xerces-c-3.0.1-CVE-2009-2625.patch
new file mode 100644
index 000000000000..d3ab8ed32722
--- /dev/null
+++ b/dev-libs/xerces-c/files/xerces-c-3.0.1-CVE-2009-2625.patch
@@ -0,0 +1,649 @@
+--- xerces/c/trunk/src/xercesc/validators/DTD/DTDScanner.cpp	2009/06/03 17:26:39	781487
++++ xerces/c/trunk/src/xercesc/validators/DTD/DTDScanner.cpp	2009/06/03 17:27:07	781488
+@@ -27,7 +27,9 @@
+ #include <xercesc/util/FlagJanitor.hpp>
+ #include <xercesc/util/Janitor.hpp>
+ #include <xercesc/util/XMLUniDefs.hpp>
++#include <xercesc/util/ValueStackOf.hpp>
+ #include <xercesc/util/UnexpectedEOFException.hpp>
++#include <xercesc/util/OutOfMemoryException.hpp>
+ #include <xercesc/sax/InputSource.hpp>
+ #include <xercesc/framework/XMLDocumentHandler.hpp>
+ #include <xercesc/framework/XMLEntityHandler.hpp>
+@@ -39,7 +41,6 @@
+ #include <xercesc/validators/DTD/DTDEntityDecl.hpp>
+ #include <xercesc/validators/DTD/DocTypeHandler.hpp>
+ #include <xercesc/validators/DTD/DTDScanner.hpp>
+-#include <xercesc/util/OutOfMemoryException.hpp>
+ 
+ XERCES_CPP_NAMESPACE_BEGIN
+ 
+@@ -1041,338 +1042,354 @@
+     // Check for a PE ref here, but don't require spaces
+     checkForPERef(false, true);
+ 
+-    // We have to check entity nesting here
+-    XMLSize_t curReader;
+-
++    ValueStackOf<XMLSize_t>* arrNestedDecl=NULL;
+     //
+     //  We know that the caller just saw an opening parenthesis, so we need
+-    //  to parse until we hit the end of it, recursing for other nested
+-    //  parentheses we see.
++    //  to parse until we hit the end of it; if we find several parenthesis,
++    //  store them in an array to be processed later.
+     //
+     //  We have to check for one up front, since it could be something like
+     //  (((a)*)) etc...
+     //
+     ContentSpecNode* curNode = 0;
+-    if (fReaderMgr->skippedChar(chOpenParen))
++    while(fReaderMgr->skippedChar(chOpenParen))
+     {
+-        curReader = fReaderMgr->getCurrentReaderNum();
++        // to check entity nesting
++        const XMLSize_t curReader = fReaderMgr->getCurrentReaderNum();
++        if(arrNestedDecl==NULL)
++            arrNestedDecl=new (fMemoryManager) ValueStackOf<XMLSize_t>(5, fMemoryManager);
++        arrNestedDecl->push(curReader);
+ 
+-        // Lets call ourself and get back the resulting node
+-        curNode = scanChildren(elemDecl, bufToUse);
++        // Check for a PE ref here, but don't require spaces
++        checkForPERef(false, true);
++    }
+ 
+-        // If that failed, no need to go further, return failure
+-        if (!curNode)
+-            return 0;
++    // We must find a leaf node here, either standalone or nested in the parenthesis
++    if (!fReaderMgr->getName(bufToUse))
++    {
++        fScanner->emitError(XMLErrs::ExpectedElementName);
++        return 0;
++    }
+ 
+-        if (curReader != fReaderMgr->getCurrentReaderNum() && fScanner->getValidationScheme() == XMLScanner::Val_Always)
+-            fScanner->getValidator()->emitError(XMLValid::PartialMarkupInPE);
++    //
++    //  Create a leaf node for it. If we can find the element id for
++    //  this element, then use it. Else, we have to fault in an element
++    //  decl, marked as created because of being in a content model.
++    //
++    XMLElementDecl* decl = fDTDGrammar->getElemDecl(fEmptyNamespaceId, 0, bufToUse.getRawBuffer(), Grammar::TOP_LEVEL_SCOPE);
++    if (!decl)
++    {
++        decl = new (fGrammarPoolMemoryManager) DTDElementDecl
++        (
++            bufToUse.getRawBuffer()
++            , fEmptyNamespaceId
++            , DTDElementDecl::Any
++            , fGrammarPoolMemoryManager
++        );
++        decl->setCreateReason(XMLElementDecl::InContentModel);
++        decl->setExternalElemDeclaration(isReadingExternalEntity());
++        fDTDGrammar->putElemDecl(decl);
+     }
+-     else
++    curNode = new (fGrammarPoolMemoryManager) ContentSpecNode
++    (
++        decl->getElementName()
++        , fGrammarPoolMemoryManager
++    );
++
++    // Check for a PE ref here, but don't require spaces
++    const bool gotSpaces = checkForPERef(false, true);
++
++    // Check for a repetition character after the leaf
++    XMLCh repCh = fReaderMgr->peekNextChar();
++    ContentSpecNode* tmpNode = makeRepNode(repCh, curNode, fGrammarPoolMemoryManager);
++    if (tmpNode != curNode)
+     {
+-        // Not a nested paren, so it must be a leaf node
+-        if (!fReaderMgr->getName(bufToUse))
++        if (gotSpaces)
+         {
+-            fScanner->emitError(XMLErrs::ExpectedElementName);
+-            return 0;
++            if (fScanner->emitErrorWillThrowException(XMLErrs::UnexpectedWhitespace))
++            {
++                delete tmpNode;
++            }
++            fScanner->emitError(XMLErrs::UnexpectedWhitespace);
+         }
++        fReaderMgr->getNextChar();
++        curNode = tmpNode;
++    }
++
++    while(arrNestedDecl==NULL || !arrNestedDecl->empty())
++    {
++        // Check for a PE ref here, but don't require spaces
++        checkForPERef(false, true);
+ 
+         //
+-        //  Create a leaf node for it. If we can find the element id for
+-        //  this element, then use it. Else, we have to fault in an element
+-        //  decl, marked as created because of being in a content model.
++        //  Ok, the next character tells us what kind of content this particular
++        //  model this particular parentesized section is. Its either a choice if
++        //  we see ',', a sequence if we see '|', or a single leaf node if we see
++        //  a closing paren.
++        //
++        const XMLCh opCh = fReaderMgr->peekNextChar();
++
++        if ((opCh != chComma)
++        &&  (opCh != chPipe)
++        &&  (opCh != chCloseParen))
++        {
++            // Not a legal char, so delete our node and return failure
++            delete curNode;
++            fScanner->emitError(XMLErrs::ExpectedSeqChoiceLeaf);
++            return 0;
++        }
++
+         //
+-        XMLElementDecl* decl = fDTDGrammar->getElemDecl(fEmptyNamespaceId, 0, bufToUse.getRawBuffer(), Grammar::TOP_LEVEL_SCOPE);
+-        if (!decl)
++        //  Create the head node of the correct type. We need this to remember
++        //  the top of the local tree. If it was a single subexpr, then just
++        //  set the head node to the current node. For the others, we'll build
++        //  the tree off the second child as we move across.
++        //
++        ContentSpecNode* headNode = 0;
++        ContentSpecNode::NodeTypes curType = ContentSpecNode::UnknownType;
++        if (opCh == chComma)
+         {
+-            decl = new (fGrammarPoolMemoryManager) DTDElementDecl
++            curType = ContentSpecNode::Sequence;
++            headNode = new (fGrammarPoolMemoryManager) ContentSpecNode
+             (
+-                bufToUse.getRawBuffer()
+-                , fEmptyNamespaceId
+-                , DTDElementDecl::Any
++                curType
++                , curNode
++                , 0
++                , true
++                , true
+                 , fGrammarPoolMemoryManager
+             );
+-            decl->setCreateReason(XMLElementDecl::InContentModel);
+-            decl->setExternalElemDeclaration(isReadingExternalEntity());
+-            fDTDGrammar->putElemDecl(decl);
++            curNode = headNode;
+         }
+-        curNode = new (fGrammarPoolMemoryManager) ContentSpecNode
+-        (
+-            decl->getElementName()
+-            , fGrammarPoolMemoryManager
+-        );
+-
+-        // Check for a PE ref here, but don't require spaces
+-        const bool gotSpaces = checkForPERef(false, true);
+-
+-        // Check for a repetition character after the leaf
+-        const XMLCh repCh = fReaderMgr->peekNextChar();
+-        ContentSpecNode* tmpNode = makeRepNode(repCh, curNode, fGrammarPoolMemoryManager);
+-        if (tmpNode != curNode)
++         else if (opCh == chPipe)
+         {
+-            if (gotSpaces)
+-            {
+-                if (fScanner->emitErrorWillThrowException(XMLErrs::UnexpectedWhitespace))
+-                {
+-                    delete tmpNode;
+-                }
+-                fScanner->emitError(XMLErrs::UnexpectedWhitespace);
+-            }
++            curType = ContentSpecNode::Choice;
++            headNode = new (fGrammarPoolMemoryManager) ContentSpecNode
++            (
++                curType
++                , curNode
++                , 0
++                , true
++                , true
++                , fGrammarPoolMemoryManager
++            );
++            curNode = headNode;
++        }
++         else
++        {
++            headNode = curNode;
+             fReaderMgr->getNextChar();
+-            curNode = tmpNode;
+         }
+-    }
+ 
+-    // Check for a PE ref here, but don't require spaces
+-    checkForPERef(false, true);
+-
+-    //
+-    //  Ok, the next character tells us what kind of content this particular
+-    //  model this particular parentesized section is. Its either a choice if
+-    //  we see ',', a sequence if we see '|', or a single leaf node if we see
+-    //  a closing paren.
+-    //
+-    const XMLCh opCh = fReaderMgr->peekNextChar();
+-
+-    if ((opCh != chComma)
+-    &&  (opCh != chPipe)
+-    &&  (opCh != chCloseParen))
+-    {
+-        // Not a legal char, so delete our node and return failure
+-        delete curNode;
+-        fScanner->emitError(XMLErrs::ExpectedSeqChoiceLeaf);
+-        return 0;
+-    }
+-
+-    //
+-    //  Create the head node of the correct type. We need this to remember
+-    //  the top of the local tree. If it was a single subexpr, then just
+-    //  set the head node to the current node. For the others, we'll build
+-    //  the tree off the second child as we move across.
+-    //
+-    ContentSpecNode* headNode = 0;
+-    ContentSpecNode::NodeTypes curType = ContentSpecNode::UnknownType;
+-    if (opCh == chComma)
+-    {
+-        curType = ContentSpecNode::Sequence;
+-        headNode = new (fGrammarPoolMemoryManager) ContentSpecNode
+-        (
+-            curType
+-            , curNode
+-            , 0
+-            , true
+-            , true
+-            , fGrammarPoolMemoryManager
+-        );
+-        curNode = headNode;
+-    }
+-     else if (opCh == chPipe)
+-    {
+-        curType = ContentSpecNode::Choice;
+-        headNode = new (fGrammarPoolMemoryManager) ContentSpecNode
+-        (
+-            curType
+-            , curNode
+-            , 0
+-            , true
+-            , true
+-            , fGrammarPoolMemoryManager
+-        );
+-        curNode = headNode;
+-    }
+-     else
+-    {
+-        headNode = curNode;
+-        fReaderMgr->getNextChar();
+-    }
+-
+-    //
+-    //  If it was a sequence or choice, we just loop until we get to the
+-    //  end of our section, adding each new leaf or sub expression to the
+-    //  right child of the current node, and making that new node the current
+-    //  node.
+-    //
+-    if ((opCh == chComma) || (opCh == chPipe))
+-    {
+-        ContentSpecNode* lastNode = 0;
+-        while (true)
++        //
++        //  If it was a sequence or choice, we just loop until we get to the
++        //  end of our section, adding each new leaf or sub expression to the
++        //  right child of the current node, and making that new node the current
++        //  node.
++        //
++        if ((opCh == chComma) || (opCh == chPipe))
+         {
+-            //
+-            //  The next thing must either be another | or , character followed
+-            //  by another leaf or subexpression, or a closing parenthesis, or a
+-            //  PE ref.
+-            //
+-            if (fReaderMgr->lookingAtChar(chPercent))
+-            {
+-                checkForPERef(false, true);
+-            }
+-             else if (fReaderMgr->skippedSpace())
+-            {
+-                // Just skip whitespace
+-                fReaderMgr->skipPastSpaces();
+-            }
+-             else if (fReaderMgr->skippedChar(chCloseParen))
++            ContentSpecNode* lastNode = 0;
++            while (true)
+             {
+                 //
+-                //  We've hit the end of this section, so break out. But, we
+-                //  need to see if we left a partial sequence of choice node
+-                //  without a second node. If so, we have to undo that and
+-                //  put its left child into the right node of the previous
+-                //  node.
++                //  The next thing must either be another | or , character followed
++                //  by another leaf or subexpression, or a closing parenthesis, or a
++                //  PE ref.
+                 //
+-                if ((curNode->getType() == ContentSpecNode::Choice)
+-                ||  (curNode->getType() == ContentSpecNode::Sequence))
++                if (fReaderMgr->lookingAtChar(chPercent))
+                 {
+-                    if (!curNode->getSecond())
++                    checkForPERef(false, true);
++                }
++                 else if (fReaderMgr->skippedSpace())
++                {
++                    // Just skip whitespace
++                    fReaderMgr->skipPastSpaces();
++                }
++                 else if (fReaderMgr->skippedChar(chCloseParen))
++                {
++                    //
++                    //  We've hit the end of this section, so break out. But, we
++                    //  need to see if we left a partial sequence of choice node
++                    //  without a second node. If so, we have to undo that and
++                    //  put its left child into the right node of the previous
++                    //  node.
++                    //
++                    if ((curNode->getType() == ContentSpecNode::Choice)
++                    ||  (curNode->getType() == ContentSpecNode::Sequence))
+                     {
+-                        ContentSpecNode* saveFirst = curNode->orphanFirst();
+-                        lastNode->setSecond(saveFirst);
+-                        curNode = lastNode;
++                        if (!curNode->getSecond())
++                        {
++                            ContentSpecNode* saveFirst = curNode->orphanFirst();
++                            lastNode->setSecond(saveFirst);
++                            curNode = lastNode;
++                        }
+                     }
++                    break;
+                 }
+-                break;
+-            }
+-             else if (fReaderMgr->skippedChar(opCh))
+-            {
+-                // Check for a PE ref here, but don't require spaces
+-                checkForPERef(false, true);
+-
+-                if (fReaderMgr->skippedChar(chOpenParen))
++                 else if (fReaderMgr->skippedChar(opCh))
+                 {
+-                    curReader = fReaderMgr->getCurrentReaderNum();
++                    // Check for a PE ref here, but don't require spaces
++                    checkForPERef(false, true);
+ 
+-                    // Recurse to handle this new guy
+-                    ContentSpecNode* subNode;
+-                    try {
+-                        subNode = scanChildren(elemDecl, bufToUse);
+-                    }
+-                    catch (const XMLErrs::Codes)
++                    if (fReaderMgr->skippedChar(chOpenParen))
+                     {
+-                        delete headNode;
+-                        throw;
+-                    }
++                        const XMLSize_t curReader = fReaderMgr->getCurrentReaderNum();
+ 
+-                    // If it failed, we are done, clean up here and return failure
+-                    if (!subNode)
+-                    {
+-                        delete headNode;
+-                        return 0;
++                        // Recurse to handle this new guy
++                        ContentSpecNode* subNode;
++                        try {
++                            subNode = scanChildren(elemDecl, bufToUse);
++                        }
++                        catch (const XMLErrs::Codes)
++                        {
++                            delete headNode;
++                            throw;
++                        }
++
++                        // If it failed, we are done, clean up here and return failure
++                        if (!subNode)
++                        {
++                            delete headNode;
++                            return 0;
++                        }
++
++                        if (curReader != fReaderMgr->getCurrentReaderNum() && fScanner->getValidationScheme() == XMLScanner::Val_Always)
++                            fScanner->getValidator()->emitError(XMLValid::PartialMarkupInPE);
++
++                        // Else patch it in and make it the new current
++                        ContentSpecNode* newCur = new (fGrammarPoolMemoryManager) ContentSpecNode
++                        (
++                            curType
++                            , subNode
++                            , 0
++                            , true
++                            , true
++                            , fGrammarPoolMemoryManager
++                        );
++                        curNode->setSecond(newCur);
++                        lastNode = curNode;
++                        curNode = newCur;
+                     }
++                     else
++                    {
++                        //
++                        //  Got to be a leaf node, so get a name. If we cannot get
++                        //  one, then clean up and get outa here.
++                        //
++                        if (!fReaderMgr->getName(bufToUse))
++                        {
++                            delete headNode;
++                            fScanner->emitError(XMLErrs::ExpectedElementName);
++                            return 0;
++                        }
++
++                        //
++                        //  Create a leaf node for it. If we can find the element
++                        //  id for this element, then use it. Else, we have to
++                        //  fault in an element decl, marked as created because
++                        //  of being in a content model.
++                        //
++                        XMLElementDecl* decl = fDTDGrammar->getElemDecl(fEmptyNamespaceId, 0, bufToUse.getRawBuffer(), Grammar::TOP_LEVEL_SCOPE);
++                        if (!decl)
++                        {
++                            decl = new (fGrammarPoolMemoryManager) DTDElementDecl
++                            (
++                                bufToUse.getRawBuffer()
++                                , fEmptyNamespaceId
++                                , DTDElementDecl::Any
++                                , fGrammarPoolMemoryManager
++                            );
++                            decl->setCreateReason(XMLElementDecl::InContentModel);
++                            decl->setExternalElemDeclaration(isReadingExternalEntity());
++                            fDTDGrammar->putElemDecl(decl);
++                        }
+ 
+-                    if (curReader != fReaderMgr->getCurrentReaderNum() && fScanner->getValidationScheme() == XMLScanner::Val_Always)
+-                        fScanner->getValidator()->emitError(XMLValid::PartialMarkupInPE);
++                        ContentSpecNode* tmpLeaf = new (fGrammarPoolMemoryManager) ContentSpecNode
++                        (
++                            decl->getElementName()
++                            , fGrammarPoolMemoryManager
++                        );
+ 
+-                    // Else patch it in and make it the new current
+-                    ContentSpecNode* newCur = new (fGrammarPoolMemoryManager) ContentSpecNode
+-                    (
+-                        curType
+-                        , subNode
+-                        , 0
+-                        , true
+-                        , true
+-                        , fGrammarPoolMemoryManager
+-                    );
+-                    curNode->setSecond(newCur);
+-                    lastNode = curNode;
+-                    curNode = newCur;
++                        // Check for a repetition character after the leaf
++                        const XMLCh repCh = fReaderMgr->peekNextChar();
++                        ContentSpecNode* tmpLeaf2 = makeRepNode(repCh, tmpLeaf, fGrammarPoolMemoryManager);
++                        if (tmpLeaf != tmpLeaf2)
++                            fReaderMgr->getNextChar();
++
++                        //
++                        //  Create a new sequence or choice node, with the leaf
++                        //  (or rep surrounding it) we just got as its first node.
++                        //  Make the new node the second node of the current node,
++                        //  and then make it the current node.
++                        //
++                        ContentSpecNode* newCur = new (fGrammarPoolMemoryManager) ContentSpecNode
++                        (
++                            curType
++                            , tmpLeaf2
++                            , 0
++                            , true
++                            , true
++                            , fGrammarPoolMemoryManager
++                        );
++                        curNode->setSecond(newCur);
++                        lastNode = curNode;
++                        curNode = newCur;
++                    }
+                 }
+                  else
+                 {
+-                    //
+-                    //  Got to be a leaf node, so get a name. If we cannot get
+-                    //  one, then clean up and get outa here.
+-                    //
+-                    if (!fReaderMgr->getName(bufToUse))
++                    // Cannot be valid
++                    delete headNode;  // emitError may do a throw so need to clean-up first
++                    if (opCh == chComma)
+                     {
+-                        delete headNode;
+-                        fScanner->emitError(XMLErrs::ExpectedElementName);
+-                        return 0;
++                        fScanner->emitError(XMLErrs::ExpectedChoiceOrCloseParen);
+                     }
+-
+-                    //
+-                    //  Create a leaf node for it. If we can find the element
+-                    //  id for this element, then use it. Else, we have to
+-                    //  fault in an element decl, marked as created because
+-                    //  of being in a content model.
+-                    //
+-                    XMLElementDecl* decl = fDTDGrammar->getElemDecl(fEmptyNamespaceId, 0, bufToUse.getRawBuffer(), Grammar::TOP_LEVEL_SCOPE);
+-                    if (!decl)
++                     else
+                     {
+-                        decl = new (fGrammarPoolMemoryManager) DTDElementDecl
++                        fScanner->emitError
+                         (
+-                            bufToUse.getRawBuffer()
+-                            , fEmptyNamespaceId
+-                            , DTDElementDecl::Any
+-                            , fGrammarPoolMemoryManager
++                            XMLErrs::ExpectedSeqOrCloseParen
++                            , elemDecl.getFullName()
+                         );
+-                        decl->setCreateReason(XMLElementDecl::InContentModel);
+-                        decl->setExternalElemDeclaration(isReadingExternalEntity());
+-                        fDTDGrammar->putElemDecl(decl);
+-                    }
++                    }                
++                    return 0;
++                }
++            }
++        }
+ 
+-                    ContentSpecNode* tmpLeaf = new (fGrammarPoolMemoryManager) ContentSpecNode
+-                    (
+-                        decl->getElementName()
+-                        , fGrammarPoolMemoryManager
+-                    );
++        //
++        //  We saw the terminating parenthesis so lets check for any repetition
++        //  character, and create a node for that, making the head node the child
++        //  of it.
++        //
++        const XMLCh repCh = fReaderMgr->peekNextChar();
++        curNode = makeRepNode(repCh, headNode, fGrammarPoolMemoryManager);
++        if (curNode != headNode)
++            fReaderMgr->getNextChar();
+ 
+-                    // Check for a repetition character after the leaf
+-                    const XMLCh repCh = fReaderMgr->peekNextChar();
+-                    ContentSpecNode* tmpLeaf2 = makeRepNode(repCh, tmpLeaf, fGrammarPoolMemoryManager);
+-                    if (tmpLeaf != tmpLeaf2)
+-                        fReaderMgr->getNextChar();
++        // prepare for recursion
++        if(arrNestedDecl==NULL)
++            break;
++        else
++        {
++            // If that failed, no need to go further, return failure
++            if (!curNode)
++                return 0;
+ 
+-                    //
+-                    //  Create a new sequence or choice node, with the leaf
+-                    //  (or rep surrounding it) we just got as its first node.
+-                    //  Make the new node the second node of the current node,
+-                    //  and then make it the current node.
+-                    //
+-                    ContentSpecNode* newCur = new (fGrammarPoolMemoryManager) ContentSpecNode
+-                    (
+-                        curType
+-                        , tmpLeaf2
+-                        , 0
+-                        , true
+-                        , true
+-                        , fGrammarPoolMemoryManager
+-                    );
+-                    curNode->setSecond(newCur);
+-                    lastNode = curNode;
+-                    curNode = newCur;
+-                }
+-            }
+-             else
++            const XMLSize_t curReader = arrNestedDecl->pop();
++            if (curReader != fReaderMgr->getCurrentReaderNum() && fScanner->getValidationScheme() == XMLScanner::Val_Always)
++                fScanner->getValidator()->emitError(XMLValid::PartialMarkupInPE);
++
++            if(arrNestedDecl->empty())
+             {
+-                // Cannot be valid
+-                delete headNode;  // emitError may do a throw so need to clean-up first
+-                if (opCh == chComma)
+-                {
+-                    fScanner->emitError(XMLErrs::ExpectedChoiceOrCloseParen);
+-                }
+-                 else
+-                {
+-                    fScanner->emitError
+-                    (
+-                        XMLErrs::ExpectedSeqOrCloseParen
+-                        , elemDecl.getFullName()
+-                    );
+-                }                
+-                return 0;
++                delete arrNestedDecl;
++                arrNestedDecl=NULL;
+             }
+         }
+     }
+ 
+-    //
+-    //  We saw the terminating parenthesis so lets check for any repetition
+-    //  character, and create a node for that, making the head node the child
+-    //  of it.
+-    //
+-    XMLCh repCh = fReaderMgr->peekNextChar();
+-    ContentSpecNode* retNode = makeRepNode(repCh, headNode, fGrammarPoolMemoryManager);
+-    if (retNode != headNode)
+-        fReaderMgr->getNextChar();
+-
+-    return retNode;
++    return curNode;
+ }
+ 
+ 
diff --git a/dev-libs/xerces-c/xerces-c-3.0.1-r1.ebuild b/dev-libs/xerces-c/xerces-c-3.0.1-r1.ebuild
new file mode 100644
index 000000000000..a86075d07565
--- /dev/null
+++ b/dev-libs/xerces-c/xerces-c-3.0.1-r1.ebuild
@@ -0,0 +1,89 @@
+# Copyright 1999-2009 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-libs/xerces-c/xerces-c-3.0.1-r1.ebuild,v 1.1 2009/08/07 05:37:03 dev-zero Exp $
+
+EAPI="2"
+
+inherit eutils
+
+DESCRIPTION="A validating XML parser written in a portable subset of C++."
+HOMEPAGE="http://xerces.apache.org/xerces-c/"
+SRC_URI="mirror://apache/xerces/c/3/sources/${P}.tar.gz"
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~hppa ~ppc ~ppc64 ~sparc ~x86 ~x86-fbsd"
+IUSE="curl debug doc iconv icu libwww threads elibc_Darwin elibc_FreeBSD"
+
+RDEPEND="icu? ( dev-libs/icu )
+	curl? ( net-misc/curl )
+	libwww? ( net-libs/libwww )
+	virtual/libiconv"
+DEPEND="${RDEPEND}
+	doc? ( app-doc/doxygen )"
+
+pkg_setup() {
+	export ICUROOT="/usr"
+
+	if use iconv && use icu ; then
+		ewarn "This package can use iconv or icu for loading messages"
+		ewarn "and transcoding, but not both. ICU will precede."
+	fi
+}
+
+src_prepare() {
+	sed -i \
+		-e 's|$(prefix)/msg|$(DESTDIR)/$(prefix)/share/xerces-c/msg|' \
+		src/xercesc/util/MsgLoaders/MsgCatalog/Makefile.in || die "sed failed"
+
+	epatch "${FILESDIR}/${P}-CVE-2009-2625.patch"
+}
+
+src_configure() {
+	local mloader="inmemory"
+	use iconv && mloader="iconv"
+	use icu && mloader="icu"
+
+	local transcoder="gnuiconv"
+	use elibc_FreeBSD && transcoder="iconv"
+	use elibc_Darwin && transcoder="macosunicodeconverter"
+	use icu && transcoder="icu"
+
+	# 'cfurl' is only available on OSX and 'socket' isn't supposed to work.
+	# But the docs aren't clear about it, so we would need some testing...
+	local netaccessor="socket"
+	use elibc_Darwin && netaccessor="cfurl"
+	use libwww && netaccessor="libwww"
+	use curl && netaccessor="curl"
+
+	econf \
+		$(use_enable debug) \
+		$(use_enable threads) \
+		--enable-msgloader-${mloader} \
+		--enable-netaccessor-${netaccessor} \
+		--enable-transcoder-${transcoder}
+}
+
+src_compile() {
+	default
+
+	if use doc ; then
+		cd "${S}/doc"
+		doxygen || die "making docs failed"
+	fi
+}
+
+src_install () {
+	emake DESTDIR="${D}" install || die "emake failed"
+
+	cd "${S}"
+	doenvd "${FILESDIR}/50xerces-c"
+
+	if use doc; then
+		insinto /usr/share/doc/${PF}
+		rm -rf samples/Makefile* samples/runConfigure samples/src/*/Makefile* samples/.libs
+		doins -r samples
+		dohtml -r doc/html/*
+	fi
+
+	dodoc CREDITS KEYS NOTICE README version.incl
+}