Check for surrogates in NCRs

diff --git a/expat/xmltok/xmltok.c b/expat/xmltok/xmltok.c
index 8691e312f2a165c767fcb3cd7ca778032c62536a..1d8a354925e64b52587c52ca701cfaf06e13f45d 100755 (executable)
--- a/expat/xmltok/xmltok.c
+++ b/expat/xmltok/xmltok.c
@@ -671,11 +671,19 @@ int XmlParseXmlDecl(int isGeneralTextEntity,
 static
 int checkCharRefNumber(int result)
 {
-  /* FIXME maybe exclude surrogates as well */
-  if ((result < 0x80 && latin1_encoding.type[result] == BT_NONXML)
-      || result == 0xFFFE
-      || result == 0xFFFF)
+  switch (result >> 8) {
+  case 0xD8: case 0xD9: case 0xDA: case 0xDB:
+  case 0xDC: case 0xDD: case 0xDE: case 0xDF:
     return -1;
+  case 0:
+    if (latin1_encoding.type[result] == BT_NONXML)
+      return -1;
+    break;
+  case 0xFF:
+    if (result == 0xFFFE || result == 0xFFFF)
+      return -1;
+    break;
+  }
   return result;
 }