Fixed bug reported by Michael Brundage, This bug occurred when you xml document loaded following DTD  http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
Fixed bug reported by Michael Brundage,
This bug occurred when you xml document loaded following DTD
 http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd


The following ATTLIST caused the DTDScanner to die:

<!ATTLIST bdo
  %coreattrs;
  %events;
  lang        %LanguageCode; #IMPLIED
  xml:lang    %LanguageCode; #IMPLIED
  dir         (ltr|rtl)      #REQUIRED
  >


D:\saxbug>java sax.SAXCount -n testhtml.xml
n
Length of fData = 97
fData = >>lang        NMTOKEN #IMPLIED
  xml:lang    NMTOKEN #IMPLIED
  dir         (ltr|rtl)      #IMPLIED<<index = 34 fCurrentOffset = 4
java.lang.StringIndexOutOfBoundsException: String index out of range: -30
	at java.lang.String.substring(String.java:1503)
	at org.apache.xerces.readers.StringReader.scanQName(StringReader.java:686)
	at org.apache.xerces.framework.XMLDTDScanner.checkForAttributeNameWithPEReference(XMLDTDScanner.java:3120)
	at org.apache.xerces.framework.XMLDTDScanner.scanAttlistDecl(XMLDTDScanner.java:2046)
	at org.apache.xerces.framework.XMLDTDScanner.scanDecls(XMLDTDScanner.java:1433)
	at org.apache.xerces.framework.XMLDocumentScanner.scanDoctypeDecl(XMLDocumentScanner.java:2179)
	at org.apache.xerces.framework.XMLDocumentScanner.access$0(XMLDocumentScanner.java:2133)
	at org.apache.xerces.framework.XMLDocumentScanner$XMLDeclDispatcher.dispatch(XMLDocumentScanner.java:775)
	at org.apache.xerces.framework.XMLDocumentScanner.parseSome(XMLDocumentScanner.java:380)
	at org.apache.xerces.framework.XMLParser.parse(XMLParser.java:861)
	at org.apache.xerces.framework.XMLParser.parse(XMLParser.java:900)
	at sax.SAXCount.print(SAXCount.java:152)
	at sax.SAXCount.main(SAXCount.java:380)


Where we were trying the following:

 int index = fData.indexOf(':', nameOffset);
        if (index != -1) {
            qname.prefix = fStringPool.addSymbol(fData.substring(nameOffset, index));
            qname.localpart = fStringPool.addSymbol(fData.substring(index, fCurrentOffset));
        }
        else {
            qname.localpart = qname.rawname;
        }

Where index > fCurrentOffset

If we want the local name we need:

  qname.localpart = fStringPool.addSymbol(fData.substring(index, index + fCurrentOffset));


We should check the rest of this module for possible bugtraps like this ( check the other
readers + have more unit testcase to test code branches less frequently used).

Jeffrey Rodriguez



PR:
Obtained from:
Submitted by:
Reviewed by:


git-svn-id: 21df804813e9d3638e43477f308dd0be51e5f30f@315938 13f79535-47bb-0310-9956-ffa450edef68

RackerWilliams/xercesj,ronsigal/xerces,RackerWilliams/xercesj,jimma/xerces,RackerWilliams/xercesj,jimma/xerces,jimma/xerces,ronsigal/xerces,ronsigal/xerces