From 180e53212167ccbeb52f871ea9fbf1cbb08975c5 Mon Sep 17 00:00:00 2001
From: "bzbarsky%mit.edu" <bzbarsky%mit.edu>
Date: Thu, 21 Apr 2005 21:20:19 +0000
Subject: [PATCH] Make sure to read memory that actually contains what we want.
  Bug 291020, r+sr=peterv, a=asa

---
 parser/expat/lib/xmlparse.c | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/parser/expat/lib/xmlparse.c b/parser/expat/lib/xmlparse.c
index 078eb9cb4211..25bdc3901939 100644
--- a/parser/expat/lib/xmlparse.c
+++ b/parser/expat/lib/xmlparse.c
@@ -2353,10 +2353,30 @@ doContent(XML_Parser parser,
         len = XmlNameLength(enc, rawName);
         if (len != tag->rawNameLength
             || memcmp(tag->rawName, rawName, len) != 0) {
-          *eventPP = rawName;
 /* BEGIN MOZILLA CHANGE (Report opening tag of mismatched closing tag) */
+	  /* This code is copied from the |if (endElementHandler)| block below */
+          const XML_Char *localPart;
+          const XML_Char *prefix;
+          XML_Char *uri;
+          localPart = tag->name.localPart;
+          if (ns && localPart) {
+            /* localPart and prefix may have been overwritten in
+               tag->name.str, since this points to the binding->uri
+               buffer which gets re-used; so we have to add them again
+            */
+            uri = (XML_Char *)tag->name.str + tag->name.uriLen;
+            /* don't need to check for space - already done in storeAtts() */
+            while (*localPart) *uri++ = *localPart++;
+            prefix = (XML_Char *)tag->name.prefix;
+            if (ns_triplets && prefix) {
+              *uri++ = namespaceSeparator;
+              while (*prefix) *uri++ = *prefix++;
+             }
+            *uri = XML_T('\0');
+          }
           mismatch = tag->name.str;
 /* END MOZILLA CHANGE */
+          *eventPP = rawName;
           return XML_ERROR_TAG_MISMATCH;
         }
         --tagLevel;