Code: xmlParsePEReference(xmlParserCtxtPtr ctxt)
{
 const xmlChar *name;
    xmlEntityPtr entity = NULL;
    xmlParserInputPtr input;

 if (RAW != '%')
 return;
    NEXT;
    name = xmlParseName(ctxt);
 if (name == NULL) {
	xmlFatalErrMsg(ctxt, XML_ERR_NAME_REQUIRED,
 "xmlParsePEReference: no name\n");
 return;
 }
 if (RAW != ';') {
	xmlFatalErr(ctxt, XML_ERR_ENTITYREF_SEMICOL_MISSING, NULL);
 return;
 }

    NEXT;

 /*
     * Increate the number of entity references parsed
     */
    ctxt->nbentities++;

 /*
     * Request the entity from SAX
     */
 if ((ctxt->sax != NULL) &&
 (ctxt->sax->getParameterEntity != NULL))
	entity = ctxt->sax->getParameterEntity(ctxt->userData, name);
 if (ctxt->instate == XML_PARSER_EOF)
 return;
 if (entity == NULL) {
 /*
	 * [ WFC: Entity Declared ]
	 * In a document without any DTD, a document with only an
	 * internal DTD subset which contains no parameter entity
	 * references, or a document with "standalone='yes'", ...
	 * ... The declaration of a parameter entity must precede
	 * any reference to it...
	 */
 if ((ctxt->standalone == 1) ||
 ((ctxt->hasExternalSubset == 0) &&
 (ctxt->hasPErefs == 0))) {
	    xmlFatalErrMsgStr(ctxt, XML_ERR_UNDECLARED_ENTITY,
 "PEReference: %%%s; not found\n",
			      name);
 } else {
 /*
	     * [ VC: Entity Declared ]
	     * In a document with an external subset or external
	     * parameter entities with "standalone='no'", ...
	     * ... The declaration of a parameter entity must
	     * precede any reference to it...
	     */
	    xmlWarningMsg(ctxt, XML_WAR_UNDECLARED_ENTITY,
 "PEReference: %%%s; not found\n",
			  name, NULL);
	    ctxt->valid = 0;
 }
	xmlParserEntityCheck(ctxt, 0, NULL, 0);
 } else {
 /*
	 * Internal checking in case the entity quest barfed
	 */
 if ((entity->etype != XML_INTERNAL_PARAMETER_ENTITY) &&
 (entity->etype != XML_EXTERNAL_PARAMETER_ENTITY)) {
	    xmlWarningMsg(ctxt, XML_WAR_UNDECLARED_ENTITY,
 "Internal: %%%s; is not a parameter entity\n",
			  name, NULL);
 } else if (ctxt->input->free != deallocblankswrapper) {
	    input = xmlNewBlanksWrapperInputStream(ctxt, entity);

 	    if (xmlPushInput(ctxt, input) < 0)
 		return;
 	} else {
 	    /*
 	     * TODO !!!
 	     * handle the extra spaces added before and after
	     * c.f. http://www.w3.org/TR/REC-xml#as-PE
	     */
	    input = xmlNewEntityInputStream(ctxt, entity);
 if (xmlPushInput(ctxt, input) < 0)
 return;
 if ((entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) &&
 (CMP5(CUR_PTR, '<', '?', 'x', 'm', 'l')) &&
 (IS_BLANK_CH(NXT(5)))) {
		xmlParseTextDecl(ctxt);
 if (ctxt->errNo ==
		    XML_ERR_UNSUPPORTED_ENCODING) {
 /*
		     * The XML REC instructs us to stop parsing
		     * right here
		     */
		    xmlHaltParser(ctxt);
 return;
 }
 }
 }
 }
    ctxt->hasPErefs = 1;
}

Vulnerability Type: 
CWE ID: CWE-611
Summary: A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).
Commit Message: DO NOT MERGE: Add validation for eternal enities

https://bugzilla.gnome.org/show_bug.cgi?id=780691

Bug: 36556310
Change-Id: I9450743e167c3c73af5e4071f3fc85e81d061648
(cherry picked from commit bef9af3d89d241bcb518c20cba6da2a2fd9ba049)
