3bd83f3
diff -Naur unbound-1.4.19-orig/smallapp/unbound-anchor.c unbound-1.4.19/smallapp/unbound-anchor.c
3bd83f3
--- unbound-1.4.19-orig/smallapp/unbound-anchor.c	2012-10-30 11:13:53.000000000 -0400
3bd83f3
+++ unbound-1.4.19/smallapp/unbound-anchor.c	2012-12-20 13:18:11.048256192 -0500
3bd83f3
@@ -1503,6 +1503,20 @@
3bd83f3
 	}
3bd83f3
 }
3bd83f3
 
3bd83f3
+/* Stop the parser when an entity declaration is encountered. For safety. */
3bd83f3
+static void
3bd83f3
+xml_entitydeclhandler(void *userData,
3bd83f3
+	const XML_Char *ATTR_UNUSED(entityName),
3bd83f3
+	int ATTR_UNUSED(is_parameter_entity),
3bd83f3
+	const XML_Char *ATTR_UNUSED(value), int ATTR_UNUSED(value_length),
3bd83f3
+	const XML_Char *ATTR_UNUSED(base),
3bd83f3
+	const XML_Char *ATTR_UNUSED(systemId),
3bd83f3
+	const XML_Char *ATTR_UNUSED(publicId),
3bd83f3
+	const XML_Char *ATTR_UNUSED(notationName))
3bd83f3
+{
3bd83f3
+	XML_StopParser((XML_Parser)userData, XML_FALSE);
3bd83f3
+}
3bd83f3
+
3bd83f3
 /**
3bd83f3
  * XML parser setup of the callbacks for the tags
3bd83f3
  */
3bd83f3
@@ -1531,6 +1545,7 @@
3bd83f3
 		if(verb) printf("out of memory\n");
3bd83f3
 		exit(0);
3bd83f3
 	}
3bd83f3
+	XML_SetEntityDeclHandler(parser, xml_entitydeclhandler);
3bd83f3
 	XML_SetElementHandler(parser, xml_startelem, xml_endelem);
3bd83f3
 	XML_SetCharacterDataHandler(parser, xml_charhandle);
3bd83f3
 }