Please describe the problem:
I use SAX parser and would like any entities not to be replaced.
In order to prevent entities expanding I add getEntity callback function in 
xmlSAXHandler data structure, which is passed as a parameter to xmlSAXUserParseFile() function.

my_getEntity() function might look like the following:

static xmlEntityPtr
my_get_entity(void *user_data, const xmlChar *name)
{
    static xmlEntity  ent;

    ent.etype = XML_INTERNAL_PREDEFINED_ENTITY;

    if (strcmp(name, "lt") == 0)
    {
        ent.name = "lt";
        ent.orig = (char *)"<";
        ent.content = (char *)"<";
    }
    else if (strcmp(name, "gt") == 0)
    {
        ent.name = "gt";
        ent.orig = (char *)">";
        ent.content = (char *)">";
    }
    else if (...)
    {
        ...
    }

    return &ent;
}

In fact I do not know any other way to prevent expanding, otherwise I would 
use it, but anyway.

That works fine while SAX parser processes DATA parts, but it works badly
when it's time to parse entities in attribute values.



Steps to reproduce:
1. Modify getEntityDebug() function in testSAX.c file as follows:

static xmlEntityPtr
getEntityDebug(void *ctx ATTRIBUTE_UNUSED, const xmlChar *name)
{
    callbacks++;
    if (quiet)
        return(NULL);
    fprintf(stdout, "SAX.getEntity(%s)\n", name);
#if 0
    return(NULL);
#else
    {
    static xmlEntity  ent;

    ent.etype = XML_INTERNAL_PREDEFINED_ENTITY;

    if (strcmp(name, "lt") == 0)
    {
        ent.name = (const char *)"lt";
        ent.orig = (char *)"<";
        ent.content = (char *)"<";
    }
    else if (strcmp(name, "gt") == 0)
    {
        ent.name = (const char *)"gt";
        ent.orig = (char *)">";
        ent.content = (char *)">";
    }
    else if (strcmp(name, "amp") == 0)
    {
        ent.name = (const char *)"amp";
        ent.orig = (char *)"&";
        ent.content = (char *)"&";
    }
    else if (strcmp(name, "quot") == 0)
    {
        ent.name = (const char *)"quot";
        ent.orig = (char *)""";
        ent.content = (char *)""";
    }
    else if (strcmp(name, "apos") == 0)
    {
        ent.name = (const char *)"apos";
        ent.orig = (char *)"'";
        ent.content = (char *)"'";
    }
    else
        return NULL;

    return &ent;
    }
#endif
}

2. rebuild testSAX application

3. Run testSAX with the following XML file:

<?xml version="1.0"?>
<test>
  <tag attr="&lt; &amp; &gt; &quot; &apos;"/>
</test>


Actual results:

4. The result will be:

SAX.setDocumentLocator()
SAX.startDocument()
SAX.startElement(test)
SAX.characters(
  , 3)
SAX.getEntity(lt)
SAX.getEntity(amp)
SAX.getEntity(gt)
SAX.getEntity(quot)
SAX.getEntity(apos)
SAX.startElement(tag, attr='&#38; &#38; &#38; &#38; &#38;')
SAX.endElement(tag)
SAX.characters(
, 1)
SAX.endElement(test)
SAX.endDocument()

=========

So you see that all the entities were expanded as &#38; , which is the code
of ampersand character. Well I do not mind that &amp; entity was converted in 
such a dirty way, but it is definitely incorrect to convert all the entities
to be ampersands!


Expected results:


Does this happen every time?


Other information:
Why it happens:
In file parser.c function xmlParseAttValueComplex() there are the following lines:

...
            } else {
                ent = xmlParseEntityRef(ctxt);
                if ((ent != NULL) &&
                    (ent->etype == XML_INTERNAL_PREDEFINED_ENTITY)) {
                    if (len > buf_size - 10) {
                        growBuffer(buf);
                    }
                    if ((ctxt->replaceEntities == 0) &&
                        (ent->content[0] == '&')) {
                        buf[len++] = '&';
                        buf[len++] = '#';
                        buf[len++] = '3';
                        buf[len++] = '8';
                        buf[len++] = ';';
                    } else {
                        buf[len++] = ent->content[0];
                    }
                } else if ((ent != NULL) &&
...

Here we can see that in case the following condition is true:
"ent->content[0] == '&'" we output &#38;
But for the case of any entity this is always true! because the first element 
of content when we parse entity is '&' character (I debugged this with GDB).

Any comments will be appreciated as I've got stuck with converting entities.
The best behaviour, which I would regard as the right solution is to output
entities according to the information I provided in my callback, otherwise
getEntity callback is just hype when it is used for attributes.

Some more words to explain why it is a problem:
When I want to define some private entities, and the way they converted 
I would define getEntity() callback and put there those mappings as I 
currently do with standards ones.

I've just check that this works for DATA regions, but attributes.