commit 0f722b53f57ef193ff7ba26fb83ba43298a91a40
Author: Hugh Davenport <hugh@allthethings.co.nz>
Date:   Thu Oct 8 17:14:35 2015 -0400

    Check parser EOF state after parsing markup declarations
    
    For https://bugzilla.gnome.org/show_bug.cgi?id=756263
    
    There are times when the parser may reach EOF on a non well-formed XML document
    within xmlParseMarkupDecl. Currently xmlParseMarkupDecl will set the instate to
    XML_PARSER_DTD at the end of the function call, but this will cause a memory
    over-read later in the parsing process if the EOF has already been reached. This
    patch detects whether the instate was set to XML_PARSER_EOF, and returns early
    if this is the case.

diff --git a/parser.c b/parser.c
index a65e4cc..04b0e58 100644
--- a/parser.c
+++ b/parser.c
@@ -6970,6 +6970,15 @@ xmlParseMarkupDecl(xmlParserCtxtPtr ctxt) {
 	    xmlParsePI(ctxt);
 	}
     }
+
+    /*
+     * If the parser eached end of file, then stop while we know it is failing.
+     * This stops the parser being put into a bad state later on when there is no
+     * more input.
+     */
+    if (ctxt->instate == XML_PARSER_EOF)
+        return;
+
     /*
      * This is only for internal subset. On external entities,
      * the replacement is done before parsing stage
