Upgrade libxmlsec to 1.2.21

Obsoletes xmlsec1-ooxml.patch.1 and xmlsec1-vs2015.patch.1.

Adds xmlsec1-keyinfo-revert.patch.1 till the LO side is adapted to the
new xmlsec requirements.

Change-Id: I1a46ad8fd7e9c8b4fa7a97591a1d90922969393d
Reviewed-on: https://gerrit.libreoffice.org/24403Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>

download.lst

@@ -92,7 +92,7 @@ export LIBEXTTEXTCAT_TARBALL := 10d61fbaa6a06348823651b1bd7940fe-libexttextcat-3
 export LIBGLTF_MD5SUM := d63a9f47ab048f5009d90693d6aa6424
 export LIBGLTF_TARBALL := libgltf-0.0.2.tar.bz2
 export LIBLANGTAG_TARBALL := aa899eff126216dafe721149fbdb511b-liblangtag-0.5.8.tar.bz2
-export LIBXMLSEC_TARBALL := ce12af00283eb90d9281956524250d6e-xmlsec1-1.2.20.tar.gz
+export LIBXMLSEC_TARBALL := 95f31bcbe0ae278a22d3f77f1e732d29-xmlsec1-1.2.21.tar.gz
 export LIBXML_TARBALL := ae249165c173b1ff386ee8ad676815f5-libxml2-2.9.4.tar.gz
 export LIBXSLT_TARBALL := a129d3c44c022de3b9dcf6d6f288d72e-libxslt-1.1.29.tar.gz
 export LPSOLVE_TARBALL := 26b3e95ddf3d9c077c480ea45874b3b8-lp_solve_5.5.tar.gz

external/libxmlsec/UnpackedTarball_xmlsec.mk

@@ -15,12 +15,9 @@ xmlsec_patches += xmlsec1-nssmangleciphers.patch.1
 xmlsec_patches += xmlsec1-noverify.patch.1
 xmlsec_patches += xmlsec1-mingw-keymgr-mscrypto.patch.1
 xmlsec_patches += xmlsec1-vc.patch.1
-# Upstreamed as <https://github.com/lsh123/xmlsec/commit/727f1d3f1fa9c23d6d356b233c6fa274b5dd7d71>.
-xmlsec_patches += xmlsec1-vs2015.patch.1
 xmlsec_patches += xmlsec1-1.2.14_fix_extern_c.patch.1
 xmlsec_patches += xmlsec1-customkeymanage.patch.1
-# Upstreamed as <https://github.com/lsh123/xmlsec/commit/7069e2b0ab49679008abedd6d223fb95538b0684>.
-xmlsec_patches += xmlsec1-ooxml.patch.1
+xmlsec_patches += xmlsec1-keyinfo-revert.patch.1
 
 $(eval $(call gb_UnpackedTarball_UnpackedTarball,xmlsec))
 

external/libxmlsec/xmlsec1-1.2.14_fix_extern_c.patch.1

-From 88dbb430ab261c153c51094dc183dd8876f9ba50 Mon Sep 17 00:00:00 2001
+From 145ae5235f79fec807f360cc34a0bf16cd6b6d75 Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:12:48 +0100
 Subject: [PATCH] xmlsec1-1.2.14_fix_extern_c.patch
@@ -10,7 +10,7 @@ Conflicts:
  1 file changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/include/xmlsec/xmlsec.h b/include/xmlsec/xmlsec.h
-index ad44918..b72aa62 100644
+index 963b37a..ec58bec 100644
 --- a/include/xmlsec/xmlsec.h
 +++ b/include/xmlsec/xmlsec.h
 @@ -11,16 +11,16 @@
@@ -35,5 +35,5 @@ index ad44918..b72aa62 100644
   *
   * Basic types to make ports to exotic platforms easier
 -- 
-2.6.2
+2.6.6
 

external/libxmlsec/xmlsec1-configure.patch.1

-From a6200ded4c697408d00eb79cbc712acceb8aef83 Mon Sep 17 00:00:00 2001
+From 3a8aaa9a5baf91ef6bf9c24b4080896fb8615b0c Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:06:19 +0100
 Subject: [PATCH] xmlsec1-configure.patch
 
 Conflicts:
-	configure.in
+	Makefile.am
+	Makefile.in
+	configure.ac
 ---
- Makefile.am         |  5 +++--
- Makefile.in         |  5 +++--
- configure.in        | 52 ++++++++++++++++++++++++++++++++++++++++------------
+ Makefile.am         |  2 +-
+ Makefile.in         |  2 +-
+ configure.ac        | 50 +++++++++++++++++++++++++++++++++++++++-----------
  win32/Makefile.msvc |  2 +-
- 4 files changed, 47 insertions(+), 17 deletions(-)
+ 4 files changed, 42 insertions(+), 14 deletions(-)
 
 diff --git a/Makefile.am b/Makefile.am
-index 669f996..0cf0798 100644
+index 3453c01..da71139 100644
 --- a/Makefile.am
 +++ b/Makefile.am
-@@ -1,8 +1,9 @@
+@@ -1,7 +1,7 @@
  NULL =
  
  SAFE_VERSION	= @XMLSEC_VERSION_SAFE@
--SUBDIRS 	= include src apps man docs
--TEST_APP 	= apps/xmlsec1$(EXEEXT)
-+#Do not build xmlsec1 app. It is not needed. Also the libtool includes 
-+#a -L/path_to_lib_dir which may contain an incompatible lixbml2.
-+SUBDIRS = include src man docs
- DEFAULT_CRYPTO	= @XMLSEC_CRYPTO@
+-SUBDIRS 	    = include src apps man docs
++SUBDIRS 	    = include src man docs
+ TEST_APP 	    = apps/xmlsec1$(EXEEXT)
+ DEFAULT_CRYPTO	= @XMLSEC_DEFAULT_CRYPTO@
  
- bin_SCRIPTS 	= xmlsec1-config
 diff --git a/Makefile.in b/Makefile.in
-index 9b252ff..c42b984 100644
+index 6b23543..759b33e 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -452,8 +452,9 @@ top_builddir = @top_builddir@
+@@ -469,7 +469,7 @@ top_builddir = @top_builddir@
  top_srcdir = @top_srcdir@
  NULL = 
  SAFE_VERSION = @XMLSEC_VERSION_SAFE@
 -SUBDIRS = include src apps man docs
--TEST_APP = apps/xmlsec1$(EXEEXT)
-+#Do not build xmlsec1 app. It is not needed. Also the libtool includes 
-+#a -L/path_to_lib_dir which may contain an incompatible lixbml2.
 +SUBDIRS = include src man docs
- DEFAULT_CRYPTO = @XMLSEC_CRYPTO@
+ TEST_APP = apps/xmlsec1$(EXEEXT)
+ DEFAULT_CRYPTO = @XMLSEC_DEFAULT_CRYPTO@
  bin_SCRIPTS = xmlsec1-config
- pkgconfig_DATA = xmlsec1.pc @XMLSEC_CRYPTO_PC_FILES_LIST@
-diff --git a/configure.in b/configure.in
-index 7690e7a..f2c98e3 100644
---- a/configure.in
-+++ b/configure.in
-@@ -188,8 +188,8 @@ dnl find libxml
+diff --git a/configure.ac b/configure.ac
+index 8fb8740..67905b5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -230,8 +230,8 @@ dnl find libxml
  dnl ==========================================================================
  LIBXML_MIN_VERSION="2.7.4"
  LIBXML_CONFIG="xml2-config"
@@ -59,7 +55,7 @@ index 7690e7a..f2c98e3 100644
  LIBXML_FOUND="no"
  AC_ARG_WITH(libxml, 
      [  --with-libxml=[PFX]       libxml2 location]
-@@ -198,6 +198,8 @@ AC_ARG_WITH(libxml-src,
+@@ -240,6 +240,8 @@ AC_ARG_WITH(libxml-src,
      [  --with-libxml-src=[PFX]   not installed yet libxml2 location]
  )
  
@@ -68,7 +64,7 @@ index 7690e7a..f2c98e3 100644
  if test "z$with_libxml" = "zno" -o "z$with_libxml_src" = "zno"; then 
      AC_MSG_CHECKING(for libxml2 libraries >= $LIBXML_MIN_VERSION) 
      AC_MSG_ERROR(libxml2 >= $LIBXML_MIN_VERSION is required for $XMLSEC_PACKAGE)
-@@ -246,6 +248,8 @@ if test "z$LIBXML_FOUND" = "zno" ; then
+@@ -288,6 +290,8 @@ if test "z$LIBXML_FOUND" = "zno" ; then
      fi
  fi
  
@@ -77,7 +73,7 @@ index 7690e7a..f2c98e3 100644
  AC_SUBST(LIBXML_CFLAGS)
  AC_SUBST(LIBXML_LIBS)
  AC_SUBST(LIBXML_CONFIG)
-@@ -570,12 +574,26 @@ dnl ==========================================================================
+@@ -601,12 +605,26 @@ dnl ==========================================================================
  XMLSEC_NO_NSS="1"
  SEAMONKEY_MIN_VERSION="1.0"
  MOZILLA_MIN_VERSION="1.4"
@@ -106,7 +102,7 @@ index 7690e7a..f2c98e3 100644
  NSS_CRYPTO_LIB="$XMLSEC_PACKAGE-nss"
  NSS_FOUND="no"
  NSPR_PACKAGE=mozilla-nspr
-@@ -602,6 +620,16 @@ elif test "z$with_nss" = "z" -a "z$with_nspr" = "z" -a "z$with_mozilla_ver" = "z
+@@ -633,6 +651,16 @@ elif test "z$with_nss" = "z" -a "z$with_nspr" = "z" -a "z$with_mozilla_ver" = "z
      dnl We are going to try all options
      dnl
      if test "z$NSS_FOUND" = "zno" ; then
@@ -123,7 +119,7 @@ index 7690e7a..f2c98e3 100644
          PKG_CHECK_MODULES(NSS, seamonkey-nspr >= $NSPR_MIN_VERSION seamonkey-nss >= $SEAMONKEY_MIN_VERSION,
      	    [NSS_FOUND=yes NSPR_PACKAGE=seamonkey-nspr NSS_PACKAGE=seamonkey-nss],
  	    [NSS_FOUND=no])
-@@ -633,8 +661,8 @@ if test "z$NSS_FOUND" = "zno" ; then
+@@ -664,8 +692,8 @@ if test "z$NSS_FOUND" = "zno" ; then
          ac_mozilla_name=mozilla-$MOZILLA_MIN_VERSION
      fi
  
@@ -134,7 +130,7 @@ index 7690e7a..f2c98e3 100644
  
      AC_MSG_CHECKING(for nspr libraries >= $NSPR_MIN_VERSION)
      NSPR_INCLUDES_FOUND="no"
-@@ -655,21 +683,21 @@ if test "z$NSS_FOUND" = "zno" ; then
+@@ -686,21 +714,21 @@ if test "z$NSS_FOUND" = "zno" ; then
  	NSPR_PRINIT_H="$with_nspr/include/prinit.h"
      else
  	for dir in $ac_nss_inc_dir ; do
@@ -160,7 +156,7 @@ index 7690e7a..f2c98e3 100644
  		dnl do not add -L/usr/lib because compiler does it anyway
          	if test "z$dir" = "z/usr/lib" ; then
              	    NSPR_LIBS="$NSPR_LIBS_LIST"
-@@ -740,7 +768,7 @@ if test "z$NSS_FOUND" = "zno" ; then
+@@ -771,7 +799,7 @@ if test "z$NSS_FOUND" = "zno" ; then
          done
         
          for dir in $ac_nss_lib_dir ; do
@@ -169,20 +165,11 @@ index 7690e7a..f2c98e3 100644
          	dnl do not add -L/usr/lib because compiler does it anyway
      		if test "z$dir" = "z/usr/lib" ; then
          	    NSS_LIBS="$NSS_LIBS_LIST"
-@@ -759,7 +787,7 @@ if test "z$NSS_FOUND" = "zno" ; then
- 
-     if test "z$NSS_INCLUDES_FOUND" = "zyes" -a "z$NSS_LIBS_FOUND" = "zyes" ; then
-        OLD_CPPFLAGS=$CPPFLAGS
--       CPPFLAGS="$NSS_CFLAGS"
-+       CPPFLAGS="$NSS_CFLAGS $NSPR_CFLAGS"
-        AC_EGREP_CPP(yes,[
-           #include <nss.h>
-           #if NSS_VMAJOR >= 3 && NSS_VMINOR >= 2
 diff --git a/win32/Makefile.msvc b/win32/Makefile.msvc
-index 2712a0a..d833497 100644
+index 357a890..30b9dfb 100644
 --- a/win32/Makefile.msvc
 +++ b/win32/Makefile.msvc
-@@ -394,7 +394,7 @@ APP_LIBS  		= $(SOLIBS) $(XMLSEC_CRYPTO_SOLIBS)
+@@ -392,7 +392,7 @@ APP_LIBS  		= $(SOLIBS) $(XMLSEC_CRYPTO_SOLIBS)
  XMLSEC_OPENSSL_SOLIBS   = libeay32.lib wsock32.lib kernel32.lib user32.lib gdi32.lib
  XMLSEC_OPENSSL_ALIBS    = libeay32.lib wsock32.lib kernel32.lib user32.lib gdi32.lib
  
@@ -192,5 +179,5 @@ index 2712a0a..d833497 100644
  
  XMLSEC_MSCRYPTO_SOLIBS  = kernel32.lib user32.lib gdi32.lib Crypt32.lib Advapi32.lib
 -- 
-2.6.2
+2.6.6
 

external/libxmlsec/xmlsec1-keyinfo-revert.patch.1

+From 8bcafc8bc497d76dbd68b02d84b4a30e709310a3 Mon Sep 17 00:00:00 2001
+From: Miklos Vajna <vmiklos@collabora.co.uk>
+Date: Thu, 7 Jul 2016 21:25:10 +0200
+Subject: [PATCH] Revert "populate KeyInfo node before calculating Reference
+ nodes"
+
+This reverts commit 8f6c95a90735c4d6e13bddf84de7a5284132826c. This is
+needed till LO code depends on the undocumented xmlsec behavior that
+throwing a binary PNG image on the XML parser returns with an error
+*before* it calls xmlSecDSigCtxProcessKeyInfoNode.
+
+Conflicts:
+	src/xmldsig.c
+---
+ src/xmldsig.c | 123 +++++++++++++++-------------------------------------------
+ 1 file changed, 32 insertions(+), 91 deletions(-)
+
+diff --git a/src/xmldsig.c b/src/xmldsig.c
+index faf5545..3c4b236 100644
+--- a/src/xmldsig.c
++++ b/src/xmldsig.c
+@@ -39,8 +39,7 @@
+ static int      xmlSecDSigCtxProcessSignatureNode       (xmlSecDSigCtxPtr dsigCtx,
+                                                          xmlNodePtr node);
+ static int      xmlSecDSigCtxProcessSignedInfoNode      (xmlSecDSigCtxPtr dsigCtx,
+-                                                         xmlNodePtr node,
+-                                                         xmlNodePtr * firstReferenceNode);
++                                                         xmlNodePtr node);
+ static int      xmlSecDSigCtxProcessKeyInfoNode         (xmlSecDSigCtxPtr dsigCtx,
+                                                          xmlNodePtr node);
+ static int      xmlSecDSigCtxProcessObjectNode          (xmlSecDSigCtxPtr dsigCtx,
+@@ -48,9 +47,6 @@ static int      xmlSecDSigCtxProcessObjectNode          (xmlSecDSigCtxPtr dsigCt
+ static int      xmlSecDSigCtxProcessManifestNode        (xmlSecDSigCtxPtr dsigCtx,
+                                                          xmlNodePtr node);
+ 
+-static int      xmlSecDSigCtxProcessReferences          (xmlSecDSigCtxPtr dsigCtx,
+-                                                         xmlNodePtr firstReferenceNode);
+-
+ /* The ID attribute in XMLDSig is 'Id' */
+ static const xmlChar*           xmlSecDSigIds[] = { xmlSecAttrId, NULL };
+ 
+@@ -474,7 +470,6 @@ xmlSecDSigCtxProcessSignatureNode(xmlSecDSigCtxPtr dsigCtx, xmlNodePtr node) {
+     xmlSecTransformDataType firstType;
+     xmlNodePtr signedInfoNode = NULL;
+     xmlNodePtr keyInfoNode = NULL;
+-    xmlNodePtr firstReferenceNode = NULL;
+     xmlNodePtr cur;
+     int ret;
+ 
+@@ -563,7 +558,7 @@ xmlSecDSigCtxProcessSignatureNode(xmlSecDSigCtxPtr dsigCtx, xmlNodePtr node) {
+     }
+ 
+     /* now validated all the references and prepare transform */
+-    ret = xmlSecDSigCtxProcessSignedInfoNode(dsigCtx, signedInfoNode, &firstReferenceNode);
++    ret = xmlSecDSigCtxProcessSignedInfoNode(dsigCtx, signedInfoNode);
+     if(ret < 0) {
+         xmlSecError(XMLSEC_ERRORS_HERE,
+                     NULL,
+@@ -572,12 +567,15 @@ xmlSecDSigCtxProcessSignatureNode(xmlSecDSigCtxPtr dsigCtx, xmlNodePtr node) {
+                     XMLSEC_ERRORS_NO_MESSAGE);
+         return(-1);
+     }
++    /* references processing might change the status */
++    if(dsigCtx->status != xmlSecDSigStatusUnknown) {
++        return(0);
++    }
+ 
+     /* as the result, we should have sign and c14n methods set */
+     xmlSecAssert2(dsigCtx->signMethod != NULL, -1);
+     xmlSecAssert2(dsigCtx->c14nMethod != NULL, -1);
+ 
+-    /* now read key info node */
+     ret = xmlSecDSigCtxProcessKeyInfoNode(dsigCtx, keyInfoNode);
+     if(ret < 0) {
+         xmlSecError(XMLSEC_ERRORS_HERE,
+@@ -590,21 +588,6 @@ xmlSecDSigCtxProcessSignatureNode(xmlSecDSigCtxPtr dsigCtx, xmlNodePtr node) {
+     /* as the result, we should have a key */
+     xmlSecAssert2(dsigCtx->signKey != NULL, -1);
+ 
+-    /* now actually process references and calculate digests */
+-    ret = xmlSecDSigCtxProcessReferences(dsigCtx, firstReferenceNode);
+-    if(ret < 0) {
+-        xmlSecError(XMLSEC_ERRORS_HERE,
+-                    NULL,
+-                    "xmlSecDSigCtxProcessReferences",
+-                    XMLSEC_ERRORS_R_XMLSEC_FAILED,
+-                    XMLSEC_ERRORS_NO_MESSAGE);
+-        return(-1);
+-    }
+-    /* references processing might change the status */
+-    if(dsigCtx->status != xmlSecDSigStatusUnknown) {
+-        return(0);
+-    }
+-
+     /* if we need to write result to xml node then we need base64 encode result */
+     if(dsigCtx->operation == xmlSecTransformOperationSign) {
+         xmlSecTransformPtr base64Encode;
+@@ -700,18 +683,18 @@ xmlSecDSigCtxProcessSignatureNode(xmlSecDSigCtxPtr dsigCtx, xmlNodePtr node) {
+  *
+  */
+ static int
+-xmlSecDSigCtxProcessSignedInfoNode(xmlSecDSigCtxPtr dsigCtx, xmlNodePtr node, xmlNodePtr * firstReferenceNode) {
+-    xmlSecSize refNodesCount = 0;
++xmlSecDSigCtxProcessSignedInfoNode(xmlSecDSigCtxPtr dsigCtx, xmlNodePtr node) {
++    xmlSecDSigReferenceCtxPtr dsigRefCtx;
+     xmlNodePtr cur;
++    int ret;
+ 
+     xmlSecAssert2(dsigCtx != NULL, -1);
+     xmlSecAssert2(dsigCtx->status == xmlSecDSigStatusUnknown, -1);
+     xmlSecAssert2(dsigCtx->signMethod == NULL, -1);
+     xmlSecAssert2(dsigCtx->c14nMethod == NULL, -1);
+     xmlSecAssert2((dsigCtx->operation == xmlSecTransformOperationSign) || (dsigCtx->operation == xmlSecTransformOperationVerify), -1);
++    xmlSecAssert2(xmlSecPtrListGetSize(&(dsigCtx->signedInfoReferences)) == 0, -1);
+     xmlSecAssert2(node != NULL, -1);
+-    xmlSecAssert2(firstReferenceNode != NULL, -1);
+-    xmlSecAssert2((*firstReferenceNode) == NULL, -1);
+ 
+     /* first node is required CanonicalizationMethod. */
+     cur = xmlSecGetNextElementNode(node->children);
+@@ -805,72 +788,12 @@ xmlSecDSigCtxProcessSignedInfoNode(xmlSecDSigCtxPtr dsigCtx, xmlNodePtr node, xm
+     }
+     dsigCtx->signMethod->operation = dsigCtx->operation;
+ 
+-    /* read references */
++    /* calculate references */
+     if(cur != NULL) {
+         cur = xmlSecGetNextElementNode(cur->next);
+     }
+     while((cur != NULL) && (xmlSecCheckNodeName(cur, xmlSecNodeReference, xmlSecDSigNs))) {
+-        /* record first reference node */
+-        if((*firstReferenceNode) == NULL) {
+-            (*firstReferenceNode) = cur;
+-        }
+-        ++refNodesCount;
+-
+-        /* go to next */
+-        cur = xmlSecGetNextElementNode(cur->next);
+-    }
+-
+-    /* check that we have at least one Reference */
+-    if(refNodesCount == 0) {
+-        xmlSecError(XMLSEC_ERRORS_HERE,
+-                    NULL,
+-                    NULL,
+-                    XMLSEC_ERRORS_R_DSIG_NO_REFERENCES,
+-                    XMLSEC_ERRORS_NO_MESSAGE);
+-        return(-1);
+-    }
+-
+-    /* if there is something left than it's an error */
+-    if(cur != NULL) {
+-        xmlSecError(XMLSEC_ERRORS_HERE,
+-                    NULL,
+-                    xmlSecErrorsSafeString(xmlSecNodeGetName(cur)),
+-                    XMLSEC_ERRORS_R_UNEXPECTED_NODE,
+-                    XMLSEC_ERRORS_NO_MESSAGE);
+-        return(-1);
+-    }
+-
+-    /* done */
+-    return(0);
+-}
+-
+-
+-static int
+-xmlSecDSigCtxProcessReferences(xmlSecDSigCtxPtr dsigCtx, xmlNodePtr firstReferenceNode) {
+-    xmlSecDSigReferenceCtxPtr dsigRefCtx;
+-    xmlNodePtr cur;
+-    int ret;
+-
+-    xmlSecAssert2(dsigCtx != NULL, -1);
+-    xmlSecAssert2(dsigCtx->status == xmlSecDSigStatusUnknown, -1);
+-    xmlSecAssert2((dsigCtx->operation == xmlSecTransformOperationSign) || (dsigCtx->operation == xmlSecTransformOperationVerify), -1);
+-    xmlSecAssert2(xmlSecPtrListGetSize(&(dsigCtx->signedInfoReferences)) == 0, -1);
+-    xmlSecAssert2(firstReferenceNode != NULL, -1);
+-
+-    /* process references */
+-    for(cur = firstReferenceNode; (cur != NULL); cur = xmlSecGetNextElementNode(cur->next)) {
+-        /* already checked but we trust none */
+-        if(!xmlSecCheckNodeName(cur, xmlSecNodeReference, xmlSecDSigNs)) {
+-            xmlSecError(XMLSEC_ERRORS_HERE,
+-                        NULL,
+-                        xmlSecErrorsSafeString(xmlSecNodeGetName(cur)),
+-                        XMLSEC_ERRORS_R_INVALID_NODE,
+-                        "expected=%s",
+-                        xmlSecErrorsSafeString(xmlSecNodeReference));
+-            return(-1);
+-        }
+-
+-        /* create reference */
++         /* create reference */
+         dsigRefCtx = xmlSecDSigReferenceCtxCreate(dsigCtx, xmlSecDSigReferenceOriginSignedInfo);
+         if(dsigRefCtx == NULL) {
+             xmlSecError(XMLSEC_ERRORS_HERE,
+@@ -910,13 +833,31 @@ xmlSecDSigCtxProcessReferences(xmlSecDSigCtxPtr dsigCtx, xmlNodePtr firstReferen
+             dsigCtx->status = xmlSecDSigStatusInvalid;
+             return(0);
+         }
++	cur = xmlSecGetNextElementNode(cur->next);
++    }
++
++    /* check that we have at least one Reference */
++    if(xmlSecPtrListGetSize(&(dsigCtx->signedInfoReferences)) == 0) {
++        xmlSecError(XMLSEC_ERRORS_HERE,
++                    NULL,
++                    NULL,
++                    XMLSEC_ERRORS_R_DSIG_NO_REFERENCES,
++                    XMLSEC_ERRORS_NO_MESSAGE);
++        return(-1);
+     }
+ 
+-    /* done */
++    /* if there is something left than it's an error */
++    if(cur != NULL) {
++        xmlSecError(XMLSEC_ERRORS_HERE,
++                    NULL,
++                    xmlSecErrorsSafeString(xmlSecNodeGetName(cur)),
++                    XMLSEC_ERRORS_R_UNEXPECTED_NODE,
++                    XMLSEC_ERRORS_NO_MESSAGE);
++        return(-1);
++    }
+     return(0);
+ }
+ 
+-
+ static int
+ xmlSecDSigCtxProcessKeyInfoNode(xmlSecDSigCtxPtr dsigCtx, xmlNodePtr node) {
+     int ret;
+-- 
+2.6.6
+

external/libxmlsec/xmlsec1-mingw-keymgr-mscrypto.patch.1

-From ba77775b6cf9a025cc049bc8c8d0381ec64933c9 Mon Sep 17 00:00:00 2001
+From 37e2cf159580f9b4e737dfe650f30981f92ad381 Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:11:52 +0100
 Subject: [PATCH] xmlsec1-mingw-keymgr-mscrypto.patch
@@ -23,10 +23,10 @@ index 5cea654..3dc6452 100644
  
  if SHAREDLIB_HACK
 diff --git a/src/mscrypto/Makefile.in b/src/mscrypto/Makefile.in
-index 2697d86..56c28ef 100644
+index d542fe4..f682964 100644
 --- a/src/mscrypto/Makefile.in
 +++ b/src/mscrypto/Makefile.in
-@@ -126,7 +126,8 @@ am__DEPENDENCIES_1 =
+@@ -135,7 +135,8 @@ am__DEPENDENCIES_1 =
  am__libxmlsec1_mscrypto_la_SOURCES_DIST = globals.h private.h app.c \
  	certkeys.c ciphers.c crypto.c digests.c hmac.c keysstore.c \
  	kw_aes.c kw_des.c kt_rsa.c signatures.c symkeys.c x509.c \
@@ -34,9 +34,9 @@ index 2697d86..56c28ef 100644
 +	x509vfy.c csp_calg.h csp_oid.h xmlsec-mingw.h ../strings.c \
 +	akmngr.c
  am__objects_1 =
+ am__dirstamp = $(am__leading_dot)dirstamp
  @SHAREDLIB_HACK_TRUE@am__objects_2 =  \
- @SHAREDLIB_HACK_TRUE@	libxmlsec1_mscrypto_la-strings.lo
-@@ -143,7 +144,8 @@ am_libxmlsec1_mscrypto_la_OBJECTS = libxmlsec1_mscrypto_la-app.lo \
+@@ -153,7 +154,8 @@ am_libxmlsec1_mscrypto_la_OBJECTS = libxmlsec1_mscrypto_la-app.lo \
  	libxmlsec1_mscrypto_la-signatures.lo \
  	libxmlsec1_mscrypto_la-symkeys.lo \
  	libxmlsec1_mscrypto_la-x509.lo \
@@ -46,7 +46,7 @@ index 2697d86..56c28ef 100644
  	$(am__objects_2)
  libxmlsec1_mscrypto_la_OBJECTS = $(am_libxmlsec1_mscrypto_la_OBJECTS)
  AM_V_lt = $(am__v_lt_@AM_V@)
-@@ -454,6 +456,7 @@ libxmlsec1_mscrypto_la_CPPFLAGS = \
+@@ -472,6 +474,7 @@ libxmlsec1_mscrypto_la_CPPFLAGS = \
  libxmlsec1_mscrypto_la_SOURCES = globals.h private.h app.c certkeys.c \
  	ciphers.c crypto.c digests.c hmac.c keysstore.c kw_aes.c \
  	kw_des.c kt_rsa.c signatures.c symkeys.c x509.c x509vfy.c \
@@ -54,15 +54,15 @@ index 2697d86..56c28ef 100644
  	csp_calg.h csp_oid.h xmlsec-mingw.h $(NULL) $(am__append_1)
  libxmlsec1_mscrypto_la_LIBADD = \
  	$(MSCRYPTO_LIBS) \
-@@ -565,6 +568,7 @@ distclean-compile:
+@@ -592,6 +595,7 @@ distclean-compile:
  @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_mscrypto_la-symkeys.Plo@am__quote@
  @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_mscrypto_la-x509.Plo@am__quote@
  @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_mscrypto_la-x509vfy.Plo@am__quote@
 +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_mscrypto_la-akmngr.Plo@am__quote@
  
  .c.o:
- @am__fastdepCC_TRUE@	$(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@@ -594,6 +598,13 @@ libxmlsec1_mscrypto_la-app.lo: app.c
+ @am__fastdepCC_TRUE@	$(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.o$$||'`;\
+@@ -624,6 +628,13 @@ libxmlsec1_mscrypto_la-app.lo: app.c
  @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
  @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_mscrypto_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libxmlsec1_mscrypto_la-app.lo `test -f 'app.c' || echo '$(srcdir)/'`app.c
  
@@ -77,5 +77,5 @@ index 2697d86..56c28ef 100644
  @am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_mscrypto_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libxmlsec1_mscrypto_la-certkeys.lo -MD -MP -MF $(DEPDIR)/libxmlsec1_mscrypto_la-certkeys.Tpo -c -o libxmlsec1_mscrypto_la-certkeys.lo `test -f 'certkeys.c' || echo '$(srcdir)/'`certkeys.c
  @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libxmlsec1_mscrypto_la-certkeys.Tpo $(DEPDIR)/libxmlsec1_mscrypto_la-certkeys.Plo
 -- 
-2.6.2
+2.6.6
 

external/libxmlsec/xmlsec1-noverify.patch.1

-From 56bd53dc3c8b7f05c55023700b3e0439dcd66aac Mon Sep 17 00:00:00 2001
+From d2b22f265df84d605338546b457aec4fb0888861 Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:10:16 +0100
 Subject: [PATCH] xmlsec1-noverify.patch
@@ -11,7 +11,7 @@ Conflicts:
  2 files changed, 31 insertions(+), 10 deletions(-)
 
 diff --git a/src/mscrypto/x509vfy.c b/src/mscrypto/x509vfy.c
-index cf31787..80de2c9 100644
+index 899cb6e..cf4cbb7 100644
 --- a/src/mscrypto/x509vfy.c
 +++ b/src/mscrypto/x509vfy.c
 @@ -560,9 +560,16 @@ xmlSecMSCryptoX509StoreVerify(xmlSecKeyDataStorePtr store, HCERTSTORE certs,
@@ -35,7 +35,7 @@ index cf31787..80de2c9 100644
  
      return (NULL);
 diff --git a/src/nss/x509vfy.c b/src/nss/x509vfy.c
-index fdb866f..8a6e97a 100644
+index 9e957fe..0edaa2d 100644
 --- a/src/nss/x509vfy.c
 +++ b/src/nss/x509vfy.c
 @@ -211,13 +211,27 @@ xmlSecNssX509StoreVerify(xmlSecKeyDataStorePtr store, CERTCertList* certs,
@@ -74,5 +74,5 @@ index fdb866f..8a6e97a 100644
  
      if (status == SECSuccess) {
 -- 
-2.6.2
+2.6.6
 

external/libxmlsec/xmlsec1-nssdisablecallbacks.patch.1

-From f93d90efc69dfd8471f446e583eaa77e4a8cde48 Mon Sep 17 00:00:00 2001
+From 7904a285f91af7e33e73ffa36c2f0a77030fd822 Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:09:10 +0100
 Subject: [PATCH] xmlsec1-nssdisablecallbacks.patch
@@ -10,7 +10,7 @@ Conflicts:
  1 file changed, 20 insertions(+)
 
 diff --git a/src/nss/crypto.c b/src/nss/crypto.c
-index 7137f1c..7a59575 100644
+index ea79519..473429f 100644
 --- a/src/nss/crypto.c
 +++ b/src/nss/crypto.c
 @@ -214,6 +214,7 @@ xmlSecCryptoGetFunctions_nss(void) {
@@ -48,5 +48,5 @@ index 7137f1c..7a59575 100644
      return(gXmlSecNssFunctions);
  }
 -- 
-2.6.2
+2.6.6
 

external/libxmlsec/xmlsec1-nssmangleciphers.patch.1

-From d1d8d2e18825756d7b21b26c8e74e331e38c66ff Mon Sep 17 00:00:00 2001
+From e91666c3d84ca8e945f0a8f408365496cfba0a22 Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:09:39 +0100
 Subject: [PATCH] xmlsec1-nssmangleciphers.patch
@@ -10,7 +10,7 @@ Conflicts:
  1 file changed, 480 insertions(+), 379 deletions(-)
 
 diff --git a/src/nss/ciphers.c b/src/nss/ciphers.c
-index 54bd2af..03af759 100644
+index cf67936..c063c04 100644
 --- a/src/nss/ciphers.c
 +++ b/src/nss/ciphers.c
 @@ -11,180 +11,422 @@
@@ -1141,5 +1141,5 @@ index 54bd2af..03af759 100644
          xmlSecError(XMLSEC_ERRORS_HERE,
                      xmlSecErrorsSafeString(xmlSecTransformGetName(transform)),
 -- 
-2.6.2
+2.6.6
 

external/libxmlsec/xmlsec1-vc.patch.1

-From 56448979392d78a6e1688f61ce7bc771f38a880b Mon Sep 17 00:00:00 2001
+From 8586bb027cde6713a9048472917c75095e186643 Mon Sep 17 00:00:00 2001
 From: Miklos Vajna <vmiklos@collabora.co.uk>
 Date: Fri, 4 Mar 2016 16:12:29 +0100
 Subject: [PATCH] xmlsec1-vc.patch
 
 ---
- apps/cmdline.c      |  2 +-
- apps/crypto.c       |  2 +-
- apps/xmlsec.c       |  2 +-
  win32/Makefile.msvc | 10 +++++++++-
- 4 files changed, 12 insertions(+), 4 deletions(-)
+ 1 file changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/win32/Makefile.msvc b/win32/Makefile.msvc
-index d833497..065595b 100644
+index 30b9dfb..51c53a7 100644
 --- a/win32/Makefile.msvc
 +++ b/win32/Makefile.msvc
-@@ -311,6 +311,10 @@ CFLAGS 			= $(CFLAGS) /D PACKAGE=\"$(XMLSEC_NAME)\"
+@@ -309,6 +309,10 @@ CFLAGS 			= $(CFLAGS) /D PACKAGE=\"$(XMLSEC_NAME)\"
  CFLAGS 			= $(CFLAGS) /D "HAVE_STDIO_H" /D "HAVE_STDLIB_H"
  CFLAGS 			= $(CFLAGS) /D "HAVE_STRING_H" /D "HAVE_CTYPE_H"
  CFLAGS 			= $(CFLAGS) /D "HAVE_MALLOC_H" /D "HAVE_MEMORY_H"
@@ -25,7 +22,16 @@ index d833497..065595b 100644
  
  !if "$(UNICODE)" == "1"
  CFLAGS 			= $(CFLAGS) /D "UNICODE" /D "_UNICODE"
-@@ -365,7 +369,11 @@ LIBS 			=
+@@ -332,7 +332,7 @@ CFLAGS 			= $(CFLAGS) /DXMLSEC_MSCRYPTO_NT4=1
+ !else 
+ !endif
+ 
+-APP_CFLAGS		= /D "XMLSEC_DEFAULT_CRYPTO=\"$(XMLSEC_DEFAULT_CRYPTO)\""
++CFLAGS			= $(CFLAGS) /D "XMLSEC_DEFAULT_CRYPTO=\"$(XMLSEC_DEFAULT_CRYPTO)\""
+ !if "$(WITH_DL)" == "1"
+ CFLAGS			= $(CFLAGS) /D "XMLSEC_DL_WIN32"
+ APP_CFLAGS		= $(APP_CFLAGS) /D "XMLSEC_CRYPTO_DYNAMIC_LOADING"
+@@ -363,7 +367,11 @@ LIBS 			=
  !if "$(DEBUG)" == "1"
  LDFLAGS 		= $(LDFLAGS) /DEBUG
  !else
@@ -39,5 +45,5 @@ index d833497..065595b 100644
  
  SOLIBS 			= $(LIBS) libxml2.lib 
 -- 
-2.6.2
+2.6.6
 

external/libxmlsec/xmlsec1-vs2015.patch.1

-From 56448979392d78a6e1688f61ce7bc771f38a880b Mon Sep 17 00:00:00 2001
-From: Miklos Vajna <vmiklos@collabora.co.uk>
-Date: Fri, 4 Mar 2016 16:12:29 +0100
-Subject: [PATCH] xmlsec1-vs2015.patch
-
----
-
-diff --git a/apps/cmdline.c b/apps/cmdline.c
-index b9ecafb..4425eaf 100644
---- a/apps/cmdline.c
-+++ b/apps/cmdline.c
-@@ -7,7 +7,7 @@
-  * 
-  * Copyright (C) 2002-2003 Aleksey Sanin <aleksey@aleksey.com>
-  */
--#if defined(_MSC_VER)
-+#if defined(_MSC_VER) && _MSC_VER < 1900
- #define snprintf _snprintf
- #endif
- 
-diff --git a/apps/crypto.c b/apps/crypto.c
-index 49dd127..f46eeee 100644
---- a/apps/crypto.c
-+++ b/apps/crypto.c
-@@ -7,7 +7,7 @@
-  * 
-  * Copyright (C) 2002-2003 Aleksey Sanin <aleksey@aleksey.com>
-  */
--#if defined(_MSC_VER)
-+#if defined(_MSC_VER) && _MSC_VER < 1900
- #define snprintf _snprintf
- #endif
- 
-diff --git a/apps/xmlsec.c b/apps/xmlsec.c
-index d551b5a..0467c25 100644
---- a/apps/xmlsec.c
-+++ b/apps/xmlsec.c
-@@ -9,7 +9,7 @@
- #include <string.h>
- #include <time.h>
- 
--#if defined(_MSC_VER)
-+#if defined(_MSC_VER) && _MSC_VER < 1900
- #define snprintf _snprintf
- #endif
-