textproc/mxml: Update to 3.3.1

Also add a patch to fix a bounds check problem discovered during an
exp-run for bug 276478.

PR:		276478

textproc/mxml/Makefile

@@ -1,6 +1,5 @@
 PORTNAME=	mxml
-DISTVERSION=	3.1
-PORTREVISION=	1
+DISTVERSION=	3.3.1
 CATEGORIES=	textproc
 MASTER_SITES=	https://github.com/michaelrsweet/mxml/releases/download/v${DISTVERSION}/
 
@@ -11,13 +10,15 @@ WWW=		http://www.minixml.org/
 LICENSE=	APACHE20
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
-USES=		desthack
 USE_LDCONFIG=	yes
 
+DESTDIRNAME=	DSTROOT
 GNU_CONFIGURE=	yes
+GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
 MAKE_ARGS=	INSTALL_DATA="${INSTALL_DATA}" \
 		INSTALL_LIB="${INSTALL_LIB}" \
 		INSTALL_MAN="${INSTALL_MAN}"
+TEST_TARGET=	test
 
 OPTIONS_DEFINE=	DOCS
 

textproc/mxml/distinfo

@@ -1,3 +1,3 @@
-TIMESTAMP = 1567960906
-SHA256 (mxml-3.1.tar.gz) = 1ac8d252f62f9dc2b2004518c70d2da313bdfcd92b8350e215f46064a34b52fc
-SIZE (mxml-3.1.tar.gz) = 9268821
+TIMESTAMP = 1708794182
+SHA256 (mxml-3.3.1.tar.gz) = 0c663ed1fe393b5619f80101798202eea43534abd7c8aff389022fd8c1dacc32
+SIZE (mxml-3.3.1.tar.gz) = 1553469

textproc/mxml/files/patch-mxml-file.c

@@ -0,0 +1,105 @@
+mxml-file.c: Fix a bounds check
+
+When writing XML data into a buffer a pointer is used to keep track of
+the current position.  When the end of the buffer is reached the writing
+stops but the pointer continues to be incremented to determine how many
+bytes would have been written had the buffer been large enough.  The
+problem is that the bounds check that stops the writing did not handle
+the case where a large amount of data causes the pointer to wrap around
+to 0.  This can happen for example when the buffer is allocated on the
+stack and the stack is close to the end of the address space.
+
+--- mxml-file.c.orig	2022-07-25 12:56:27 UTC
++++ mxml-file.c
+@@ -50,6 +50,11 @@ typedef struct _mxml_fdbuf_s		/**** File descriptor bu
+ 		buffer[8192];		/* Character buffer */
+ } _mxml_fdbuf_t;
+ 
++typedef struct _mxml_strbuf_s		/**** String buffer ****/
++{
++  char		*current;		/* Current position in buffer */
++  int		remaining;		/* Remaining size of buffer */
++} _mxml_strbuf_t;
+ 
+ /*
+  * Local functions...
+@@ -352,41 +357,43 @@ mxmlSaveString(mxml_node_t    *node,	/* I - Node to wr
+                mxml_save_cb_t cb)	/* I - Whitespace callback or @code MXML_NO_CALLBACK@ */
+ {
+   int	col;				/* Final column */
+-  char	*ptr[2];			/* Pointers for putc_cb */
++  _mxml_strbuf_t buf;			/* State for putc_cb */
+   _mxml_global_t *global = _mxml_global();
+ 					/* Global data */
+ 
++  if (bufsize < 0)
++    return (-1);
+ 
+  /*
+   * Write the node...
+   */
+ 
+-  ptr[0] = buffer;
+-  ptr[1] = buffer + bufsize;
++  buf.current = buffer;
++  buf.remaining = bufsize;
+ 
+-  if ((col = mxml_write_node(node, ptr, cb, 0, mxml_string_putc, global)) < 0)
++  if ((col = mxml_write_node(node, &buf, cb, 0, mxml_string_putc, global)) < 0)
+     return (-1);
+ 
+   if (col > 0)
+-    mxml_string_putc('\n', ptr);
++    mxml_string_putc('\n', &buf);
+ 
+  /*
+   * Nul-terminate the buffer...
+   */
+ 
+-  if (ptr[0] >= ptr[1])
++  if (buf.remaining == 0)
+   {
+-    if (bufsize > 0)
++    if (bufsize != 0)
+       buffer[bufsize - 1] = '\0';
+   }
+   else
+-    ptr[0][0] = '\0';
++    *buf.current = '\0';
+ 
+  /*
+   * Return the number of characters...
+   */
+ 
+-  return ((int)(ptr[0] - buffer));
++  return ((int)(buf.current - buffer));
+ }
+ 
+ 
+@@ -2674,17 +2681,19 @@ mxml_string_putc(int  ch,		/* I - Character to write *
+ 
+ static int				/* O - 0 on success, -1 on failure */
+ mxml_string_putc(int  ch,		/* I - Character to write */
+-                 void *p)		/* I - Pointer to string pointers */
++                 void *p)		/* I - String buffer */
+ {
+-  char	**pp;				/* Pointer to string pointers */
++  _mxml_strbuf_t *buf;			/* String buffer */
+ 
++  buf = (_mxml_strbuf_t *)p;
+ 
+-  pp = (char **)p;
++  if (buf->remaining != 0)
++  {
++    *buf->current = ch;
++    buf->remaining--;
++  }
+ 
+-  if (pp[0] < pp[1])
+-    pp[0][0] = ch;
+-
+-  pp[0] ++;
++  buf->current++;
+ 
+   return (0);
+ }