From 27119ec33c9f6b9830efa1e0da0acfa353dfa55a Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Mon, 17 Aug 2020 00:05:19 +0200
Subject: [PATCH] Fix quadratic runtime in xi:fallback processing

Copying the tree would lead to runtime quadratic in nested fallback
depth, similar to naive string concatenation.
---
 xinclude.c | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/xinclude.c b/xinclude.c
index e9d3af5..9a65ee5 100644
--- a/xinclude.c
+++ b/xinclude.c
@@ -2003,8 +2003,7 @@ xmlXIncludeLoadFallback(xmlXIncludeCtxtPtr ctxt, xmlNodePtr fallback, int nr) {
 	    ret = -1;
 	xmlXIncludeFreeContext(newctxt);
 
-	ctxt->incTab[nr]->inc = xmlDocCopyNodeList(ctxt->doc,
-	                                           fallback->children);
+	ctxt->incTab[nr]->inc = fallback->children;
     } else {
         ctxt->incTab[nr]->inc = NULL;
     }
@@ -2268,12 +2267,6 @@ xmlXIncludeIncludeNode(xmlXIncludeCtxtPtr ctxt, int nr) {
 	 * XInclude end one
 	 */
 	cur->type = XML_XINCLUDE_START;
-        /* Remove fallback children */
-        for (child = cur->children; child != NULL; child = next) {
-            next = child->next;
-            xmlUnlinkNode(child);
-            xmlFreeNode(child);
-        }
 	end = xmlNewDocNode(cur->doc, cur->ns, cur->name, NULL);
 	if (end == NULL) {
 	    xmlXIncludeErr(ctxt, ctxt->incTab[nr]->ref,
@@ -2289,11 +2282,17 @@ xmlXIncludeIncludeNode(xmlXIncludeCtxtPtr ctxt, int nr) {
 	 * Add the list of nodes
 	 */
 	while (list != NULL) {
-	    cur = list;
-	    list = list->next;
-
-	    xmlAddPrevSibling(end, cur);
+	    next = list->next;
+	    xmlAddPrevSibling(end, list);
+	    list = next;
 	}
+
+        /* Remove fallback node */
+        for (child = cur->children; child != NULL; child = next) {
+            next = child->next;
+            xmlUnlinkNode(child);
+            xmlFreeNode(child);
+        }
     }
 
 
-- 
1.8.3.1