From 500adfed4fdcb393cec06f30b0cf38ea78f006df Mon Sep 17 00:00:00 2001
From: Ben Kibbey <bjk@luxsci.net>
Date: Fri, 19 Jul 2013 19:58:50 -0400
Subject: [PATCH] Fix another false positive (error) in target validation.

These are hard to find for every case. Please report bugs.
---
 src/xml.c | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/src/xml.c b/src/xml.c
index 4f478a4d..e9ee14cb 100644
--- a/src/xml.c
+++ b/src/xml.c
@@ -1824,7 +1824,8 @@ node_to_element_path (xmlNodePtr node)
  */
 static gpg_error_t
 find_child_to_target (xmlDocPtr doc, xmlNodePtr node,
-		      xmlNodePtr src, xmlNodePtr dst, unsigned depth)
+		      xmlNodePtr src, xmlNodePtr dst, unsigned depth,
+		      int is_target)
 {
   xmlNodePtr n;
   gpg_error_t rc = 0;
@@ -1853,18 +1854,29 @@ find_child_to_target (xmlDocPtr doc, xmlNodePtr node,
 	  strv_free (result);
 	  if (!rc)
 	    {
-	      rc = find_child_to_target (doc, tmp, src, dst, ++depth);
+	      rc = find_child_to_target (doc, tmp, src, dst, ++depth, 1);
 	      depth--;
 	    }
 
 	  if (rc)
 	    return rc;
+
+	  if (is_target)
+	    break;
+
+	  continue;
 	}
 
-      rc = find_child_to_target (doc, n->children, src, dst, ++depth);
-      depth--;
-      if (rc)
-	return rc;
+      if (n->children)
+	{
+	  rc = find_child_to_target (doc, n->children, src, dst, ++depth,0);
+	  depth--;
+	  if (rc)
+	    return rc;
+	}
+
+      if (is_target)
+	break;
     }
 
   return rc;
@@ -1945,7 +1957,7 @@ validate_target_attribute (xmlDocPtr doc, const char *src,
     goto fail;
 
   /* A destination child element contains a target to the source element. */
-  rc = find_child_to_target (doc, dst_node->children, src_node, dst_node, 0);
+  rc = find_child_to_target (doc, dst_node->children, src_node, dst_node, 0, 0);
   if (rc)
     goto fail;
 
-- 
2.11.4.GIT