Index: libxml2-2.7.6/elfgcchack.h
===================================================================
--- libxml2-2.7.6.orig/elfgcchack.h
+++ libxml2-2.7.6/elfgcchack.h
@@ -6445,6 +6445,16 @@ extern __typeof (xmlNoNetExternalEntityL
 #endif
 #endif
 
+#ifdef bottom_xmlIO
+#undef xmlNoXxeExternalEntityLoader
+extern __typeof (xmlNoXxeExternalEntityLoader) xmlNoXxeExternalEntityLoader __attribute((alias("xmlNoXxeExternalEntityLoader__internal_alias")));
+#else
+#ifndef xmlNoXxeExternalEntityLoader
+extern __typeof (xmlNoXxeExternalEntityLoader) xmlNoXxeExternalEntityLoader__internal_alias __attribute((visibility("hidden")));
+#define xmlNoXxeExternalEntityLoader xmlNoXxeExternalEntityLoader__internal_alias
+#endif
+#endif
+
 #ifdef bottom_tree
 #undef xmlNodeAddContent
 extern __typeof (xmlNodeAddContent) xmlNodeAddContent __attribute((alias("xmlNodeAddContent__internal_alias")));
Index: libxml2-2.7.6/include/libxml/parser.h
===================================================================
--- libxml2-2.7.6.orig/include/libxml/parser.h
+++ libxml2-2.7.6/include/libxml/parser.h
@@ -303,6 +303,8 @@ struct _xmlParserCtxt {
     unsigned long    nbentities;    /* number of entities references */
     unsigned long  sizeentities;    /* size of parsed entities */
     unsigned long   sizeentcopy;    /* volume of entity copy */
+
+     int input_id; /* we need to label inputs */
 };
 
 /**
@@ -1101,7 +1103,8 @@ typedef enum {
     XML_PARSE_OLD10	= 1<<17,/* parse using XML-1.0 before update 5 */
     XML_PARSE_NOBASEFIX = 1<<18,/* do not fixup XINCLUDE xml:base uris */
     XML_PARSE_HUGE      = 1<<19, /* relax any hardcoded limit from the parser */
-    XML_PARSE_OLDSAX    = 1<<20 /* parse using SAX2 interface from before 2.7.0 */
+    XML_PARSE_OLDSAX    = 1<<20, /* parse using SAX2 interface from before 2.7.0 */
+    XML_PARSE_NOXXE	= 1<<23 /* Forbid any external entity substitution */
 } xmlParserOption;
 
 XMLPUBFUN void XMLCALL
Index: libxml2-2.7.6/include/libxml/xmlIO.h
===================================================================
--- libxml2-2.7.6.orig/include/libxml/xmlIO.h
+++ libxml2-2.7.6/include/libxml/xmlIO.h
@@ -293,6 +293,15 @@ XMLPUBFUN xmlParserInputPtr XMLCALL
 					 const char *ID,
 					 xmlParserCtxtPtr ctxt);
 
+/*
+ * A predefined entity loader external entity expansion
+ */
+XMLPUBFUN xmlParserInputPtr XMLCALL
+	xmlNoXxeExternalEntityLoader	(const char *URL,
+					 const char *ID,
+					 xmlParserCtxtPtr ctxt);
+
+
 /* 
  * xmlNormalizeWindowsPath is obsolete, don't use it. 
  * Check xmlCanonicPath in uri.h for a better alternative.
Index: libxml2-2.7.6/include/libxml/xmlerror.h
===================================================================
--- libxml2-2.7.6.orig/include/libxml/xmlerror.h
+++ libxml2-2.7.6/include/libxml/xmlerror.h
@@ -467,6 +467,7 @@ typedef enum {
     XML_IO_EADDRINUSE, /* 1554 */
     XML_IO_EALREADY, /* 1555 */
     XML_IO_EAFNOSUPPORT, /* 1556 */
+    XML_IO_ILLEGAL_XXE, /* 1557 */
     XML_XINCLUDE_RECURSION=1600,
     XML_XINCLUDE_PARSE_VALUE, /* 1601 */
     XML_XINCLUDE_ENTITY_DEF_MISMATCH, /* 1602 */
Index: libxml2-2.7.6/parser.c
===================================================================
--- libxml2-2.7.6.orig/parser.c
+++ libxml2-2.7.6/parser.c
@@ -14771,6 +14771,10 @@ xmlCtxtUseOptionsInternal(xmlParserCtxtP
 	ctxt->options |= XML_PARSE_NONET;
         options -= XML_PARSE_NONET;
     }
+    if (options & XML_PARSE_NOXXE) {
+	ctxt->options |= XML_PARSE_NOXXE;
+        options -= XML_PARSE_NOXXE;
+    }
     if (options & XML_PARSE_COMPACT) {
 	ctxt->options |= XML_PARSE_COMPACT;
         options -= XML_PARSE_COMPACT;
Index: libxml2-2.7.6/xmlIO.c
===================================================================
--- libxml2-2.7.6.orig/xmlIO.c
+++ libxml2-2.7.6/xmlIO.c
@@ -204,6 +204,7 @@ static const char *IOerr[] = {
     "adddress in use",		/* EADDRINUSE */
     "already in use",		/* EALREADY */
     "unknown address familly",	/* EAFNOSUPPORT */
+    "Attempt to load external entity %s", /* XML_IO_ILLEGAL_XXE */
 };
 
 #if defined(_WIN32) || defined (__DJGPP__) && !defined (__CYGWIN__)
@@ -3861,13 +3862,22 @@ xmlDefaultExternalEntityLoader(const cha
     xmlGenericError(xmlGenericErrorContext,
                     "xmlDefaultExternalEntityLoader(%s, xxx)\n", URL);
 #endif
-    if ((ctxt != NULL) && (ctxt->options & XML_PARSE_NONET)) {
+    if (ctxt != NULL) {
         int options = ctxt->options;
 
-	ctxt->options -= XML_PARSE_NONET;
-        ret = xmlNoNetExternalEntityLoader(URL, ID, ctxt);
-	ctxt->options = options;
-	return(ret);
+        if (options & XML_PARSE_NOXXE) {
+            ctxt->options -= XML_PARSE_NOXXE;
+            ret = xmlNoXxeExternalEntityLoader(URL, ID, ctxt);
+            ctxt->options = options;
+            return(ret);
+        }
+ 
+        if (options & XML_PARSE_NONET) {
+            ctxt->options -= XML_PARSE_NONET;
+            ret = xmlNoNetExternalEntityLoader(URL, ID, ctxt);
+            ctxt->options = options;
+            return(ret);
+        }
     }
 #ifdef LIBXML_CATALOG_ENABLED
     resource = xmlResolveResourceFromCatalog(URL, ID, ctxt);
@@ -3968,6 +3978,13 @@ xmlNoNetExternalEntityLoader(const char
     xmlParserInputPtr input = NULL;
     xmlChar *resource = NULL;
 
+    if (ctxt == NULL) {
+        return(NULL);
+    }
+    if (ctxt->input_id == 1) {
+        return xmlDefaultExternalEntityLoader((const char *) URL, ID, ctxt);
+    }
+
 #ifdef LIBXML_CATALOG_ENABLED
     resource = xmlResolveResourceFromCatalog(URL, ID, ctxt);
 #endif
@@ -3990,5 +4007,18 @@ xmlNoNetExternalEntityLoader(const char
     return(input);
 }
 
+xmlParserInputPtr
+xmlNoXxeExternalEntityLoader(const char *URL, const char *ID,
+                          xmlParserCtxtPtr ctxt) {
+    if (ctxt == NULL) {
+        return(NULL);
+    }
+    if (ctxt->input_id == 1) {
+        return xmlDefaultExternalEntityLoader((const char *) URL, ID, ctxt);
+    }
+    xmlIOErr(XML_IO_ILLEGAL_XXE, (const char *) URL);
+    return(NULL);
+}
+
 #define bottom_xmlIO
 #include "elfgcchack.h"
Index: libxml2-2.7.6/xmllint.c
===================================================================
--- libxml2-2.7.6.orig/xmllint.c
+++ libxml2-2.7.6/xmllint.c
@@ -2867,6 +2867,7 @@ static void usage(const char *name) {
     printf("\t--path 'paths': provide a set of paths for resources\n");
     printf("\t--load-trace : print trace of all external entites loaded\n");
     printf("\t--nonet : refuse to fetch DTDs or entities over network\n");
+    printf("\t--noxxe : forbid any external entity substitution\n");
     printf("\t--nocompact : do not generate compact text nodes\n");
     printf("\t--htmlout : output results as HTML\n");
     printf("\t--nowrap : do not put HTML doc wrapper\n");
@@ -3269,6 +3270,10 @@ main(int argc, char **argv) {
                    (!strcmp(argv[i], "--nonet"))) {
 	    options |= XML_PARSE_NONET;
 	    xmlSetExternalEntityLoader(xmlNoNetExternalEntityLoader);
+        } else if ((!strcmp(argv[i], "-noxxe")) ||
+                   (!strcmp(argv[i], "--noxxe"))) {
+	    options |= XML_PARSE_NOXXE;
+	    xmlSetExternalEntityLoader(xmlNoXxeExternalEntityLoader);
         } else if ((!strcmp(argv[i], "-nocompact")) ||
                    (!strcmp(argv[i], "--nocompact"))) {
 	    options &= ~XML_PARSE_COMPACT;
Index: libxml2-2.7.6/parserInternals.c
===================================================================
--- libxml2-2.7.6.orig/parserInternals.c
+++ libxml2-2.7.6/parserInternals.c
@@ -1393,7 +1393,6 @@ xmlFreeInputStream(xmlParserInputPtr inp
 xmlParserInputPtr
 xmlNewInputStream(xmlParserCtxtPtr ctxt) {
     xmlParserInputPtr input;
-    static int id = 0;
 
     input = (xmlParserInputPtr) xmlMalloc(sizeof(xmlParserInput));
     if (input == NULL) {
@@ -1408,7 +1407,13 @@ xmlNewInputStream(xmlParserCtxtPtr ctxt)
      * we don't care about thread reentrancy unicity for a single
      * parser context (and hence thread) is sufficient.
      */
-    input->id = id++;
+     /*
+      * If the context is NULL the id cannot be initialized, but that
+      * should not happen while parsing which is the situation where
+      * the id is actually needed.
+      */
+      if (ctxt != NULL)
+          input->id = ctxt->input_id++;
     return(input);
 }
 
@@ -1774,6 +1779,7 @@ xmlInitParserCtxt(xmlParserCtxtPtr ctxt)
     ctxt->nbentities = 0;
     ctxt->sizeentities = 0;
     ctxt->sizeentcopy = 0;
+    ctxt->input_id = 1;
     xmlInitNodeInfoSeq(&ctxt->node_seq);
     return(0);
 }
