parser: Fix handling of invalid char refs in recovery mode

Revert to the old behavior which handles invalid char refs more
gracefully. Probably regressed with 37c6618b (version 2.13.0).

parser.c

@@ -2628,14 +2628,13 @@ xmlParseCharRef(xmlParserCtxt *ctxt) {
         xmlFatalErrMsgInt(ctxt, XML_ERR_INVALID_CHAR,
                 "xmlParseCharRef: character reference out of bounds\n",
 	        val);
-    } else if (IS_CHAR(val)) {
+        val = 0xFFFD;
-        return(val);
+    } else if (!IS_CHAR(val)) {
-    } else {
         xmlFatalErrMsgInt(ctxt, XML_ERR_INVALID_CHAR,
                           "xmlParseCharRef: invalid xmlChar value %d\n",
 	                  val);
     }
-    return(0);
+    return(val);
 }
 
 /**

testparser.c

@@ -183,6 +183,24 @@ testUndeclEntInContent(void) {
     return err;
 }
 
+static int
+testInvalidCharRecovery(void) {
+    const char *xml = "<doc>&#x10;</doc>";
+    xmlDoc *doc;
+    int err = 0;
+
+    doc = xmlReadDoc(BAD_CAST xml, NULL, NULL, XML_PARSE_RECOVER);
+
+    if (strcmp((char *) doc->children->children->content, "\x10") != 0) {
+        fprintf(stderr, "Failed to recover from invalid char ref\n");
+        err = 1;
+    }
+
+    xmlFreeDoc(doc);
+
+    return err;
+}
+
 #ifdef LIBXML_VALID_ENABLED
 static void
 testSwitchDtdExtSubset(void *vctxt, const xmlChar *name ATTRIBUTE_UNUSED,
@@ -1409,6 +1427,7 @@ main(void) {
     err |= testNodeGetContent();
     err |= testCFileIO();
     err |= testUndeclEntInContent();
+    err |= testInvalidCharRecovery();
 #ifdef LIBXML_VALID_ENABLED
     err |= testSwitchDtd();
 #endif