Escape ?> sequence in PI value during printing

This prevents malformed PI value from breaking the document structure.

src/pugixml.cpp

@@ -3462,6 +3462,27 @@ PUGI__NS_BEGIN
 		writer.write('-', '-', '>');
 	}
 
+	PUGI__FN void node_output_pi_value(xml_buffered_writer& writer, const char_t* s)
+	{
+		while (*s)
+		{
+			const char_t* prev = s;
+
+			// look for ?> sequence - we can't output it since ?> terminates PI
+			while (*s && !(s[0] == '?' && s[1] == '>')) ++s;
+
+			writer.write_buffer(prev, static_cast<size_t>(s - prev));
+
+			if (*s)
+			{
+				assert(s[0] == '?' && s[1] == '>');
+
+				writer.write('?', ' ', '>');
+				s += 2;
+			}
+		}
+	}
+
 	PUGI__FN void node_output_attributes(xml_buffered_writer& writer, xml_node_struct* node, unsigned int flags)
 	{
 		const char_t* default_name = PUGIXML_TEXT(":anonymous");
@@ -3575,7 +3596,7 @@ PUGI__NS_BEGIN
 				if (node->value)
 				{
 					writer.write(' ');
-					writer.write_string(node->value);
+					node_output_pi_value(writer, node->value);
 				}
 
 				writer.write('?', '>');

tests/test_write.cpp

@@ -115,6 +115,25 @@ TEST(write_pi_null)
 	CHECK_NODE(doc, STR("<?:anonymous value?>"));
 }
 
+TEST(write_pi_invalid)
+{
+	xml_document doc;
+	xml_node node = doc.append_child(node_pi);
+
+	node.set_name(STR("test"));
+	node.set_value(STR("?"));
+
+	CHECK_NODE(doc, STR("<?test ?" "?>"));
+
+	node.set_value(STR("?>"));
+
+	CHECK_NODE(doc, STR("<?test ? >?>"));
+
+	node.set_value(STR("<?foo?>"));
+
+	CHECK_NODE(doc, STR("<?test <?foo? >?>"));
+}
+
 TEST_XML_FLAGS(write_declaration, "<?xml version='2.0'?>", parse_declaration | parse_fragment)
 {
 	CHECK_NODE(doc, STR("<?xml version=\"2.0\"?>"));