Consider using reliable crash-resistant xml parser instead of xml-rs.

[xjewer]

After introducing libfuzzer #2 (comment), found out that xms-rs crate has at least one place to crash with add to attempt with overflow.

Moreover xml-rs doesn't have contributions for almost a year and it seems to be abandoned.

cc @kornelski

[kornelski]

The state of Rust XML parsers is a bit sad. I've tried quick-xml, but it wasn't better.

[00xc]

I tested this with the latest xml-rs version (v0.8.13) and the crash does not reproduce anymore. Consider updating the dependencies for this repository.

[00xc]

Just FYI, I have tested this again and found 2 more panics in xml-rs through the svg-hush harness:

• Panic in PullParser::push_pos() netvl/xml-rs#225 (only with debug assertions enabled)
• Avoid panic when displaying unexpected token error netvl/xml-rs#226 (fix got merged)

[kornelski]

I've fixed and improved a bunch of things in xml-rs, and I think it's a good choice now. There might still be some bugs left, so please keep fuzzing!