lib/libexpat/lib/xmlparse.c

4217

if (totalLen > SIZE_MAX - EXPAND_SPARE

lib/libexpat/lib/xmlparse.c

4218

|| totalLen + EXPAND_SPARE > SIZE_MAX / sizeof(XML_Char)) {

lib/libexpat/lib/xmlparse.c

4222

uri = MALLOC(parser, (totalLen + EXPAND_SPARE) * sizeof(XML_Char));

lib/libexpat/lib/xmlparse.c

4225

binding->uriAlloc = totalLen + EXPAND_SPARE;

lib/libexpat/lib/xmlparse.c

4466

if (len > SIZE_MAX - EXPAND_SPARE

lib/libexpat/lib/xmlparse.c

4467

|| len + EXPAND_SPARE > SIZE_MAX / sizeof(XML_Char)) {

lib/libexpat/lib/xmlparse.c

4472

= REALLOC(parser, b->uri, sizeof(XML_Char) * (len + EXPAND_SPARE));

lib/libexpat/lib/xmlparse.c

4476

b->uriAlloc = len + EXPAND_SPARE;

lib/libexpat/lib/xmlparse.c

4485

if (len > SIZE_MAX - EXPAND_SPARE

lib/libexpat/lib/xmlparse.c

4486

|| len + EXPAND_SPARE > SIZE_MAX / sizeof(XML_Char)) {

lib/libexpat/lib/xmlparse.c

4490

b->uri = MALLOC(parser, sizeof(XML_Char) * (len + EXPAND_SPARE));

lib/libexpat/lib/xmlparse.c

4495

b->uriAlloc = len + EXPAND_SPARE;