From 8855346359a475c022ec8c28484a76c852f144d9 Mon Sep 17 00:00:00 2001
From: Matthew Fernandez <matthew.fernandez@gmail.com>
Date: Thu, 2 Oct 2025 17:15:15 -0700
Subject: [PATCH] lib: Realign a size with the `REALLOC` type signature it is
 passed into

Note that this implicitly assumes `tag->bufEnd >= tag->buf`, which should
already be guaranteed true.

CVE: CVE-2026-25210
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/8855346359a475c022ec8c28484a76c852f144d9]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
---
 lib/xmlparse.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index 2f9adffc..ee18a87f 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -3488,7 +3488,6 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
         const char *fromPtr = tag->rawName;
         toPtr = (XML_Char *)tag->buf;
         for (;;) {
-          int bufSize;
           int convLen;
           const enum XML_Convert_Result convert_res
               = XmlConvert(enc, &fromPtr, rawNameEnd, (ICHAR **)&toPtr,
@@ -3499,7 +3498,7 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
             tag->name.strLen = convLen;
             break;
           }
-          bufSize = (int)(tag->bufEnd - tag->buf) * 2;
+          const size_t bufSize = (size_t)(tag->bufEnd - tag->buf) * 2;
           {
             char *temp = REALLOC(parser, tag->buf, bufSize);
             if (temp == NULL)
