From 8855346359a475c022ec8c28484a76c852f144d9 Mon Sep 17 00:00:00 2001 From: Matthew Fernandez Date: Thu, 2 Oct 2025 17:15:15 -0700 Subject: [PATCH] lib: Realign a size with the `REALLOC` type signature it is passed into Note that this implicitly assumes `tag->bufEnd >= tag->buf`, which should already be guaranteed true. CVE: CVE-2026-25210 Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/8855346359a475c022ec8c28484a76c852f144d9] Signed-off-by: Peter Marko --- lib/xmlparse.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/xmlparse.c b/lib/xmlparse.c index 2f9adffc..ee18a87f 100644 --- a/lib/xmlparse.c +++ b/lib/xmlparse.c @@ -2966,7 +2966,6 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, const char *fromPtr = tag->rawName; toPtr = (XML_Char *)tag->buf; for (;;) { - int bufSize; int convLen; const enum XML_Convert_Result convert_res = XmlConvert(enc, &fromPtr, rawNameEnd, (ICHAR **)&toPtr, @@ -2977,7 +2976,7 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, tag->name.strLen = convLen; break; } - bufSize = (int)(tag->bufEnd - tag->buf) * 2; + const size_t bufSize = (size_t)(tag->bufEnd - tag->buf) * 2; { char *temp = (char *)REALLOC(parser, tag->buf, bufSize); if (temp == NULL)