From 9c2d990389e6abe2e44527eeaa8b39f16fe859c7 Mon Sep 17 00:00:00 2001
From: Matthew Fernandez <matthew.fernandez@gmail.com>
Date: Thu, 2 Oct 2025 17:15:15 -0700
Subject: [PATCH] lib: Introduce an integer overflow check for tag buffer
 reallocation

Suggested-by: Sebastian Pipping <sebastian@pipping.org>

CVE: CVE-2026-25210
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/9c2d990389e6abe2e44527eeaa8b39f16fe859c7]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 lib/xmlparse.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index ee18a87f..d8c54c38 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -2976,6 +2976,8 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
             tag->name.strLen = convLen;
             break;
           }
+          if (SIZE_MAX / 2 < (size_t)(tag->bufEnd - tag->buf))
+            return XML_ERROR_NO_MEMORY;
           const size_t bufSize = (size_t)(tag->bufEnd - tag->buf) * 2;
           {
             char *temp = (char *)REALLOC(parser, tag->buf, bufSize);