More overflow checks in XML_GetBuffer(), adapted from FreeBSD security

advisory FreeBSD-SA-15:20. Most of them were already fixed by niallo@'s work,
which unfortunately got removed in r1.10 /-:

With help from doug@

1 files changed, 5 insertions, 1 deletions

diff --git a/lib/libexpat/lib/xmlparse.c b/lib/libexpat/lib/xmlparse.c
index bcb4871c81e..ccb45fbbb20 100644
--- a/lib/libexpat/lib/xmlparse.c
+++ b/lib/libexpat/lib/xmlparse.c
@@ -1693,7 +1693,7 @@ XML_GetBuffer(XML_Parser parser, int len)
   }
 
   /* Avoid integer overflow */
-  if (len > MAXLEN - (bufferEnd - bufferPtr)) {
+  if (len < 0 || len > MAXLEN - (bufferEnd - bufferPtr)) {
     errorCode = XML_ERROR_NO_MEMORY;
     return NULL; 
   }
@@ -1726,6 +1726,10 @@ XML_GetBuffer(XML_Parser parser, int len)
       if (bufferSize == 0)
         bufferSize = INIT_BUFFER_SIZE;
       do {
+        if (bufferSize > MAXLEN / 2) {
+          errorCode = XML_ERROR_NO_MEMORY;
+          return NULL;
+        }
         bufferSize *= 2;
       } while (bufferSize < neededSize);
       newBuf = (char *)MALLOC(bufferSize);