xsltAddTextString: Check for overflow when merging text nodes.

third_party/libxslt/libxslt/transform.c

 /*
  * transform.c: Implementation of the XSL Transformation 1.0 engine
  *              transform part, i.e. applying a Stylesheet to a document
  *
  * References:
  *   http://www.w3.org/TR/1999/REC-xslt-19991116
  *
  *   Michael Kay "XSLT Programmer's Reference" pp 637-643
  *   Writing Multiple Output Files
  *
@@ skipping 795 matching lines @@
 static xmlNodePtr
 xsltAddTextString(xsltTransformContextPtr ctxt, xmlNodePtr target,
                   const xmlChar *string, int len) {
     /*
      * optimization
      */
     if ((len <= 0) || (string == NULL) || (target == NULL))
         return(target);
 
     if (ctxt->lasttext == target->content) {
+        int minSize;
 
-        if (ctxt->lasttuse + len >= ctxt->lasttsize) {
+        /* Check for integer overflow accounting for NUL terminator. */
+        if (len >= INT_MAX - ctxt->lasttuse) {
+            xsltTransformError(ctxt, NULL, target,
+                "xsltCopyText: text allocation failed\n");
+            return(NULL);
+        }
+        minSize = ctxt->lasttuse + len + 1;
+
+        if (ctxt->lasttsize < minSize) {
             xmlChar *newbuf;
             int size;
+            int extra;
 
-            size = ctxt->lasttsize + len + 100;
-            size *= 2;
+            /* Double buffer size but increase by at least 100 bytes. */
+            extra = minSize < 100 ? 100 : minSize;
+
+            /* Check for integer overflow. */
+            if (extra > INT_MAX - ctxt->lasttsize) {
+                size = INT_MAX;
+            }
+            else {
+                size = ctxt->lasttsize + extra;
+            }
+
             newbuf = (xmlChar *) xmlRealloc(target->content,size);
             if (newbuf == NULL) {
                 xsltTransformError(ctxt, NULL, target,
                  "xsltCopyText: text allocation failed\n");
                 return(NULL);
             }
             ctxt->lasttsize = size;
             ctxt->lasttext = newbuf;
             target->content = newbuf;
         }
@@ skipping 5578 matching lines @@
                            XSLT_NAMESPACE,
                            (xsltTransformFunction) xsltDebug);
     xsltRegisterExtElement(ctxt, (const xmlChar *) "otherwise",
                            XSLT_NAMESPACE,
                            (xsltTransformFunction) xsltDebug);
     xsltRegisterExtElement(ctxt, (const xmlChar *) "fallback",
                            XSLT_NAMESPACE,
                            (xsltTransformFunction) xsltDebug);
 
 }