Fix a couple of memory allocation bugs with namespace processing and XML_UNICODE.

diff --git a/expat/xmlparse/xmlparse.c b/expat/xmlparse/xmlparse.c
index 16c226d8525c88d53c359a75581f2778efb7e821..fe09d19b188718abf07e85cdab87beef7c865aae 100755 (executable)
--- a/expat/xmlparse/xmlparse.c
+++ b/expat/xmlparse/xmlparse.c
@@ -1750,7 +1750,7 @@ static enum XML_Error storeAtts(XML_Parser parser, const ENCODING *enc,
   i = binding->uriLen;
   do {
     if (i == binding->uriAlloc) {
-      binding->uri = realloc(binding->uri, binding->uriAlloc *= 2);
+      binding->uri = realloc(binding->uri, (binding->uriAlloc *= 2) * sizeof(XML_Char));
       if (!binding->uri)
        return XML_ERROR_NO_MEMORY;
     }
@@ -1772,7 +1772,7 @@ int addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId, con
   if (freeBindingList) {
     b = freeBindingList;
     if (len > b->uriAlloc) {
-      b->uri = realloc(b->uri, len + EXPAND_SPARE);
+      b->uri = realloc(b->uri, sizeof(XML_Char) * (len + EXPAND_SPARE));
       if (!b->uri)
        return 0;
       b->uriAlloc = len + EXPAND_SPARE;
@@ -1783,12 +1783,12 @@ int addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId, con
     b = malloc(sizeof(BINDING));
     if (!b)
       return 0;
-    b->uri = malloc(sizeof(XML_Char) * len + EXPAND_SPARE);
+    b->uri = malloc(sizeof(XML_Char) * (len + EXPAND_SPARE));
     if (!b->uri) {
       free(b);
       return 0;
     }
-    b->uriAlloc = len;
+    b->uriAlloc = len + EXPAND_SPARE;
   }
   b->uriLen = len;
   memcpy(b->uri, uri, len * sizeof(XML_Char));