Fix for bug #615606.

diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
index 9d2c225c9e5265fc6022190cdccbc90ac3dc8800..5853e08e0a2649d956e5fc6c8a7741e151ff8a42 100644 (file)
--- a/expat/lib/xmlparse.c
+++ b/expat/lib/xmlparse.c
@@ -1670,8 +1670,12 @@ storeRawNames(XML_Parser parser)
       char *temp = REALLOC(tag->buf, bufSize);
       if (temp == NULL)
         return XML_FALSE;
+      /* if tag->name.str points to tag->buf (i.e. when namespace
+         processing is off) then we have to update it 
+      */
+      if (tag->name.str == (XML_Char *)tag->buf)
+        tag->name.str = (XML_Char *)temp;
       tag->buf = temp;
-      tag->name.str = (XML_Char *)temp;
       tag->bufEnd = temp + bufSize;
       rawNameBuf = temp + nameLen;
     }