Fix bug with > INIT_ATTS_SIZE attributes

diff --git a/expat/xmlparse/xmlparse.c b/expat/xmlparse/xmlparse.c
index efb3ab02ec444d9a3a5daafada83ffc85be21df0..11ebf760dbf37bdc84fe7ecaf39469fca804fc31 100755 (executable)
--- a/expat/xmlparse/xmlparse.c
+++ b/expat/xmlparse/xmlparse.c
@@ -803,7 +803,7 @@ static enum XML_Error storeAtts(XML_Parser parser, const ENCODING *enc,
 {
   ELEMENT_TYPE *elementType = 0;
   int nDefaultAtts = 0;
-  const char **appAtts = (const char **)atts;
+  const char **appAtts;
   int i;
   int n;
 
@@ -815,13 +815,15 @@ static enum XML_Error storeAtts(XML_Parser parser, const ENCODING *enc,
   
   n = XmlGetAttributes(enc, s, attsSize, atts);
   if (n + nDefaultAtts > attsSize) {
-    attsSize = 2*n;
+    int oldAttsSize = attsSize;
+    attsSize = n + nDefaultAtts + INIT_ATTS_SIZE;
     atts = realloc((void *)atts, attsSize * sizeof(ATTRIBUTE));
     if (!atts)
       return XML_ERROR_NO_MEMORY;
-    if (n > attsSize)
+    if (n > oldAttsSize)
       XmlGetAttributes(enc, s, n, atts);
   }
+  appAtts = (const char **)atts;
   for (i = 0; i < n; i++) {
     ATTRIBUTE_ID *attId = getAttributeId(parser, enc, atts[i].name,
                                          atts[i].name