$OpenBSD: patch-tree_c,v 1.1 2008/11/23 18:49:42 naddy Exp $
--- tree.c.orig	Tue Apr  8 15:54:48 2008
+++ tree.c	Sun Nov 23 18:28:13 2008
@@ -14,7 +14,7 @@
 #include "libxml.h"
 
 #include <string.h> /* for memset() only ! */
-
+#include <limits.h>
 #ifdef HAVE_CTYPE_H
 #include <ctype.h>
 #endif
@@ -6916,7 +6916,13 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
     case XML_BUFFER_ALLOC_DOUBLEIT:
 	/*take care of empty case*/
         newSize = (buf->size ? buf->size*2 : size + 10);
-        while (size > newSize) newSize *= 2;
+        while (size > newSize) {
+            if (newSize > UINT_MAX / 2) {
+                xmlTreeErrMemory("growing buffer");
+                return 0;
+            }
+            newSize *= 2;
+        }
         break;
     case XML_BUFFER_ALLOC_EXACT:
         newSize = size+10;
