71fa08
diff -up thunderbird-91.7.0/parser/expat/lib/xmlparse.c.expat-CVE-2022-25315 thunderbird-91.7.0/parser/expat/lib/xmlparse.c
71fa08
--- thunderbird-91.7.0/parser/expat/lib/xmlparse.c.expat-CVE-2022-25315	2022-03-02 18:17:50.966583254 +0100
71fa08
+++ thunderbird-91.7.0/parser/expat/lib/xmlparse.c	2022-03-02 18:19:27.636924735 +0100
71fa08
@@ -2479,6 +2479,7 @@ storeRawNames(XML_Parser parser)
71fa08
   while (tag) {
71fa08
     int bufSize;
71fa08
     int nameLen = sizeof(XML_Char) * (tag->name.strLen + 1);
71fa08
+    size_t rawNameLen;
71fa08
     char *rawNameBuf = tag->buf + nameLen;
71fa08
     /* Stop if already stored.  Since tagStack is a stack, we can stop
71fa08
        at the first entry that has already been copied; everything
71fa08
@@ -2490,7 +2491,11 @@ storeRawNames(XML_Parser parser)
71fa08
     /* For re-use purposes we need to ensure that the
71fa08
        size of tag->buf is a multiple of sizeof(XML_Char).
71fa08
     */
71fa08
-    bufSize = nameLen + ROUND_UP(tag->rawNameLength, sizeof(XML_Char));
71fa08
+    rawNameLen = ROUND_UP(tag->rawNameLength, sizeof(XML_Char));
71fa08
+    /* Detect and prevent integer overflow. */
71fa08
+    if (rawNameLen > (size_t)INT_MAX - nameLen)
71fa08
+      return XML_FALSE;
71fa08
+    bufSize = nameLen + (int)rawNameLen;
71fa08
     if (bufSize > tag->bufEnd - tag->buf) {
71fa08
       char *temp = (char *)REALLOC(tag->buf, bufSize);
71fa08
       if (temp == NULL)