1 files changed, 12 insertions, 11 deletions

diff --git a/chromium/third_party/libxml/src/xmlstring.c b/chromium/third_party/libxml/src/xmlstring.c
index 2bd7e6a6fef..7fbf9d079e2 100644
--- a/chromium/third_party/libxml/src/xmlstring.c
+++ b/chromium/third_party/libxml/src/xmlstring.c
@@ -46,12 +46,12 @@ xmlStrndup(const xmlChar *cur, int len) {
     xmlChar *ret;
 
     if ((cur == NULL) || (len < 0)) return(NULL);
-    ret = (xmlChar *) xmlMallocAtomic(((size_t) len + 1) * sizeof(xmlChar));
+    ret = (xmlChar *) xmlMallocAtomic((size_t) len + 1);
     if (ret == NULL) {
         xmlErrMemory(NULL, NULL);
         return(NULL);
     }
-    memcpy(ret, cur, len * sizeof(xmlChar));
+    memcpy(ret, cur, len);
     ret[len] = 0;
     return(ret);
 }
@@ -91,12 +91,13 @@ xmlCharStrndup(const char *cur, int len) {
     xmlChar *ret;
 
     if ((cur == NULL) || (len < 0)) return(NULL);
-    ret = (xmlChar *) xmlMallocAtomic(((size_t) len + 1) * sizeof(xmlChar));
+    ret = (xmlChar *) xmlMallocAtomic((size_t) len + 1);
     if (ret == NULL) {
         xmlErrMemory(NULL, NULL);
         return(NULL);
     }
     for (i = 0;i < len;i++) {
+        /* Explicit sign change */
         ret[i] = (xmlChar) cur[i];
         if (ret[i] == 0) return(ret);
     }
@@ -460,12 +461,12 @@ xmlStrncat(xmlChar *cur, const xmlChar *add, int len) {
     size = xmlStrlen(cur);
     if ((size < 0) || (size > INT_MAX - len))
         return(NULL);
-    ret = (xmlChar *) xmlRealloc(cur, ((size_t) size + len + 1) * sizeof(xmlChar));
+    ret = (xmlChar *) xmlRealloc(cur, (size_t) size + len + 1);
     if (ret == NULL) {
         xmlErrMemory(NULL, NULL);
         return(cur);
     }
-    memcpy(&ret[size], add, len * sizeof(xmlChar));
+    memcpy(&ret[size], add, len);
     ret[size + len] = 0;
     return(ret);
 }
@@ -500,13 +501,13 @@ xmlStrncatNew(const xmlChar *str1, const xmlChar *str2, int len) {
     size = xmlStrlen(str1);
     if ((size < 0) || (size > INT_MAX - len))
         return(NULL);
-    ret = (xmlChar *) xmlMalloc(((size_t) size + len + 1) * sizeof(xmlChar));
+    ret = (xmlChar *) xmlMalloc((size_t) size + len + 1);
     if (ret == NULL) {
         xmlErrMemory(NULL, NULL);
         return(xmlStrndup(str1, size));
     }
-    memcpy(ret, str1, size * sizeof(xmlChar));
-    memcpy(&ret[size], str2, len * sizeof(xmlChar));
+    memcpy(ret, str1, size);
+    memcpy(&ret[size], str2, len);
     ret[size + len] = 0;
     return(ret);
 }
@@ -874,11 +875,11 @@ xmlUTF8Strndup(const xmlChar *utf, int len) {
 
     if ((utf == NULL) || (len < 0)) return(NULL);
     i = xmlUTF8Strsize(utf, len);
-    ret = (xmlChar *) xmlMallocAtomic(((size_t) i + 1) * sizeof(xmlChar));
+    ret = (xmlChar *) xmlMallocAtomic((size_t) i + 1);
     if (ret == NULL) {
         return(NULL);
     }
-    memcpy(ret, utf, i * sizeof(xmlChar));
+    memcpy(ret, utf, i);
     ret[i] = 0;
     return(ret);
 }
@@ -1025,7 +1026,7 @@ xmlEscapeFormatString(xmlChar **msg)
     if ((count > INT_MAX) || (msgLen > INT_MAX - count))
         return(NULL);
     resultLen = msgLen + count + 1;
-    result = (xmlChar *) xmlMallocAtomic(resultLen * sizeof(xmlChar));
+    result = (xmlChar *) xmlMallocAtomic(resultLen);
     if (result == NULL) {
         /* Clear *msg to prevent format string vulnerabilities in
            out-of-memory situations. */