An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m groupSize on 32-bit platforms (where UINT MAX equals SIZE MAX).