From d913033f184945f19edde8345868be790e77f88b Mon Sep 17 00:00:00 2001
From: Kyue <164024549+Gooh456@users.noreply.github.com>
Date: Fri, 24 Jul 2026 14:13:49 +0100
Subject: [PATCH] DynArray::EnsureCapacity: make the overflow check survive
 release builds

Signed-off-by: Kyue <164024549+Gooh456@users.noreply.github.com>
---
 tinyxml2.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tinyxml2.h b/tinyxml2.h
index 048f8543..8892a90e 100644
--- a/tinyxml2.h
+++ b/tinyxml2.h
@@ -296,6 +296,13 @@ class DynArray
         TIXMLASSERT( cap > 0 );
         if ( cap > _allocated ) {
             TIXMLASSERT( cap <= SIZE_MAX / 2 / sizeof(T));
+            if ( cap > SIZE_MAX / 2 / sizeof(T) ) {
+                // cap*2 below would overflow size_t and wrap to a tiny
+                // value, giving a too-small allocation followed by an
+                // out-of-bounds memcpy. TIXMLASSERT is a no-op in release
+                // builds, so this needs to be a real check.
+                abort();
+            }
             const size_t newAllocated = cap * 2;
             T* newMem = new T[newAllocated];
             TIXMLASSERT( newAllocated >= _size );