[libxml2] Fix integer overflow in xmlFAParseQuantExact

[Nick Wellnhofer <nwellnhof src gnome org>]

commit 1e7851b5aea4b2d8b9a6b6c02187fc4786f7a8b7
Author: Nick Wellnhofer <wellnhofer aevum de>
Date:   Thu Jun 25 12:17:50 2020 +0200

    Fix integer overflow in xmlFAParseQuantExact
    
    Found by OSS-Fuzz.

 xmlregexp.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)
---
diff --git a/xmlregexp.c b/xmlregexp.c
index 53fa145c..0272dcab 100644
--- a/xmlregexp.c
+++ b/xmlregexp.c
@@ -5211,13 +5211,24 @@ static int
 xmlFAParseQuantExact(xmlRegParserCtxtPtr ctxt) {
     int ret = 0;
     int ok = 0;
+    int overflow = 0;
 
     while ((CUR >= '0') && (CUR <= '9')) {
-       ret = ret * 10 + (CUR - '0');
+        if (ret > INT_MAX / 10) {
+            overflow = 1;
+        } else {
+            int digit = CUR - '0';
+
+            ret *= 10;
+            if (ret > INT_MAX - digit)
+                overflow = 1;
+            else
+                ret += digit;
+        }
        ok = 1;
        NEXT;
     }
-    if (ok != 1) {
+    if ((ok != 1) || (overflow == 1)) {
        return(-1);
     }
     return(ret);