In XML_ParseBuffer(), if len exceeds the unoccupied capacity of the internal buffer (EXPAT_SAFE_PTR_DIFF(m_bufferLim, m_bufferEnd)), parser->m_bufferEnd was previously advanced past parser->m_bufferLim. This violated the internal pointer invariant (m_bufferEnd <= m_bufferLim) and caused callProcessor() to read unallocated or uninitialized heap memory beyond the buffer bounds.

NOTE: https://github.com/libexpat/libexpat/pull/1393
NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/4d9b1c499ecb66323260a7274edcf86c5eab0517 (R_2_9_0)