1 diff --git a/xpath.c b/xpath.c
2 index 8b56189..608fe00 100644
5 @@ -3522,13 +3522,13 @@ xmlXPathNodeSetAddNs(xmlNodeSetPtr cur, xmlNodePtr node, xmlNsPtr ns) {
6 } else if (cur->nodeNr == cur->nodeMax) {
10 - temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
11 + temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
14 xmlXPathErrMemory(NULL, "growing nodeset\n");
20 cur->nodeTab[cur->nodeNr++] = xmlXPathNodeSetDupNs(node, ns);
21 @@ -3627,14 +3627,14 @@ xmlXPathNodeSetAddUnique(xmlNodeSetPtr cur, xmlNodePtr val) {
22 } else if (cur->nodeNr == cur->nodeMax) {
26 - temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
27 + temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
30 xmlXPathErrMemory(NULL, "growing nodeset\n");
36 if (val->type == XML_NAMESPACE_DECL) {
37 xmlNsPtr ns = (xmlNsPtr) val;
38 @@ -3738,14 +3738,14 @@ xmlXPathNodeSetMerge(xmlNodeSetPtr val1, xmlNodeSetPtr val2) {
39 } else if (val1->nodeNr == val1->nodeMax) {
43 - temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax *
44 + temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax * 2 *
47 xmlXPathErrMemory(NULL, "merging nodeset\n");
53 if (n2->type == XML_NAMESPACE_DECL) {
54 xmlNsPtr ns = (xmlNsPtr) n2;
55 @@ -3907,14 +3907,14 @@ xmlXPathNodeSetMergeAndClear(xmlNodeSetPtr set1, xmlNodeSetPtr set2,
56 } else if (set1->nodeNr >= set1->nodeMax) {
60 temp = (xmlNodePtr *) xmlRealloc(
61 - set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
62 + set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
64 xmlXPathErrMemory(NULL, "merging nodeset\n");
70 if (n2->type == XML_NAMESPACE_DECL) {
71 xmlNsPtr ns = (xmlNsPtr) n2;
72 @@ -3991,14 +3991,14 @@ xmlXPathNodeSetMergeAndClearNoDupls(xmlNodeSetPtr set1, xmlNodeSetPtr set2,
73 } else if (set1->nodeNr >= set1->nodeMax) {
77 temp = (xmlNodePtr *) xmlRealloc(
78 - set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
79 + set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
81 xmlXPathErrMemory(NULL, "merging nodeset\n");
87 set1->nodeTab[set1->nodeNr++] = n2;