--- libxml-1.8.17/xpath.c.orig	2000-06-28 19:33:51.000000000 +0100
+++ libxml-1.8.17/xpath.c	2011-06-02 16:20:16.095097371 +0100
@@ -179,13 +179,13 @@
 #define PUSH_AND_POP(type, name)					\
 extern int name##Push(xmlXPathParserContextPtr ctxt, type value) {	\
     if (ctxt->name##Nr >= ctxt->name##Max) {				\
-	ctxt->name##Max *= 2;						\
         ctxt->name##Tab = (void *) xmlRealloc(ctxt->name##Tab,		\
-	             ctxt->name##Max * sizeof(ctxt->name##Tab[0]));	\
+	             ctxt->name##Max * 2 * sizeof(ctxt->name##Tab[0]));	\
         if (ctxt->name##Tab == NULL) {					\
 	    fprintf(xmlXPathDebug, "realloc failed !\n");		\
 	    return(0);							\
 	}								\
+	ctxt->name##Max *= 2;						\
     }									\
     ctxt->name##Tab[ctxt->name##Nr] = value;				\
     ctxt->name = value;							\
@@ -418,14 +418,14 @@
     } else if (cur->nodeNr == cur->nodeMax) {
         xmlNodePtr *temp;
 
-        cur->nodeMax *= 2;
-	temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
+	temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
 				      sizeof(xmlNodePtr));
 	if (temp == NULL) {
 	    fprintf(xmlXPathDebug, "xmlXPathNodeSetAdd: out of memory\n");
 	    return;
 	}
 	cur->nodeTab = temp;
+        cur->nodeMax *= 2;
     }
     cur->nodeTab[cur->nodeNr++] = val;
 }