--- ./xmlIO.c.orig	2024-07-24 09:00:51.000000000 -0500
+++ ./xmlIO.c	2026-09-04 18:22:18.783060668 -0500
@@ -3354,6 +3354,11 @@
             if ((nbchars < MINLEN) && (len <= 0))
                 goto done;
 
+            if (nbchars >= INT_MAX) {
+                out->error = XML_ERR_INTERNAL_ERROR;
+                return(-1);
+            }
+
 	    /*
 	     * second write the stuff to the I/O channel
 	     */
@@ -3651,15 +3656,25 @@
      */
     if ((out->conv != NULL) && (out->encoder != NULL) &&
 	(out->writecallback != NULL)) {
+        size_t bufsize = xmlBufUse(out->conv);
+        if (bufsize >= INT_MAX) {
+            out->error = XML_ERR_INTERNAL_ERROR;
+            return(-1);
+        }
 	ret = out->writecallback(out->context,
                                  (const char *)xmlBufContent(out->conv),
-                                 xmlBufUse(out->conv));
+                                 bufsize);
 	if (ret >= 0)
 	    xmlBufShrink(out->conv, ret);
     } else if (out->writecallback != NULL) {
+        size_t bufsize = xmlBufUse(out->buffer);
+        if (bufsize >= INT_MAX) {
+            out->error = XML_ERR_INTERNAL_ERROR;
+            return(-1);
+        }
 	ret = out->writecallback(out->context,
                                  (const char *)xmlBufContent(out->buffer),
-                                 xmlBufUse(out->buffer));
+                                 bufsize);
 	if (ret >= 0)
 	    xmlBufShrink(out->buffer, ret);
     }