Using a regex with an {nnn} expression where 'nnn' is larger than INT_MAX, an integer overflow occurs in xmlFAParseQuantExact() (found by oss-fuzz running with UBSan):

static int
xmlFAParseQuantExact(xmlRegParserCtxtPtr ctxt) {
    int ret = 0;
    int ok = 0;

    while ((CUR >= '0') && (CUR <= '9')) {
	ret = ret * 10 + (CUR - '0');  // Integer overflow.
	ok = 1;
	NEXT;
    }
    if (ok != 1) {
	return(-1);
    }
    return(ret);
}

A sample test case would be:

.{4294967295}

Imported from:  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520