Created attachment 367643 [details] [review]
0001-Remove-a-misleading-line-from-xmlCharEncOutput.patch

Overview:
I was just passing by and saw a line of code that looked oddly out of place.

if (ret >= 0) output += ret;

This line increases xmlOutputBufferPtr output (one of the parameters of the xmlCharEncOutput) by the number of bytes written. This pointer points to a wrapper struct, not to any buffer so after incrementing it becomes invalid. It looks like this line was accidentally copied over from xmlCharEncOutFunc where output is an int variable for collecting statistics. Luckily the current implementation of xmlCharEncOutput doesn't dereference output after accidentally advancing it or it would trigger UB. I decided to remove the line anyway because it creates a potentially dangerous situation.