Index: xmlreader.c
===================================================================
--- xmlreader.c	(revision 7902)
+++ xmlreader.c	(working copy)
@@ -809,6 +809,7 @@
     xmlBufferPtr inbuf;
     int val, s;
     xmlTextReaderState oldstate;
+    int csize = CHUNK_SIZE;
 
     if ((reader->input == NULL) || (reader->input->buffer == NULL))
 	return(-1);
@@ -818,12 +819,15 @@
     inbuf = reader->input->buffer;
 
     while (reader->state == XML_TEXTREADER_NONE) {
-	if (inbuf->use < reader->cur + CHUNK_SIZE) {
+	if (inbuf->use < reader->cur + csize) {
 	    /*
 	     * Refill the buffer unless we are at the end of the stream
 	     */
 	    if (reader->mode != XML_TEXTREADER_MODE_EOF) {
-		val = xmlParserInputBufferRead(reader->input, 4096);
+		int rsize = 4096;
+		if (rsize < csize)
+		    rsize += csize;
+		val = xmlParserInputBufferRead(reader->input, rsize);
 		if ((val == 0) &&
 		    (inbuf->alloc == XML_BUFFER_ALLOC_IMMUTABLE)) {
 		    if (inbuf->use == reader->cur) {
@@ -849,11 +853,11 @@
 	 * parse by block of CHUNK_SIZE bytes, various tests show that
 	 * it's the best tradeoff at least on a 1.2GH Duron
 	 */
-	if (inbuf->use >= reader->cur + CHUNK_SIZE) {
+	if (inbuf->use >= reader->cur + csize) {
 	    val = xmlParseChunk(reader->ctxt,
 		          (const char *) &inbuf->content[reader->cur],
-			  CHUNK_SIZE, 0);
-	    reader->cur += CHUNK_SIZE;
+			  csize, 0);
+	    reader->cur += csize;
 	    if ((val != 0) || (reader->ctxt->wellFormed == 0))
 		return(-1);
 	} else {
@@ -866,6 +870,8 @@
 		return(-1);
 	    break;
 	}
+	/* FIXME: should use a reasonable max size to avoids overflows on ill cases */
+	csize *= 2;
     }
 
     /*