More overflow checks

tinyxml2.h

@@ -232,11 +232,14 @@ public:
     }
 
     void Push( T t ) {
+        TIXMLASSERT( _size < (size_t)(-1) );
         EnsureCapacity( _size+1 );
         _mem[_size++] = t;
     }
 
     T* PushArr( int count ) {
+        TIXMLASSERT( count >= 0 );
+        TIXMLASSERT( _size <= (size_t)(-1) - count );
         EnsureCapacity( _size+count );
         T* ret = &_mem[_size];
         _size += count;
@@ -244,6 +247,7 @@ public:
     }
 
     T Pop() {
+        TIXMLASSERT( _size > 0 );
         return _mem[--_size];
     }