Use size_t for string lengths in ext/xml compat layer

[nielsdos]

This is not exploitable right now because libxml guarantees right now a maximum string length of 1M bytes. But if that limit were to ever change this could overflow in the future leading to exploits. Again, not exploitable right now, but just making it more future-proof.

[devnexen]

question: would not you need an explicit cast for xmlStrlen too (just to avoid possible build warnings) ? e.g.

_build_comment(comment, xmlStrlen(comment), &d_comment, &d_comment_len);

[Girgias]

LGTM

[nielsdos]

question: would not you need an explicit cast for xmlStrlen too (just to avoid possible build warnings) ? e.g.

C should implicitly cast, but under -Wconversion could indeed warn. We don't enable this for PHP but I agree that we can do the cast so at least the intent is clear; and if we ever enable such warning there won't be a problem here.