You are underestimating how easy it is to write insecure C code.

But it would be nice to know if this is expat, libxml2, or what.