[3.15] gh-148441: Avoid integer overflow in Expat's CharacterDataHandler (GH-148904)

[3.15] gh-148441: Avoid integer overflow in Expat's CharacterDataHandler (GH-148904) #115622