expat: Update to version 2.10.0
Commit Message
- Update from version 2.9.0 to 2.10.0
- Update of rootfile
- 4 CVE fixes
- Changelog
2.10.0
Security fixes:
( #1431) CVE-2026-113351 -- Fix denial of service with use of
`XML_ParserReset`
(#1433 #1436 ..)
(#1438 #1439 ..)
(#1442) CVE-2026-115506 -- Detect billion laughs attacks quicker
and more of its variations. Related payload fuzzer at:
https://github.com/hannob/lololol
Please note that a layer of compression around XML can
significantly reduce the minimum attack payload size.
In case of backporting, please note pull request #1439
in particular.
(#1444) CVE-2026-117610 -- Fix initial non-final empty subparser
parse calls. Was segfaulting previously.
(#1450) CVE-2026-118370 -- Protect `attIndex` and `nPrefixes` in
function `storeAtts` from signed integer overflow
Bug fixes:
(#1452) lib: Initialize `m_parsingStatus.finalBuffer` in `parserInit`
to fix calling `XML_GetParsingStatus` right after
parser creation
(#1457 #1459) lib: Improve `XML_Parse` for `XML_CONTEXT_BYTES == 0`
including NULL pointer arithmetic undefined behavior
and uninitialized variable access
(#1458) lib: Use C99 length modifiers for `ptrdiff_t` and `size_t`
to fix support for CHERI-RISC-V
(#1461) lib: Check `isCalledFromInsideHandler` first in `XML_Parse`
(#1467) lib: Add missing check for a character handler reset
Other changes:
(#1441) Autotools: Move `-lm` from LDFLAGS to LIBADD/LDADD
to better support compilation with `-Wl,--as-needed`
(#1412) CMake: Support repeated `find_package` calls
(#1413) lib: Address warning `XML_GE is not defined [-Werror=undef]`
(#1415) lib: Stop delaying `callStoreEntityValue` error handling
(#1415) lib: Add missing call to `poolDiscard`
(#1437) lib: Add missing `NULL` check for `m_startDoctypeDeclHandler`
(#1417) lib: Migrate `ENTITY.textLen` and `ENTITY.processed` from
`int` to `size_t`
(#1463) lib: Fix integer truncation in `XmlGetAttributes`/`getAtts`
(#1420) lib: Some more `XML_Bool` to `bool` migration
(#1449 #1460) lib: Document the memory reuse black magic that function
`storeAtts` is doing
(#1453) lib: Document failure to reject bad redefinitions of
predefined entities
(#1432) tests: Replace `XML_SetHashSalt` with
`XML_SetHashSalt16Bytes`
(#1416 #1435) Version info bumped from 14:0:13 (libexpat*.so.1.13.0)
to 14:1:13 (libexpat*.so.1.13.1); see https://verbump.de/
for what these numbers do
Infrastructure:
(#1414) CI: Stop using about-to-be-removed image "macos-14"
(#1418 #1434) CI: Bump MinGW Clang from 23.1.2 to 23.1.4
(#1443) CI: Bump Fil-C from 0.686 to 0.687
(#1456) Drop a `lib/xcsinc.c` leftover
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/common/expat | 20 ++++++++++----------
lfs/expat | 4 ++--
2 files changed, 12 insertions(+), 12 deletions(-)
@@ -2,21 +2,21 @@
#usr/include/expat.h
#usr/include/expat_config.h
#usr/include/expat_external.h
-#usr/lib/cmake/expat-2.9.0
-#usr/lib/cmake/expat-2.9.0/expat-config-version.cmake
-#usr/lib/cmake/expat-2.9.0/expat-config.cmake
-#usr/lib/cmake/expat-2.9.0/expat-noconfig.cmake
-#usr/lib/cmake/expat-2.9.0/expat.cmake
+#usr/lib/cmake/expat-2.10.0
+#usr/lib/cmake/expat-2.10.0/expat-config-version.cmake
+#usr/lib/cmake/expat-2.10.0/expat-config.cmake
+#usr/lib/cmake/expat-2.10.0/expat-noconfig.cmake
+#usr/lib/cmake/expat-2.10.0/expat.cmake
#usr/lib/libexpat.la
#usr/lib/libexpat.so
usr/lib/libexpat.so.1
-usr/lib/libexpat.so.1.13.0
+usr/lib/libexpat.so.1.13.1
#usr/lib/pkgconfig/expat.pc
#usr/share/doc/expat
-#usr/share/doc/expat-2.9.0
-#usr/share/doc/expat-2.9.0/ok.min.css
-#usr/share/doc/expat-2.9.0/reference.html
-#usr/share/doc/expat-2.9.0/style.css
+#usr/share/doc/expat-2.10.0
+#usr/share/doc/expat-2.10.0/ok.min.css
+#usr/share/doc/expat-2.10.0/reference.html
+#usr/share/doc/expat-2.10.0/style.css
#usr/share/doc/expat/AUTHORS
#usr/share/doc/expat/changelog
#usr/share/man/man1/xmlwf.1
@@ -24,7 +24,7 @@
include Config
-VER = 2.9.0
+VER = 2.10.0
THISAPP = expat-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = b029962cd2ea06fbbe922837e6c708512a5c77a4617ee399779788ffe91537533d8c66e0ca63e0b92b76da8e84c10fa82216f27a6e48b16b898905b06e116562
+$(DL_FILE)_BLAKE2 = ac940001ac7e18cfa2639e881324006a8272e69e5b83ca06da4d080eaead60366930782e38dd559abc9fd0dcede23a557683bc871e4bdea287167822fd8f3416
install : $(TARGET)