From patchwork Tue Nov 3 12:26:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10639 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4jJnqv0B0Kz3x5B for ; Tue, 03 Nov 2026 12:26:35 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jJnqs3T35z8ml for ; Tue, 03 Nov 2026 12:26:33 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jJnqs2YHKz363y for ; Tue, 03 Nov 2026 12:26:33 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jJnqp4C8rz30GZ for ; Tue, 03 Nov 2026 12:26:30 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4jJnqp0ckVz2jt; Tue, 03 Nov 2026 12:26:30 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1793708790; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9Nwru0JbQLFYYWjMshZmgvKAnFkwWXhTQzeISFnKLPM=; b=EvXoAy+5nE8vgXMbwHTX5rDtQsHEXI1sTL2zeAKgL4sOyjyKZ0LbEsSTaM/1gc62oSXz4G HCL3qM9t7KzQWQCA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1793708790; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9Nwru0JbQLFYYWjMshZmgvKAnFkwWXhTQzeISFnKLPM=; b=TsEFhMz84nfTWraQ8I6mkbAugQsM2J4Om5x+ddLjS8afg8NSopBstpWe9+hYHbPiziBRYv u39GhAk+P6kKntHW0wSw72nxDJOOzS9g3GW2aNaZk2GjNmECRSBdGlmffSIhCHYidpv8KC Z5EqqqeddIr3RnktU5uxsxWhCovXeAb8akjKuvhRTdC5P3PQJrtSpP93VBaSnbJ/AqWmmN /7e3Or5UEZ58msUWx3CwHQlzVcDwCVsyTMZa8v/kAuxqkzSq2MBzMqtkdfFk1whtcSkTDD T8D4d8UTXYpzJIFfLjovxfxiBvNaIkb3pAWjokBuWBTAVypKI6N97o0fMSTDcg== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] expat: Update to version 2.10.0 Date: Tue, 3 Nov 2026 13:26:24 +0100 Message-ID: <20261103122625.3264251-3-adolf.belka@ipfire.org> In-Reply-To: <20261103122625.3264251-1-adolf.belka@ipfire.org> References: <20261103122625.3264251-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 2.9.0 to 2.10.0 - Update of rootfile - 4 CVE fixes - Changelog 2.10.0 Security fixes: ( #1431) CVE-2026-113351 -- Fix denial of service with use of `XML_ParserReset` (#1433 #1436 ..) (#1438 #1439 ..) (#1442) CVE-2026-115506 -- Detect billion laughs attacks quicker and more of its variations. Related payload fuzzer at: https://github.com/hannob/lololol Please note that a layer of compression around XML can significantly reduce the minimum attack payload size. In case of backporting, please note pull request #1439 in particular. (#1444) CVE-2026-117610 -- Fix initial non-final empty subparser parse calls. Was segfaulting previously. (#1450) CVE-2026-118370 -- Protect `attIndex` and `nPrefixes` in function `storeAtts` from signed integer overflow Bug fixes: (#1452) lib: Initialize `m_parsingStatus.finalBuffer` in `parserInit` to fix calling `XML_GetParsingStatus` right after parser creation (#1457 #1459) lib: Improve `XML_Parse` for `XML_CONTEXT_BYTES == 0` including NULL pointer arithmetic undefined behavior and uninitialized variable access (#1458) lib: Use C99 length modifiers for `ptrdiff_t` and `size_t` to fix support for CHERI-RISC-V (#1461) lib: Check `isCalledFromInsideHandler` first in `XML_Parse` (#1467) lib: Add missing check for a character handler reset Other changes: (#1441) Autotools: Move `-lm` from LDFLAGS to LIBADD/LDADD to better support compilation with `-Wl,--as-needed` (#1412) CMake: Support repeated `find_package` calls (#1413) lib: Address warning `XML_GE is not defined [-Werror=undef]` (#1415) lib: Stop delaying `callStoreEntityValue` error handling (#1415) lib: Add missing call to `poolDiscard` (#1437) lib: Add missing `NULL` check for `m_startDoctypeDeclHandler` (#1417) lib: Migrate `ENTITY.textLen` and `ENTITY.processed` from `int` to `size_t` (#1463) lib: Fix integer truncation in `XmlGetAttributes`/`getAtts` (#1420) lib: Some more `XML_Bool` to `bool` migration (#1449 #1460) lib: Document the memory reuse black magic that function `storeAtts` is doing (#1453) lib: Document failure to reject bad redefinitions of predefined entities (#1432) tests: Replace `XML_SetHashSalt` with `XML_SetHashSalt16Bytes` (#1416 #1435) Version info bumped from 14:0:13 (libexpat*.so.1.13.0) to 14:1:13 (libexpat*.so.1.13.1); see https://verbump.de/ for what these numbers do Infrastructure: (#1414) CI: Stop using about-to-be-removed image "macos-14" (#1418 #1434) CI: Bump MinGW Clang from 23.1.2 to 23.1.4 (#1443) CI: Bump Fil-C from 0.686 to 0.687 (#1456) Drop a `lib/xcsinc.c` leftover Signed-off-by: Adolf Belka --- config/rootfiles/common/expat | 20 ++++++++++---------- lfs/expat | 4 ++-- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/config/rootfiles/common/expat b/config/rootfiles/common/expat index f0ef98fe7..7d41bfae1 100644 --- a/config/rootfiles/common/expat +++ b/config/rootfiles/common/expat @@ -2,21 +2,21 @@ #usr/include/expat.h #usr/include/expat_config.h #usr/include/expat_external.h -#usr/lib/cmake/expat-2.9.0 -#usr/lib/cmake/expat-2.9.0/expat-config-version.cmake -#usr/lib/cmake/expat-2.9.0/expat-config.cmake -#usr/lib/cmake/expat-2.9.0/expat-noconfig.cmake -#usr/lib/cmake/expat-2.9.0/expat.cmake +#usr/lib/cmake/expat-2.10.0 +#usr/lib/cmake/expat-2.10.0/expat-config-version.cmake +#usr/lib/cmake/expat-2.10.0/expat-config.cmake +#usr/lib/cmake/expat-2.10.0/expat-noconfig.cmake +#usr/lib/cmake/expat-2.10.0/expat.cmake #usr/lib/libexpat.la #usr/lib/libexpat.so usr/lib/libexpat.so.1 -usr/lib/libexpat.so.1.13.0 +usr/lib/libexpat.so.1.13.1 #usr/lib/pkgconfig/expat.pc #usr/share/doc/expat -#usr/share/doc/expat-2.9.0 -#usr/share/doc/expat-2.9.0/ok.min.css -#usr/share/doc/expat-2.9.0/reference.html -#usr/share/doc/expat-2.9.0/style.css +#usr/share/doc/expat-2.10.0 +#usr/share/doc/expat-2.10.0/ok.min.css +#usr/share/doc/expat-2.10.0/reference.html +#usr/share/doc/expat-2.10.0/style.css #usr/share/doc/expat/AUTHORS #usr/share/doc/expat/changelog #usr/share/man/man1/xmlwf.1 diff --git a/lfs/expat b/lfs/expat index d47d3833f..3caf002bd 100644 --- a/lfs/expat +++ b/lfs/expat @@ -24,7 +24,7 @@ include Config -VER = 2.9.0 +VER = 2.10.0 THISAPP = expat-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = b029962cd2ea06fbbe922837e6c708512a5c77a4617ee399779788ffe91537533d8c66e0ca63e0b92b76da8e84c10fa82216f27a6e48b16b898905b06e116562 +$(DL_FILE)_BLAKE2 = ac940001ac7e18cfa2639e881324006a8272e69e5b83ca06da4d080eaead60366930782e38dd559abc9fd0dcede23a557683bc871e4bdea287167822fd8f3416 install : $(TARGET)