From f0ac75693e9e76f4b7cfca520304075c69789f5e Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Wed, 12 Aug 2026 12:16:38 +0100 Subject: [PATCH] gh-155558: Update bundled Expat to 2.8.3 (GH-155560) (cherry picked from commit 3d6a50598ba7c89a6468f8e77afe2a39787c80e5) Co-authored-by: Stan Ulbrych --- ...-08-11-15-24-21.gh-issue-155558.yDsXZC.rst | 2 + Misc/sbom.spdx.json | 96 +++++++++---------- Modules/expat/ascii.h | 2 + Modules/expat/asciitab.h | 2 + Modules/expat/expat.h | 4 +- Modules/expat/expat_external.h | 2 + Modules/expat/fallthrough.h | 2 + Modules/expat/iasciitab.h | 2 + Modules/expat/internal.h | 17 +--- Modules/expat/latin1tab.h | 2 + Modules/expat/memory_sanitizer.h | 2 + Modules/expat/nametab.h | 2 + Modules/expat/refresh.sh | 6 +- Modules/expat/siphash.h | 2 + Modules/expat/utf8tab.h | 2 + Modules/expat/winconfig.h | 2 + Modules/expat/xcsinc.c | 8 +- Modules/expat/xmlparse.c | 74 +++++++++----- Modules/expat/xmlrole.c | 2 + Modules/expat/xmlrole.h | 2 + Modules/expat/xmltok.c | 17 +++- Modules/expat/xmltok.h | 10 +- Modules/expat/xmltok_impl.c | 2 + Modules/expat/xmltok_impl.h | 2 + Modules/expat/xmltok_ns.c | 2 + 25 files changed, 170 insertions(+), 96 deletions(-) create mode 100644 Misc/NEWS.d/next/Security/2026-08-11-15-24-21.gh-issue-155558.yDsXZC.rst diff --git a/Misc/NEWS.d/next/Security/2026-08-11-15-24-21.gh-issue-155558.yDsXZC.rst b/Misc/NEWS.d/next/Security/2026-08-11-15-24-21.gh-issue-155558.yDsXZC.rst new file mode 100644 index 00000000000000..439366c8633e82 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2026-08-11-15-24-21.gh-issue-155558.yDsXZC.rst @@ -0,0 +1,2 @@ +Update bundled `libexpat `_ to version 2.8.3 +for the fix to :cve:`2026-72522`. diff --git a/Misc/sbom.spdx.json b/Misc/sbom.spdx.json index 4087d99f0e49d7..b801a6386e5616 100644 --- a/Misc/sbom.spdx.json +++ b/Misc/sbom.spdx.json @@ -20,11 +20,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "b0235fa3cf845a7d68e8e66dd344d5e32e8951b5" + "checksumValue": "27529094aa9998963bbacdab4dd77f23691adc93" }, { "algorithm": "SHA256", - "checksumValue": "42f8b392c70366743eacbc60ce021389ccaa333598dd49eef6ee5c93698ca205" + "checksumValue": "5ce49460794894b78f97060f634c129d13f2e9cc9b8dacd829f4be2dbc6e0649" } ], "fileName": "Modules/expat/ascii.h" @@ -34,11 +34,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "cbb53d16ca1f35ee9c9e296116efd222ae611ed9" + "checksumValue": "f0c9b25759ccf57fd65eb4356c2762f25c0e9a6f" }, { "algorithm": "SHA256", - "checksumValue": "1cc0ae749019fc0e488cd1cf245f6beaa6d4f7c55a1fc797e5aa40a408bc266b" + "checksumValue": "5792cb56f285c8876b988d875a70d49019bc7e6d5ebcd0f8224b24e695301832" } ], "fileName": "Modules/expat/asciitab.h" @@ -48,11 +48,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "00c5e72b384f5c305be613729184ad37bb491238" + "checksumValue": "7baecf6e04769cfb0c5ce2a6e3241e3a0bb8c9e9" }, { "algorithm": "SHA256", - "checksumValue": "eb43180fbdca40e36d9558060e6e654ef4c451ca656ad679e9e1269eb45456b3" + "checksumValue": "d3f19ed52dc975741ecc5a0fc553f910a241d60c76fa4621356d0cdb0490ca28" } ], "fileName": "Modules/expat/expat.h" @@ -62,11 +62,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "d8f9211d52ff0384e229e4d4d56adae5db2d7f91" + "checksumValue": "288700b1dd47ec564d2159a0a519bbc2f273b9e9" }, { "algorithm": "SHA256", - "checksumValue": "b77f8192baf90aaa41f7023bc68fd1f22ab2552f98758271a1e090544537def5" + "checksumValue": "d55e546603baf0b7085d6ff1d8f38d56d6de009a1731186509103c5d292c1a75" } ], "fileName": "Modules/expat/expat_external.h" @@ -76,11 +76,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "69db5031480c50a1e35a51190bd64fcb816b6caf" + "checksumValue": "378f1dffca32e580be8fb445677950cd1c4c4ea8" }, { "algorithm": "SHA256", - "checksumValue": "3dac2e4fdec819ede1b081ef776f2421c98ab509f69d5647a21d63d651179df2" + "checksumValue": "5e42477487bca7e7caac6b832ab940f39a1a20b8765c945374e4f6c2670f55b6" } ], "fileName": "Modules/expat/fallthrough.h" @@ -90,11 +90,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "1b0e9014c0baa4c6254d2b5e6a67c70148309c34" + "checksumValue": "19b25ac4e504efa5e51ce639c83be053da587543" }, { "algorithm": "SHA256", - "checksumValue": "ad8b01e9f323cc4208bcd22241df383d7e8641fe3c8b3415aa513de82531f89f" + "checksumValue": "a9cd6f2cf5199ae3c29d22ee4913736fcd984f62132146a0352c88549700e83f" } ], "fileName": "Modules/expat/iasciitab.h" @@ -104,11 +104,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "2555e70b29c1efc0af40879daafd12f8b36aca2c" + "checksumValue": "476a11d9872f8f38844e398c5486ad183ffe2dcf" }, { "algorithm": "SHA256", - "checksumValue": "4feb1df53898a48ae0ae04b5d0352c90395c8e693e5c2675f8ced41903d6fa94" + "checksumValue": "89f661fa3fa5f7892d83a13ecd685a56aace3fe740abce88a863031114ee2cef" } ], "fileName": "Modules/expat/internal.h" @@ -118,11 +118,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "d335ecca380e331a0ea7dc33838a4decd93ec1e4" + "checksumValue": "8d31198775c89582e37cd0dcac4e87a718cc17cb" }, { "algorithm": "SHA256", - "checksumValue": "eab66226da100372e01e42e1cbcd8ac2bbbb5c1b5f95d735289cc85c7a8fc2ba" + "checksumValue": "b0daf8a75c690e895421f765ddb2ae2fbc1ba14694e06a3215dba84f1ff3427d" } ], "fileName": "Modules/expat/latin1tab.h" @@ -132,11 +132,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "abdf1b9e9642176466ecbb77d5f48e502d01d0d8" + "checksumValue": "19ff1e65b76536a4595c38d21a500cbc7b86c408" }, { "algorithm": "SHA256", - "checksumValue": "10c66f1cf9dc28608d57cb19adc8c7c654800e8b5b1b9be176eaed802deca2d9" + "checksumValue": "377ca054fdc531360f42a5cb7c522bcbf88b6c67aebc2e29544c37d14e836bde" } ], "fileName": "Modules/expat/memory_sanitizer.h" @@ -146,11 +146,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "cf2bc9626c945826602ba9170786e9a2a44645e4" + "checksumValue": "19ecc1cf2a899fe1b80de263c8b09d6de451c6b8" }, { "algorithm": "SHA256", - "checksumValue": "67dcf415d37a4b692a6a8bb46f990c02d83f2ef3d01a65cd61c8594a084246f2" + "checksumValue": "8f78e64f11e2b23df8b32cb5528cfeda6215acd6abf6bcf1ad59fdc7b1ffd105" } ], "fileName": "Modules/expat/nametab.h" @@ -160,11 +160,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "6648f9c12a8d6f77a6eab5ef5c7caa976e7549aa" + "checksumValue": "bcde3e9100b62b87d2b2d628bdacddf415782bdb" }, { "algorithm": "SHA256", - "checksumValue": "c1be28dd62282e668d4daedfe756edb68b7da165c442202bb06a9e597cd5c289" + "checksumValue": "12ecc9915bccb793ea8bb543cc7d002e226f4e4d6b97ec9839dca41cbe4e2e27" } ], "fileName": "Modules/expat/siphash.h" @@ -174,11 +174,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "b77c8fcfb551553c81d6fbd94c798c8aa04ad021" + "checksumValue": "30276d76d64af27de1d0de06160c5b58c884ee8b" }, { "algorithm": "SHA256", - "checksumValue": "8cd26bd461d334d5e1caedb3af4518d401749f2fc66d56208542b29085159c18" + "checksumValue": "3fa349a3a19143366e80a58d9aa950152ef9cd7903f557f971051410b47f335c" } ], "fileName": "Modules/expat/utf8tab.h" @@ -188,11 +188,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "a3a8c44efd55dbf2cfea8fcee009ec63120ec0a3" + "checksumValue": "d296304ae595486ec094e341fed8a8450d4cedbe" }, { "algorithm": "SHA256", - "checksumValue": "e70948500d34dfcba4e9f0b305319dfe2a937c7cbfb687905128b56e1a6f8b33" + "checksumValue": "0ab6446eb98abc492ae341ef7607b535e44dedf52633fdc7c6e1a1361aec3922" } ], "fileName": "Modules/expat/winconfig.h" @@ -202,11 +202,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "69fa7a25f555164f089fdcf290f3af6a1731621f" + "checksumValue": "ecac5a698350e3c9e6c899bbcbfb62875ecf326e" }, { "algorithm": "SHA256", - "checksumValue": "071345c5ccfbe2e46a02839331ee60ee20048348b4408964bff48c4355473b9e" + "checksumValue": "1210979a688301412f46e058d0497fa3c1c63c296c2e015834cda0f0b314875d" } ], "fileName": "Modules/expat/xcsinc.c" @@ -216,11 +216,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "a5a5dd44ee8eeb73f42fa42ca1499cd282ddf6a6" + "checksumValue": "0939e3fe0ebb21a5b8ed9d9fdd33cde75ee5658a" }, { "algorithm": "SHA256", - "checksumValue": "5d2c99b576744edd9545cefe613e0577617f57e16c86387edc13d45710dc97d2" + "checksumValue": "da48375e85bdc2f97da4445169aafc0b363f150a1a8275dd417e6d84cfc3e443" } ], "fileName": "Modules/expat/xmlparse.c" @@ -230,11 +230,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "c8769fcb93f00272a6e6ca560be633649c817ff7" + "checksumValue": "6e046b576085df9bb8f6b18f60ccf0f7a40308b5" }, { "algorithm": "SHA256", - "checksumValue": "5b81f0eb0e144b611dbd1bc9e6037075a16bff94f823d57a81eb2a3e4999e91a" + "checksumValue": "db4004fa2cabc811fc493b5b04b44cd336d19434bc653725f090131e43a89406" } ], "fileName": "Modules/expat/xmlrole.c" @@ -244,11 +244,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "ac2964cca107f62dd133bfd4736a9a17defbc401" + "checksumValue": "4a3bf2554da3a7b02b0f2d4d07f446f7f6e34af5" }, { "algorithm": "SHA256", - "checksumValue": "92e41f373b67f6e0dcd7735faef3c3f1e2c17fe59e007e6b74beef6a2e70fa88" + "checksumValue": "486faffdfcd0c1668406648220c6638c98ddfe044d04d66551999ab8e02564fa" } ], "fileName": "Modules/expat/xmlrole.h" @@ -258,11 +258,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "08dba893b34338e64b66f1044f542aa6760dbab1" + "checksumValue": "c3377af96ec7fef8b502967ac818e3bfea04f584" }, { "algorithm": "SHA256", - "checksumValue": "0c842b1876503e699517994317805dd2298d9e11c94dcc87c2ecb6c2b8e00bc0" + "checksumValue": "f2732a8e91fd901d75431d35edc421e1ff3893a275c4de1cc855b3d4deadfd37" } ], "fileName": "Modules/expat/xmltok.c" @@ -272,11 +272,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "d126831eaa5158cff187a8c93f4bc1c8118f3b17" + "checksumValue": "8e4bf167669dddff38269486f33eccb0fde0c7ca" }, { "algorithm": "SHA256", - "checksumValue": "91bf003a725a675761ea8d92cebc299a76fd28c3a950572f41bc7ce5327ee7b5" + "checksumValue": "20013b75027e04e324452a002100076e30ec20e0f28b318f392317f99a4c4115" } ], "fileName": "Modules/expat/xmltok.h" @@ -286,11 +286,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "3ccb9335589c3ff60aae50ac79b2cdac57999bee" + "checksumValue": "9f1c475da821ccf2763594c9b79175544af08d7a" }, { "algorithm": "SHA256", - "checksumValue": "94eeaef9ed46d10f80f748924fbf41f950b4859d6f234f61fdb2c8f1a8e77bd1" + "checksumValue": "c7b197b596192ad3f8c872ae9c0524e7dd85da10cb4bfdf29d630e12782dfbf7" } ], "fileName": "Modules/expat/xmltok_impl.c" @@ -300,11 +300,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "788332fe8040bed71172cddedb69abd848cc62f7" + "checksumValue": "f862ff6393d47ac1ad9cd0f5f844b43e7c21a20e" }, { "algorithm": "SHA256", - "checksumValue": "f05ad4fe5e98429a7349ff04f57192cac58c324601f2a2e5e697ab0bc05d36d5" + "checksumValue": "a5053c69219d12788088de9bd670537e1c784302766c331afe6b253460d0417d" } ], "fileName": "Modules/expat/xmltok_impl.h" @@ -314,11 +314,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "41b8c8fc275882c76d4210b7d40a18e506b07147" + "checksumValue": "974e4255236de201a718a1e5fc1c772356153415" }, { "algorithm": "SHA256", - "checksumValue": "b2188c7e5fa5b33e355cf6cf342dfb8f6e23859f2a6b1ddf79841d7f84f7b196" + "checksumValue": "3c0c930dfdd484f98c6a32bd397919f3d2ee3701e6023effb463512af1849499" } ], "fileName": "Modules/expat/xmltok_ns.c" @@ -1590,14 +1590,14 @@ "checksums": [ { "algorithm": "SHA256", - "checksumValue": "ef7d1994f533c9e7343d6c19f31064fc8ebbcbcaa144be3812b4f43052a05f4c" + "checksumValue": "22920a86c83f32300b11463635b71f11137a917975af297725e55525027d4e50" } ], - "downloadLocation": "https://github.com/libexpat/libexpat/releases/download/R_2_8_2/expat-2.8.2.tar.gz", + "downloadLocation": "https://github.com/libexpat/libexpat/releases/download/R_2_8_3/expat-2.8.3.tar.gz", "externalRefs": [ { "referenceCategory": "SECURITY", - "referenceLocator": "cpe:2.3:a:libexpat_project:libexpat:2.8.2:*:*:*:*:*:*:*", + "referenceLocator": "cpe:2.3:a:libexpat_project:libexpat:2.8.3:*:*:*:*:*:*:*", "referenceType": "cpe23Type" } ], @@ -1605,7 +1605,7 @@ "name": "expat", "originator": "Organization: Expat development team", "primaryPackagePurpose": "SOURCE", - "versionInfo": "2.8.2" + "versionInfo": "2.8.3" }, { "SPDXID": "SPDXRef-PACKAGE-hacl-star", diff --git a/Modules/expat/ascii.h b/Modules/expat/ascii.h index 1f594d2e54b4d2..1d9cf70bf695da 100644 --- a/Modules/expat/ascii.h +++ b/Modules/expat/ascii.h @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #define ASCII_A 0x41 diff --git a/Modules/expat/asciitab.h b/Modules/expat/asciitab.h index af766fb24785ea..43af0876ccd3f8 100644 --- a/Modules/expat/asciitab.h +++ b/Modules/expat/asciitab.h @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* 0x00 */ BT_NONXML, BT_NONXML, BT_NONXML, BT_NONXML, diff --git a/Modules/expat/expat.h b/Modules/expat/expat.h index c493c70441c418..dbebd985a652ac 100644 --- a/Modules/expat/expat.h +++ b/Modules/expat/expat.h @@ -40,6 +40,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef Expat_INCLUDED @@ -1094,7 +1096,7 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled); */ # define XML_MAJOR_VERSION 2 # define XML_MINOR_VERSION 8 -# define XML_MICRO_VERSION 2 +# define XML_MICRO_VERSION 3 # ifdef __cplusplus } diff --git a/Modules/expat/expat_external.h b/Modules/expat/expat_external.h index cc945c424e471f..6cc3f19ed7dbc8 100644 --- a/Modules/expat/expat_external.h +++ b/Modules/expat/expat_external.h @@ -36,6 +36,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef Expat_External_INCLUDED diff --git a/Modules/expat/fallthrough.h b/Modules/expat/fallthrough.h index 707dbdd44bfe53..0152d1bdc5de8f 100644 --- a/Modules/expat/fallthrough.h +++ b/Modules/expat/fallthrough.h @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef FALLTHROUGH_H diff --git a/Modules/expat/iasciitab.h b/Modules/expat/iasciitab.h index 5d8646f2a318b8..1de8d519c8b7ba 100644 --- a/Modules/expat/iasciitab.h +++ b/Modules/expat/iasciitab.h @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* Like asciitab.h, except that 0xD has code BT_S rather than BT_CR */ diff --git a/Modules/expat/internal.h b/Modules/expat/internal.h index 420d4217a569b1..7e67d2e378c524 100644 --- a/Modules/expat/internal.h +++ b/Modules/expat/internal.h @@ -53,6 +53,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(__GNUC__) && defined(__i386__) && ! defined(__MINGW32__) @@ -123,20 +125,11 @@ # define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u" # endif #else +# include // PRIdPTR, PRIuPTR # define EXPAT_FMT_LLX(midpart) "%" midpart "llx" # define EXPAT_FMT_ULL(midpart) "%" midpart "llu" -# if ! defined(ULONG_MAX) -# error Compiler did not define ULONG_MAX for us -# elif ULONG_MAX == 18446744073709551615u // 2^64-1 -# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "ld" -# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "lu" -# elif defined(__wasm32__) // 32bit mode Emscripten or WASI SDK -# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "ld" -# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "zu" -# else -# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "d" -# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u" -# endif +# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart PRIdPTR +# define EXPAT_FMT_SIZE_T(midpart) "%" midpart PRIuPTR #endif #ifndef UNUSED_P diff --git a/Modules/expat/latin1tab.h b/Modules/expat/latin1tab.h index b681d278af6569..3793f4f3cc7841 100644 --- a/Modules/expat/latin1tab.h +++ b/Modules/expat/latin1tab.h @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* 0x80 */ BT_OTHER, BT_OTHER, BT_OTHER, BT_OTHER, diff --git a/Modules/expat/memory_sanitizer.h b/Modules/expat/memory_sanitizer.h index a8a8006ccded12..f739b88f304871 100644 --- a/Modules/expat/memory_sanitizer.h +++ b/Modules/expat/memory_sanitizer.h @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(MEMORY_SANITIZER_H) diff --git a/Modules/expat/nametab.h b/Modules/expat/nametab.h index 63485446b96727..2385851562e7dc 100644 --- a/Modules/expat/nametab.h +++ b/Modules/expat/nametab.h @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ static const unsigned namingBitmap[] = { diff --git a/Modules/expat/refresh.sh b/Modules/expat/refresh.sh index 60f0b75a9e6acc..f30c01f83bcc4b 100755 --- a/Modules/expat/refresh.sh +++ b/Modules/expat/refresh.sh @@ -12,9 +12,9 @@ fi # Update this when updating to a new version after verifying that the changes # the update brings in are good. These values are used for verifying the SBOM, too. -expected_libexpat_tag="R_2_8_2" -expected_libexpat_version="2.8.2" -expected_libexpat_sha256="ef7d1994f533c9e7343d6c19f31064fc8ebbcbcaa144be3812b4f43052a05f4c" +expected_libexpat_tag="R_2_8_3" +expected_libexpat_version="2.8.3" +expected_libexpat_sha256="22920a86c83f32300b11463635b71f11137a917975af297725e55525027d4e50" expat_dir="$(realpath "$(dirname -- "${BASH_SOURCE[0]}")")" cd ${expat_dir} diff --git a/Modules/expat/siphash.h b/Modules/expat/siphash.h index be216b4006dc84..ac1fbfaf0bde81 100644 --- a/Modules/expat/siphash.h +++ b/Modules/expat/siphash.h @@ -8,6 +8,8 @@ * * 1. https://www.131002.net/siphash/siphash24.c * 2. https://www.131002.net/siphash/ + * + * SPDX-License-Identifier: CC0-1.0 * -------------------------------------------------------------------------- * HISTORY: * diff --git a/Modules/expat/utf8tab.h b/Modules/expat/utf8tab.h index 88efcf91cc16a6..73732d1527f142 100644 --- a/Modules/expat/utf8tab.h +++ b/Modules/expat/utf8tab.h @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* 0x80 */ BT_TRAIL, BT_TRAIL, BT_TRAIL, BT_TRAIL, diff --git a/Modules/expat/winconfig.h b/Modules/expat/winconfig.h index 05805514ec7fa2..9e7e8bdc22ca36 100644 --- a/Modules/expat/winconfig.h +++ b/Modules/expat/winconfig.h @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef WINCONFIG_H diff --git a/Modules/expat/xcsinc.c b/Modules/expat/xcsinc.c index 3597c2480bc961..675b2844c708d6 100644 --- a/Modules/expat/xcsinc.c +++ b/Modules/expat/xcsinc.c @@ -6,7 +6,7 @@ \___/_/\_\ .__/ \__,_|\__| |_| XML parser - Copyright (c) 2022 Sebastian Pipping + Copyright (c) 2022-2026 Sebastian Pipping Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -27,8 +27,14 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ +#if defined(XML_UNICODE) && defined(XML_UNICODE_WCHAR_T) +# include +#endif + static size_t xcslen(const XML_Char *s) { #ifdef XML_UNICODE diff --git a/Modules/expat/xmlparse.c b/Modules/expat/xmlparse.c index d961ebf227e740..4fa61bca8c1629 100644 --- a/Modules/expat/xmlparse.c +++ b/Modules/expat/xmlparse.c @@ -1,4 +1,4 @@ -/* 5de44e6750c6cc78818f06ed552f522a1241df0299395250e1792cb339389daf (2.8.2+) +/* ee5f82c3ffd57c5224394ba46f348dbce466d34d6c925a527ae46b1cfe6adf1d (2.8.3+) __ __ _ ___\ \/ /_ __ __ _| |_ / _ \\ /| '_ \ / _` | __| @@ -50,6 +50,7 @@ Copyright (c) 2026 Nick Begg Copyright (c) 2026 Kartik Kenchi Copyright (c) 2026 Haris Hussain + Copyright (c) 2026 Evgeny Kotkov Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -70,6 +71,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #define XML_BUILDING_EXPAT 1 @@ -93,10 +96,10 @@ #include #include /* memset(), memcpy() */ #include -#include /* INT_MAX, LLONG_MAX, LONG_MAX, UINT_MAX */ +#include /* INT_MAX, UINT_MAX */ #include /* fprintf */ #include /* getenv */ -#include /* SIZE_MAX, uintptr_t */ +#include /* SIZE_MAX, UINT64_MAX, uint64_t, uintptr_t */ #include /* isnan */ #include @@ -211,12 +214,6 @@ typedef char ICHAR; #endif -#ifdef XML_LARGE_SIZE -# define XML_INDEX_MAX LLONG_MAX -#else -# define XML_INDEX_MAX LONG_MAX -#endif - /* Round up n to be a multiple of sz, where sz is a power of 2. */ #define ROUND_UP(n, sz) (((n) + ((sz) - 1)) & ~((sz) - 1)) @@ -719,7 +716,7 @@ struct XML_ParserStruct { char *m_bufferEnd; // past last character to be parsed const char *m_bufferLim; // allocated end of m_buffer - XML_Index m_parseEndByteIndex; + uint64_t m_parseEndByteIndex; const char *m_parseEndPtr; size_t m_partialTokenBytesBefore; /* used in heuristic to avoid O(n^2) */ XML_Bool m_reparseDeferralEnabled; @@ -2312,7 +2309,7 @@ XML_Parse(XML_Parser parser, const char *s, int len, int isFinal) { int nLeftOver; enum XML_Status result; /* Detect overflow (a+b > MAX <==> b > MAX-a) */ - if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) { + if ((uint64_t)len > UINT64_MAX - parser->m_parseEndByteIndex) { parser->m_errorCode = XML_ERROR_NO_MEMORY; parser->m_eventPtr = parser->m_eventEndPtr = NULL; parser->m_processor = errorProcessor; @@ -2430,7 +2427,7 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) { } // Detect and avoid integer overflow - if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) { + if ((uint64_t)len > UINT64_MAX - parser->m_parseEndByteIndex) { parser->m_errorCode = XML_ERROR_NO_MEMORY; parser->m_eventPtr = parser->m_eventEndPtr = NULL; parser->m_processor = errorProcessor; @@ -2692,9 +2689,15 @@ XML_Index XMLCALL XML_GetCurrentByteIndex(XML_Parser parser) { if (parser == NULL) return -1; - if (parser->m_eventPtr) + if (parser->m_eventPtr) { + // NOTE: XML_Index is known to wrap around for >2 GiB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. return (XML_Index)(parser->m_parseEndByteIndex - (parser->m_parseEndPtr - parser->m_eventPtr)); + } return -1; } @@ -2736,7 +2739,12 @@ XML_GetCurrentLineNumber(XML_Parser parser) { parser->m_eventPtr, &parser->m_position); parser->m_positionPtr = parser->m_eventPtr; } - return parser->m_position.lineNumber + 1; + // NOTE: XML_Size is known to wrap around for >2 4iB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. + return (XML_Size)(parser->m_position.lineNumber + 1); } XML_Size XMLCALL @@ -2748,7 +2756,12 @@ XML_GetCurrentColumnNumber(XML_Parser parser) { parser->m_eventPtr, &parser->m_position); parser->m_positionPtr = parser->m_eventPtr; } - return parser->m_position.columnNumber; + // NOTE: XML_Size is known to wrap around for >2 4iB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. + return (XML_Size)parser->m_position.columnNumber; } void XMLCALL @@ -3905,14 +3918,22 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr, if (! attId) return XML_ERROR_NO_MEMORY; #ifdef XML_ATTR_INFO + // NOTE: XML_Index is known to wrap around for >2 GiB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. currAttInfo->nameStart - = parser->m_parseEndByteIndex - (parser->m_parseEndPtr - currAtt->name); + = (XML_Index)(parser->m_parseEndByteIndex + - (parser->m_parseEndPtr - currAtt->name)); currAttInfo->nameEnd = currAttInfo->nameStart + XmlNameLength(enc, currAtt->name); - currAttInfo->valueStart = parser->m_parseEndByteIndex - - (parser->m_parseEndPtr - currAtt->valuePtr); - currAttInfo->valueEnd = parser->m_parseEndByteIndex - - (parser->m_parseEndPtr - currAtt->valueEnd); + currAttInfo->valueStart + = (XML_Index)(parser->m_parseEndByteIndex + - (parser->m_parseEndPtr - currAtt->valuePtr)); + currAttInfo->valueEnd + = (XML_Index)(parser->m_parseEndByteIndex + - (parser->m_parseEndPtr - currAtt->valueEnd)); #endif /* Detect duplicate attributes by their QNames. This does not work when namespace processing is turned on and different prefixes for the same @@ -6554,11 +6575,12 @@ storeAttributeValue(XML_Parser parser, const ENCODING *enc, XML_Bool isCdata, // Check if entity is complete, if not, mark down how much of it is // processed. A XML_SUSPENDED check here is not required as // appendAttributeValue will never suspend the parser. - if (textEnd != nextInEntity) { + if (nextInEntity < textEnd) { entity->processed = (int)(nextInEntity - (const char *)entity->textPtr); continue; } + assert(nextInEntity == textEnd); // Entity is complete. We cannot close it here since we need to first // process its possible inner entities (which are added to the @@ -8192,7 +8214,7 @@ poolGrow(STRING_POOL *pool) { pool->freeBlocks = tem; memcpy(pool->blocks->s, pool->start, (pool->end - pool->start) * sizeof(XML_Char)); - pool->ptr = pool->blocks->s + (pool->ptr - pool->start); + pool->ptr = pool->blocks->s + EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start); pool->start = pool->blocks->s; pool->end = pool->start + pool->blocks->size; return XML_TRUE; @@ -8205,7 +8227,8 @@ poolGrow(STRING_POOL *pool) { /* NOTE: Needs to be calculated prior to calling `realloc` to avoid dangling pointers: */ - const ptrdiff_t offsetInsideBlock = pool->ptr - pool->start; + const ptrdiff_t offsetInsideBlock + = EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start); if (blockSize < 0) { /* This condition traps a situation where either more than @@ -8268,8 +8291,9 @@ poolGrow(STRING_POOL *pool) { tem->next = pool->blocks; pool->blocks = tem; if (pool->ptr != pool->start) - memcpy(tem->s, pool->start, (pool->ptr - pool->start) * sizeof(XML_Char)); - pool->ptr = tem->s + (pool->ptr - pool->start); + memcpy(tem->s, pool->start, + EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start) * sizeof(XML_Char)); + pool->ptr = tem->s + EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start); pool->start = tem->s; pool->end = tem->s + blockSize; } diff --git a/Modules/expat/xmlrole.c b/Modules/expat/xmlrole.c index d56bee82dd2d13..8f6bedda71652d 100644 --- a/Modules/expat/xmlrole.c +++ b/Modules/expat/xmlrole.c @@ -37,6 +37,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff --git a/Modules/expat/xmlrole.h b/Modules/expat/xmlrole.h index 9d0d4ff11b7f98..903a6951f434e2 100644 --- a/Modules/expat/xmlrole.h +++ b/Modules/expat/xmlrole.h @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef XmlRole_INCLUDED diff --git a/Modules/expat/xmltok.c b/Modules/expat/xmltok.c index 387c6e44a25f80..d66af6045f07ac 100644 --- a/Modules/expat/xmltok.c +++ b/Modules/expat/xmltok.c @@ -12,7 +12,7 @@ Copyright (c) 2002 Greg Stein Copyright (c) 2002-2016 Karl Waclawek Copyright (c) 2005-2009 Steven Solie - Copyright (c) 2016-2024 Sebastian Pipping + Copyright (c) 2016-2026 Sebastian Pipping Copyright (c) 2016 Pascal Cuoq Copyright (c) 2016 Don Lewis Copyright (c) 2017 Rhodri James @@ -26,6 +26,7 @@ Copyright (c) 2023 Hanno Böck Copyright (c) 2025 Alfonso Gregory Copyright (c) 2026 Nick Begg + Copyright (c) 2026 Kartik Kenchi Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -46,6 +47,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" @@ -705,9 +708,10 @@ unicode_byte_type(char hi, char lo) { enum XML_Convert_Result res = XML_CONVERT_COMPLETED; \ UNUSED_P(enc); \ fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1); /* shrink to even */ \ - /* Avoid copying first half only of surrogate */ \ + /* Avoid copying the first half (2 bytes) of surrogate pairs (4 bytes) */ \ if (fromLim - *fromP > ((toLim - *toP) << 1) \ - && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) { \ + && /* are the last two bytes a high surrogate (0xD800-0xDBFF)? */ \ + (GET_HI(fromLim - 2) & 0xFC) == 0xD8) { \ fromLim -= 2; \ res = XML_CONVERT_INPUT_INCOMPLETE; \ } \ @@ -1177,6 +1181,13 @@ doParseXmlDecl(const ENCODING *(*encodingFinder)(const ENCODING *, const char *, *versionPtr = val; if (versionEndPtr) *versionEndPtr = ptr; + /* The version number must not be empty; VersionNum requires at least + one character. The encoding and standalone pseudo-attributes below + already reject an empty value, so keep version consistent. */ + if (val == ptr - enc->minBytesPerChar) { + *badPtr = val; + return 0; + } if (! parsePseudoAttribute(enc, ptr, end, &name, &nameEnd, &val, &ptr)) { *badPtr = ptr; return 0; diff --git a/Modules/expat/xmltok.h b/Modules/expat/xmltok.h index 79a9fb76871f10..bd868b87a407d6 100644 --- a/Modules/expat/xmltok.h +++ b/Modules/expat/xmltok.h @@ -10,7 +10,7 @@ Copyright (c) 2000 Clark Cooper Copyright (c) 2002 Fred L. Drake, Jr. Copyright (c) 2002-2005 Karl Waclawek - Copyright (c) 2016-2024 Sebastian Pipping + Copyright (c) 2016-2026 Sebastian Pipping Copyright (c) 2017 Rhodri James Licensed under the MIT license: @@ -32,11 +32,15 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef XmlTok_INCLUDED # define XmlTok_INCLUDED 1 +# include // uint64_t + # ifdef __cplusplus extern "C" { # endif @@ -145,8 +149,8 @@ extern "C" { typedef struct position { /* first line and first column are 0 not 1 */ - XML_Size lineNumber; - XML_Size columnNumber; + uint64_t lineNumber; + uint64_t columnNumber; } POSITION; typedef struct { diff --git a/Modules/expat/xmltok_impl.c b/Modules/expat/xmltok_impl.c index eae11bdd968aee..1d8e457d9de544 100644 --- a/Modules/expat/xmltok_impl.c +++ b/Modules/expat/xmltok_impl.c @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef XML_TOK_IMPL_C diff --git a/Modules/expat/xmltok_impl.h b/Modules/expat/xmltok_impl.h index 3469c4ae138c95..13a08899da3b1a 100644 --- a/Modules/expat/xmltok_impl.h +++ b/Modules/expat/xmltok_impl.h @@ -29,6 +29,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ enum { diff --git a/Modules/expat/xmltok_ns.c b/Modules/expat/xmltok_ns.c index 810ca2c6d0485e..40a02a0308b563 100644 --- a/Modules/expat/xmltok_ns.c +++ b/Modules/expat/xmltok_ns.c @@ -33,6 +33,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef XML_TOK_NS_C