From patchwork Mon Aug 24 15:15:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 96187 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F035C5DF9B for ; Mon, 24 Aug 2026 15:15:19 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.18]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.19081.1787584510508542611 for ; Mon, 24 Aug 2026 08:15:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=CYaRQR9N; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 52.101.69.18, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=YznrWnLd6je9nXVk+lMzaI9SjKIIj8jC5afCQ5xcax7K2IEfgMi1VOS6DXn5v5opxhrdcxKIVI/LKwp8xrNoTNHNtUAjZcxhT6p75LVS3vntSpsF5zZE87cqmQeCyTLBxF7fN1lreVSFjtDu0gN7n7jF2gUfHhS16U9xIQMezFPY+y3JyVaeKlR/fBDCCfy8QbmRaLYtx8Qqxh9++XYrv9usBs/U6oif+DzVDYZdTcs1jI88sl6uVaiG1qvoNi1Mncqj5lg7+pI935GwjjJ+4AxcABJ11gCVRw97n/KsckqkwCDfMdQF0E/dGrjmF8pNtfN8n4ZK4ORA5w0YEjwRqg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=S+m6X3RVa95/Ds19dMDuqXyDNG14qOzesRCl/MGcYQU=; b=fH2Jpt7zUthkKWmNSeUwYBffhLmHHZRJWvu+WQ2usrYXdH91ExqyTwPGoQXiQfc+ww0ZqBme9KJKcMiAtJs+K0LehxWBHDfCprldmS0Di4MMmiA82CtTsi170kSUn8aFJuIpuVIOYcLRKKU7be/VbloPx+3naJyh5Md3H7rlbnEjUqTI5waA6Fc/8ptPsrZu4sJxCYpmHe5bHZf8SbRQaj1di1hG3MIY80DGBZ18izgM2HOzMhIufLHSGSXxRjPB2zw8uXI1gs4FKMxCOkoAdIrFgFLFrn21vV7f5qtNp2ugIyE5C7JWxW1jQKN0FQaB+VaATwuNdWppjxx7gzU2SA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=S+m6X3RVa95/Ds19dMDuqXyDNG14qOzesRCl/MGcYQU=; b=CYaRQR9NXwyJ2KHM9UfhrnMh40vxk1eNzHmZxtcddbOpwJe6otltjHkK3IS7XMpPa9LwRHdvm8ngXaVaxAXDteh5aKf5TDg5IOe8o06JGD3Rg+10ZOsqqrfJs83rwRDhqmjIyWLHEy+H5OGb/OZCmuknWa9SHrksEG4Gi8hj2X8MrCTSni0LDMcdW27Hwzmbw70N8Dlaelwqyfk67c5BcIk+dyRN2JIesoqA9SxMDQrEzgPycxpJqxoI+IcNf4ws++cCdDM80TsW6E5Fz44zbf2QUvMLnfkFExArDpcnrs1Dr+P8mJ5l5KhqNyPKaoRYuXDh1+YzcHFZaFvWymIK1g== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by AMBPR07MB11278.eurprd07.prod.outlook.com (2603:10a6:20b:6f1::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.6; Mon, 24 Aug 2026 15:15:06 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0360.005; Mon, 24 Aug 2026 15:15:05 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [PATCH 1/3] expat: fix CVE-2026-50219 Thread-Topic: [PATCH 1/3] expat: fix CVE-2026-50219 Thread-Index: AQHdM9tXsjAHLjPS6U+ne+4F8NXhnQ== Date: Mon, 24 Aug 2026 15:15:05 +0000 Message-ID: <20260824151448.19118-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|AMBPR07MB11278:EE_ x-ms-office365-filtering-correlation-id: 24f0dbd7-0028-41b8-642f-08df01f27a4a x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|23010399003|1800799024|366016|38070700021|6133799003|3023799007|10067099003|56012099006|11063799006|18002099003; x-microsoft-antispam-message-info: F0nbedctNY+u7rwW2v2oitFJO6qUEG0vlxYIZLfWDUUhVrwYp05yLCmuiZrSbopIQjR2F9U56UM+zBj22Plg/N8HXURmRTUiaye7yaOprbdnKYJjQZcF0hqN4owrAvIQ3Nz2xtQtomGvEEuAG79QhZoAhJH7wCoUjtPvT/q4eKvWE6SBlnlpMm53zd+g/Ai9F7O5b3lCze2735rm1uTuAMwx11y+agDgNXaINR7Se5x0+xi2fa5qNvTljPz4rVb7hVexVYALr4uk6rAfCPQSI5ZNHKljR5/0UzrgoM/vTcI3MEa+4u1gjURszVOCmsdArB4DzWo+5iIlLlEwa2dWH/IWW5wBtLmfXYZz2NRhtXPJ2f/ky6Rp6wefeia0z07Okeu88lKRDs5bhZpOImM2BU5lABKxd4ETnJ3YrY9ACFHNRWjHj78Vaibi2fGeM3Q3Z7fljGfbi3MQ7lfh0ts8yfZGpIohu/t4ZtRROfUWk8l3DFQhVb8AnT6feDyBYnWirrunEwjalFAxXJMzvjTcKnSxBlmVY2gXzhr3wvGSztDNf62p8K+pf1yg9LFyF3p3v7KhnmtK/z/DydnLxHIl3BQXhnmjlt3/7g1rzo25LMzW3I1WZHTquRLpAAosMlwDkc85GXBS/GwiI3mBCuwex0OTRphYuk2yZw2tAk1ivTk= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(1800799024)(366016)(38070700021)(6133799003)(3023799007)(10067099003)(56012099006)(11063799006)(18002099003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?q?yhUr45ikPpyGI5a8uQMwEW0?= =?iso-8859-1?q?t+RNotPif2JK0+VW4vwIlrW0czsB+USHJEqo78QiBeSkagp0rWMyE6+ZueLb?= =?iso-8859-1?q?vgMH9MuRZTI95goBjsu9flEfBNU8CHWtxgoNnKphvJeHGNzEOLr6IcPBqz78?= =?iso-8859-1?q?pv4EEMMTQ6Wj0GqANXPZY34M8vWZO/JxxxNzifqmGas6+uTt5WhjpAEq1OSS?= =?iso-8859-1?q?sj42RVJLAg/oU1WVH+kUDrzhlM8ivrxd3M9HelTxQNFxw0E1R4VsJLCEoVTm?= =?iso-8859-1?q?KHLZyK8plpx2LN8TKDlhxVaoJ06Xb47Du+S3Rzp7OYgEC5OnFtGJCzY8lYMO?= =?iso-8859-1?q?SljA+zfXP2ECzdCAZKHRBkWXmrpD30T5vy0IUfORMtbNxuGbBC+Wi/Gm5rbx?= =?iso-8859-1?q?mO4fnDn4x4r4gsN5WLJTq1yCsyyzmwmA3t1bxFY0eJNHtyYGcYDUoOBDgwVY?= =?iso-8859-1?q?7Vge+WRJOcyRK5MiLuamYnyFFkflQzk40+nJhdY+emCXo/6hv6t3RzxMsU+T?= =?iso-8859-1?q?HYP52fQWytJJBWyq4KXWpZ0URfLPQkNJIghQq5YmzD3FGLW7IGJA4FIGa7Le?= =?iso-8859-1?q?O/kMYIc2D/7OWvmteWvvYa28Z+7YT/As6m/r/8xEVtQCDwYZfwNw3pcDthJA?= =?iso-8859-1?q?hMeSJ88ihS7qFdye94QgY9nUvYDjjTzmiz7TIp5RPOpbWpZ+MVa7QpG6dQtc?= =?iso-8859-1?q?HS0sbXmAAUvB3KKz1mMNhZgWdknmCDI9fr64BDY+AfnRCRAO1rS0Nk/EXQr3?= =?iso-8859-1?q?Dw0coCQQv38yIXkhMhKDj9ISYmjOWT+Z7iUiVxKFg0umXFk4JsANE54WeUhE?= =?iso-8859-1?q?1H7i/bQ6CTT35PBL90zQHvgWK9D2eSwigQF6G19lvF17vE9DEUemPzs88txH?= =?iso-8859-1?q?eSzCpwqHTpnmrKdtF9zGxbN2qrMlZEwWK73LKfzL9LEx4OhEzel8RkrAVUCa?= =?iso-8859-1?q?Sw0WhiTNo2ni6Yyuo8DCxbtGD/3b47VN8rqgpu05l46Etx9ZHxyBHbbSvzMv?= =?iso-8859-1?q?W/4Rw5H+FKmz8OKV7BST2DjmQtldYTpRGq3wsVTEOROxQluzKrkKCS8M2dlQ?= =?iso-8859-1?q?lfA/5C096dUjP1cbQzO+dQoDsoR7OTFHM06YVHAhhK2iP8gitPbGGpQEYwMg?= =?iso-8859-1?q?EoIubnpHRkx/CcCdFIwS3AN/JP2S7sQ4VUGRqVzWtH7nl4t8cdcmmjKGFIcb?= =?iso-8859-1?q?ZVbUW6gljQ7XjBVe1c59WdME08uTQqN68UzLIZBDqYZ010mEFietPjDZx5zg?= =?iso-8859-1?q?JVf/c2nkNWgZfOImPRqSEA37rIKB0RaYQaAWSZHEOXLCe+DYs9iSiY6dK+Wu?= =?iso-8859-1?q?ffsPmfvsmuUppBw1CSwK0SGU+G6f0IuxNIBVVZ3d7mHS9a/5fjr95hnOTVqh?= =?iso-8859-1?q?kRjOeo8z1fmqYxdz5ju9QUNp1wIQr/0T9SV4Y1D/TQoJ5TtYRsgpLc2r2AhA?= =?iso-8859-1?q?eO8+xZzMnEuiEfe0wz3Nhh6luIJeBCUMyj7HaQpkPNngP9t6/Sp2oIhS7Q8i?= =?iso-8859-1?q?5oKLcUacIgn0Hy651CQZrGtTCSycN7JLK3OSpDbdJG+lQRl1re+DL+2UQKGt?= =?iso-8859-1?q?ITlHYPFUrgCMa9Om9Jg4aH1pPzfYZ2lCVBU19QMTwK/ljdfeY7jUXCxGWcQK?= =?iso-8859-1?q?r7eUsv6zR0JKagioXbdH4L1Wg861M074++yhyJpgzvIp+pK44YbY+YMmlFwy?= =?iso-8859-1?q?L6AdPBTwHO0FawohO2Ygva4/hhQ+cjQ90GJ43TS0N/rs7EXt7bYZDs2g0Yw/?= =?iso-8859-1?q?IjkDzCNgXmFdN486vzHUMEhM6FPbOdOlKdUMPGtI7ftJ/Vg=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 24f0dbd7-0028-41b8-642f-08df01f27a4a X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Aug 2026 15:15:05.5039 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 1KsgtPQTAlDrNc/CElJNn08RGC0oGxbinweKzdt4FXZwCc6v8qekVLjZ6RtPVxyz2I/gm3Mk+oMOHWIyqxOzuNqA5B39fSqLIl+V5lbaoEo= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AMBPR07MB11278 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 24 Aug 2026 15:15:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244127 Expat does not track whether its public parser APIs are called from inside a user handler. Re-entering the parser through XML_GetBuffer(), XML_Parse(), XML_ParseBuffer(), XML_ParserFree() or XML_ParserReset() can therefore result in use-after-free and memory corruption. The 32 upstream commits are divided as follows: * 01 introduces the handler call depth counter and the helper functions used to enter, leave and detect handler execution. * 02-04 are preparation patches. They extract handler calls from compound expressions so that depth tracking can be placed before and after each invocation without changing handler return-value semantics. * 05-26 instrument the individual handler types. Each patch covers a distinct callback path; omitting one would leave a route around the API guards. * 27-31 add the actual policy enforcement to XML_GetBuffer(), XML_Parse(), XML_ParseBuffer(), XML_ParserFree() and XML_ParserReset(). * 32 adds regression coverage for all five rejected calls. Documentation and Changes-file commits from the upstream series are dropped because they do not affect the fix or its test coverage. An explicit XML_Parser cast is added to the regression-test handler because handlers.c is also included by handlers_cxx.cpp and compiled as C++ in the OE build. Upstream pull request: https://github.com/libexpat/libexpat/pull/1246 Signed-off-by: Jakub Szczudlo --- .../expat/expat/CVE-2026-50219-01.patch | 61 +++++++ .../expat/expat/CVE-2026-50219-02.patch | 84 ++++++++++ .../expat/expat/CVE-2026-50219-03.patch | 92 +++++++++++ .../expat/expat/CVE-2026-50219-04.patch | 34 ++++ .../expat/expat/CVE-2026-50219-05.patch | 48 ++++++ .../expat/expat/CVE-2026-50219-06.patch | 154 ++++++++++++++++++ .../expat/expat/CVE-2026-50219-07.patch | 32 ++++ .../expat/expat/CVE-2026-50219-08.patch | 44 +++++ .../expat/expat/CVE-2026-50219-09.patch | 44 +++++ .../expat/expat/CVE-2026-50219-10.patch | 35 ++++ .../expat/expat/CVE-2026-50219-11.patch | 32 ++++ .../expat/expat/CVE-2026-50219-12.patch | 42 +++++ .../expat/expat/CVE-2026-50219-13.patch | 49 ++++++ .../expat/expat/CVE-2026-50219-14.patch | 74 +++++++++ .../expat/expat/CVE-2026-50219-15.patch | 82 ++++++++++ .../expat/expat/CVE-2026-50219-16.patch | 46 ++++++ .../expat/expat/CVE-2026-50219-17.patch | 64 ++++++++ .../expat/expat/CVE-2026-50219-18.patch | 32 ++++ .../expat/expat/CVE-2026-50219-19.patch | 87 ++++++++++ .../expat/expat/CVE-2026-50219-20.patch | 62 +++++++ .../expat/expat/CVE-2026-50219-21.patch | 46 ++++++ .../expat/expat/CVE-2026-50219-22.patch | 48 ++++++ .../expat/expat/CVE-2026-50219-23.patch | 36 ++++ .../expat/expat/CVE-2026-50219-24.patch | 33 ++++ .../expat/expat/CVE-2026-50219-25.patch | 35 ++++ .../expat/expat/CVE-2026-50219-26.patch | 33 ++++ .../expat/expat/CVE-2026-50219-27.patch | 30 ++++ .../expat/expat/CVE-2026-50219-28.patch | 30 ++++ .../expat/expat/CVE-2026-50219-29.patch | 31 ++++ .../expat/expat/CVE-2026-50219-30.patch | 31 ++++ .../expat/expat/CVE-2026-50219-31.patch | 31 ++++ .../expat/expat/CVE-2026-50219-32.patch | 100 ++++++++++++ meta/recipes-core/expat/expat_2.7.5.bb | 32 ++++ 33 files changed, 1714 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-01.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-02.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-03.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-04.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-05.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-06.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-07.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-08.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-09.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-10.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-11.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-12.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-13.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-14.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-15.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-16.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-17.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-18.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-19.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-20.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-21.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-22.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-23.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-24.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-25.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-26.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-27.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-28.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-29.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-30.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-31.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-32.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-01.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-01.patch new file mode 100644 index 0000000000..1d3a8cbba2 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-01.patch @@ -0,0 +1,61 @@ +From 8da7b772a31155083a37796f96e622f6dce25454 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 15:15:10 +0200 +Subject: [PATCH] lib: Introduce handler call depth tracking + +(cherry picked from commit f69d0719bf01596f1d95c9e902f4a279e62c6305) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/f69d0719bf01596f1d95c9e902f4a279e62c6305] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 2a5ebb7..38617a6 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -793,6 +793,7 @@ struct XML_ParserStruct { + ENTITY_STATS m_entity_stats; + #endif + XML_Bool m_reenter; ++ unsigned m_handlerCallDepth; + }; + + #if XML_GE == 1 +@@ -1260,6 +1261,23 @@ generate_hash_secret_salt(void) { + #endif + } + ++static void ++beforeHandler(XML_Parser parser) { ++ assert(parser->m_handlerCallDepth < UINT_MAX); ++ parser->m_handlerCallDepth++; ++} ++ ++static void ++afterHandler(XML_Parser parser) { ++ assert(parser->m_handlerCallDepth > 0); ++ parser->m_handlerCallDepth--; ++} ++ ++static bool ++isCalledFromInsideHandler(XML_Parser parser) { ++ return parser->m_handlerCallDepth > 0; ++} ++ + static enum XML_Error + callProcessor(XML_Parser parser, const char *start, const char *end, + const char **endPtr) { +@@ -1614,6 +1632,7 @@ parserInit(XML_Parser parser, const XML_Char *encodingName) { + parser->m_parsingStatus.parsing = XML_INITIALIZED; + // Reentry can only be triggered inside m_processor calls + parser->m_reenter = XML_FALSE; ++ parser->m_handlerCallDepth = 0; + #ifdef XML_DTD + parser->m_isParamEntity = XML_FALSE; + parser->m_useForeignDTD = XML_FALSE; +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-02.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-02.patch new file mode 100644 index 0000000000..bb9335381a --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-02.patch @@ -0,0 +1,84 @@ +From 3832d4080d50d5aeeeaae32688ba3bf4af2042a2 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:33:26 +0200 +Subject: [PATCH] lib: Prepare `m_notStandaloneHandler` calls for upcoming + wrapping + +(cherry picked from commit cdd21e84e150cc2ca961533e157bd52e3cbb4aa4) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/cdd21e84e150cc2ca961533e157bd52e3cbb4aa4] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 34 ++++++++++++++++++++++------------ + 1 file changed, 22 insertions(+), 12 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 38617a6..65df026 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -5537,9 +5537,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + entity->systemId, entity->publicId)) + return XML_ERROR_EXTERNAL_ENTITY_HANDLING; + if (dtd->paramEntityRead) { +- if (! dtd->standalone && parser->m_notStandaloneHandler +- && ! parser->m_notStandaloneHandler(parser->m_handlerArg)) +- return XML_ERROR_NOT_STANDALONE; ++ if (! dtd->standalone && parser->m_notStandaloneHandler) { ++ const int handlerStatus ++ = parser->m_notStandaloneHandler(parser->m_handlerArg); ++ if (! handlerStatus) ++ return XML_ERROR_NOT_STANDALONE; ++ } + } + /* if we didn't read the foreign DTD then this means that there + is no external subset and we must reset dtd->hasParamEntityRefs +@@ -5577,9 +5580,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + entity->systemId, entity->publicId)) + return XML_ERROR_EXTERNAL_ENTITY_HANDLING; + if (dtd->paramEntityRead) { +- if (! dtd->standalone && parser->m_notStandaloneHandler +- && ! parser->m_notStandaloneHandler(parser->m_handlerArg)) +- return XML_ERROR_NOT_STANDALONE; ++ if (! dtd->standalone && parser->m_notStandaloneHandler) { ++ const int handlerStatus ++ = parser->m_notStandaloneHandler(parser->m_handlerArg); ++ if (! handlerStatus) ++ return XML_ERROR_NOT_STANDALONE; ++ } + } + /* if we didn't read the foreign DTD then this means that there + is no external subset and we must reset dtd->hasParamEntityRefs +@@ -5793,9 +5799,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + #ifdef XML_DTD + && ! parser->m_paramEntityParsing + #endif /* XML_DTD */ +- && parser->m_notStandaloneHandler +- && ! parser->m_notStandaloneHandler(parser->m_handlerArg)) +- return XML_ERROR_NOT_STANDALONE; ++ && parser->m_notStandaloneHandler) { ++ const int status = parser->m_notStandaloneHandler(parser->m_handlerArg); ++ if (! status) ++ return XML_ERROR_NOT_STANDALONE; ++ } + #ifndef XML_DTD + break; + #else /* XML_DTD */ +@@ -6179,9 +6187,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + } + } + #endif /* XML_DTD */ +- if (! dtd->standalone && parser->m_notStandaloneHandler +- && ! parser->m_notStandaloneHandler(parser->m_handlerArg)) +- return XML_ERROR_NOT_STANDALONE; ++ if (! dtd->standalone && parser->m_notStandaloneHandler) { ++ const int status = parser->m_notStandaloneHandler(parser->m_handlerArg); ++ if (! status) ++ return XML_ERROR_NOT_STANDALONE; ++ } + break; + + /* Element declaration stuff */ +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-03.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-03.patch new file mode 100644 index 0000000000..dca99968ae --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-03.patch @@ -0,0 +1,92 @@ +From 3fd5635fac887f161ab02adf749c2bab1d2ee904 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Sat, 30 May 2026 00:45:34 +0200 +Subject: [PATCH] lib: Prepare `m_externalEntityRefHandler` calls for upcoming + wrapping + +(cherry picked from commit 1ffe852fe1d8e1d73eb4eb5798456aefc8300299) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/1ffe852fe1d8e1d73eb4eb5798456aefc8300299] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 35 ++++++++++++++++++++--------------- + 1 file changed, 20 insertions(+), 15 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 65df026..eb8e803 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -3533,9 +3533,10 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + entity->open = XML_FALSE; + if (! context) + return XML_ERROR_NO_MEMORY; +- if (! parser->m_externalEntityRefHandler( +- parser->m_externalEntityRefHandlerArg, context, entity->base, +- entity->systemId, entity->publicId)) ++ const int status = parser->m_externalEntityRefHandler( ++ parser->m_externalEntityRefHandlerArg, context, entity->base, ++ entity->systemId, entity->publicId); ++ if (! status) + return XML_ERROR_EXTERNAL_ENTITY_HANDLING; + poolDiscard(&parser->m_tempPool); + } else if (parser->m_defaultHandler) +@@ -5532,9 +5533,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + if (parser->m_useForeignDTD) + entity->base = parser->m_curBase; + dtd->paramEntityRead = XML_FALSE; +- if (! parser->m_externalEntityRefHandler( +- parser->m_externalEntityRefHandlerArg, 0, entity->base, +- entity->systemId, entity->publicId)) ++ const int status = parser->m_externalEntityRefHandler( ++ parser->m_externalEntityRefHandlerArg, 0, entity->base, ++ entity->systemId, entity->publicId); ++ if (! status) + return XML_ERROR_EXTERNAL_ENTITY_HANDLING; + if (dtd->paramEntityRead) { + if (! dtd->standalone && parser->m_notStandaloneHandler) { +@@ -5575,9 +5577,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + return XML_ERROR_NO_MEMORY; + entity->base = parser->m_curBase; + dtd->paramEntityRead = XML_FALSE; +- if (! parser->m_externalEntityRefHandler( +- parser->m_externalEntityRefHandlerArg, 0, entity->base, +- entity->systemId, entity->publicId)) ++ const int status = parser->m_externalEntityRefHandler( ++ parser->m_externalEntityRefHandlerArg, 0, entity->base, ++ entity->systemId, entity->publicId); ++ if (! status) + return XML_ERROR_EXTERNAL_ENTITY_HANDLING; + if (dtd->paramEntityRead) { + if (! dtd->standalone && parser->m_notStandaloneHandler) { +@@ -6167,9 +6170,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + dtd->paramEntityRead = XML_FALSE; + entity->open = XML_TRUE; + entityTrackingOnOpen(parser, entity, __LINE__); +- if (! parser->m_externalEntityRefHandler( +- parser->m_externalEntityRefHandlerArg, 0, entity->base, +- entity->systemId, entity->publicId)) { ++ const int status = parser->m_externalEntityRefHandler( ++ parser->m_externalEntityRefHandlerArg, 0, entity->base, ++ entity->systemId, entity->publicId); ++ if (! status) { + entityTrackingOnClose(parser, entity, __LINE__); + entity->open = XML_FALSE; + return XML_ERROR_EXTERNAL_ENTITY_HANDLING; +@@ -6959,9 +6963,10 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc, + dtd->paramEntityRead = XML_FALSE; + entity->open = XML_TRUE; + entityTrackingOnOpen(parser, entity, __LINE__); +- if (! parser->m_externalEntityRefHandler( +- parser->m_externalEntityRefHandlerArg, 0, entity->base, +- entity->systemId, entity->publicId)) { ++ const int status = parser->m_externalEntityRefHandler( ++ parser->m_externalEntityRefHandlerArg, 0, entity->base, ++ entity->systemId, entity->publicId); ++ if (! status) { + entityTrackingOnClose(parser, entity, __LINE__); + entity->open = XML_FALSE; + result = XML_ERROR_EXTERNAL_ENTITY_HANDLING; +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-04.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-04.patch new file mode 100644 index 0000000000..3f4070e6e6 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-04.patch @@ -0,0 +1,34 @@ +From 9a13084051f0dbff8f980db7aca46b02111cb6d5 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Sat, 30 May 2026 00:46:36 +0200 +Subject: [PATCH] lib: Prepare `m_unknownEncodingHandler` calls for upcoming + wrapping + +(cherry picked from commit adcafd4316259ef48b1763e584733a7bff4a8db0) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/adcafd4316259ef48b1763e584733a7bff4a8db0] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index eb8e803..dddcb47 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -5057,8 +5057,9 @@ handleUnknownEncoding(XML_Parser parser, const XML_Char *encodingName) { + info.convert = NULL; + info.data = NULL; + info.release = NULL; +- if (parser->m_unknownEncodingHandler(parser->m_unknownEncodingHandlerData, +- encodingName, &info)) { ++ const int status = parser->m_unknownEncodingHandler( ++ parser->m_unknownEncodingHandlerData, encodingName, &info); ++ if (status) { + ENCODING *enc; + parser->m_unknownEncodingMem = MALLOC(parser, XmlSizeOfUnknownEncoding()); + if (! parser->m_unknownEncodingMem) { +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-05.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-05.patch new file mode 100644 index 0000000000..29f9a0afcc --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-05.patch @@ -0,0 +1,48 @@ +From 6e755a1e9c3e4cc7c1ed60c96e9d2e1659daf5da Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:05:19 +0200 +Subject: [PATCH] lib: Register `m_attlistDeclHandler` with handler call depth + tracking + +(cherry picked from commit 781092f189a8c8e8be6640258829a7f783864282) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/781092f189a8c8e8be6640258829a7f783864282] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index dddcb47..16ab984 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -5682,10 +5682,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + poolFinish(&parser->m_tempPool); + } + *eventEndPP = s; ++ beforeHandler(parser); + parser->m_attlistDeclHandler( + parser->m_handlerArg, parser->m_declElementType->name, + parser->m_declAttributeId->name, parser->m_declAttributeType, 0, + role == XML_ROLE_REQUIRED_ATTRIBUTE_VALUE); ++ afterHandler(parser); + handleDefault = XML_FALSE; + } + } +@@ -5720,10 +5722,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + poolFinish(&parser->m_tempPool); + } + *eventEndPP = s; ++ beforeHandler(parser); + parser->m_attlistDeclHandler( + parser->m_handlerArg, parser->m_declElementType->name, + parser->m_declAttributeId->name, parser->m_declAttributeType, + attVal, role == XML_ROLE_FIXED_ATTRIBUTE_VALUE); ++ afterHandler(parser); + poolClear(&parser->m_tempPool); + handleDefault = XML_FALSE; + } +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-06.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-06.patch new file mode 100644 index 0000000000..c5ca02b37a --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-06.patch @@ -0,0 +1,154 @@ +From 80765c36bc9b272d0141fa8c3ea3da59a16c443e Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:08:02 +0200 +Subject: [PATCH] lib: Register `m_characterDataHandler` with handler call + depth tracking + +(cherry picked from commit 5ee607587a997220a48e78b5f6c55a05e50e5b20) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/5ee607587a997220a48e78b5f6c55a05e50e5b20] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 44 ++++++++++++++++++++++++++++++++++---------- + 1 file changed, 34 insertions(+), 10 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 16ab984..4556805 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -3428,7 +3428,9 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + *eventEndPP = end; + if (parser->m_characterDataHandler) { + XML_Char c = 0xA; ++ beforeHandler(parser); + parser->m_characterDataHandler(parser->m_handlerArg, &c, 1); ++ afterHandler(parser); + } else if (parser->m_defaultHandler) + reportDefault(parser, enc, s, end); + /* We are at the end of the final buffer, should we check for +@@ -3481,9 +3483,11 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + ((char *)&ch) + sizeof(XML_Char), __LINE__, + XML_ACCOUNT_ENTITY_EXPANSION); + #endif /* XML_GE == 1 */ +- if (parser->m_characterDataHandler) ++ if (parser->m_characterDataHandler) { ++ beforeHandler(parser); + parser->m_characterDataHandler(parser->m_handlerArg, &ch, 1); +- else if (parser->m_defaultHandler) ++ afterHandler(parser); ++ } else if (parser->m_defaultHandler) + reportDefault(parser, enc, s, next); + break; + } +@@ -3729,8 +3733,10 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + return XML_ERROR_BAD_CHAR_REF; + if (parser->m_characterDataHandler) { + XML_Char buf[XML_ENCODE_MAX]; ++ beforeHandler(parser); + parser->m_characterDataHandler(parser->m_handlerArg, buf, + XmlEncode(n, (ICHAR *)buf)); ++ afterHandler(parser); + } else if (parser->m_defaultHandler) + reportDefault(parser, enc, s, next); + } break; +@@ -3739,7 +3745,9 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + case XML_TOK_DATA_NEWLINE: + if (parser->m_characterDataHandler) { + XML_Char c = 0xA; ++ beforeHandler(parser); + parser->m_characterDataHandler(parser->m_handlerArg, &c, 1); ++ afterHandler(parser); + } else if (parser->m_defaultHandler) + reportDefault(parser, enc, s, next); + break; +@@ -3760,11 +3768,13 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + However, now we have a start/endCdataSectionHandler, so it seems + easier to let the user deal with this. + */ +- else if ((0) && parser->m_characterDataHandler) ++ else if ((0) && parser->m_characterDataHandler) { ++ beforeHandler(parser); + parser->m_characterDataHandler(parser->m_handlerArg, parser->m_dataBuf, + 0); +- /* END disabled code */ +- else if (parser->m_defaultHandler) ++ afterHandler(parser); ++ /* END disabled code */ ++ } else if (parser->m_defaultHandler) + reportDefault(parser, enc, s, next); + result + = doCdataSection(parser, enc, &next, end, nextPtr, haveMore, account); +@@ -3784,13 +3794,18 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + if (MUST_CONVERT(enc, s)) { + ICHAR *dataPtr = (ICHAR *)parser->m_dataBuf; + XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)parser->m_dataBufEnd); ++ beforeHandler(parser); + parser->m_characterDataHandler( + parser->m_handlerArg, parser->m_dataBuf, + (int)(dataPtr - (ICHAR *)parser->m_dataBuf)); +- } else ++ afterHandler(parser); ++ } else { ++ beforeHandler(parser); + parser->m_characterDataHandler( + parser->m_handlerArg, (const XML_Char *)s, + (int)((const XML_Char *)end - (const XML_Char *)s)); ++ afterHandler(parser); ++ } + } else if (parser->m_defaultHandler) + reportDefault(parser, enc, s, end); + /* We are at the end of the final buffer, should we check for +@@ -3815,16 +3830,21 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + const enum XML_Convert_Result convert_res = XmlConvert( + enc, &s, next, &dataPtr, (ICHAR *)parser->m_dataBufEnd); + *eventEndPP = s; ++ beforeHandler(parser); + charDataHandler(parser->m_handlerArg, parser->m_dataBuf, + (int)(dataPtr - (ICHAR *)parser->m_dataBuf)); ++ afterHandler(parser); + if ((convert_res == XML_CONVERT_COMPLETED) + || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) + break; + *eventPP = s; + } +- } else ++ } else { ++ beforeHandler(parser); + charDataHandler(parser->m_handlerArg, (const XML_Char *)s, + (int)((const XML_Char *)next - (const XML_Char *)s)); ++ afterHandler(parser); ++ } + } else if (parser->m_defaultHandler) + reportDefault(parser, enc, s, next); + } break; +@@ -4730,11 +4750,13 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr, + parser->m_endCdataSectionHandler(parser->m_handlerArg); + /* BEGIN disabled code */ + /* see comment under XML_TOK_CDATA_SECT_OPEN */ +- else if ((0) && parser->m_characterDataHandler) ++ else if ((0) && parser->m_characterDataHandler) { ++ beforeHandler(parser); + parser->m_characterDataHandler(parser->m_handlerArg, parser->m_dataBuf, + 0); +- /* END disabled code */ +- else if (parser->m_defaultHandler) ++ afterHandler(parser); ++ /* END disabled code */ ++ } else if (parser->m_defaultHandler) + reportDefault(parser, enc, s, next); + *startPtr = next; + *nextPtr = next; +@@ -4745,7 +4767,9 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr, + case XML_TOK_DATA_NEWLINE: + if (parser->m_characterDataHandler) { + XML_Char c = 0xA; ++ beforeHandler(parser); + parser->m_characterDataHandler(parser->m_handlerArg, &c, 1); ++ afterHandler(parser); + } else if (parser->m_defaultHandler) + reportDefault(parser, enc, s, next); + break; +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-07.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-07.patch new file mode 100644 index 0000000000..1bf15cdd01 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-07.patch @@ -0,0 +1,32 @@ +From bba681b574c9675f331e79db0513bb9df1fec523 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:08:40 +0200 +Subject: [PATCH] lib: Register `m_commentHandler` with handler call depth + tracking + +(cherry picked from commit 0e7dbfee7912a8e25aace775be47e5ad570b9cc3) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/0e7dbfee7912a8e25aace775be47e5ad570b9cc3] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 4556805..98ffe5a 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -7269,7 +7269,9 @@ reportComment(XML_Parser parser, const ENCODING *enc, const char *start, + if (! data) + return 0; + normalizeLines(data); ++ beforeHandler(parser); + parser->m_commentHandler(parser->m_handlerArg, data); ++ afterHandler(parser); + poolClear(&parser->m_tempPool); + return 1; + } +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-08.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-08.patch new file mode 100644 index 0000000000..7a21357ae7 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-08.patch @@ -0,0 +1,44 @@ +From c6e96e6a5ec4afc710f4aee2b81bda4baca71a25 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:14:10 +0200 +Subject: [PATCH] lib: Register `m_defaultHandler` with handler call depth + tracking + +(cherry picked from commit e5b76bd58dd9984cef46c2a66a98b03c95a3c774) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/e5b76bd58dd9984cef46c2a66a98b03c95a3c774] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 98ffe5a..ed9628f 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -7312,15 +7312,20 @@ reportDefault(XML_Parser parser, const ENCODING *enc, const char *s, + convert_res + = XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)parser->m_dataBufEnd); + *eventEndPP = s; ++ beforeHandler(parser); + parser->m_defaultHandler(parser->m_handlerArg, parser->m_dataBuf, + (int)(dataPtr - (ICHAR *)parser->m_dataBuf)); ++ afterHandler(parser); + *eventPP = s; + } while ((convert_res != XML_CONVERT_COMPLETED) + && (convert_res != XML_CONVERT_INPUT_INCOMPLETE)); +- } else ++ } else { ++ beforeHandler(parser); + parser->m_defaultHandler( + parser->m_handlerArg, (const XML_Char *)s, + (int)((const XML_Char *)end - (const XML_Char *)s)); ++ afterHandler(parser); ++ } + } + + static int +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-09.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-09.patch new file mode 100644 index 0000000000..9d87b20d7c --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-09.patch @@ -0,0 +1,44 @@ +From 8f2979090e01719c7f0c005816943d93bfda2754 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:15:01 +0200 +Subject: [PATCH] lib: Register `m_elementDeclHandler` with handler call depth + tracking + +(cherry picked from commit b4a711a33591c0d45d6e630ed6448dcbc5534700) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/b4a711a33591c0d45d6e630ed6448dcbc5534700] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index ed9628f..03bc212 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -6259,8 +6259,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + content->type = ((role == XML_ROLE_CONTENT_ANY) ? XML_CTYPE_ANY + : XML_CTYPE_EMPTY); + *eventEndPP = s; ++ beforeHandler(parser); + parser->m_elementDeclHandler( + parser->m_handlerArg, parser->m_declElementType->name, content); ++ afterHandler(parser); + handleDefault = XML_FALSE; + } + dtd->in_eldecl = XML_FALSE; +@@ -6342,8 +6344,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + if (! model) + return XML_ERROR_NO_MEMORY; + *eventEndPP = s; ++ beforeHandler(parser); + parser->m_elementDeclHandler( + parser->m_handlerArg, parser->m_declElementType->name, model); ++ afterHandler(parser); + } + dtd->in_eldecl = XML_FALSE; + dtd->contentStringLen = 0; +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-10.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-10.patch new file mode 100644 index 0000000000..97c0975217 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-10.patch @@ -0,0 +1,35 @@ +From 8849de56e9789089103114f472d68f3a37f5ab53 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:15:40 +0200 +Subject: [PATCH] lib: Register `m_endCdataSectionHandler` with handler call + depth tracking + +(cherry picked from commit b08e08c0558152a4180597a3e880dc70040c2b2a) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/b08e08c0558152a4180597a3e880dc70040c2b2a] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 03bc212..a894538 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -4746,8 +4746,11 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr, + *eventEndPP = next; + switch (tok) { + case XML_TOK_CDATA_SECT_CLOSE: +- if (parser->m_endCdataSectionHandler) ++ if (parser->m_endCdataSectionHandler) { ++ beforeHandler(parser); + parser->m_endCdataSectionHandler(parser->m_handlerArg); ++ afterHandler(parser); ++ } + /* BEGIN disabled code */ + /* see comment under XML_TOK_CDATA_SECT_OPEN */ + else if ((0) && parser->m_characterDataHandler) { +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-11.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-11.patch new file mode 100644 index 0000000000..64c95c02e8 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-11.patch @@ -0,0 +1,32 @@ +From 8114f635922a0c22ad11630aa953ca1545d23044 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:16:13 +0200 +Subject: [PATCH] lib: Register `m_endDoctypeDeclHandler` with handler call + depth tracking + +(cherry picked from commit bd454febe07b931e638f2186755585b67a738d31) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/bd454febe07b931e638f2186755585b67a738d31] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index a894538..2fe2f71 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -5585,7 +5585,9 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + } + #endif /* XML_DTD */ + if (parser->m_endDoctypeDeclHandler) { ++ beforeHandler(parser); + parser->m_endDoctypeDeclHandler(parser->m_handlerArg); ++ afterHandler(parser); + handleDefault = XML_FALSE; + } + break; +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-12.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-12.patch new file mode 100644 index 0000000000..5fb7b7dcf1 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-12.patch @@ -0,0 +1,42 @@ +From 1d95acdeab736c3b4e08477b958b6f7296a75607 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:17:10 +0200 +Subject: [PATCH] lib: Register `m_endElementHandler` with handler call depth + tracking + +(cherry picked from commit e411d9907b8addb334d1ed5db1afd5b5bf625f24) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/e411d9907b8addb334d1ed5db1afd5b5bf625f24] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 2fe2f71..37aaabc 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -3645,7 +3645,9 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + if (parser->m_endElementHandler) { + if (parser->m_startElementHandler) + *eventPP = *eventEndPP; ++ beforeHandler(parser); + parser->m_endElementHandler(parser->m_handlerArg, name.str); ++ afterHandler(parser); + noElmHandlers = XML_FALSE; + } + if (noElmHandlers && parser->m_defaultHandler) +@@ -3703,7 +3705,9 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + } + *uri = XML_T('\0'); + } ++ beforeHandler(parser); + parser->m_endElementHandler(parser->m_handlerArg, tag->name.str); ++ afterHandler(parser); + } else if (parser->m_defaultHandler) + reportDefault(parser, enc, s, next); + while (tag->bindings) { +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-13.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-13.patch new file mode 100644 index 0000000000..f74de674b0 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-13.patch @@ -0,0 +1,49 @@ +From 3e9e33361aeaa853f16fd85bf30a71f0ac0b2791 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:23:59 +0200 +Subject: [PATCH] lib: Register `m_endNamespaceDeclHandler` with handler call + depth tracking + +(cherry picked from commit 274aa82340fe1b2205e8e3ae1cd35e2168cd42e8) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/274aa82340fe1b2205e8e3ae1cd35e2168cd42e8] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 37aaabc..ad72001 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -3712,9 +3712,12 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + reportDefault(parser, enc, s, next); + while (tag->bindings) { + BINDING *b = tag->bindings; +- if (parser->m_endNamespaceDeclHandler) ++ if (parser->m_endNamespaceDeclHandler) { ++ beforeHandler(parser); + parser->m_endNamespaceDeclHandler(parser->m_handlerArg, + b->prefix->name); ++ afterHandler(parser); ++ } + tag->bindings = tag->bindings->nextTagBinding; + b->nextTagBinding = parser->m_freeBindingList; + parser->m_freeBindingList = b; +@@ -3906,8 +3909,11 @@ freeBindings(XML_Parser parser, BINDING *bindings) { + /* m_startNamespaceDeclHandler will have been called for this + * binding in addBindings(), so call the end handler now. + */ +- if (parser->m_endNamespaceDeclHandler) ++ if (parser->m_endNamespaceDeclHandler) { ++ beforeHandler(parser); + parser->m_endNamespaceDeclHandler(parser->m_handlerArg, b->prefix->name); ++ afterHandler(parser); ++ } + + bindings = bindings->nextTagBinding; + b->nextTagBinding = parser->m_freeBindingList; +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-14.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-14.patch new file mode 100644 index 0000000000..4d37cd6f0c --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-14.patch @@ -0,0 +1,74 @@ +From 13084e0a4473dcea40fc0173a2c54fbf9fd3eece Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:25:42 +0200 +Subject: [PATCH] lib: Register `m_entityDeclHandler` with handler call depth + tracking + +(cherry picked from commit 6e62649e6b25eb789166b9131dfadfe9d806f5ce) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/6e62649e6b25eb789166b9131dfadfe9d806f5ce] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index ad72001..e9466d5 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -5791,10 +5791,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + poolFinish(&dtd->entityValuePool); + if (parser->m_entityDeclHandler) { + *eventEndPP = s; ++ beforeHandler(parser); + parser->m_entityDeclHandler( + parser->m_handlerArg, parser->m_declEntity->name, + parser->m_declEntity->is_param, parser->m_declEntity->textPtr, + parser->m_declEntity->textLen, parser->m_curBase, 0, 0, 0); ++ afterHandler(parser); + handleDefault = XML_FALSE; + } + } else +@@ -5812,10 +5814,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + + if (parser->m_entityDeclHandler) { + *eventEndPP = s; ++ beforeHandler(parser); + parser->m_entityDeclHandler( + parser->m_handlerArg, parser->m_declEntity->name, + parser->m_declEntity->is_param, parser->m_declEntity->textPtr, + parser->m_declEntity->textLen, parser->m_curBase, 0, 0, 0); ++ afterHandler(parser); + handleDefault = XML_FALSE; + } + } +@@ -5893,10 +5897,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + if (dtd->keepProcessing && parser->m_declEntity + && parser->m_entityDeclHandler) { + *eventEndPP = s; ++ beforeHandler(parser); + parser->m_entityDeclHandler( + parser->m_handlerArg, parser->m_declEntity->name, + parser->m_declEntity->is_param, 0, 0, parser->m_declEntity->base, + parser->m_declEntity->systemId, parser->m_declEntity->publicId, 0); ++ afterHandler(parser); + handleDefault = XML_FALSE; + } + break; +@@ -5916,10 +5922,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + handleDefault = XML_FALSE; + } else if (parser->m_entityDeclHandler) { + *eventEndPP = s; ++ beforeHandler(parser); + parser->m_entityDeclHandler( + parser->m_handlerArg, parser->m_declEntity->name, 0, 0, 0, + parser->m_declEntity->base, parser->m_declEntity->systemId, + parser->m_declEntity->publicId, parser->m_declEntity->notation); ++ afterHandler(parser); + handleDefault = XML_FALSE; + } + } +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-15.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-15.patch new file mode 100644 index 0000000000..07e69cb772 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-15.patch @@ -0,0 +1,82 @@ +From e5035de264c3102b33891570bdff7c6313a9d2b5 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Sat, 30 May 2026 00:45:50 +0200 +Subject: [PATCH] lib: Register `m_externalEntityRefHandler` with handler call + depth tracking + +(cherry picked from commit d4ba1c29165de39605b799223392dfb28bed85d5) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/d4ba1c29165de39605b799223392dfb28bed85d5] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index e9466d5..7909490 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -3537,9 +3537,11 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + entity->open = XML_FALSE; + if (! context) + return XML_ERROR_NO_MEMORY; ++ beforeHandler(parser); + const int status = parser->m_externalEntityRefHandler( + parser->m_externalEntityRefHandlerArg, context, entity->base, + entity->systemId, entity->publicId); ++ afterHandler(parser); + if (! status) + return XML_ERROR_EXTERNAL_ENTITY_HANDLING; + poolDiscard(&parser->m_tempPool); +@@ -5571,9 +5573,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + if (parser->m_useForeignDTD) + entity->base = parser->m_curBase; + dtd->paramEntityRead = XML_FALSE; ++ beforeHandler(parser); + const int status = parser->m_externalEntityRefHandler( + parser->m_externalEntityRefHandlerArg, 0, entity->base, + entity->systemId, entity->publicId); ++ afterHandler(parser); + if (! status) + return XML_ERROR_EXTERNAL_ENTITY_HANDLING; + if (dtd->paramEntityRead) { +@@ -5617,9 +5621,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + return XML_ERROR_NO_MEMORY; + entity->base = parser->m_curBase; + dtd->paramEntityRead = XML_FALSE; ++ beforeHandler(parser); + const int status = parser->m_externalEntityRefHandler( + parser->m_externalEntityRefHandlerArg, 0, entity->base, + entity->systemId, entity->publicId); ++ afterHandler(parser); + if (! status) + return XML_ERROR_EXTERNAL_ENTITY_HANDLING; + if (dtd->paramEntityRead) { +@@ -6222,9 +6228,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + dtd->paramEntityRead = XML_FALSE; + entity->open = XML_TRUE; + entityTrackingOnOpen(parser, entity, __LINE__); ++ beforeHandler(parser); + const int status = parser->m_externalEntityRefHandler( + parser->m_externalEntityRefHandlerArg, 0, entity->base, + entity->systemId, entity->publicId); ++ afterHandler(parser); + if (! status) { + entityTrackingOnClose(parser, entity, __LINE__); + entity->open = XML_FALSE; +@@ -7019,9 +7027,11 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc, + dtd->paramEntityRead = XML_FALSE; + entity->open = XML_TRUE; + entityTrackingOnOpen(parser, entity, __LINE__); ++ beforeHandler(parser); + const int status = parser->m_externalEntityRefHandler( + parser->m_externalEntityRefHandlerArg, 0, entity->base, + entity->systemId, entity->publicId); ++ afterHandler(parser); + if (! status) { + entityTrackingOnClose(parser, entity, __LINE__); + entity->open = XML_FALSE; +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-16.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-16.patch new file mode 100644 index 0000000000..3cc3f7faaf --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-16.patch @@ -0,0 +1,46 @@ +From 24ec73df3f099032fb66638685c296c18d914f84 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:27:13 +0200 +Subject: [PATCH] lib: Register `m_notationDeclHandler` with handler call depth + tracking + +(cherry picked from commit 4739ad3fda250cf458d396d9c17a0e0fef571bdd) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/4739ad3fda250cf458d396d9c17a0e0fef571bdd] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 7909490..5a0f063 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -6040,9 +6040,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + if (! systemId) + return XML_ERROR_NO_MEMORY; + *eventEndPP = s; ++ beforeHandler(parser); + parser->m_notationDeclHandler( + parser->m_handlerArg, parser->m_declNotationName, parser->m_curBase, + systemId, parser->m_declNotationPublicId); ++ afterHandler(parser); + handleDefault = XML_FALSE; + } + poolClear(&parser->m_tempPool); +@@ -6050,9 +6052,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + case XML_ROLE_NOTATION_NO_SYSTEM_ID: + if (parser->m_declNotationPublicId && parser->m_notationDeclHandler) { + *eventEndPP = s; ++ beforeHandler(parser); + parser->m_notationDeclHandler( + parser->m_handlerArg, parser->m_declNotationName, parser->m_curBase, + 0, parser->m_declNotationPublicId); ++ afterHandler(parser); + handleDefault = XML_FALSE; + } + poolClear(&parser->m_tempPool); +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-17.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-17.patch new file mode 100644 index 0000000000..992ae93d6e --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-17.patch @@ -0,0 +1,64 @@ +From 08eea37057ebc8f6dafcec601b0ff923d221e205 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:34:29 +0200 +Subject: [PATCH] lib: Register `m_notStandaloneHandler` with handler call + depth tracking + +(cherry picked from commit d7a9c975ceeaa24c730e50fef2bedff5f99d2172) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/d7a9c975ceeaa24c730e50fef2bedff5f99d2172] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 5a0f063..93110fe 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -5582,8 +5582,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + return XML_ERROR_EXTERNAL_ENTITY_HANDLING; + if (dtd->paramEntityRead) { + if (! dtd->standalone && parser->m_notStandaloneHandler) { ++ beforeHandler(parser); + const int handlerStatus + = parser->m_notStandaloneHandler(parser->m_handlerArg); ++ afterHandler(parser); + if (! handlerStatus) + return XML_ERROR_NOT_STANDALONE; + } +@@ -5630,8 +5632,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + return XML_ERROR_EXTERNAL_ENTITY_HANDLING; + if (dtd->paramEntityRead) { + if (! dtd->standalone && parser->m_notStandaloneHandler) { ++ beforeHandler(parser); + const int handlerStatus + = parser->m_notStandaloneHandler(parser->m_handlerArg); ++ afterHandler(parser); + if (! handlerStatus) + return XML_ERROR_NOT_STANDALONE; + } +@@ -5857,7 +5861,9 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + && ! parser->m_paramEntityParsing + #endif /* XML_DTD */ + && parser->m_notStandaloneHandler) { ++ beforeHandler(parser); + const int status = parser->m_notStandaloneHandler(parser->m_handlerArg); ++ afterHandler(parser); + if (! status) + return XML_ERROR_NOT_STANDALONE; + } +@@ -6256,7 +6262,9 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + } + #endif /* XML_DTD */ + if (! dtd->standalone && parser->m_notStandaloneHandler) { ++ beforeHandler(parser); + const int status = parser->m_notStandaloneHandler(parser->m_handlerArg); ++ afterHandler(parser); + if (! status) + return XML_ERROR_NOT_STANDALONE; + } +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-18.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-18.patch new file mode 100644 index 0000000000..4520cbd13a --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-18.patch @@ -0,0 +1,32 @@ +From d9ea54153ef454217b8a2a8255b2bd1ead460e83 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:35:08 +0200 +Subject: [PATCH] lib: Register `m_processingInstructionHandler` with handler + call depth tracking + +(cherry picked from commit 8bb00d345d5f92b17a06e01a926ee1dda797e0af) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/8bb00d345d5f92b17a06e01a926ee1dda797e0af] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 93110fe..b2672ae 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -7298,7 +7298,9 @@ reportProcessingInstruction(XML_Parser parser, const ENCODING *enc, + if (! data) + return 0; + normalizeLines(data); ++ beforeHandler(parser); + parser->m_processingInstructionHandler(parser->m_handlerArg, target, data); ++ afterHandler(parser); + poolClear(&parser->m_tempPool); + return 1; + } +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-19.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-19.patch new file mode 100644 index 0000000000..6d6e2cf2d4 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-19.patch @@ -0,0 +1,87 @@ +From 1cbb5676ee24c03222923f2ce853ffe245a831ad Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:36:39 +0200 +Subject: [PATCH] lib: Register `m_skippedEntityHandler` with handler call + depth tracking + +(cherry picked from commit 64e3adf0c9d7e1846cff784de3159f1067eb5e06) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/64e3adf0c9d7e1846cff784de3159f1067eb5e06] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index b2672ae..1ee7cca 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -3507,9 +3507,11 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + else if (! entity->is_internal) + return XML_ERROR_ENTITY_DECLARED_IN_PE; + } else if (! entity) { +- if (parser->m_skippedEntityHandler) ++ if (parser->m_skippedEntityHandler) { ++ beforeHandler(parser); + parser->m_skippedEntityHandler(parser->m_handlerArg, name, 0); +- else if (parser->m_defaultHandler) ++ afterHandler(parser); ++ } else if (parser->m_defaultHandler) + reportDefault(parser, enc, s, next); + break; + } +@@ -3520,10 +3522,12 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + if (entity->textPtr) { + enum XML_Error result; + if (! parser->m_defaultExpandInternalEntities) { +- if (parser->m_skippedEntityHandler) ++ if (parser->m_skippedEntityHandler) { ++ beforeHandler(parser); + parser->m_skippedEntityHandler(parser->m_handlerArg, entity->name, + 0); +- else if (parser->m_defaultHandler) ++ afterHandler(parser); ++ } else if (parser->m_defaultHandler) + reportDefault(parser, enc, s, next); + break; + } +@@ -6217,7 +6221,9 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + /* cannot report skipped entities in declarations */ + if ((role == XML_ROLE_PARAM_ENTITY_REF) + && parser->m_skippedEntityHandler) { ++ beforeHandler(parser); + parser->m_skippedEntityHandler(parser->m_handlerArg, name, 1); ++ afterHandler(parser); + handleDefault = XML_FALSE; + } + break; +@@ -6888,8 +6894,11 @@ appendAttributeValue(XML_Parser parser, const ENCODING *enc, XML_Bool isCdata, + } else if (! entity) { + /* Cannot report skipped entity here - see comments on + parser->m_skippedEntityHandler. +- if (parser->m_skippedEntityHandler) ++ if (parser->m_skippedEntityHandler) { ++ beforeHandler(parser); + parser->m_skippedEntityHandler(parser->m_handlerArg, name, 0); ++ afterHandler(parser); ++ } + */ + /* Cannot call the default handler because this would be + out of sync with the call to the startElementHandler. +@@ -7022,8 +7031,11 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc, + /* not a well-formedness error - see XML 1.0: WFC Entity Declared */ + /* cannot report skipped entity here - see comments on + parser->m_skippedEntityHandler +- if (parser->m_skippedEntityHandler) ++ if (parser->m_skippedEntityHandler) { ++ beforeHandler(parser); + parser->m_skippedEntityHandler(parser->m_handlerArg, name, 0); ++ afterHandler(parser); ++ } + */ + dtd->keepProcessing = dtd->standalone; + goto endEntityValue; +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-20.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-20.patch new file mode 100644 index 0000000000..e36403367e --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-20.patch @@ -0,0 +1,62 @@ +From 6697406736678ac3f6738f5b171c4c128b66df7d Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:37:49 +0200 +Subject: [PATCH] lib: Register `m_startCdataSectionHandler` with handler call + depth tracking + +(cherry picked from commit 222278ad452d27f8c35ba031be14d6e70aab5ab1) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/222278ad452d27f8c35ba031be14d6e70aab5ab1] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 32 +++++++++++++++++--------------- + 1 file changed, 17 insertions(+), 15 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 1ee7cca..ad8cc44 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -3766,22 +3766,24 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + break; + case XML_TOK_CDATA_SECT_OPEN: { + enum XML_Error result; +- if (parser->m_startCdataSectionHandler) ++ if (parser->m_startCdataSectionHandler) { ++ beforeHandler(parser); + parser->m_startCdataSectionHandler(parser->m_handlerArg); +- /* BEGIN disabled code */ +- /* Suppose you doing a transformation on a document that involves +- changing only the character data. You set up a defaultHandler +- and a characterDataHandler. The defaultHandler simply copies +- characters through. The characterDataHandler does the +- transformation and writes the characters out escaping them as +- necessary. This case will fail to work if we leave out the +- following two lines (because & and < inside CDATA sections will +- be incorrectly escaped). +- +- However, now we have a start/endCdataSectionHandler, so it seems +- easier to let the user deal with this. +- */ +- else if ((0) && parser->m_characterDataHandler) { ++ afterHandler(parser); ++ /* BEGIN disabled code */ ++ /* Suppose you doing a transformation on a document that involves ++ changing only the character data. You set up a defaultHandler ++ and a characterDataHandler. The defaultHandler simply copies ++ characters through. The characterDataHandler does the ++ transformation and writes the characters out escaping them as ++ necessary. This case will fail to work if we leave out the ++ following two lines (because & and < inside CDATA sections will ++ be incorrectly escaped). ++ ++ However, now we have a start/endCdataSectionHandler, so it seems ++ easier to let the user deal with this. ++ */ ++ } else if ((0) && parser->m_characterDataHandler) { + beforeHandler(parser); + parser->m_characterDataHandler(parser->m_handlerArg, parser->m_dataBuf, + 0); +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-21.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-21.patch new file mode 100644 index 0000000000..bbeeced76e --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-21.patch @@ -0,0 +1,46 @@ +From c7cc71e323ef0afcb115dd1567bf1bdfcbc5f8d2 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:38:47 +0200 +Subject: [PATCH] lib: Register `m_startDoctypeDeclHandler` with handler call + depth tracking + +(cherry picked from commit 82f1d14a033f7c5bd6f658c3cdcd2515efe86745) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/82f1d14a033f7c5bd6f658c3cdcd2515efe86745] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index ad8cc44..0e101af 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -5481,9 +5481,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + break; + case XML_ROLE_DOCTYPE_INTERNAL_SUBSET: + if (parser->m_startDoctypeDeclHandler) { ++ beforeHandler(parser); + parser->m_startDoctypeDeclHandler( + parser->m_handlerArg, parser->m_doctypeName, parser->m_doctypeSysid, + parser->m_doctypePubid, 1); ++ afterHandler(parser); + parser->m_doctypeName = NULL; + poolClear(&parser->m_tempPool); + handleDefault = XML_FALSE; +@@ -5550,9 +5552,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + } + + if (parser->m_doctypeName) { ++ beforeHandler(parser); + parser->m_startDoctypeDeclHandler( + parser->m_handlerArg, parser->m_doctypeName, parser->m_doctypeSysid, + parser->m_doctypePubid, 0); ++ afterHandler(parser); + poolClear(&parser->m_tempPool); + handleDefault = XML_FALSE; + } +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-22.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-22.patch new file mode 100644 index 0000000000..931bc06f1a --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-22.patch @@ -0,0 +1,48 @@ +From 355e3aaa79f1b0e6067a8ebbc6fcbac47e98542e Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:39:38 +0200 +Subject: [PATCH] lib: Register `m_startElementHandler` with handler call depth + tracking + +(cherry picked from commit 4f9a8f1cc2ed03cd9e23d281a6abac44dc89e8ab) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/4f9a8f1cc2ed03cd9e23d281a6abac44dc89e8ab] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 0e101af..a222a3f 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -3615,10 +3615,12 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + = storeAtts(parser, enc, s, &(tag->name), &(tag->bindings), account); + if (result) + return result; +- if (parser->m_startElementHandler) ++ if (parser->m_startElementHandler) { ++ beforeHandler(parser); + parser->m_startElementHandler(parser->m_handlerArg, tag->name.str, + (const XML_Char **)parser->m_atts); +- else if (parser->m_defaultHandler) ++ afterHandler(parser); ++ } else if (parser->m_defaultHandler) + reportDefault(parser, enc, s, next); + poolClear(&parser->m_tempPool); + break; +@@ -3644,8 +3646,10 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc, + } + poolFinish(&parser->m_tempPool); + if (parser->m_startElementHandler) { ++ beforeHandler(parser); + parser->m_startElementHandler(parser->m_handlerArg, name.str, + (const XML_Char **)parser->m_atts); ++ afterHandler(parser); + noElmHandlers = XML_FALSE; + } + if (parser->m_endElementHandler) { +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-23.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-23.patch new file mode 100644 index 0000000000..7f883faeb1 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-23.patch @@ -0,0 +1,36 @@ +From ac747d83eb8b6d7c71da606a9cb1a65aef50d0c1 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:40:13 +0200 +Subject: [PATCH] lib: Register `m_startNamespaceDeclHandler` with handler call + depth tracking + +(cherry picked from commit ddd0238420113c97594083194e517e8bc742700c) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/ddd0238420113c97594083194e517e8bc742700c] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index a222a3f..267a198 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -4704,9 +4704,12 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId, + b->nextTagBinding = *bindingsPtr; + *bindingsPtr = b; + /* if attId == NULL then we are not starting a namespace scope */ +- if (attId && parser->m_startNamespaceDeclHandler) ++ if (attId && parser->m_startNamespaceDeclHandler) { ++ beforeHandler(parser); + parser->m_startNamespaceDeclHandler(parser->m_handlerArg, prefix->name, + prefix->binding ? uri : 0); ++ afterHandler(parser); ++ } + return XML_ERROR_NONE; + } + +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-24.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-24.patch new file mode 100644 index 0000000000..9f4e938218 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-24.patch @@ -0,0 +1,33 @@ +From 36ada7e4ef06aa18765557240fb30a1a669d438a Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Sat, 30 May 2026 00:46:47 +0200 +Subject: [PATCH] lib: Register `m_unknownEncodingHandler` with handler call + depth tracking + +(cherry picked from commit f66d83c9aecaa802174f95a1348a89f56e3b9441) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/f66d83c9aecaa802174f95a1348a89f56e3b9441] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 267a198..c76f8ea 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -5109,8 +5109,10 @@ handleUnknownEncoding(XML_Parser parser, const XML_Char *encodingName) { + info.convert = NULL; + info.data = NULL; + info.release = NULL; ++ beforeHandler(parser); + const int status = parser->m_unknownEncodingHandler( + parser->m_unknownEncodingHandlerData, encodingName, &info); ++ afterHandler(parser); + if (status) { + ENCODING *enc; + parser->m_unknownEncodingMem = MALLOC(parser, XmlSizeOfUnknownEncoding()); +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-25.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-25.patch new file mode 100644 index 0000000000..ab8a94c02c --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-25.patch @@ -0,0 +1,35 @@ +From 002404e9805e4e685ca4c473a9c057a93c5b50e2 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:41:00 +0200 +Subject: [PATCH] lib: Register `m_unparsedEntityDeclHandler` with handler call + depth tracking + +(cherry picked from commit 6e7c5af75a743c609fdb35627554cc7e940e6593) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/6e7c5af75a743c609fdb35627554cc7e940e6593] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index c76f8ea..aebcda3 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -5946,10 +5946,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + poolFinish(&dtd->pool); + if (parser->m_unparsedEntityDeclHandler) { + *eventEndPP = s; ++ beforeHandler(parser); + parser->m_unparsedEntityDeclHandler( + parser->m_handlerArg, parser->m_declEntity->name, + parser->m_declEntity->base, parser->m_declEntity->systemId, + parser->m_declEntity->publicId, parser->m_declEntity->notation); ++ afterHandler(parser); + handleDefault = XML_FALSE; + } else if (parser->m_entityDeclHandler) { + *eventEndPP = s; +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-26.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-26.patch new file mode 100644 index 0000000000..a40a613eba --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-26.patch @@ -0,0 +1,33 @@ +From 646eb417403a714ecd962f85a2d3c4b198f9b44b Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 21:41:38 +0200 +Subject: [PATCH] lib: Register `m_xmlDeclHandler` with handler call depth + tracking + +(cherry picked from commit 91484ffb98ec138df79265e431a55823bc80c6c4) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/91484ffb98ec138df79265e431a55823bc80c6c4] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index aebcda3..edaf5f8 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -5058,8 +5058,10 @@ processXmlDecl(XML_Parser parser, int isGeneralTextEntity, const char *s, + if (! storedversion) + return XML_ERROR_NO_MEMORY; + } ++ beforeHandler(parser); + parser->m_xmlDeclHandler(parser->m_handlerArg, storedversion, storedEncName, + standalone); ++ afterHandler(parser); + } else if (parser->m_defaultHandler) + reportDefault(parser, parser->m_encoding, s, next); + if (parser->m_protocolEncodingName == NULL) { +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-27.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-27.patch new file mode 100644 index 0000000000..e3eff545cc --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-27.patch @@ -0,0 +1,30 @@ +From 640fa889d24387ba5ad4e44d89a6440b927f6f45 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 15:35:27 +0200 +Subject: [PATCH] lib: Protect `XML_GetBuffer` from being called from a handler + +(cherry picked from commit 5d90d1aebfe606af2550e92983cbe121d7eda032) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/5d90d1aebfe606af2550e92983cbe121d7eda032] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index edaf5f8..d729fc7 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -2599,7 +2599,7 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) { + + void *XMLCALL + XML_GetBuffer(XML_Parser parser, int len) { +- if (parser == NULL) ++ if ((parser == NULL) || isCalledFromInsideHandler(parser)) + return NULL; + if (len < 0) { + parser->m_errorCode = XML_ERROR_NO_MEMORY; +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-28.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-28.patch new file mode 100644 index 0000000000..1a923a111c --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-28.patch @@ -0,0 +1,30 @@ +From b6281b0d445029cad63a2eeb0fda9c6aaa8ad690 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 15:32:38 +0200 +Subject: [PATCH] lib: Protect `XML_Parse` from being called from a handler + +(cherry picked from commit b59f1865e6c0c0ab2c1623b9dfd53aa6fb85bb96) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/b59f1865e6c0c0ab2c1623b9dfd53aa6fb85bb96] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index d729fc7..f69e32c 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -2414,6 +2414,8 @@ XML_Parse(XML_Parser parser, const char *s, int len, int isFinal) { + parser->m_errorCode = XML_ERROR_INVALID_ARGUMENT; + return XML_STATUS_ERROR; + } ++ if (isCalledFromInsideHandler(parser)) ++ return XML_STATUS_ERROR; + switch (parser->m_parsingStatus.parsing) { + case XML_SUSPENDED: + parser->m_errorCode = XML_ERROR_SUSPENDED; +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-29.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-29.patch new file mode 100644 index 0000000000..02e172bfa9 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-29.patch @@ -0,0 +1,31 @@ +From 3ea9955feaa8db08300c83de24ab8001aef19077 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 15:33:44 +0200 +Subject: [PATCH] lib: Protect `XML_ParseBuffer` from being called from a + handler + +(cherry picked from commit ef3267d5f8157862e33d87c45c6fe82ac26e557f) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/ef3267d5f8157862e33d87c45c6fe82ac26e557f] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index f69e32c..87c20bf 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -2525,7 +2525,7 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) { + const char *start; + enum XML_Status result = XML_STATUS_OK; + +- if (parser == NULL) ++ if ((parser == NULL) || isCalledFromInsideHandler(parser)) + return XML_STATUS_ERROR; + + if (len < 0) { +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-30.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-30.patch new file mode 100644 index 0000000000..2b7402ae5c --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-30.patch @@ -0,0 +1,31 @@ +From 69fc1130413313ecd8728573a254bd26afebd632 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 15:21:28 +0200 +Subject: [PATCH] lib: Protect `XML_ParserFree` from being called from a + handler + +(cherry picked from commit 827fbddcaaa8ba2171ef76a3223d6f403388635c) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/827fbddcaaa8ba2171ef76a3223d6f403388635c] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 87c20bf..bfa3217 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -1958,7 +1958,7 @@ void XMLCALL + XML_ParserFree(XML_Parser parser) { + TAG *tagList; + OPEN_INTERNAL_ENTITY *entityList; +- if (parser == NULL) ++ if ((parser == NULL) || isCalledFromInsideHandler(parser)) + return; + /* free m_tagStack and m_freeTagList */ + tagList = parser->m_tagStack; +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-31.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-31.patch new file mode 100644 index 0000000000..1fc8877a3e --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-31.patch @@ -0,0 +1,31 @@ +From e7ea42e0111e697d2de64a94c8fd6bca9d2c99c9 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 26 May 2026 15:22:41 +0200 +Subject: [PATCH] lib: Protect `XML_ParserReset` from being called from a + handler + +(cherry picked from commit 34bc7e080a1b432ad9d6879a6c718f2d6f12fa22) + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/34bc7e080a1b432ad9d6879a6c718f2d6f12fa22] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index bfa3217..cc1d550 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -1671,7 +1671,7 @@ XML_ParserReset(XML_Parser parser, const XML_Char *encodingName) { + TAG *tStk; + OPEN_INTERNAL_ENTITY *openEntityList; + +- if (parser == NULL) ++ if ((parser == NULL) || isCalledFromInsideHandler(parser)) + return XML_FALSE; + + if (parser->m_parentParser) +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-32.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-32.patch new file mode 100644 index 0000000000..30a73f9bf5 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-50219-32.patch @@ -0,0 +1,100 @@ +From 8683ba1631c0467f78f512b16a8dfd1ea9636538 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Sun, 31 May 2026 13:37:01 +0200 +Subject: [PATCH] tests: Cover calls forbidden from handlers + +(cherry picked from commit 2e16f4c98f1f28bb9da36108b60c181d77752acb) + +Add an explicit cast for compatibility with Expat's C++ test build, which +includes handlers.c from handlers_cxx.cpp. + +CVE: CVE-2026-50219 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/2e16f4c98f1f28bb9da36108b60c181d77752acb] +Signed-off-by: Jakub Szczudlo +--- + tests/handlers.c | 24 ++++++++++++++++++++++++ + tests/handlers.h | 4 ++++ + tests/misc_tests.c | 15 +++++++++++++++ + 3 files changed, 43 insertions(+) + +diff --git a/tests/handlers.c b/tests/handlers.c +index 8cda3a8..c7d6578 100644 +--- a/tests/handlers.c ++++ b/tests/handlers.c +@@ -1991,3 +1991,27 @@ accumulate_and_suspend_comment_handler(void *userData, const XML_Char *data) { + accumulate_comment(parserPlusStorage->storage, data); + XML_StopParser(parserPlusStorage->parser, XML_TRUE); + } ++ ++void XMLCALL ++forbidden_calls_character_handler(void *userData, const XML_Char *s, int len) { ++ UNUSED_P(s); ++ UNUSED_P(len); ++ XML_Parser parser = (XML_Parser)userData; ++ ++ assert_true(parser != NULL); // self-test ++ ++ assert_true(XML_GetBuffer(parser, 123) == NULL); // i.e. rejected ++ ++ assert_true(XML_Parse(parser, "", 0, /*isFinal=*/XML_FALSE) ++ == XML_STATUS_ERROR); // i.e. rejected ++ ++ assert_true(XML_ParseBuffer(parser, 0, /*isFinal=*/XML_FALSE) ++ == XML_STATUS_ERROR); // i.e. rejected ++ ++ XML_ParserFree(parser); // rejected ++ ++ assert_true(XML_ParserReset(parser, /*encodingName=*/NULL) ++ == XML_FALSE); // i.e. rejected ++ ++ assert_true(XML_GetErrorCode(parser) == XML_ERROR_NONE); ++} +diff --git a/tests/handlers.h b/tests/handlers.h +index 27a53f2..de28392 100644 +--- a/tests/handlers.h ++++ b/tests/handlers.h +@@ -612,6 +612,10 @@ typedef struct { + extern void XMLCALL + accumulate_and_suspend_comment_handler(void *userData, const XML_Char *data); + ++extern void XMLCALL forbidden_calls_character_handler(void *userData, ++ const XML_Char *s, ++ int len); ++ + #endif /* XML_HANDLERS_H */ + + #ifdef __cplusplus +diff --git a/tests/misc_tests.c b/tests/misc_tests.c +index 1c508bd..b9053fe 100644 +--- a/tests/misc_tests.c ++++ b/tests/misc_tests.c +@@ -801,6 +801,20 @@ START_TEST(test_misc_no_infinite_loop_issue_1161) { + } + END_TEST + ++START_TEST(test_misc_calls_forbidden_from_handlers) { ++ const char *const doc = "Hello world!"; ++ ++ XML_Parser parser = XML_ParserCreate(NULL); ++ XML_UseParserAsHandlerArg(parser); ++ XML_SetCharacterDataHandler(parser, forbidden_calls_character_handler); ++ ++ assert_true(XML_Parse(parser, doc, (int)strlen(doc), /*isFinal=*/XML_TRUE) ++ == XML_STATUS_OK); ++ ++ XML_ParserFree(parser); ++} ++END_TEST ++ + void + make_miscellaneous_test_case(Suite *s) { + TCase *tc_misc = tcase_create("miscellaneous tests"); +@@ -832,4 +846,5 @@ make_miscellaneous_test_case(Suite *s) { + tcase_add_test(tc_misc, test_misc_sync_entity_tolerated); + tcase_add_test(tc_misc, test_misc_async_entity_rejected); + tcase_add_test(tc_misc, test_misc_no_infinite_loop_issue_1161); ++ tcase_add_test(tc_misc, test_misc_calls_forbidden_from_handlers); + } +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb index 890ee5b7d3..7f00c6f90b 100644 --- a/meta/recipes-core/expat/expat_2.7.5.bb +++ b/meta/recipes-core/expat/expat_2.7.5.bb @@ -36,6 +36,38 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-56132_p3.patch;striplevel=2 \ file://CVE-2026-56132_p4.patch;striplevel=2 \ file://CVE-2026-56132_p5.patch;striplevel=2 \ + file://CVE-2026-50219-01.patch \ + file://CVE-2026-50219-02.patch \ + file://CVE-2026-50219-03.patch \ + file://CVE-2026-50219-04.patch \ + file://CVE-2026-50219-05.patch \ + file://CVE-2026-50219-06.patch \ + file://CVE-2026-50219-07.patch \ + file://CVE-2026-50219-08.patch \ + file://CVE-2026-50219-09.patch \ + file://CVE-2026-50219-10.patch \ + file://CVE-2026-50219-11.patch \ + file://CVE-2026-50219-12.patch \ + file://CVE-2026-50219-13.patch \ + file://CVE-2026-50219-14.patch \ + file://CVE-2026-50219-15.patch \ + file://CVE-2026-50219-16.patch \ + file://CVE-2026-50219-17.patch \ + file://CVE-2026-50219-18.patch \ + file://CVE-2026-50219-19.patch \ + file://CVE-2026-50219-20.patch \ + file://CVE-2026-50219-21.patch \ + file://CVE-2026-50219-22.patch \ + file://CVE-2026-50219-23.patch \ + file://CVE-2026-50219-24.patch \ + file://CVE-2026-50219-25.patch \ + file://CVE-2026-50219-26.patch \ + file://CVE-2026-50219-27.patch \ + file://CVE-2026-50219-28.patch \ + file://CVE-2026-50219-29.patch \ + file://CVE-2026-50219-30.patch \ + file://CVE-2026-50219-31.patch \ + file://CVE-2026-50219-32.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"