From patchwork Mon Aug 24 15:15:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 96186 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C385C5DF81 for ; Mon, 24 Aug 2026 15:15:19 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.23]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.18995.1787584513854410918 for ; Mon, 24 Aug 2026 08:15:14 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=YtmFgmHd; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 52.101.69.23, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=EzM3TNNPSFiMATkbzWcfWAmuYJLHm9nzC2cOnwdf0TUKmp0+H8un8L2n7zdez383K5dAnu8lWOOSEax93Jh3SxE65/5bSEZdkoqWEL8gZcICHUEyjPpeX8vdXmRkadil2gigOjEk822QOoGSrDWTf/wz7nI2/QDDXg4Cc7YnUjmYfm6uasM9qKoV8z2Djmzh09puZAoBonZPHy1mnQN3y3t6t2xMkJasu181QIgHA8qIFjIQQmxm3FDDT3Y8GQ3g4WKO5rx2gHdc02IQD7h5HkvwlPelUQrd/jvC9qUSXKGaC3yURPdaqiggqdybLbzfM1KAx60785tdCWidicdpBw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=DZ7+oM0Sr7dXlgBaRRaR2jOqoFn4yH2aI3XAI+upIL4=; b=vdvSQmizzhSTXkkBRvSjeA3K7AKVnzEK/YqW2ZAg/O0m1DT65F7yW7hE5v7N8unlFwsN/xNLkfe+XMXiwfkjOMmWNhw4qdzJoCN/uBo5AmaH/Cbu/FFFz+CwA+6X6CJ5Yo+olI2T4dZB49p7Yu9vEIbQFuVGC+qHvLeFOYGyoBurwQuu16ZXnQUC5MTDq8suKg0C5UdZx+CuvfyHcxR6ktCsrygYZX23YjB03XIH+q76svBL3/qNlg3iKHEffologgnl7OseGWj/wMfuGPvycPeOHsSzTsFuQetUfg0LF3x+jShq44JcW1kBfB6n2tuOAY8g4CT3VFU/Nf8OoTVgFQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DZ7+oM0Sr7dXlgBaRRaR2jOqoFn4yH2aI3XAI+upIL4=; b=YtmFgmHd3KfYcOiHZvd+F4sO6fJMSzCpdKDGCpF2Y7FUYIUrWiNz/ofbhJFUpi4poVCCymbkwImVcfHa23JmNaew1bwF1rOY65V4lLFyXkPeNGZlTNP0D99wFE7yBW/xgDhqporVYAUtbpFUQgE8XKBrcFho3q5I/p3UgqUNx/2sQm2x9FUBWq7ZXUmfNWd4igjP3gYOARBoQpQVRoihXfOZap5c8DBnbrKQRk38tcaz9tbqEY5Pj2sKd0e+aG2GftcxSQ1bSPp+6xgub2GISMRQshasTbTOdSmCVakQ9tUKekmxkhMViOTbcNGELK2Vvfa9g2Dul8cuU9sx7Tp5RA== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by AMBPR07MB11278.eurprd07.prod.outlook.com (2603:10a6:20b:6f1::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.6; Mon, 24 Aug 2026 15:15:11 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0360.005; Mon, 24 Aug 2026 15:15:11 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [PATCH 2/3] expat: fix CVE-2026-56131 Thread-Topic: [PATCH 2/3] expat: fix CVE-2026-56131 Thread-Index: AQHdM9tbzne/PJYr5ESRFQ6mVzM5ag== Date: Mon, 24 Aug 2026 15:15:11 +0000 Message-ID: <20260824151448.19118-2-jakub.szczudlo@nokia.com> References: <20260824151448.19118-1-jakub.szczudlo@nokia.com> In-Reply-To: <20260824151448.19118-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|AMBPR07MB11278:EE_ x-ms-office365-filtering-correlation-id: cced165a-8ae3-43b1-b735-08df01f27da8 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|23010399003|1800799024|366016|38070700021|10067099003|56012099006|11063799006|22082099003|18002099003; x-microsoft-antispam-message-info: qLP/ptXFY8oZ2G2fC2RADGh7cgIoENZ31aEdD+2d7DO6ojeZAGseBMLp1drbULafpB997gk9Iu1Hpm+PFaEWxkFlo1KN8lBFQKXkxLlckqdcGAGXY4/gR5wLe6OqWZpDGjj7VnCz3nzKYgIVrT2NvTIzniKJ8UD7ZmLkRNi8QnrhCVZ8zwd0IhEpbnBRWzktu7px2W54CArQIIXZmqqr9b6JWTU2wX8yJVMHTODQP6LdeiO68R6InXgpsiyWTj+HMHX6j8cFvaNx9u1u0hxu7fBKBpA1rWqc+NRGkVMIm2H89m4QCqYBm0Y3Z1zJdT5NQeseystLe6HB+EPWwC6tMGhibPiF2cfj963S523cE1S8Gn9ygxrvYztv77mKVf9/HEhol7e2i+FR2rnEz9rMdKmCwHgVqovRiCmUiDCv6IxF2VIYgrSU7JVPDgR703qNtijBdlCFTr3mK6Nec0gQ5TntAADWOpZaznwbLaN1n/BZh9uHUlMRqlCmuU+KDzLlZ07JHoNi+WV3D2be8uDpKWAkH86DzGhQqTmsS4MZqk6LxsxvbLjAcv+mFm9fEuBNJGzipSjB+MOwRrcOYatp2esOpD3PUyVYY2DUZdvw4NwE/o9lCLDEgZ4ZrXGs/8ji+RJbL++nCzOAibRTyOS5lsnYm5D6hNJmwOaf3JF+bOM= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(1800799024)(366016)(38070700021)(10067099003)(56012099006)(11063799006)(22082099003)(18002099003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?q?5B2r/hmIcem6GYe3drh56CG?= =?iso-8859-1?q?f4o8H+cjSfgWSAa10uj92VnNIjCtyMvR89rHeIImL4lmYKSBaDk2CTnzgS3L?= =?iso-8859-1?q?DdwshL24IBhaoyGJDCSDA+mCb1sBSn6EZ09clofibg0xR2Obsz+XLjhaHAy0?= =?iso-8859-1?q?lWqfPKApdygjN4UkBqbsPCadcbiPYv7wEu+7mcHa6ZAzQGRTxG7sPJKc9tXQ?= =?iso-8859-1?q?UL0CTVpx+V1wJeCgFujIoOdkfQdVtYSnQ6LLd5Flk/0JzjkJhBBnEG6GBDob?= =?iso-8859-1?q?FoMAVeQD9N6ek0z5SOLIwhKOwg4DnbisGYvtZFRtxa1CEnn98dcwwUJOPb7z?= =?iso-8859-1?q?Z2xiT6RcIyq5PKAp5SWPLSIe0LJ5h/eRNzuFxhBN2cND/0ZQlMWqPqlVqtgR?= =?iso-8859-1?q?8nfC5ZaAzCT5/ToAKSuQzuh5AlDo5PIdNj53TiEI4zgJqu7dovIIqdHLkADo?= =?iso-8859-1?q?ioEu+gLMjKqnghap43JMwYuUNPwSD6b4gWCqwId9Qw+5yTFic3UxI5b4GzoX?= =?iso-8859-1?q?EPNExeQPLblD/wMa15vp86xsyLuqjn3J2rCWmGpk7yBUexf6PO5px9qM6VBE?= =?iso-8859-1?q?wyzYG0KUxUoV4sgRS72FYeR5CdkTVRHSfEO10g94BArNDrZVSKLX+3BzJqkH?= =?iso-8859-1?q?4pkDvjfoo49e3J9KAVK/e8fngX21T4/b1SfHIGl65qd5frjqCNojWmSsevNq?= =?iso-8859-1?q?/IQ1TY7iouV/qnw4lfafw5GRmZh50s+oohyUSPjDSZHWuEYgbznxbM4qmr1n?= =?iso-8859-1?q?w9URxs6O/eiZnisjAA1u27ORQ47Ljd45w/lpggyvP0zmKXvCM3RIddXC5/O+?= =?iso-8859-1?q?8JtNGoc/9nmCwbf5Mke4n1bIy/k1YwfSxjYfBr/tvHa/OI0tU97Z+GRmPKuY?= =?iso-8859-1?q?Fnx0EsmBqjD+DoBKoAmz734YIkpbcgBBCKb0lE33tT3gHGHhs2+gxW2hDRFU?= =?iso-8859-1?q?3IM//Ak9Cj0MtYLG68MfOyuO4h90CtoVUel3Dc7fasCtY8E7eTYkiW/i6HdI?= =?iso-8859-1?q?L6Hc3dbldVbgJfjoXU7J9+Mr5fMIWrq76uGbH50hIDc42snCvodwdhthvKQS?= =?iso-8859-1?q?UQcCWpP8Mm7xcjlaJ1lSEiaxLEzDc179Kc+U6njeQ3JWgzr8JFG4DhMauOl8?= =?iso-8859-1?q?huYc+nVd6vmF0aBfqN7oXQ+GS82H4D5DPHCEed2hrEw80cT4SEEkO1nHXbwq?= =?iso-8859-1?q?OvrviGZuvrAbtViCVnIKye5/spXh+UEx8CZ612CZCZKwUTJ2QdsmOjkIM89s?= =?iso-8859-1?q?oMiWw9rHqRgFp7Zv2h8olkd9X4myOlsWz86D6nWG8RdieW6tdFk2AeDHQ5Xr?= =?iso-8859-1?q?/UmNmJBva5Gcp7s1SlRtUo33xv1V8WwkeSq3kVCF7xXVVckfxOWJLKqAspV6?= =?iso-8859-1?q?+NVz5WE5TT52OYMxAF1ZvuGNE3TZY1RzbuMDBFO+H6Lmfu1sR6HZUPEzjisT?= =?iso-8859-1?q?jjLwTJ6GK5P4liSa+06PIgqDWZRuqI6jUfXVbhktMbDy4XpqIGz34R0067dj?= =?iso-8859-1?q?VvP/sbkWkTsiQbU+jj2mg/FYO8/qYrsLomynM4zSnw5jjP0mZOLr3aSJ46TH?= =?iso-8859-1?q?mi0RH2/aKKOkGyXxKvwSnxqjv0Xn5V1Car8P6NUvW3R2P+hf9h9XdzgYh991?= =?iso-8859-1?q?PK5+IrOxiFT96EuiOFLzRSKogyj01z/ec6O1vtYoJb2xIkp/qomG3DqyWxzL?= =?iso-8859-1?q?+Kk02BFz0PDfBDC9JNYAj9T16E6sRclUAs2O355e26854mhf4PBK/lwWTvNE?= =?iso-8859-1?q?sbCc8CyjUwJbwemnOKQs2RdR3fgqvJHTKFnLRtwR7Kur10A=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: cced165a-8ae3-43b1-b735-08df01f27da8 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Aug 2026 15:15:11.1620 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 7+tfC9NpRpiWOKd0w6QwpSobjHiLbs1Cip9i1PE8F9lrOuA9pt49ovG9V0HwIzG8dnRgEKgQF5AOrOC1NE2dLe/4RpCN08GtZqBhaHJv6BE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AMBPR07MB11278 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 24 Aug 2026 15:15:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244128 Backport patch to fix CVE-2026-56131. References: https://nvd.nist.gov/vuln/detail/CVE-2026-56131 Upstream fix: https://github.com/libexpat/libexpat/commit/d5a654b4881f450827af5b3b7b72370a3bbf9a8f Signed-off-by: Jakub Szczudlo --- .../expat/expat/CVE-2026-56131.patch | 124 ++++++++++++++++++ meta/recipes-core/expat/expat_2.7.5.bb | 1 + 2 files changed, 125 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56131.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-56131.patch b/meta/recipes-core/expat/expat/CVE-2026-56131.patch new file mode 100644 index 0000000000..8691f98f89 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56131.patch @@ -0,0 +1,124 @@ +From 29dfca6ad4d2a9dfd5ce72efd72e1b67d598ab4c Mon Sep 17 00:00:00 2001 +From: netliomax25-code +Date: Sat, 6 Jun 2026 20:03:53 +0530 +Subject: [PATCH] lib: protect XML_ResumeParser from being called from a + handler + +The handler-reentrancy guards from CVE-2026-50219 cover XML_Parse, XML_ParseBuffer, XML_GetBuffer, XML_ParserFree and XML_ParserReset but not XML_ResumeParser, which drives the parser through callProcessor in the same way. + +(cherry picked from commit d5a654b4881f450827af5b3b7b72370a3bbf9a8f) + +CVE: CVE-2026-56131 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1267/commits/d5a654b4881f450827af5b3b7b72370a3bbf9a8f] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 2 +- + tests/handlers.c | 24 ++++++++++++++++++++++++ + tests/handlers.h | 9 +++++++++ + tests/misc_tests.c | 20 ++++++++++++++++++++ + 4 files changed, 54 insertions(+), 1 deletion(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index cc1d550..a5fa256 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -2778,7 +2778,7 @@ enum XML_Status XMLCALL + XML_ResumeParser(XML_Parser parser) { + enum XML_Status result = XML_STATUS_OK; + +- if (parser == NULL) ++ if ((parser == NULL) || isCalledFromInsideHandler(parser)) + return XML_STATUS_ERROR; + if (parser->m_parsingStatus.parsing != XML_SUSPENDED) { + parser->m_errorCode = XML_ERROR_NOT_SUSPENDED; +diff --git a/tests/handlers.c b/tests/handlers.c +index c7d6578..5a85f6d 100644 +--- a/tests/handlers.c ++++ b/tests/handlers.c +@@ -2015,3 +2015,27 @@ forbidden_calls_character_handler(void *userData, const XML_Char *s, int len) { + + assert_true(XML_GetErrorCode(parser) == XML_ERROR_NONE); + } ++ ++void XMLCALL ++suspend_then_resume_character_handler(void *userData, const XML_Char *s, ++ int len) { ++ UNUSED_P(s); ++ UNUSED_P(len); ++ ResumeFromHandlerData *const data = (ResumeFromHandlerData *)userData; ++ ++ data->callCount++; ++ if (data->callCount > 1) { ++ // Reached only if the guard under test is missing: XML_ResumeParser would ++ // then have driven the parser re-entrantly and called us again. Bail out ++ // so the test fails by assertion below rather than recursing without bound. ++ return; ++ } ++ ++ // Put the parser into XML_SUSPENDED so that, without the guard, ++ // XML_ResumeParser would proceed into a re-entrant parse. ++ assert_true(XML_StopParser(data->parser, /*resumable=*/XML_TRUE) ++ == XML_STATUS_OK); ++ ++ // Resuming the parser from inside a handler must be rejected. ++ assert_true(XML_ResumeParser(data->parser) == XML_STATUS_ERROR); ++} +diff --git a/tests/handlers.h b/tests/handlers.h +index de28392..507ad8b 100644 +--- a/tests/handlers.h ++++ b/tests/handlers.h +@@ -616,6 +616,15 @@ extern void XMLCALL forbidden_calls_character_handler(void *userData, + const XML_Char *s, + int len); + ++typedef struct { ++ XML_Parser parser; ++ int callCount; ++} ResumeFromHandlerData; ++ ++extern void XMLCALL suspend_then_resume_character_handler(void *userData, ++ const XML_Char *s, ++ int len); ++ + #endif /* XML_HANDLERS_H */ + + #ifdef __cplusplus +diff --git a/tests/misc_tests.c b/tests/misc_tests.c +index b9053fe..265e7cb 100644 +--- a/tests/misc_tests.c ++++ b/tests/misc_tests.c +@@ -815,6 +815,25 @@ START_TEST(test_misc_calls_forbidden_from_handlers) { + } + END_TEST + ++START_TEST(test_misc_resume_parser_forbidden_from_handler) { ++ const char *const doc = "Hello world!"; ++ ++ XML_Parser parser = XML_ParserCreate(NULL); ++ ResumeFromHandlerData data = {parser, 0}; ++ XML_SetUserData(parser, &data); ++ XML_SetCharacterDataHandler(parser, suspend_then_resume_character_handler); ++ ++ // The handler suspends the parser, so the top-level parse reports suspension ++ // rather than completion. The handler also asserts that resuming from inside ++ // itself is rejected. ++ assert_true(XML_Parse(parser, doc, (int)strlen(doc), /*isFinal=*/XML_TRUE) ++ == XML_STATUS_SUSPENDED); ++ assert_true(data.callCount == 1); ++ ++ XML_ParserFree(parser); ++} ++END_TEST ++ + void + make_miscellaneous_test_case(Suite *s) { + TCase *tc_misc = tcase_create("miscellaneous tests"); +@@ -847,4 +866,5 @@ make_miscellaneous_test_case(Suite *s) { + tcase_add_test(tc_misc, test_misc_async_entity_rejected); + tcase_add_test(tc_misc, test_misc_no_infinite_loop_issue_1161); + tcase_add_test(tc_misc, test_misc_calls_forbidden_from_handlers); ++ tcase_add_test(tc_misc, test_misc_resume_parser_forbidden_from_handler); + } +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb index 7f00c6f90b..78e35243c5 100644 --- a/meta/recipes-core/expat/expat_2.7.5.bb +++ b/meta/recipes-core/expat/expat_2.7.5.bb @@ -68,6 +68,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-50219-30.patch \ file://CVE-2026-50219-31.patch \ file://CVE-2026-50219-32.patch \ + file://CVE-2026-56131.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"