diff mbox series

[3/3] expat: fix CVE-2026-56412

Message ID 20260824151448.19118-3-jakub.szczudlo@nokia.com
State Changes Requested
Headers show
Series [1/3] expat: fix CVE-2026-50219 | expand

Commit Message

Jakub Szczudlo (Nokia) Aug. 24, 2026, 3:15 p.m. UTC 
Backport patch to fix CVE-2026-56412.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-56412

Upstream fix:
  https://github.com/libexpat/libexpat/commit/d19e834794060d18c061d94452c35d725393ea58

Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
---
 .../expat/expat/CVE-2026-56412.patch          | 45 +++++++++++++++++++
 meta/recipes-core/expat/expat_2.7.5.bb        |  1 +
 2 files changed, 46 insertions(+)
 create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56412.patch
diff mbox series

Patch

diff --git a/meta/recipes-core/expat/expat/CVE-2026-56412.patch b/meta/recipes-core/expat/expat/CVE-2026-56412.patch
new file mode 100644
index 0000000000..8959bdec5c
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56412.patch
@@ -0,0 +1,45 @@ 
+From b94cd5b9a6dc7f938a50db2417e4ff60ed35c4a1 Mon Sep 17 00:00:00 2001
+From: hextheshadow <hextheshadow0x@gmail.com>
+Date: Sat, 20 Jun 2026 21:07:29 +0500
+Subject: [PATCH] lib: guard XML_TOK_DATA_CHARS handler calls in
+ doCdataSection()
+
+(cherry picked from commit d19e834794060d18c061d94452c35d725393ea58)
+
+CVE: CVE-2026-56412
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1278/commits/d19e834794060d18c061d94452c35d725393ea58]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index a5fa256..1476c7e 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -4812,16 +4812,21 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr,
+             const enum XML_Convert_Result convert_res = XmlConvert(
+                 enc, &s, next, &dataPtr, (ICHAR *)parser->m_dataBufEnd);
+             *eventEndPP = next;
++            beforeHandler(parser);
+             charDataHandler(parser->m_handlerArg, parser->m_dataBuf,
+                             (int)(dataPtr - (ICHAR *)parser->m_dataBuf));
++            afterHandler(parser);
+             if ((convert_res == XML_CONVERT_COMPLETED)
+                 || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+               break;
+             *eventPP = s;
+           }
+-        } else
++        } else {
++          beforeHandler(parser);
+           charDataHandler(parser->m_handlerArg, (const XML_Char *)s,
+                           (int)((const XML_Char *)next - (const XML_Char *)s));
++          afterHandler(parser);
++        }
+       } else if (parser->m_defaultHandler)
+         reportDefault(parser, enc, s, next);
+     } break;
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index 78e35243c5..6fdae2458f 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -69,6 +69,7 @@  SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2  \
            file://CVE-2026-50219-31.patch \
            file://CVE-2026-50219-32.patch \
            file://CVE-2026-56131.patch \
+           file://CVE-2026-56412.patch \
            "
 
 GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"