new file mode 100644
@@ -0,0 +1,61 @@
+From 8da7b772a31155083a37796f96e622f6dce25454 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 15:15:10 +0200
+Subject: [PATCH] lib: Introduce handler call depth tracking
+
+(cherry picked from commit f69d0719bf01596f1d95c9e902f4a279e62c6305)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/f69d0719bf01596f1d95c9e902f4a279e62c6305]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 2a5ebb7..38617a6 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -793,6 +793,7 @@ struct XML_ParserStruct {
+ ENTITY_STATS m_entity_stats;
+ #endif
+ XML_Bool m_reenter;
++ unsigned m_handlerCallDepth;
+ };
+
+ #if XML_GE == 1
+@@ -1260,6 +1261,23 @@ generate_hash_secret_salt(void) {
+ #endif
+ }
+
++static void
++beforeHandler(XML_Parser parser) {
++ assert(parser->m_handlerCallDepth < UINT_MAX);
++ parser->m_handlerCallDepth++;
++}
++
++static void
++afterHandler(XML_Parser parser) {
++ assert(parser->m_handlerCallDepth > 0);
++ parser->m_handlerCallDepth--;
++}
++
++static bool
++isCalledFromInsideHandler(XML_Parser parser) {
++ return parser->m_handlerCallDepth > 0;
++}
++
+ static enum XML_Error
+ callProcessor(XML_Parser parser, const char *start, const char *end,
+ const char **endPtr) {
+@@ -1614,6 +1632,7 @@ parserInit(XML_Parser parser, const XML_Char *encodingName) {
+ parser->m_parsingStatus.parsing = XML_INITIALIZED;
+ // Reentry can only be triggered inside m_processor calls
+ parser->m_reenter = XML_FALSE;
++ parser->m_handlerCallDepth = 0;
+ #ifdef XML_DTD
+ parser->m_isParamEntity = XML_FALSE;
+ parser->m_useForeignDTD = XML_FALSE;
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,84 @@
+From 3832d4080d50d5aeeeaae32688ba3bf4af2042a2 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:33:26 +0200
+Subject: [PATCH] lib: Prepare `m_notStandaloneHandler` calls for upcoming
+ wrapping
+
+(cherry picked from commit cdd21e84e150cc2ca961533e157bd52e3cbb4aa4)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/cdd21e84e150cc2ca961533e157bd52e3cbb4aa4]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 34 ++++++++++++++++++++++------------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 38617a6..65df026 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5537,9 +5537,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ entity->systemId, entity->publicId))
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+- if (! dtd->standalone && parser->m_notStandaloneHandler
+- && ! parser->m_notStandaloneHandler(parser->m_handlerArg))
+- return XML_ERROR_NOT_STANDALONE;
++ if (! dtd->standalone && parser->m_notStandaloneHandler) {
++ const int handlerStatus
++ = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ if (! handlerStatus)
++ return XML_ERROR_NOT_STANDALONE;
++ }
+ }
+ /* if we didn't read the foreign DTD then this means that there
+ is no external subset and we must reset dtd->hasParamEntityRefs
+@@ -5577,9 +5580,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ entity->systemId, entity->publicId))
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+- if (! dtd->standalone && parser->m_notStandaloneHandler
+- && ! parser->m_notStandaloneHandler(parser->m_handlerArg))
+- return XML_ERROR_NOT_STANDALONE;
++ if (! dtd->standalone && parser->m_notStandaloneHandler) {
++ const int handlerStatus
++ = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ if (! handlerStatus)
++ return XML_ERROR_NOT_STANDALONE;
++ }
+ }
+ /* if we didn't read the foreign DTD then this means that there
+ is no external subset and we must reset dtd->hasParamEntityRefs
+@@ -5793,9 +5799,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ #ifdef XML_DTD
+ && ! parser->m_paramEntityParsing
+ #endif /* XML_DTD */
+- && parser->m_notStandaloneHandler
+- && ! parser->m_notStandaloneHandler(parser->m_handlerArg))
+- return XML_ERROR_NOT_STANDALONE;
++ && parser->m_notStandaloneHandler) {
++ const int status = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ if (! status)
++ return XML_ERROR_NOT_STANDALONE;
++ }
+ #ifndef XML_DTD
+ break;
+ #else /* XML_DTD */
+@@ -6179,9 +6187,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ }
+ }
+ #endif /* XML_DTD */
+- if (! dtd->standalone && parser->m_notStandaloneHandler
+- && ! parser->m_notStandaloneHandler(parser->m_handlerArg))
+- return XML_ERROR_NOT_STANDALONE;
++ if (! dtd->standalone && parser->m_notStandaloneHandler) {
++ const int status = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ if (! status)
++ return XML_ERROR_NOT_STANDALONE;
++ }
+ break;
+
+ /* Element declaration stuff */
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,92 @@
+From 3fd5635fac887f161ab02adf749c2bab1d2ee904 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sat, 30 May 2026 00:45:34 +0200
+Subject: [PATCH] lib: Prepare `m_externalEntityRefHandler` calls for upcoming
+ wrapping
+
+(cherry picked from commit 1ffe852fe1d8e1d73eb4eb5798456aefc8300299)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/1ffe852fe1d8e1d73eb4eb5798456aefc8300299]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 35 ++++++++++++++++++++---------------
+ 1 file changed, 20 insertions(+), 15 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 65df026..eb8e803 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3533,9 +3533,10 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ entity->open = XML_FALSE;
+ if (! context)
+ return XML_ERROR_NO_MEMORY;
+- if (! parser->m_externalEntityRefHandler(
+- parser->m_externalEntityRefHandlerArg, context, entity->base,
+- entity->systemId, entity->publicId))
++ const int status = parser->m_externalEntityRefHandler(
++ parser->m_externalEntityRefHandlerArg, context, entity->base,
++ entity->systemId, entity->publicId);
++ if (! status)
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ poolDiscard(&parser->m_tempPool);
+ } else if (parser->m_defaultHandler)
+@@ -5532,9 +5533,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ if (parser->m_useForeignDTD)
+ entity->base = parser->m_curBase;
+ dtd->paramEntityRead = XML_FALSE;
+- if (! parser->m_externalEntityRefHandler(
+- parser->m_externalEntityRefHandlerArg, 0, entity->base,
+- entity->systemId, entity->publicId))
++ const int status = parser->m_externalEntityRefHandler(
++ parser->m_externalEntityRefHandlerArg, 0, entity->base,
++ entity->systemId, entity->publicId);
++ if (! status)
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+ if (! dtd->standalone && parser->m_notStandaloneHandler) {
+@@ -5575,9 +5577,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ return XML_ERROR_NO_MEMORY;
+ entity->base = parser->m_curBase;
+ dtd->paramEntityRead = XML_FALSE;
+- if (! parser->m_externalEntityRefHandler(
+- parser->m_externalEntityRefHandlerArg, 0, entity->base,
+- entity->systemId, entity->publicId))
++ const int status = parser->m_externalEntityRefHandler(
++ parser->m_externalEntityRefHandlerArg, 0, entity->base,
++ entity->systemId, entity->publicId);
++ if (! status)
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+ if (! dtd->standalone && parser->m_notStandaloneHandler) {
+@@ -6167,9 +6170,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ dtd->paramEntityRead = XML_FALSE;
+ entity->open = XML_TRUE;
+ entityTrackingOnOpen(parser, entity, __LINE__);
+- if (! parser->m_externalEntityRefHandler(
+- parser->m_externalEntityRefHandlerArg, 0, entity->base,
+- entity->systemId, entity->publicId)) {
++ const int status = parser->m_externalEntityRefHandler(
++ parser->m_externalEntityRefHandlerArg, 0, entity->base,
++ entity->systemId, entity->publicId);
++ if (! status) {
+ entityTrackingOnClose(parser, entity, __LINE__);
+ entity->open = XML_FALSE;
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+@@ -6959,9 +6963,10 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc,
+ dtd->paramEntityRead = XML_FALSE;
+ entity->open = XML_TRUE;
+ entityTrackingOnOpen(parser, entity, __LINE__);
+- if (! parser->m_externalEntityRefHandler(
+- parser->m_externalEntityRefHandlerArg, 0, entity->base,
+- entity->systemId, entity->publicId)) {
++ const int status = parser->m_externalEntityRefHandler(
++ parser->m_externalEntityRefHandlerArg, 0, entity->base,
++ entity->systemId, entity->publicId);
++ if (! status) {
+ entityTrackingOnClose(parser, entity, __LINE__);
+ entity->open = XML_FALSE;
+ result = XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,34 @@
+From 9a13084051f0dbff8f980db7aca46b02111cb6d5 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sat, 30 May 2026 00:46:36 +0200
+Subject: [PATCH] lib: Prepare `m_unknownEncodingHandler` calls for upcoming
+ wrapping
+
+(cherry picked from commit adcafd4316259ef48b1763e584733a7bff4a8db0)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/adcafd4316259ef48b1763e584733a7bff4a8db0]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index eb8e803..dddcb47 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5057,8 +5057,9 @@ handleUnknownEncoding(XML_Parser parser, const XML_Char *encodingName) {
+ info.convert = NULL;
+ info.data = NULL;
+ info.release = NULL;
+- if (parser->m_unknownEncodingHandler(parser->m_unknownEncodingHandlerData,
+- encodingName, &info)) {
++ const int status = parser->m_unknownEncodingHandler(
++ parser->m_unknownEncodingHandlerData, encodingName, &info);
++ if (status) {
+ ENCODING *enc;
+ parser->m_unknownEncodingMem = MALLOC(parser, XmlSizeOfUnknownEncoding());
+ if (! parser->m_unknownEncodingMem) {
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,48 @@
+From 6e755a1e9c3e4cc7c1ed60c96e9d2e1659daf5da Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:05:19 +0200
+Subject: [PATCH] lib: Register `m_attlistDeclHandler` with handler call depth
+ tracking
+
+(cherry picked from commit 781092f189a8c8e8be6640258829a7f783864282)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/781092f189a8c8e8be6640258829a7f783864282]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index dddcb47..16ab984 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5682,10 +5682,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ poolFinish(&parser->m_tempPool);
+ }
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_attlistDeclHandler(
+ parser->m_handlerArg, parser->m_declElementType->name,
+ parser->m_declAttributeId->name, parser->m_declAttributeType, 0,
+ role == XML_ROLE_REQUIRED_ATTRIBUTE_VALUE);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ }
+@@ -5720,10 +5722,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ poolFinish(&parser->m_tempPool);
+ }
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_attlistDeclHandler(
+ parser->m_handlerArg, parser->m_declElementType->name,
+ parser->m_declAttributeId->name, parser->m_declAttributeType,
+ attVal, role == XML_ROLE_FIXED_ATTRIBUTE_VALUE);
++ afterHandler(parser);
+ poolClear(&parser->m_tempPool);
+ handleDefault = XML_FALSE;
+ }
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,154 @@
+From 80765c36bc9b272d0141fa8c3ea3da59a16c443e Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:08:02 +0200
+Subject: [PATCH] lib: Register `m_characterDataHandler` with handler call
+ depth tracking
+
+(cherry picked from commit 5ee607587a997220a48e78b5f6c55a05e50e5b20)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/5ee607587a997220a48e78b5f6c55a05e50e5b20]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 44 ++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 34 insertions(+), 10 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 16ab984..4556805 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3428,7 +3428,9 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ *eventEndPP = end;
+ if (parser->m_characterDataHandler) {
+ XML_Char c = 0xA;
++ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, &c, 1);
++ afterHandler(parser);
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, end);
+ /* We are at the end of the final buffer, should we check for
+@@ -3481,9 +3483,11 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ ((char *)&ch) + sizeof(XML_Char), __LINE__,
+ XML_ACCOUNT_ENTITY_EXPANSION);
+ #endif /* XML_GE == 1 */
+- if (parser->m_characterDataHandler)
++ if (parser->m_characterDataHandler) {
++ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, &ch, 1);
+- else if (parser->m_defaultHandler)
++ afterHandler(parser);
++ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ break;
+ }
+@@ -3729,8 +3733,10 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ return XML_ERROR_BAD_CHAR_REF;
+ if (parser->m_characterDataHandler) {
+ XML_Char buf[XML_ENCODE_MAX];
++ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, buf,
+ XmlEncode(n, (ICHAR *)buf));
++ afterHandler(parser);
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ } break;
+@@ -3739,7 +3745,9 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ case XML_TOK_DATA_NEWLINE:
+ if (parser->m_characterDataHandler) {
+ XML_Char c = 0xA;
++ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, &c, 1);
++ afterHandler(parser);
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ break;
+@@ -3760,11 +3768,13 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ However, now we have a start/endCdataSectionHandler, so it seems
+ easier to let the user deal with this.
+ */
+- else if ((0) && parser->m_characterDataHandler)
++ else if ((0) && parser->m_characterDataHandler) {
++ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, parser->m_dataBuf,
+ 0);
+- /* END disabled code */
+- else if (parser->m_defaultHandler)
++ afterHandler(parser);
++ /* END disabled code */
++ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ result
+ = doCdataSection(parser, enc, &next, end, nextPtr, haveMore, account);
+@@ -3784,13 +3794,18 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ if (MUST_CONVERT(enc, s)) {
+ ICHAR *dataPtr = (ICHAR *)parser->m_dataBuf;
+ XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)parser->m_dataBufEnd);
++ beforeHandler(parser);
+ parser->m_characterDataHandler(
+ parser->m_handlerArg, parser->m_dataBuf,
+ (int)(dataPtr - (ICHAR *)parser->m_dataBuf));
+- } else
++ afterHandler(parser);
++ } else {
++ beforeHandler(parser);
+ parser->m_characterDataHandler(
+ parser->m_handlerArg, (const XML_Char *)s,
+ (int)((const XML_Char *)end - (const XML_Char *)s));
++ afterHandler(parser);
++ }
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, end);
+ /* We are at the end of the final buffer, should we check for
+@@ -3815,16 +3830,21 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ const enum XML_Convert_Result convert_res = XmlConvert(
+ enc, &s, next, &dataPtr, (ICHAR *)parser->m_dataBufEnd);
+ *eventEndPP = s;
++ beforeHandler(parser);
+ charDataHandler(parser->m_handlerArg, parser->m_dataBuf,
+ (int)(dataPtr - (ICHAR *)parser->m_dataBuf));
++ afterHandler(parser);
+ if ((convert_res == XML_CONVERT_COMPLETED)
+ || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+ break;
+ *eventPP = s;
+ }
+- } else
++ } else {
++ beforeHandler(parser);
+ charDataHandler(parser->m_handlerArg, (const XML_Char *)s,
+ (int)((const XML_Char *)next - (const XML_Char *)s));
++ afterHandler(parser);
++ }
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ } break;
+@@ -4730,11 +4750,13 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr,
+ parser->m_endCdataSectionHandler(parser->m_handlerArg);
+ /* BEGIN disabled code */
+ /* see comment under XML_TOK_CDATA_SECT_OPEN */
+- else if ((0) && parser->m_characterDataHandler)
++ else if ((0) && parser->m_characterDataHandler) {
++ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, parser->m_dataBuf,
+ 0);
+- /* END disabled code */
+- else if (parser->m_defaultHandler)
++ afterHandler(parser);
++ /* END disabled code */
++ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ *startPtr = next;
+ *nextPtr = next;
+@@ -4745,7 +4767,9 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr,
+ case XML_TOK_DATA_NEWLINE:
+ if (parser->m_characterDataHandler) {
+ XML_Char c = 0xA;
++ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, &c, 1);
++ afterHandler(parser);
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ break;
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,32 @@
+From bba681b574c9675f331e79db0513bb9df1fec523 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:08:40 +0200
+Subject: [PATCH] lib: Register `m_commentHandler` with handler call depth
+ tracking
+
+(cherry picked from commit 0e7dbfee7912a8e25aace775be47e5ad570b9cc3)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/0e7dbfee7912a8e25aace775be47e5ad570b9cc3]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 4556805..98ffe5a 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -7269,7 +7269,9 @@ reportComment(XML_Parser parser, const ENCODING *enc, const char *start,
+ if (! data)
+ return 0;
+ normalizeLines(data);
++ beforeHandler(parser);
+ parser->m_commentHandler(parser->m_handlerArg, data);
++ afterHandler(parser);
+ poolClear(&parser->m_tempPool);
+ return 1;
+ }
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,44 @@
+From c6e96e6a5ec4afc710f4aee2b81bda4baca71a25 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:14:10 +0200
+Subject: [PATCH] lib: Register `m_defaultHandler` with handler call depth
+ tracking
+
+(cherry picked from commit e5b76bd58dd9984cef46c2a66a98b03c95a3c774)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/e5b76bd58dd9984cef46c2a66a98b03c95a3c774]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 98ffe5a..ed9628f 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -7312,15 +7312,20 @@ reportDefault(XML_Parser parser, const ENCODING *enc, const char *s,
+ convert_res
+ = XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)parser->m_dataBufEnd);
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_defaultHandler(parser->m_handlerArg, parser->m_dataBuf,
+ (int)(dataPtr - (ICHAR *)parser->m_dataBuf));
++ afterHandler(parser);
+ *eventPP = s;
+ } while ((convert_res != XML_CONVERT_COMPLETED)
+ && (convert_res != XML_CONVERT_INPUT_INCOMPLETE));
+- } else
++ } else {
++ beforeHandler(parser);
+ parser->m_defaultHandler(
+ parser->m_handlerArg, (const XML_Char *)s,
+ (int)((const XML_Char *)end - (const XML_Char *)s));
++ afterHandler(parser);
++ }
+ }
+
+ static int
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,44 @@
+From 8f2979090e01719c7f0c005816943d93bfda2754 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:15:01 +0200
+Subject: [PATCH] lib: Register `m_elementDeclHandler` with handler call depth
+ tracking
+
+(cherry picked from commit b4a711a33591c0d45d6e630ed6448dcbc5534700)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/b4a711a33591c0d45d6e630ed6448dcbc5534700]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index ed9628f..03bc212 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -6259,8 +6259,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ content->type = ((role == XML_ROLE_CONTENT_ANY) ? XML_CTYPE_ANY
+ : XML_CTYPE_EMPTY);
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_elementDeclHandler(
+ parser->m_handlerArg, parser->m_declElementType->name, content);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ dtd->in_eldecl = XML_FALSE;
+@@ -6342,8 +6344,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ if (! model)
+ return XML_ERROR_NO_MEMORY;
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_elementDeclHandler(
+ parser->m_handlerArg, parser->m_declElementType->name, model);
++ afterHandler(parser);
+ }
+ dtd->in_eldecl = XML_FALSE;
+ dtd->contentStringLen = 0;
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,35 @@
+From 8849de56e9789089103114f472d68f3a37f5ab53 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:15:40 +0200
+Subject: [PATCH] lib: Register `m_endCdataSectionHandler` with handler call
+ depth tracking
+
+(cherry picked from commit b08e08c0558152a4180597a3e880dc70040c2b2a)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/b08e08c0558152a4180597a3e880dc70040c2b2a]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 03bc212..a894538 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -4746,8 +4746,11 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr,
+ *eventEndPP = next;
+ switch (tok) {
+ case XML_TOK_CDATA_SECT_CLOSE:
+- if (parser->m_endCdataSectionHandler)
++ if (parser->m_endCdataSectionHandler) {
++ beforeHandler(parser);
+ parser->m_endCdataSectionHandler(parser->m_handlerArg);
++ afterHandler(parser);
++ }
+ /* BEGIN disabled code */
+ /* see comment under XML_TOK_CDATA_SECT_OPEN */
+ else if ((0) && parser->m_characterDataHandler) {
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,32 @@
+From 8114f635922a0c22ad11630aa953ca1545d23044 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:16:13 +0200
+Subject: [PATCH] lib: Register `m_endDoctypeDeclHandler` with handler call
+ depth tracking
+
+(cherry picked from commit bd454febe07b931e638f2186755585b67a738d31)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/bd454febe07b931e638f2186755585b67a738d31]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index a894538..2fe2f71 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5585,7 +5585,9 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ }
+ #endif /* XML_DTD */
+ if (parser->m_endDoctypeDeclHandler) {
++ beforeHandler(parser);
+ parser->m_endDoctypeDeclHandler(parser->m_handlerArg);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ break;
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,42 @@
+From 1d95acdeab736c3b4e08477b958b6f7296a75607 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:17:10 +0200
+Subject: [PATCH] lib: Register `m_endElementHandler` with handler call depth
+ tracking
+
+(cherry picked from commit e411d9907b8addb334d1ed5db1afd5b5bf625f24)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/e411d9907b8addb334d1ed5db1afd5b5bf625f24]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 2fe2f71..37aaabc 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3645,7 +3645,9 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ if (parser->m_endElementHandler) {
+ if (parser->m_startElementHandler)
+ *eventPP = *eventEndPP;
++ beforeHandler(parser);
+ parser->m_endElementHandler(parser->m_handlerArg, name.str);
++ afterHandler(parser);
+ noElmHandlers = XML_FALSE;
+ }
+ if (noElmHandlers && parser->m_defaultHandler)
+@@ -3703,7 +3705,9 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ }
+ *uri = XML_T('\0');
+ }
++ beforeHandler(parser);
+ parser->m_endElementHandler(parser->m_handlerArg, tag->name.str);
++ afterHandler(parser);
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ while (tag->bindings) {
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,49 @@
+From 3e9e33361aeaa853f16fd85bf30a71f0ac0b2791 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:23:59 +0200
+Subject: [PATCH] lib: Register `m_endNamespaceDeclHandler` with handler call
+ depth tracking
+
+(cherry picked from commit 274aa82340fe1b2205e8e3ae1cd35e2168cd42e8)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/274aa82340fe1b2205e8e3ae1cd35e2168cd42e8]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 37aaabc..ad72001 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3712,9 +3712,12 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ reportDefault(parser, enc, s, next);
+ while (tag->bindings) {
+ BINDING *b = tag->bindings;
+- if (parser->m_endNamespaceDeclHandler)
++ if (parser->m_endNamespaceDeclHandler) {
++ beforeHandler(parser);
+ parser->m_endNamespaceDeclHandler(parser->m_handlerArg,
+ b->prefix->name);
++ afterHandler(parser);
++ }
+ tag->bindings = tag->bindings->nextTagBinding;
+ b->nextTagBinding = parser->m_freeBindingList;
+ parser->m_freeBindingList = b;
+@@ -3906,8 +3909,11 @@ freeBindings(XML_Parser parser, BINDING *bindings) {
+ /* m_startNamespaceDeclHandler will have been called for this
+ * binding in addBindings(), so call the end handler now.
+ */
+- if (parser->m_endNamespaceDeclHandler)
++ if (parser->m_endNamespaceDeclHandler) {
++ beforeHandler(parser);
+ parser->m_endNamespaceDeclHandler(parser->m_handlerArg, b->prefix->name);
++ afterHandler(parser);
++ }
+
+ bindings = bindings->nextTagBinding;
+ b->nextTagBinding = parser->m_freeBindingList;
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,74 @@
+From 13084e0a4473dcea40fc0173a2c54fbf9fd3eece Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:25:42 +0200
+Subject: [PATCH] lib: Register `m_entityDeclHandler` with handler call depth
+ tracking
+
+(cherry picked from commit 6e62649e6b25eb789166b9131dfadfe9d806f5ce)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/6e62649e6b25eb789166b9131dfadfe9d806f5ce]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index ad72001..e9466d5 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5791,10 +5791,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ poolFinish(&dtd->entityValuePool);
+ if (parser->m_entityDeclHandler) {
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_entityDeclHandler(
+ parser->m_handlerArg, parser->m_declEntity->name,
+ parser->m_declEntity->is_param, parser->m_declEntity->textPtr,
+ parser->m_declEntity->textLen, parser->m_curBase, 0, 0, 0);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ } else
+@@ -5812,10 +5814,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+
+ if (parser->m_entityDeclHandler) {
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_entityDeclHandler(
+ parser->m_handlerArg, parser->m_declEntity->name,
+ parser->m_declEntity->is_param, parser->m_declEntity->textPtr,
+ parser->m_declEntity->textLen, parser->m_curBase, 0, 0, 0);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ }
+@@ -5893,10 +5897,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ if (dtd->keepProcessing && parser->m_declEntity
+ && parser->m_entityDeclHandler) {
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_entityDeclHandler(
+ parser->m_handlerArg, parser->m_declEntity->name,
+ parser->m_declEntity->is_param, 0, 0, parser->m_declEntity->base,
+ parser->m_declEntity->systemId, parser->m_declEntity->publicId, 0);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ break;
+@@ -5916,10 +5922,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ handleDefault = XML_FALSE;
+ } else if (parser->m_entityDeclHandler) {
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_entityDeclHandler(
+ parser->m_handlerArg, parser->m_declEntity->name, 0, 0, 0,
+ parser->m_declEntity->base, parser->m_declEntity->systemId,
+ parser->m_declEntity->publicId, parser->m_declEntity->notation);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ }
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,82 @@
+From e5035de264c3102b33891570bdff7c6313a9d2b5 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sat, 30 May 2026 00:45:50 +0200
+Subject: [PATCH] lib: Register `m_externalEntityRefHandler` with handler call
+ depth tracking
+
+(cherry picked from commit d4ba1c29165de39605b799223392dfb28bed85d5)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/d4ba1c29165de39605b799223392dfb28bed85d5]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index e9466d5..7909490 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3537,9 +3537,11 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ entity->open = XML_FALSE;
+ if (! context)
+ return XML_ERROR_NO_MEMORY;
++ beforeHandler(parser);
+ const int status = parser->m_externalEntityRefHandler(
+ parser->m_externalEntityRefHandlerArg, context, entity->base,
+ entity->systemId, entity->publicId);
++ afterHandler(parser);
+ if (! status)
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ poolDiscard(&parser->m_tempPool);
+@@ -5571,9 +5573,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ if (parser->m_useForeignDTD)
+ entity->base = parser->m_curBase;
+ dtd->paramEntityRead = XML_FALSE;
++ beforeHandler(parser);
+ const int status = parser->m_externalEntityRefHandler(
+ parser->m_externalEntityRefHandlerArg, 0, entity->base,
+ entity->systemId, entity->publicId);
++ afterHandler(parser);
+ if (! status)
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+@@ -5617,9 +5621,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ return XML_ERROR_NO_MEMORY;
+ entity->base = parser->m_curBase;
+ dtd->paramEntityRead = XML_FALSE;
++ beforeHandler(parser);
+ const int status = parser->m_externalEntityRefHandler(
+ parser->m_externalEntityRefHandlerArg, 0, entity->base,
+ entity->systemId, entity->publicId);
++ afterHandler(parser);
+ if (! status)
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+@@ -6222,9 +6228,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ dtd->paramEntityRead = XML_FALSE;
+ entity->open = XML_TRUE;
+ entityTrackingOnOpen(parser, entity, __LINE__);
++ beforeHandler(parser);
+ const int status = parser->m_externalEntityRefHandler(
+ parser->m_externalEntityRefHandlerArg, 0, entity->base,
+ entity->systemId, entity->publicId);
++ afterHandler(parser);
+ if (! status) {
+ entityTrackingOnClose(parser, entity, __LINE__);
+ entity->open = XML_FALSE;
+@@ -7019,9 +7027,11 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc,
+ dtd->paramEntityRead = XML_FALSE;
+ entity->open = XML_TRUE;
+ entityTrackingOnOpen(parser, entity, __LINE__);
++ beforeHandler(parser);
+ const int status = parser->m_externalEntityRefHandler(
+ parser->m_externalEntityRefHandlerArg, 0, entity->base,
+ entity->systemId, entity->publicId);
++ afterHandler(parser);
+ if (! status) {
+ entityTrackingOnClose(parser, entity, __LINE__);
+ entity->open = XML_FALSE;
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,46 @@
+From 24ec73df3f099032fb66638685c296c18d914f84 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:27:13 +0200
+Subject: [PATCH] lib: Register `m_notationDeclHandler` with handler call depth
+ tracking
+
+(cherry picked from commit 4739ad3fda250cf458d396d9c17a0e0fef571bdd)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/4739ad3fda250cf458d396d9c17a0e0fef571bdd]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 7909490..5a0f063 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -6040,9 +6040,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ if (! systemId)
+ return XML_ERROR_NO_MEMORY;
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_notationDeclHandler(
+ parser->m_handlerArg, parser->m_declNotationName, parser->m_curBase,
+ systemId, parser->m_declNotationPublicId);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ poolClear(&parser->m_tempPool);
+@@ -6050,9 +6052,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ case XML_ROLE_NOTATION_NO_SYSTEM_ID:
+ if (parser->m_declNotationPublicId && parser->m_notationDeclHandler) {
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_notationDeclHandler(
+ parser->m_handlerArg, parser->m_declNotationName, parser->m_curBase,
+ 0, parser->m_declNotationPublicId);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ poolClear(&parser->m_tempPool);
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,64 @@
+From 08eea37057ebc8f6dafcec601b0ff923d221e205 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:34:29 +0200
+Subject: [PATCH] lib: Register `m_notStandaloneHandler` with handler call
+ depth tracking
+
+(cherry picked from commit d7a9c975ceeaa24c730e50fef2bedff5f99d2172)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/d7a9c975ceeaa24c730e50fef2bedff5f99d2172]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 5a0f063..93110fe 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5582,8 +5582,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+ if (! dtd->standalone && parser->m_notStandaloneHandler) {
++ beforeHandler(parser);
+ const int handlerStatus
+ = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ afterHandler(parser);
+ if (! handlerStatus)
+ return XML_ERROR_NOT_STANDALONE;
+ }
+@@ -5630,8 +5632,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+ if (! dtd->standalone && parser->m_notStandaloneHandler) {
++ beforeHandler(parser);
+ const int handlerStatus
+ = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ afterHandler(parser);
+ if (! handlerStatus)
+ return XML_ERROR_NOT_STANDALONE;
+ }
+@@ -5857,7 +5861,9 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ && ! parser->m_paramEntityParsing
+ #endif /* XML_DTD */
+ && parser->m_notStandaloneHandler) {
++ beforeHandler(parser);
+ const int status = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ afterHandler(parser);
+ if (! status)
+ return XML_ERROR_NOT_STANDALONE;
+ }
+@@ -6256,7 +6262,9 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ }
+ #endif /* XML_DTD */
+ if (! dtd->standalone && parser->m_notStandaloneHandler) {
++ beforeHandler(parser);
+ const int status = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ afterHandler(parser);
+ if (! status)
+ return XML_ERROR_NOT_STANDALONE;
+ }
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,32 @@
+From d9ea54153ef454217b8a2a8255b2bd1ead460e83 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:35:08 +0200
+Subject: [PATCH] lib: Register `m_processingInstructionHandler` with handler
+ call depth tracking
+
+(cherry picked from commit 8bb00d345d5f92b17a06e01a926ee1dda797e0af)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/8bb00d345d5f92b17a06e01a926ee1dda797e0af]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 93110fe..b2672ae 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -7298,7 +7298,9 @@ reportProcessingInstruction(XML_Parser parser, const ENCODING *enc,
+ if (! data)
+ return 0;
+ normalizeLines(data);
++ beforeHandler(parser);
+ parser->m_processingInstructionHandler(parser->m_handlerArg, target, data);
++ afterHandler(parser);
+ poolClear(&parser->m_tempPool);
+ return 1;
+ }
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,87 @@
+From 1cbb5676ee24c03222923f2ce853ffe245a831ad Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:36:39 +0200
+Subject: [PATCH] lib: Register `m_skippedEntityHandler` with handler call
+ depth tracking
+
+(cherry picked from commit 64e3adf0c9d7e1846cff784de3159f1067eb5e06)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/64e3adf0c9d7e1846cff784de3159f1067eb5e06]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index b2672ae..1ee7cca 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3507,9 +3507,11 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ else if (! entity->is_internal)
+ return XML_ERROR_ENTITY_DECLARED_IN_PE;
+ } else if (! entity) {
+- if (parser->m_skippedEntityHandler)
++ if (parser->m_skippedEntityHandler) {
++ beforeHandler(parser);
+ parser->m_skippedEntityHandler(parser->m_handlerArg, name, 0);
+- else if (parser->m_defaultHandler)
++ afterHandler(parser);
++ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ break;
+ }
+@@ -3520,10 +3522,12 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ if (entity->textPtr) {
+ enum XML_Error result;
+ if (! parser->m_defaultExpandInternalEntities) {
+- if (parser->m_skippedEntityHandler)
++ if (parser->m_skippedEntityHandler) {
++ beforeHandler(parser);
+ parser->m_skippedEntityHandler(parser->m_handlerArg, entity->name,
+ 0);
+- else if (parser->m_defaultHandler)
++ afterHandler(parser);
++ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ break;
+ }
+@@ -6217,7 +6221,9 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ /* cannot report skipped entities in declarations */
+ if ((role == XML_ROLE_PARAM_ENTITY_REF)
+ && parser->m_skippedEntityHandler) {
++ beforeHandler(parser);
+ parser->m_skippedEntityHandler(parser->m_handlerArg, name, 1);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ break;
+@@ -6888,8 +6894,11 @@ appendAttributeValue(XML_Parser parser, const ENCODING *enc, XML_Bool isCdata,
+ } else if (! entity) {
+ /* Cannot report skipped entity here - see comments on
+ parser->m_skippedEntityHandler.
+- if (parser->m_skippedEntityHandler)
++ if (parser->m_skippedEntityHandler) {
++ beforeHandler(parser);
+ parser->m_skippedEntityHandler(parser->m_handlerArg, name, 0);
++ afterHandler(parser);
++ }
+ */
+ /* Cannot call the default handler because this would be
+ out of sync with the call to the startElementHandler.
+@@ -7022,8 +7031,11 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc,
+ /* not a well-formedness error - see XML 1.0: WFC Entity Declared */
+ /* cannot report skipped entity here - see comments on
+ parser->m_skippedEntityHandler
+- if (parser->m_skippedEntityHandler)
++ if (parser->m_skippedEntityHandler) {
++ beforeHandler(parser);
+ parser->m_skippedEntityHandler(parser->m_handlerArg, name, 0);
++ afterHandler(parser);
++ }
+ */
+ dtd->keepProcessing = dtd->standalone;
+ goto endEntityValue;
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,62 @@
+From 6697406736678ac3f6738f5b171c4c128b66df7d Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:37:49 +0200
+Subject: [PATCH] lib: Register `m_startCdataSectionHandler` with handler call
+ depth tracking
+
+(cherry picked from commit 222278ad452d27f8c35ba031be14d6e70aab5ab1)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/222278ad452d27f8c35ba031be14d6e70aab5ab1]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 32 +++++++++++++++++---------------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 1ee7cca..ad8cc44 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3766,22 +3766,24 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ break;
+ case XML_TOK_CDATA_SECT_OPEN: {
+ enum XML_Error result;
+- if (parser->m_startCdataSectionHandler)
++ if (parser->m_startCdataSectionHandler) {
++ beforeHandler(parser);
+ parser->m_startCdataSectionHandler(parser->m_handlerArg);
+- /* BEGIN disabled code */
+- /* Suppose you doing a transformation on a document that involves
+- changing only the character data. You set up a defaultHandler
+- and a characterDataHandler. The defaultHandler simply copies
+- characters through. The characterDataHandler does the
+- transformation and writes the characters out escaping them as
+- necessary. This case will fail to work if we leave out the
+- following two lines (because & and < inside CDATA sections will
+- be incorrectly escaped).
+-
+- However, now we have a start/endCdataSectionHandler, so it seems
+- easier to let the user deal with this.
+- */
+- else if ((0) && parser->m_characterDataHandler) {
++ afterHandler(parser);
++ /* BEGIN disabled code */
++ /* Suppose you doing a transformation on a document that involves
++ changing only the character data. You set up a defaultHandler
++ and a characterDataHandler. The defaultHandler simply copies
++ characters through. The characterDataHandler does the
++ transformation and writes the characters out escaping them as
++ necessary. This case will fail to work if we leave out the
++ following two lines (because & and < inside CDATA sections will
++ be incorrectly escaped).
++
++ However, now we have a start/endCdataSectionHandler, so it seems
++ easier to let the user deal with this.
++ */
++ } else if ((0) && parser->m_characterDataHandler) {
+ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, parser->m_dataBuf,
+ 0);
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,46 @@
+From c7cc71e323ef0afcb115dd1567bf1bdfcbc5f8d2 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:38:47 +0200
+Subject: [PATCH] lib: Register `m_startDoctypeDeclHandler` with handler call
+ depth tracking
+
+(cherry picked from commit 82f1d14a033f7c5bd6f658c3cdcd2515efe86745)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/82f1d14a033f7c5bd6f658c3cdcd2515efe86745]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index ad8cc44..0e101af 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5481,9 +5481,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ break;
+ case XML_ROLE_DOCTYPE_INTERNAL_SUBSET:
+ if (parser->m_startDoctypeDeclHandler) {
++ beforeHandler(parser);
+ parser->m_startDoctypeDeclHandler(
+ parser->m_handlerArg, parser->m_doctypeName, parser->m_doctypeSysid,
+ parser->m_doctypePubid, 1);
++ afterHandler(parser);
+ parser->m_doctypeName = NULL;
+ poolClear(&parser->m_tempPool);
+ handleDefault = XML_FALSE;
+@@ -5550,9 +5552,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ }
+
+ if (parser->m_doctypeName) {
++ beforeHandler(parser);
+ parser->m_startDoctypeDeclHandler(
+ parser->m_handlerArg, parser->m_doctypeName, parser->m_doctypeSysid,
+ parser->m_doctypePubid, 0);
++ afterHandler(parser);
+ poolClear(&parser->m_tempPool);
+ handleDefault = XML_FALSE;
+ }
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,48 @@
+From 355e3aaa79f1b0e6067a8ebbc6fcbac47e98542e Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:39:38 +0200
+Subject: [PATCH] lib: Register `m_startElementHandler` with handler call depth
+ tracking
+
+(cherry picked from commit 4f9a8f1cc2ed03cd9e23d281a6abac44dc89e8ab)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/4f9a8f1cc2ed03cd9e23d281a6abac44dc89e8ab]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 0e101af..a222a3f 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3615,10 +3615,12 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ = storeAtts(parser, enc, s, &(tag->name), &(tag->bindings), account);
+ if (result)
+ return result;
+- if (parser->m_startElementHandler)
++ if (parser->m_startElementHandler) {
++ beforeHandler(parser);
+ parser->m_startElementHandler(parser->m_handlerArg, tag->name.str,
+ (const XML_Char **)parser->m_atts);
+- else if (parser->m_defaultHandler)
++ afterHandler(parser);
++ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ poolClear(&parser->m_tempPool);
+ break;
+@@ -3644,8 +3646,10 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ }
+ poolFinish(&parser->m_tempPool);
+ if (parser->m_startElementHandler) {
++ beforeHandler(parser);
+ parser->m_startElementHandler(parser->m_handlerArg, name.str,
+ (const XML_Char **)parser->m_atts);
++ afterHandler(parser);
+ noElmHandlers = XML_FALSE;
+ }
+ if (parser->m_endElementHandler) {
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,36 @@
+From ac747d83eb8b6d7c71da606a9cb1a65aef50d0c1 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:40:13 +0200
+Subject: [PATCH] lib: Register `m_startNamespaceDeclHandler` with handler call
+ depth tracking
+
+(cherry picked from commit ddd0238420113c97594083194e517e8bc742700c)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/ddd0238420113c97594083194e517e8bc742700c]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index a222a3f..267a198 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -4704,9 +4704,12 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId,
+ b->nextTagBinding = *bindingsPtr;
+ *bindingsPtr = b;
+ /* if attId == NULL then we are not starting a namespace scope */
+- if (attId && parser->m_startNamespaceDeclHandler)
++ if (attId && parser->m_startNamespaceDeclHandler) {
++ beforeHandler(parser);
+ parser->m_startNamespaceDeclHandler(parser->m_handlerArg, prefix->name,
+ prefix->binding ? uri : 0);
++ afterHandler(parser);
++ }
+ return XML_ERROR_NONE;
+ }
+
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,33 @@
+From 36ada7e4ef06aa18765557240fb30a1a669d438a Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sat, 30 May 2026 00:46:47 +0200
+Subject: [PATCH] lib: Register `m_unknownEncodingHandler` with handler call
+ depth tracking
+
+(cherry picked from commit f66d83c9aecaa802174f95a1348a89f56e3b9441)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/f66d83c9aecaa802174f95a1348a89f56e3b9441]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 267a198..c76f8ea 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5109,8 +5109,10 @@ handleUnknownEncoding(XML_Parser parser, const XML_Char *encodingName) {
+ info.convert = NULL;
+ info.data = NULL;
+ info.release = NULL;
++ beforeHandler(parser);
+ const int status = parser->m_unknownEncodingHandler(
+ parser->m_unknownEncodingHandlerData, encodingName, &info);
++ afterHandler(parser);
+ if (status) {
+ ENCODING *enc;
+ parser->m_unknownEncodingMem = MALLOC(parser, XmlSizeOfUnknownEncoding());
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,35 @@
+From 002404e9805e4e685ca4c473a9c057a93c5b50e2 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:41:00 +0200
+Subject: [PATCH] lib: Register `m_unparsedEntityDeclHandler` with handler call
+ depth tracking
+
+(cherry picked from commit 6e7c5af75a743c609fdb35627554cc7e940e6593)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/6e7c5af75a743c609fdb35627554cc7e940e6593]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index c76f8ea..aebcda3 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5946,10 +5946,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ poolFinish(&dtd->pool);
+ if (parser->m_unparsedEntityDeclHandler) {
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_unparsedEntityDeclHandler(
+ parser->m_handlerArg, parser->m_declEntity->name,
+ parser->m_declEntity->base, parser->m_declEntity->systemId,
+ parser->m_declEntity->publicId, parser->m_declEntity->notation);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ } else if (parser->m_entityDeclHandler) {
+ *eventEndPP = s;
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,33 @@
+From 646eb417403a714ecd962f85a2d3c4b198f9b44b Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:41:38 +0200
+Subject: [PATCH] lib: Register `m_xmlDeclHandler` with handler call depth
+ tracking
+
+(cherry picked from commit 91484ffb98ec138df79265e431a55823bc80c6c4)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/91484ffb98ec138df79265e431a55823bc80c6c4]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index aebcda3..edaf5f8 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5058,8 +5058,10 @@ processXmlDecl(XML_Parser parser, int isGeneralTextEntity, const char *s,
+ if (! storedversion)
+ return XML_ERROR_NO_MEMORY;
+ }
++ beforeHandler(parser);
+ parser->m_xmlDeclHandler(parser->m_handlerArg, storedversion, storedEncName,
+ standalone);
++ afterHandler(parser);
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, parser->m_encoding, s, next);
+ if (parser->m_protocolEncodingName == NULL) {
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,30 @@
+From 640fa889d24387ba5ad4e44d89a6440b927f6f45 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 15:35:27 +0200
+Subject: [PATCH] lib: Protect `XML_GetBuffer` from being called from a handler
+
+(cherry picked from commit 5d90d1aebfe606af2550e92983cbe121d7eda032)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/5d90d1aebfe606af2550e92983cbe121d7eda032]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index edaf5f8..d729fc7 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -2599,7 +2599,7 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) {
+
+ void *XMLCALL
+ XML_GetBuffer(XML_Parser parser, int len) {
+- if (parser == NULL)
++ if ((parser == NULL) || isCalledFromInsideHandler(parser))
+ return NULL;
+ if (len < 0) {
+ parser->m_errorCode = XML_ERROR_NO_MEMORY;
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,30 @@
+From b6281b0d445029cad63a2eeb0fda9c6aaa8ad690 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 15:32:38 +0200
+Subject: [PATCH] lib: Protect `XML_Parse` from being called from a handler
+
+(cherry picked from commit b59f1865e6c0c0ab2c1623b9dfd53aa6fb85bb96)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/b59f1865e6c0c0ab2c1623b9dfd53aa6fb85bb96]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index d729fc7..f69e32c 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -2414,6 +2414,8 @@ XML_Parse(XML_Parser parser, const char *s, int len, int isFinal) {
+ parser->m_errorCode = XML_ERROR_INVALID_ARGUMENT;
+ return XML_STATUS_ERROR;
+ }
++ if (isCalledFromInsideHandler(parser))
++ return XML_STATUS_ERROR;
+ switch (parser->m_parsingStatus.parsing) {
+ case XML_SUSPENDED:
+ parser->m_errorCode = XML_ERROR_SUSPENDED;
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,31 @@
+From 3ea9955feaa8db08300c83de24ab8001aef19077 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 15:33:44 +0200
+Subject: [PATCH] lib: Protect `XML_ParseBuffer` from being called from a
+ handler
+
+(cherry picked from commit ef3267d5f8157862e33d87c45c6fe82ac26e557f)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/ef3267d5f8157862e33d87c45c6fe82ac26e557f]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index f69e32c..87c20bf 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -2525,7 +2525,7 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) {
+ const char *start;
+ enum XML_Status result = XML_STATUS_OK;
+
+- if (parser == NULL)
++ if ((parser == NULL) || isCalledFromInsideHandler(parser))
+ return XML_STATUS_ERROR;
+
+ if (len < 0) {
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,31 @@
+From 69fc1130413313ecd8728573a254bd26afebd632 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 15:21:28 +0200
+Subject: [PATCH] lib: Protect `XML_ParserFree` from being called from a
+ handler
+
+(cherry picked from commit 827fbddcaaa8ba2171ef76a3223d6f403388635c)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/827fbddcaaa8ba2171ef76a3223d6f403388635c]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 87c20bf..bfa3217 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -1958,7 +1958,7 @@ void XMLCALL
+ XML_ParserFree(XML_Parser parser) {
+ TAG *tagList;
+ OPEN_INTERNAL_ENTITY *entityList;
+- if (parser == NULL)
++ if ((parser == NULL) || isCalledFromInsideHandler(parser))
+ return;
+ /* free m_tagStack and m_freeTagList */
+ tagList = parser->m_tagStack;
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,31 @@
+From e7ea42e0111e697d2de64a94c8fd6bca9d2c99c9 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 15:22:41 +0200
+Subject: [PATCH] lib: Protect `XML_ParserReset` from being called from a
+ handler
+
+(cherry picked from commit 34bc7e080a1b432ad9d6879a6c718f2d6f12fa22)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/34bc7e080a1b432ad9d6879a6c718f2d6f12fa22]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index bfa3217..cc1d550 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -1671,7 +1671,7 @@ XML_ParserReset(XML_Parser parser, const XML_Char *encodingName) {
+ TAG *tStk;
+ OPEN_INTERNAL_ENTITY *openEntityList;
+
+- if (parser == NULL)
++ if ((parser == NULL) || isCalledFromInsideHandler(parser))
+ return XML_FALSE;
+
+ if (parser->m_parentParser)
+--
+2.34.1
+
new file mode 100644
@@ -0,0 +1,100 @@
+From 8683ba1631c0467f78f512b16a8dfd1ea9636538 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sun, 31 May 2026 13:37:01 +0200
+Subject: [PATCH] tests: Cover calls forbidden from handlers
+
+(cherry picked from commit 2e16f4c98f1f28bb9da36108b60c181d77752acb)
+
+Add an explicit cast for compatibility with Expat's C++ test build, which
+includes handlers.c from handlers_cxx.cpp.
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/2e16f4c98f1f28bb9da36108b60c181d77752acb]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ tests/handlers.c | 24 ++++++++++++++++++++++++
+ tests/handlers.h | 4 ++++
+ tests/misc_tests.c | 15 +++++++++++++++
+ 3 files changed, 43 insertions(+)
+
+diff --git a/tests/handlers.c b/tests/handlers.c
+index 8cda3a8..c7d6578 100644
+--- a/tests/handlers.c
++++ b/tests/handlers.c
+@@ -1991,3 +1991,27 @@ accumulate_and_suspend_comment_handler(void *userData, const XML_Char *data) {
+ accumulate_comment(parserPlusStorage->storage, data);
+ XML_StopParser(parserPlusStorage->parser, XML_TRUE);
+ }
++
++void XMLCALL
++forbidden_calls_character_handler(void *userData, const XML_Char *s, int len) {
++ UNUSED_P(s);
++ UNUSED_P(len);
++ XML_Parser parser = (XML_Parser)userData;
++
++ assert_true(parser != NULL); // self-test
++
++ assert_true(XML_GetBuffer(parser, 123) == NULL); // i.e. rejected
++
++ assert_true(XML_Parse(parser, "", 0, /*isFinal=*/XML_FALSE)
++ == XML_STATUS_ERROR); // i.e. rejected
++
++ assert_true(XML_ParseBuffer(parser, 0, /*isFinal=*/XML_FALSE)
++ == XML_STATUS_ERROR); // i.e. rejected
++
++ XML_ParserFree(parser); // rejected
++
++ assert_true(XML_ParserReset(parser, /*encodingName=*/NULL)
++ == XML_FALSE); // i.e. rejected
++
++ assert_true(XML_GetErrorCode(parser) == XML_ERROR_NONE);
++}
+diff --git a/tests/handlers.h b/tests/handlers.h
+index 27a53f2..de28392 100644
+--- a/tests/handlers.h
++++ b/tests/handlers.h
+@@ -612,6 +612,10 @@ typedef struct {
+ extern void XMLCALL
+ accumulate_and_suspend_comment_handler(void *userData, const XML_Char *data);
+
++extern void XMLCALL forbidden_calls_character_handler(void *userData,
++ const XML_Char *s,
++ int len);
++
+ #endif /* XML_HANDLERS_H */
+
+ #ifdef __cplusplus
+diff --git a/tests/misc_tests.c b/tests/misc_tests.c
+index 1c508bd..b9053fe 100644
+--- a/tests/misc_tests.c
++++ b/tests/misc_tests.c
+@@ -801,6 +801,20 @@ START_TEST(test_misc_no_infinite_loop_issue_1161) {
+ }
+ END_TEST
+
++START_TEST(test_misc_calls_forbidden_from_handlers) {
++ const char *const doc = "<doc>Hello world!</doc>";
++
++ XML_Parser parser = XML_ParserCreate(NULL);
++ XML_UseParserAsHandlerArg(parser);
++ XML_SetCharacterDataHandler(parser, forbidden_calls_character_handler);
++
++ assert_true(XML_Parse(parser, doc, (int)strlen(doc), /*isFinal=*/XML_TRUE)
++ == XML_STATUS_OK);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
+ void
+ make_miscellaneous_test_case(Suite *s) {
+ TCase *tc_misc = tcase_create("miscellaneous tests");
+@@ -832,4 +846,5 @@ make_miscellaneous_test_case(Suite *s) {
+ tcase_add_test(tc_misc, test_misc_sync_entity_tolerated);
+ tcase_add_test(tc_misc, test_misc_async_entity_rejected);
+ tcase_add_test(tc_misc, test_misc_no_infinite_loop_issue_1161);
++ tcase_add_test(tc_misc, test_misc_calls_forbidden_from_handlers);
+ }
+--
+2.34.1
+
@@ -36,6 +36,38 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56132_p3.patch;striplevel=2 \
file://CVE-2026-56132_p4.patch;striplevel=2 \
file://CVE-2026-56132_p5.patch;striplevel=2 \
+ file://CVE-2026-50219-01.patch \
+ file://CVE-2026-50219-02.patch \
+ file://CVE-2026-50219-03.patch \
+ file://CVE-2026-50219-04.patch \
+ file://CVE-2026-50219-05.patch \
+ file://CVE-2026-50219-06.patch \
+ file://CVE-2026-50219-07.patch \
+ file://CVE-2026-50219-08.patch \
+ file://CVE-2026-50219-09.patch \
+ file://CVE-2026-50219-10.patch \
+ file://CVE-2026-50219-11.patch \
+ file://CVE-2026-50219-12.patch \
+ file://CVE-2026-50219-13.patch \
+ file://CVE-2026-50219-14.patch \
+ file://CVE-2026-50219-15.patch \
+ file://CVE-2026-50219-16.patch \
+ file://CVE-2026-50219-17.patch \
+ file://CVE-2026-50219-18.patch \
+ file://CVE-2026-50219-19.patch \
+ file://CVE-2026-50219-20.patch \
+ file://CVE-2026-50219-21.patch \
+ file://CVE-2026-50219-22.patch \
+ file://CVE-2026-50219-23.patch \
+ file://CVE-2026-50219-24.patch \
+ file://CVE-2026-50219-25.patch \
+ file://CVE-2026-50219-26.patch \
+ file://CVE-2026-50219-27.patch \
+ file://CVE-2026-50219-28.patch \
+ file://CVE-2026-50219-29.patch \
+ file://CVE-2026-50219-30.patch \
+ file://CVE-2026-50219-31.patch \
+ file://CVE-2026-50219-32.patch \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
Expat does not track whether its public parser APIs are called from inside a user handler. Re-entering the parser through XML_GetBuffer(), XML_Parse(), XML_ParseBuffer(), XML_ParserFree() or XML_ParserReset() can therefore result in use-after-free and memory corruption. The 32 upstream commits are divided as follows: * 01 introduces the handler call depth counter and the helper functions used to enter, leave and detect handler execution. * 02-04 are preparation patches. They extract handler calls from compound expressions so that depth tracking can be placed before and after each invocation without changing handler return-value semantics. * 05-26 instrument the individual handler types. Each patch covers a distinct callback path; omitting one would leave a route around the API guards. * 27-31 add the actual policy enforcement to XML_GetBuffer(), XML_Parse(), XML_ParseBuffer(), XML_ParserFree() and XML_ParserReset(). * 32 adds regression coverage for all five rejected calls. Documentation and Changes-file commits from the upstream series are dropped because they do not affect the fix or its test coverage. An explicit XML_Parser cast is added to the regression-test handler because handlers.c is also included by handlers_cxx.cpp and compiled as C++ in the OE build. Upstream pull request: https://github.com/libexpat/libexpat/pull/1246 Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com> --- .../expat/expat/CVE-2026-50219-01.patch | 61 +++++++ .../expat/expat/CVE-2026-50219-02.patch | 84 ++++++++++ .../expat/expat/CVE-2026-50219-03.patch | 92 +++++++++++ .../expat/expat/CVE-2026-50219-04.patch | 34 ++++ .../expat/expat/CVE-2026-50219-05.patch | 48 ++++++ .../expat/expat/CVE-2026-50219-06.patch | 154 ++++++++++++++++++ .../expat/expat/CVE-2026-50219-07.patch | 32 ++++ .../expat/expat/CVE-2026-50219-08.patch | 44 +++++ .../expat/expat/CVE-2026-50219-09.patch | 44 +++++ .../expat/expat/CVE-2026-50219-10.patch | 35 ++++ .../expat/expat/CVE-2026-50219-11.patch | 32 ++++ .../expat/expat/CVE-2026-50219-12.patch | 42 +++++ .../expat/expat/CVE-2026-50219-13.patch | 49 ++++++ .../expat/expat/CVE-2026-50219-14.patch | 74 +++++++++ .../expat/expat/CVE-2026-50219-15.patch | 82 ++++++++++ .../expat/expat/CVE-2026-50219-16.patch | 46 ++++++ .../expat/expat/CVE-2026-50219-17.patch | 64 ++++++++ .../expat/expat/CVE-2026-50219-18.patch | 32 ++++ .../expat/expat/CVE-2026-50219-19.patch | 87 ++++++++++ .../expat/expat/CVE-2026-50219-20.patch | 62 +++++++ .../expat/expat/CVE-2026-50219-21.patch | 46 ++++++ .../expat/expat/CVE-2026-50219-22.patch | 48 ++++++ .../expat/expat/CVE-2026-50219-23.patch | 36 ++++ .../expat/expat/CVE-2026-50219-24.patch | 33 ++++ .../expat/expat/CVE-2026-50219-25.patch | 35 ++++ .../expat/expat/CVE-2026-50219-26.patch | 33 ++++ .../expat/expat/CVE-2026-50219-27.patch | 30 ++++ .../expat/expat/CVE-2026-50219-28.patch | 30 ++++ .../expat/expat/CVE-2026-50219-29.patch | 31 ++++ .../expat/expat/CVE-2026-50219-30.patch | 31 ++++ .../expat/expat/CVE-2026-50219-31.patch | 31 ++++ .../expat/expat/CVE-2026-50219-32.patch | 100 ++++++++++++ meta/recipes-core/expat/expat_2.7.5.bb | 32 ++++ 33 files changed, 1714 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-01.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-02.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-03.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-04.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-05.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-06.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-07.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-08.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-09.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-10.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-11.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-12.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-13.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-14.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-15.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-16.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-17.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-18.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-19.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-20.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-21.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-22.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-23.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-24.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-25.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-26.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-27.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-28.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-29.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-30.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-31.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-32.patch