From patchwork Mon Aug 24 15:20:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 96189 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8395C5DF9B for ; Mon, 24 Aug 2026 15:20:43 +0000 (UTC) Received: from GVXPR05CU001.outbound.protection.outlook.com (GVXPR05CU001.outbound.protection.outlook.com [52.101.83.30]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.92.1787584841778568195 for ; Mon, 24 Aug 2026 08:20:42 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=lVBuQ++2; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 52.101.83.30, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=UhjEZ7bZLd8ZZjrydLxTMCUf7iFLDYRl0whj1jKdE+5BuWSVDOE8EAnonOarWL+E5AYiq+eym+9o9xLX+jpECBJwDFbQfj67xBip4clqz6v/QCqUVZinFOAtLxiYvdWW4lTzzvtdMRa+tvdde6q3VQnUrJ4Fmg7QCkJD8hu4QMT+vpPwkk1Fw/9YMK/IyD9HWhWEYagrh5HRuLT2p+z76fif8/CFEyiE0c7HLfLYoWkshQa3t82Avth8To+htZ7cIPcpLNpwdoBZ1VKp4CK6NJR6jUxiiVp/cPhDJxtklGrSWy7NRTZ+ktRfDU2c+R/mdwUttI8WMh+VY6Lb97+B+A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=DZ7+oM0Sr7dXlgBaRRaR2jOqoFn4yH2aI3XAI+upIL4=; b=J7LXpZ/CAAB+/lX9zud9aq7IT1F6ZYnEvG5BSuwe9hs8c+1JDwNVJziIz49syRXRFoFv/z6PufGHwlvel4qrpHm26+CMVKMA6Xdq8/hR+//rPLh1dkytDhhbm8SlBChVKE3N5JC7zZIEdvp8n43OEFOPLowlXUBmzOZGwrguzhbp+20p0wsjRDXTh7GI0Gb9FHq94uceIdIIlr9IdDNrnsMBgLW2FBsGf35Dvt594GtfSPP8Re89z9B+FzVgQubp/hmqwShsCflE9AfhzkM43YP6pKaJO3bxo7EaVS6vcrSMZHu1NWOycHL7NBi4VIAjje6gV+YaPx535kOjc0fZ+g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DZ7+oM0Sr7dXlgBaRRaR2jOqoFn4yH2aI3XAI+upIL4=; b=lVBuQ++28J7+RwjmQWTdF8/bHdOTWP4SuC+gQxbs74QwXbhId7QNzQT0Sr5YbX92c3PA2hxQeaceaawb3e1tOvEhZiyVY+JtOz2i+UYtPVjgN/zfjZw4e9BdIU2dVhPobFMfjm22zq4qg2VkKDn3zLYHhDQ9dEKO86CtP2zGGWE0A2ylLdemRmIR1v/t49TS46Kb0+VXrgOTSnM232Auj+A1C+2ZpgPcqLpcOGjRfUsQnxiD4Jxy2CQk5g2ApM2RUcKH97LyMRbh4j4Fx2amWwBaEIDKVbMeWu4iadwatDimAnmxHAPHdtptL8IFUeXENf896t063sj9VpgOFcSKxQ== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by DUZPR07MB9935.eurprd07.prod.outlook.com (2603:10a6:10:4ae::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.6; Mon, 24 Aug 2026 15:20:37 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0360.005; Mon, 24 Aug 2026 15:20:36 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [wrynose][PATCH 2/3] expat: fix CVE-2026-56131 Thread-Topic: [wrynose][PATCH 2/3] expat: fix CVE-2026-56131 Thread-Index: AQHdM9wd/uQf9+gNwEeHqDqyjkjk2g== Date: Mon, 24 Aug 2026 15:20:36 +0000 Message-ID: <20260824152023.19501-2-jakub.szczudlo@nokia.com> References: <20260824152023.19501-1-jakub.szczudlo@nokia.com> In-Reply-To: <20260824152023.19501-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|DUZPR07MB9935:EE_ x-ms-office365-filtering-correlation-id: 9310de8b-e530-4064-bb41-08df01f33fd4 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|366016|23010399003|376014|1800799024|38070700021|56012099006|11063799006|10067099003|18002099003|22082099003; x-microsoft-antispam-message-info: UPcJZ65Z2ntKCCzByB5aFjsxX2eAPUmRs3h1IHBmV8+I/77dtknst9d2l6Gm7i5Zk3RA3wIqK47/EucbB/DwuTR+znXzSuzNw3oTFEUqEongv8LeAuxt9ssCUAsV10AAK+y6wHIbdbMS50eZtJ9cgyMTVGFOB6AGxwyLlCiqInresL6XtTkmjHqZ7Z+xnKABTRc00qtjq+0SymkZ6niV/ewCplCAKihwJqtbFhg8psLPLhxnnQqthiQdR90WFssQnUd/lqY6E+l5muDKc3UAleciRqyy6rYvPz9qu1NgbwcP+8E2D3iu3sr+Fq5+uwmFxqqSujgyxkY2ZYPPO2cev9V+edv9cmT9SsZy3fN/N617KGotC/IWEDFPBRX3wFfS7r8cW75pqv+brHggYEErbRDlPoPfz9QSEe9QNrxeY6OHeMcWC706f6VAuOEOKbDKMoXw98VGV5nZT3N/t+5vUb7y4zqdfsSQdVT+lePp7xzruWw0teSHFiMLJfFPjvq60h504slD1qXzH8/meSe/XTbvuc6tlx0x5ru6hWAHdGv2Bud3p+yb2uWsoaJuvTEa36Vn1t7JGpBvFbhm6yMhIWSnhK1oBWL2V9f+1U9buUQhaY/b6szsTdZb/u90yj69gC0LiVlZ3ZWjLIRW5kv5NJZFIvr8XO0HBXh1gdJ84Ys= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(376014)(1800799024)(38070700021)(56012099006)(11063799006)(10067099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?q?337RHDHj1i7nDbXP02CMwYW?= =?iso-8859-1?q?+/Y6Lg3FYsd4LQFM6hJ1ZJIFvg405jZQDC5tVUIDsW7WqAz+rsU8LF6HYhyz?= =?iso-8859-1?q?oawhoPUziOkxdjyTaE2QoGjkxyC3oyJRC3sijm8t8frNiCyHMchZz8KLsdhe?= =?iso-8859-1?q?2yTNtPQJWlMlgVSJD8xPaYoiLLfq48wJC3qTA3nKkoX7CKUWpYIkz3hj29cn?= =?iso-8859-1?q?fXl24ExxDCGhsljqWQoMjwi20/xArWhVAy/of66tM6N0e/0ja8cv2/eaOOHj?= =?iso-8859-1?q?ERLiZPYAvmUXAwrvPBfhCcP+B+/tjGvmuH34F/Lkf2vLDfUX4IuLBLTTuxtw?= =?iso-8859-1?q?cTz5KUBsYKbEyCMc05/fdoDg6CfWO/IwShclrtZ0YR8Kiivl+f7FV7OGs/Pc?= =?iso-8859-1?q?fPOkH5IBDKAhsnZ0UgC8ySzvjCW/F4sDwIznVpuNaOzr0Wr9pS7PkNdxTorZ?= =?iso-8859-1?q?YFC5qmAEk3py9qyDvrL+dGlSPpW2KBGydkBlVHgms6VI3xMT3yOCMkEKvToL?= =?iso-8859-1?q?ldJ7tDV+JScySoSp4KtRo/+hVTja25V+juaNsElYFAHdd4k9bPurofVKlom7?= =?iso-8859-1?q?B0uv+/zE15LXywCm2qYYB73J+rpBwvUmy1sJtegjMxeS/SeuZYhC1MbqE6DW?= =?iso-8859-1?q?NLDpozLYG1Rj/SALyDXd5dS9iAx5+HmhOzAFTsxNc0ZL05d2/fKn/HwExvrl?= =?iso-8859-1?q?KrnXxl8rm8h7U8AjdcNnrYFIkoLfcFKtbjBERutDeqrGUuTz/1ZGTTcO+cCX?= =?iso-8859-1?q?BIq+5yj8sXcChOURDyKseY6DYSJA6qXkuATlx/GVWcKXqEbN+eC6y0MnlBJI?= =?iso-8859-1?q?+LFQbFswEy0c4WqxK+zKRBIJLul6jl/Xuts3qyHSf9JOjX7Jljupd+0bUpK7?= =?iso-8859-1?q?N+QZxQhhMJ79Ytnyb/GPKxPTNYzXxlYS0eswrprA09T2RCc1vf/sz6uNOYvf?= =?iso-8859-1?q?/pO/cLri0BafXQ6LbznwEke7abaJwnA8mLYxMVmn1wygL2/3/qBDdg3m3Pgl?= =?iso-8859-1?q?cvWDJGxHRv67zR5LWbYIIIzoraQNkvtEERRbjpDVjMmUK+++/Nk7c4cS84Hz?= =?iso-8859-1?q?jarjBmE2ABeMXJCXrLIcX3vi2spf6KXlmgdKR4LK31tsDPLofUH3uvpRiaxg?= =?iso-8859-1?q?svD+7KxWgplNX9dPv61QQiUZjx9qVOP6uH1CqSLTpyL6D4tRIFxKUITVEdB6?= =?iso-8859-1?q?i5lO/rJpdvfau3jfUbk+/smJPU8nLlby7i0xEQvponSqDQKY/GxTJuu9U/P1?= =?iso-8859-1?q?Wllhv4kO0iIwpIbWDNtEEWgUeDtYWLaB4oVDyb8jXgoNYyQZMhPwoawXPV9/?= =?iso-8859-1?q?jGgxw00b/p94gyiHts0E1g0hlRHH8zUqF/1arEnWil/8eZSbRQPNBSTr29q/?= =?iso-8859-1?q?xEsZley45CfOoEz7VCOcAsLVGPQHCqtTqA6x+VmQXUvG/GvzEA89ar9eyLwR?= =?iso-8859-1?q?ckbnlIuMxMvUPG2nhN9gLl6Pl2+qd0cJOOj4qfTQDCkkr19tq1I5C+IAf3L4?= =?iso-8859-1?q?7f7Q11DjYnVSzhGm300X5iip4zAfqlBE79+DgXGDtF7mUnxyVhi0bFERKZMY?= =?iso-8859-1?q?JsTINEg1lCjEgJqtoPGVxOIWg0/xCnn9/v5ZNY0yt9Fmqj2mlknMWeL8Hxni?= =?iso-8859-1?q?D28iyFmC5IgxJwmhjkcAZAL8UOjeUkKIL4AFHqoj4z3b5w8SErSUuM8Rb/xQ?= =?iso-8859-1?q?acMeO6dOWKy5X9srx1AtM44A6w12tLfs/tXorAi2/CT/orEK9wFaBdB09LlL?= =?iso-8859-1?q?RS5b56JOkPsnK/pdd7LKwtv9z?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9310de8b-e530-4064-bb41-08df01f33fd4 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Aug 2026 15:20:36.9460 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: UBAVSBuX2AhdcnB94rA3fycmuLk+tR3O0OlShZqwuTeCbaCv83grI4JxB0aq/e/uN2pDTKSlPOBvZSfbeZMzJkbT04sCLkbIMuOkt/wKbiI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DUZPR07MB9935 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 24 Aug 2026 15:20:43 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244131 Backport patch to fix CVE-2026-56131. References: https://nvd.nist.gov/vuln/detail/CVE-2026-56131 Upstream fix: https://github.com/libexpat/libexpat/commit/d5a654b4881f450827af5b3b7b72370a3bbf9a8f Signed-off-by: Jakub Szczudlo --- .../expat/expat/CVE-2026-56131.patch | 124 ++++++++++++++++++ meta/recipes-core/expat/expat_2.7.5.bb | 1 + 2 files changed, 125 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56131.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-56131.patch b/meta/recipes-core/expat/expat/CVE-2026-56131.patch new file mode 100644 index 0000000000..8691f98f89 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56131.patch @@ -0,0 +1,124 @@ +From 29dfca6ad4d2a9dfd5ce72efd72e1b67d598ab4c Mon Sep 17 00:00:00 2001 +From: netliomax25-code +Date: Sat, 6 Jun 2026 20:03:53 +0530 +Subject: [PATCH] lib: protect XML_ResumeParser from being called from a + handler + +The handler-reentrancy guards from CVE-2026-50219 cover XML_Parse, XML_ParseBuffer, XML_GetBuffer, XML_ParserFree and XML_ParserReset but not XML_ResumeParser, which drives the parser through callProcessor in the same way. + +(cherry picked from commit d5a654b4881f450827af5b3b7b72370a3bbf9a8f) + +CVE: CVE-2026-56131 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1267/commits/d5a654b4881f450827af5b3b7b72370a3bbf9a8f] +Signed-off-by: Jakub Szczudlo +--- + lib/xmlparse.c | 2 +- + tests/handlers.c | 24 ++++++++++++++++++++++++ + tests/handlers.h | 9 +++++++++ + tests/misc_tests.c | 20 ++++++++++++++++++++ + 4 files changed, 54 insertions(+), 1 deletion(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index cc1d550..a5fa256 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -2778,7 +2778,7 @@ enum XML_Status XMLCALL + XML_ResumeParser(XML_Parser parser) { + enum XML_Status result = XML_STATUS_OK; + +- if (parser == NULL) ++ if ((parser == NULL) || isCalledFromInsideHandler(parser)) + return XML_STATUS_ERROR; + if (parser->m_parsingStatus.parsing != XML_SUSPENDED) { + parser->m_errorCode = XML_ERROR_NOT_SUSPENDED; +diff --git a/tests/handlers.c b/tests/handlers.c +index c7d6578..5a85f6d 100644 +--- a/tests/handlers.c ++++ b/tests/handlers.c +@@ -2015,3 +2015,27 @@ forbidden_calls_character_handler(void *userData, const XML_Char *s, int len) { + + assert_true(XML_GetErrorCode(parser) == XML_ERROR_NONE); + } ++ ++void XMLCALL ++suspend_then_resume_character_handler(void *userData, const XML_Char *s, ++ int len) { ++ UNUSED_P(s); ++ UNUSED_P(len); ++ ResumeFromHandlerData *const data = (ResumeFromHandlerData *)userData; ++ ++ data->callCount++; ++ if (data->callCount > 1) { ++ // Reached only if the guard under test is missing: XML_ResumeParser would ++ // then have driven the parser re-entrantly and called us again. Bail out ++ // so the test fails by assertion below rather than recursing without bound. ++ return; ++ } ++ ++ // Put the parser into XML_SUSPENDED so that, without the guard, ++ // XML_ResumeParser would proceed into a re-entrant parse. ++ assert_true(XML_StopParser(data->parser, /*resumable=*/XML_TRUE) ++ == XML_STATUS_OK); ++ ++ // Resuming the parser from inside a handler must be rejected. ++ assert_true(XML_ResumeParser(data->parser) == XML_STATUS_ERROR); ++} +diff --git a/tests/handlers.h b/tests/handlers.h +index de28392..507ad8b 100644 +--- a/tests/handlers.h ++++ b/tests/handlers.h +@@ -616,6 +616,15 @@ extern void XMLCALL forbidden_calls_character_handler(void *userData, + const XML_Char *s, + int len); + ++typedef struct { ++ XML_Parser parser; ++ int callCount; ++} ResumeFromHandlerData; ++ ++extern void XMLCALL suspend_then_resume_character_handler(void *userData, ++ const XML_Char *s, ++ int len); ++ + #endif /* XML_HANDLERS_H */ + + #ifdef __cplusplus +diff --git a/tests/misc_tests.c b/tests/misc_tests.c +index b9053fe..265e7cb 100644 +--- a/tests/misc_tests.c ++++ b/tests/misc_tests.c +@@ -815,6 +815,25 @@ START_TEST(test_misc_calls_forbidden_from_handlers) { + } + END_TEST + ++START_TEST(test_misc_resume_parser_forbidden_from_handler) { ++ const char *const doc = "Hello world!"; ++ ++ XML_Parser parser = XML_ParserCreate(NULL); ++ ResumeFromHandlerData data = {parser, 0}; ++ XML_SetUserData(parser, &data); ++ XML_SetCharacterDataHandler(parser, suspend_then_resume_character_handler); ++ ++ // The handler suspends the parser, so the top-level parse reports suspension ++ // rather than completion. The handler also asserts that resuming from inside ++ // itself is rejected. ++ assert_true(XML_Parse(parser, doc, (int)strlen(doc), /*isFinal=*/XML_TRUE) ++ == XML_STATUS_SUSPENDED); ++ assert_true(data.callCount == 1); ++ ++ XML_ParserFree(parser); ++} ++END_TEST ++ + void + make_miscellaneous_test_case(Suite *s) { + TCase *tc_misc = tcase_create("miscellaneous tests"); +@@ -847,4 +866,5 @@ make_miscellaneous_test_case(Suite *s) { + tcase_add_test(tc_misc, test_misc_async_entity_rejected); + tcase_add_test(tc_misc, test_misc_no_infinite_loop_issue_1161); + tcase_add_test(tc_misc, test_misc_calls_forbidden_from_handlers); ++ tcase_add_test(tc_misc, test_misc_resume_parser_forbidden_from_handler); + } +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb index 7f00c6f90b..78e35243c5 100644 --- a/meta/recipes-core/expat/expat_2.7.5.bb +++ b/meta/recipes-core/expat/expat_2.7.5.bb @@ -68,6 +68,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-50219-30.patch \ file://CVE-2026-50219-31.patch \ file://CVE-2026-50219-32.patch \ + file://CVE-2026-56131.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"