[scarthgap] expat: fix CVE-2026-118370

diff --git a/meta/recipes-core/expat/expat/CVE-2026-118370-01.patch b/meta/recipes-core/expat/expat/CVE-2026-118370-01.patch
new file mode 100644
index 0000000000..aa4fe2df28
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-118370-01.patch
@@ -0,0 +1,58 @@ 
+From a135244f77776c56d825cd81efd8f98abe014841 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 27 Oct 2026 15:20:33 +0100
+Subject: [PATCH] lib: Protect `attIndex` in `storeAtts` from signed integer
+ overflow
+
+.. by migrating to `size_t`
+
+CVE: CVE-2026-118370
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1450]
+
+Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
+---
+ lib/xmlparse.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index cb8839be..dadf647a 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3858,7 +3858,7 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
+           TAG_NAME *tagNamePtr, BINDING **bindingsPtr,
+           enum XML_Account account) {
+   DTD *const dtd = parser->m_dtd; /* save one level of indirection */
+-  int attIndex = 0;
++  size_t attIndex = 0;
+   XML_Char *uri;
+   int nPrefixes = 0;
+   BINDING *binding;
+@@ -4037,11 +4037,16 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
+   }
+ 
+   /* set-up for XML_GetSpecifiedAttributeCount and XML_GetIdAttributeIndex */
+-  parser->m_nSpecifiedAtts = attIndex;
++  // Detect and reject integer overflow
++  if (attIndex > INT_MAX)
++    return XML_ERROR_NO_MEMORY;
++  parser->m_nSpecifiedAtts = (int)attIndex;
+   if (elementType->idAtt && (elementType->idAtt->name)[-1]) {
+-    for (int i = 0; i < attIndex; i += 2)
++    for (size_t i = 0; i < attIndex; i += 2)
+       if (appAtts[i] == elementType->idAtt->name) {
+-        parser->m_idAttIndex = i;
++        if (i > INT_MAX)
++          return XML_ERROR_NO_MEMORY;
++        parser->m_idAttIndex = (int)i;
+         break;
+       }
+   } else
+@@ -4074,7 +4079,7 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
+ 
+   /* expand prefixed attribute names, check for duplicates,
+      and clear flags that say whether attributes were specified */
+-  int i = 0;
++  size_t i = 0;
+   if (nPrefixes) {
+     unsigned int j; /* hash table index */
+     unsigned long version = parser->m_nsAttsVersion;
diff --git a/meta/recipes-core/expat/expat/CVE-2026-118370-02.patch b/meta/recipes-core/expat/expat/CVE-2026-118370-02.patch
new file mode 100644
index 0000000000..1d8d1d4907
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-118370-02.patch
@@ -0,0 +1,29 @@ 
+From d39404514bc51901b1e673b88bf5ec5bc6bf657a Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 27 Oct 2026 17:57:19 +0100
+Subject: [PATCH] lib: Protect `nPrefixes` in `storeAtts` from signed integer
+ overflow
+
+.. by migrating to `size_t`
+
+CVE: CVE-2026-118370
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1450]
+
+Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
+---
+ lib/xmlparse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index dadf647a..e248043e 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3860,7 +3860,7 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
+   DTD *const dtd = parser->m_dtd; /* save one level of indirection */
+   size_t attIndex = 0;
+   XML_Char *uri;
+-  int nPrefixes = 0;
++  size_t nPrefixes = 0;
+   BINDING *binding;
+   const XML_Char *localPart;
+ 
diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb
index 6d08a3fd94..ff46beae8c 100644
--- a/meta/recipes-core/expat/expat_2.8.3.bb
+++ b/meta/recipes-core/expat/expat_2.8.3.bb
@@ -18,6 +18,8 @@  SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2  \
            file://CVE-2026-76957-02.patch \
            file://CVE-2026-93990-01.patch \
            file://CVE-2026-93990-02.patch \
+           file://CVE-2026-118370-01.patch \
+           file://CVE-2026-118370-02.patch \
            "
 
 GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"