From patchwork Thu Nov 5 09:17:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103102 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.30511.1793870243232825457 for ; Thu, 05 Nov 2026 01:17:23 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=knvzD9AY; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=17936; q=dns/txt; s=iport01; t=1793870243; x=1795079843; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=GhWhMuNdX1zT40n3GIajBg0NGOT0VajN0urWFwJVtko=; b=knvzD9AYAIq4/MDA14NQ/DcljOsDYFjvY+2Z/l4q1ahapziml0EzcvD7 THrvD+WyaCmJPuLhd4rYONielZI7DYSgKHL6W+wHScodBSFxsS6iDpgKl NT8ZBrGFIX9Vtlm+8zekAvquBDA2gPmS1cm1vTXO2l8fjwAIBp7CUlHNM BlNWmVBp6/XhgiZZDs2dyzpOkYJTNfwn6NqAQey9R8yaRTbbCc0rmwDq+ 5uMVZChXQK7X2pjp+l7fzC2VlbUmzyUmg9/t+4B6y2xkJuDauSdgznEvn 8rOfs9bo3c6fdoR2hFqynFsjKTKVkIkoddEtLzWJEGdHLJBUbUcRP1RBX A==; X-CSE-ConnectionGUID: ErXQDTLoRueVy89ozA7t5g== X-CSE-MsgGUID: SFbZIhP5RXGYyAM0D7Tpeg== X-IPAS-Result: A0BGAgCwSOxq/43/Ja1aHgEBCxIMggULgld1YENJlV9sniQUgWoPAQEBD0QNBAEBhD9Gjh8CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEqCwEYAS0sAwECWiMhgwIBgnQDEbt2GzeBeTOBAYIigQcBPwJDUNszAQsUAYE4hUCII10YAYR9JxsbgXKBFYNpgQWBXAEBgScRD4ZfBIINFYEMgVoegwmJcQKBUoZxSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQxyORAwHiQvBRwmQBsKGBgNSBEsNxUZBD5uB5IvgxABAWIhCgETGAmBThUYkzQrCJAWgiGhEQoog3iMJJU6GjOqcQuYfY4KlWEjTYRpgWg8gSgfCwdwFYJuATMJShkPjisDAQoLg2CBf8xOJjICCTIBAQcCBw4DC4FokAABJ4FWAQE IronPort-Data: A9a23:Mz2SA678tXWxpBkePuFHJQxRtGnGchMFZxGqfqrLsTDasY5as4F+v mFODWmEa/2NM2ujKtsgPNjkoEJU6pCGnN83QFY++Sg8Zn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqaztMtvrawP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eEJcow8pLJWZ06 PEmOWBcaQKq2P7rz+fuIgVsrpxLwMjDJogTvDRkiDreF/tjGcyFSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkEWUrsUIMpWcOOAinrydzRZuVu9rqss6G+Vxwt0uFToGIeJIY3aH5sLwy50o Er90W7LIxEiaeav5guU21f0qrDzhS70Ddd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBYCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u78Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:XHCNca4BXMMpRGRhjwPXwP7XdLJyesId70hD6qm+c3Nom6uj5q WTdZsgtCMc5Ax9ZJhCo6HjBED/exPhHPdOiOF7V4tKNzOJhILHFu1fBPPZsl7dMhy70PJB3q F9dKU7ItjxAV9myfve2mCDYrIdKB3tytHPuQ8YpE0dKj1XVw== X-Talos-CUID: 9a23:Z8HMH21D46+gkxtB84bol7xfN9oVS1Hh6HDqPkKGGDY4T6+8FkPN9/Yx X-Talos-MUID: 9a23:omv96AuBI4eU4AL9FM2nvx9oBuZo2/mUOG88gLwj4+XbCTR9NGLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="543982665" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:17:22 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id 24782180005D7; Thu, 5 Nov 2026 09:17:22 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id C195DCC1611; Thu, 5 Nov 2026 01:17:21 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 1/3] expat: fix CVE-2026-113351 Date: Thu, 5 Nov 2026 01:17:17 -0800 Message-Id: <20261105091719.1622520-1-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:17:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249521 From: Darsh Kelaiya Backport the allocation-tracking reset fix [1] from upstream PR [2], which is referenced by the NVD record [3]. Snapshot retained allocations during XML_ParserReset() and exclude those bytes from the next document's allocation-amplification checks. Include the required counter extraction, accounting-settings correction and both upstream regression tests from the same PR. Retain Expat 2.8.3's XmlBigCount counters and adapt the accounting regression to its existing protection-setting APIs. Omit the PR's comment-only encoding-check change because the later check that it explains is absent from this source. [1] https://github.com/libexpat/libexpat/commit/a6cf8a6944b6c6d81e74c4cd95faa29132e67aa3 [2] https://github.com/libexpat/libexpat/pull/1431 [3] https://nvd.nist.gov/vuln/detail/CVE-2026-113351 Signed-off-by: Darsh Kelaiya --- .../expat/expat/CVE-2026-113351_p1.patch | 39 ++++++++ .../expat/expat/CVE-2026-113351_p2.patch | 65 +++++++++++++ .../expat/expat/CVE-2026-113351_p3.patch | 80 ++++++++++++++++ .../expat/expat/CVE-2026-113351_p4.patch | 95 +++++++++++++++++++ .../expat/expat/CVE-2026-113351_p5.patch | 70 ++++++++++++++ meta/recipes-core/expat/expat_2.8.3.bb | 7 +- 6 files changed, 355 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-113351_p1.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-113351_p2.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-113351_p3.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-113351_p4.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-113351_p5.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-113351_p1.patch b/meta/recipes-core/expat/expat/CVE-2026-113351_p1.patch new file mode 100644 index 0000000000..cbb52a5412 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-113351_p1.patch @@ -0,0 +1,39 @@ +From 45bb6e5bf4c288f3ea3dd4c1d2b4f93702d4aac3 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Sat, 17 Oct 2026 20:43:01 +0200 +Subject: [PATCH] lib: Extract variable `bytesAllocated` + +CVE: CVE-2026-113351 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/16b6b2d583f8de3fe204f5ce3c2a6b9f1e2b4cd7] + +Backport Changes: +- Drop the upstream expat/ prefix to match the release tarball. +- Retain XmlBigCount and its maximum-value overflow check instead of + the newer size_t and SIZE_MAX allocation-counter representation. + +(cherry picked from commit 16b6b2d583f8de3fe204f5ce3c2a6b9f1e2b4cd7) +Signed-off-by: Darsh Kelaiya +--- + lib/xmlparse.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index cb8839be..74e832e2 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -871,11 +871,13 @@ expat_heap_increase_tolerable(XML_Parser rootParser, XmlBigCount increase, + XmlBigCount newTotal = 0; + bool tolerable = true; + ++ const XmlBigCount bytesAllocated = rootParser->m_alloc_tracker.bytesAllocated; ++ + // Detect integer overflow +- if ((XmlBigCount)-1 - rootParser->m_alloc_tracker.bytesAllocated < increase) { ++ if ((XmlBigCount)-1 - bytesAllocated < increase) { + tolerable = false; + } else { +- newTotal = rootParser->m_alloc_tracker.bytesAllocated + increase; ++ newTotal = bytesAllocated + increase; + + if (newTotal >= rootParser->m_alloc_tracker.activationThresholdBytes) { + assert(newTotal > 0); diff --git a/meta/recipes-core/expat/expat/CVE-2026-113351_p2.patch b/meta/recipes-core/expat/expat/CVE-2026-113351_p2.patch new file mode 100644 index 0000000000..c5153a4825 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-113351_p2.patch @@ -0,0 +1,65 @@ +From 8cd33639f458d1bad41be4c455f2878653cb1014 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Sat, 17 Oct 2026 20:51:49 +0200 +Subject: [PATCH] lib: Offset allocation tracking at `XML_ParserReset` time + +.. to enforce the same rules to later parses as to the first + +CVE: CVE-2026-113351 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/a6cf8a6944b6c6d81e74c4cd95faa29132e67aa3] + +Backport Changes: +- Drop the upstream expat/ prefix to match the release tarball. +- Retain XmlBigCount for the new reset snapshot and local byte count. +- Place the snapshot before the existing success return. Expat 2.8.3 + lacks the later encoding-name allocation-failure check, so omit the + comment-only prerequisite ba431e267e751bfd0ed8bb608d21b0b1b52bd604. + +(cherry picked from commit a6cf8a6944b6c6d81e74c4cd95faa29132e67aa3) +Signed-off-by: Darsh Kelaiya +--- + lib/xmlparse.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 74e832e2..638f35c0 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -479,6 +479,7 @@ typedef struct accounting { + typedef struct MALLOC_TRACKER { + XmlBigCount bytesAllocated; + XmlBigCount peakBytesAllocated; // updated live only for debug level >=2 ++ XmlBigCount bytesAllocatedWhenLastReset; + unsigned long debugLevel; + float maximumAmplificationFactor; // >=1.0 + XmlBigCount activationThresholdBytes; +@@ -871,7 +872,16 @@ expat_heap_increase_tolerable(XML_Parser rootParser, XmlBigCount increase, + XmlBigCount newTotal = 0; + bool tolerable = true; + +- const XmlBigCount bytesAllocated = rootParser->m_alloc_tracker.bytesAllocated; ++ // The idea is to subtract the amount of memory that was already ++ // allocated the last time that `XML_ParserReset` was called for ++ // this parser, the memory use of one document could skew the ++ // memory statso of the next document. ++ const XmlBigCount bytesAllocated ++ = (rootParser->m_alloc_tracker.bytesAllocatedWhenLastReset ++ > rootParser->m_alloc_tracker.bytesAllocated) ++ ? 0 ++ : (rootParser->m_alloc_tracker.bytesAllocated ++ - rootParser->m_alloc_tracker.bytesAllocatedWhenLastReset); + + // Detect integer overflow + if ((XmlBigCount)-1 - bytesAllocated < increase) { +@@ -1651,6 +1661,11 @@ XML_ParserReset(XML_Parser parser, const XML_Char *encodingName) { + parser->m_protocolEncodingName = NULL; + parserInit(parser, encodingName); + dtdReset(parser->m_dtd, parser); ++#if XML_GE == 1 ++ parser->m_alloc_tracker.bytesAllocatedWhenLastReset ++ = parser->m_alloc_tracker.bytesAllocated; ++#endif ++ + return XML_TRUE; + } + diff --git a/meta/recipes-core/expat/expat/CVE-2026-113351_p3.patch b/meta/recipes-core/expat/expat/CVE-2026-113351_p3.patch new file mode 100644 index 0000000000..7fd8c06b87 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-113351_p3.patch @@ -0,0 +1,80 @@ +From 29dd825cec80e0e68c5dd7c2e692505e02ba1563 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Mon, 19 Oct 2026 17:55:36 +0200 +Subject: [PATCH] tests/alloc_tests.c: Cover `XML_ParserReset` alloc tracker + neutrality + +CVE: CVE-2026-113351 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/c400537c2df393161946d60bedbdc2c3a7e971ef] + +Backport Changes: +- Drop the upstream expat/ prefix to match the release tarball. +- Insert the test beside the existing allocation-tracker API tests; + the newer property-API round-trip test is absent from Expat 2.8.3. + +(cherry picked from commit c400537c2df393161946d60bedbdc2c3a7e971ef) +Signed-off-by: Darsh Kelaiya +--- + tests/alloc_tests.c | 42 ++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 42 insertions(+) + +diff --git a/tests/alloc_tests.c b/tests/alloc_tests.c +index c7939708..76aebdbe 100644 +--- a/tests/alloc_tests.c ++++ b/tests/alloc_tests.c +@@ -2273,6 +2273,47 @@ START_TEST(test_alloc_tracker_api) { + } + END_TEST + ++START_TEST(test_alloc_tracker_reset_neutrality) { ++ // Speed up the test, chunk size expected to not matter in this test ++ if (g_chunkSize != 0) ++ return; ++ ++ XML_Parser parser = XML_ParserCreate(NULL); ++ ++ const char *const small = ""; ++ ++ // Create a document that drives `parser->m_alloc_tracker.bytesAllocated` ++ // towards the activation threshold ++#if XML_GE == 1 ++ const size_t bigSizeBytes ++ = (size_t)(1.1f * EXPAT_ALLOC_TRACKER_ACTIVATION_THRESHOLD_DEFAULT); ++ const char *const before = ""; ++ char *const big = malloc(bigSizeBytes); ++ assert_true(big != NULL); ++ memset(big, 'X', bigSizeBytes); ++ memcpy(big, before, strlen(before)); // without zero terminator ++ strcpy(big + (bigSizeBytes - strlen(after) - 1), ++ after); // with zero terminator ++ assert_true(strlen(big) == bigSizeBytes - 1); // self-test ++ ++ assert_true( ++ _XML_Parse_SINGLE_BYTES(parser, big, strlen(big), /*isFinal=*/XML_TRUE) ++ == XML_STATUS_OK); ++ ++ free(big); ++#endif // XML_GE == 1 ++ ++ XML_ParserReset(parser, NULL); ++ ++ assert_true(_XML_Parse_SINGLE_BYTES(parser, small, strlen(small), ++ /*isFinal=*/XML_TRUE) ++ == XML_STATUS_OK); ++ ++ XML_ParserFree(parser); ++} ++END_TEST ++ + START_TEST(test_mem_api_cycle) { + XML_Parser parser = XML_ParserCreate(NULL); + +@@ -2386,6 +2427,7 @@ make_alloc_test_case(Suite *s) { + tcase_add_test__if_xml_ge(tc_alloc, test_alloc_tracker_threshold); + tcase_add_test__if_xml_ge(tc_alloc, test_alloc_tracker_getbuffer_unlimited); + tcase_add_test__if_xml_ge(tc_alloc, test_alloc_tracker_api); ++ tcase_add_test__if_xml_ge(tc_alloc, test_alloc_tracker_reset_neutrality); + + tcase_add_test(tc_alloc, test_mem_api_cycle); + tcase_add_test__if_xml_ge(tc_alloc, test_mem_api_unlimited); diff --git a/meta/recipes-core/expat/expat/CVE-2026-113351_p4.patch b/meta/recipes-core/expat/expat/CVE-2026-113351_p4.patch new file mode 100644 index 0000000000..1ce4e4ee26 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-113351_p4.patch @@ -0,0 +1,95 @@ +From 6c2084fc5609cb64822e0dc7085cc796846f7eee Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Mon, 19 Oct 2026 19:17:06 +0200 +Subject: [PATCH] lib: Stop `XML_ParserReset` from resetting accounting + settings + +.. and debugging levels + +CVE: CVE-2026-113351 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/8b722a1453b8179dbda9876df2af4ce62e34b00c] + +Backport Changes: +- Drop the upstream expat/ prefix to match the release tarball. + +(cherry picked from commit 8b722a1453b8179dbda9876df2af4ce62e34b00c) +Signed-off-by: Darsh Kelaiya +--- + lib/xmlparse.c | 36 +++++++++++++++++++++++------------- + 1 file changed, 23 insertions(+), 13 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 638f35c0..ee89502d 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -638,7 +638,8 @@ static XML_Parser parserCreate(const XML_Char *encodingName, + const XML_Char *nameSep, DTD *dtd, + XML_Parser parentParser); + +-static void parserInit(XML_Parser parser, const XML_Char *encodingName); ++static void parserInit(XML_Parser parser, const XML_Char *encodingName, ++ bool isReset); + + #if XML_GE == 1 + static float accountingGetCurrentAmplification(XML_Parser rootParser); +@@ -1482,7 +1483,7 @@ parserCreate(const XML_Char *encodingName, + + poolInit(&parser->m_tempPool, parser); + poolInit(&parser->m_temp2Pool, parser); +- parserInit(parser, encodingName); ++ parserInit(parser, encodingName, /*isReset=*/false); + + if (encodingName && ! parser->m_protocolEncodingName) { + if (dtd) { +@@ -1509,7 +1510,7 @@ parserCreate(const XML_Char *encodingName, + } + + static void +-parserInit(XML_Parser parser, const XML_Char *encodingName) { ++parserInit(XML_Parser parser, const XML_Char *encodingName, bool isReset) { + parser->m_processor = prologInitProcessor; + XmlPrologStateInit(&parser->m_prologState); + if (encodingName != NULL) { +@@ -1590,15 +1591,24 @@ parserInit(XML_Parser parser, const XML_Char *encodingName) { + parser->m_hash_secret_salt_set = XML_FALSE; + + #if XML_GE == 1 +- memset(&parser->m_accounting, 0, sizeof(ACCOUNTING)); +- parser->m_accounting.debugLevel = getDebugLevel("EXPAT_ACCOUNTING_DEBUG", 0u); +- parser->m_accounting.maximumAmplificationFactor +- = EXPAT_BILLION_LAUGHS_ATTACK_PROTECTION_MAXIMUM_AMPLIFICATION_DEFAULT; +- parser->m_accounting.activationThresholdBytes +- = EXPAT_BILLION_LAUGHS_ATTACK_PROTECTION_ACTIVATION_THRESHOLD_DEFAULT; +- +- memset(&parser->m_entity_stats, 0, sizeof(ENTITY_STATS)); +- parser->m_entity_stats.debugLevel = getDebugLevel("EXPAT_ENTITY_DEBUG", 0u); ++ parser->m_accounting.countBytesDirect = 0; ++ parser->m_accounting.countBytesIndirect = 0; ++ if (! isReset) { ++ parser->m_accounting.debugLevel ++ = getDebugLevel("EXPAT_ACCOUNTING_DEBUG", 0u); ++ parser->m_accounting.maximumAmplificationFactor ++ = EXPAT_BILLION_LAUGHS_ATTACK_PROTECTION_MAXIMUM_AMPLIFICATION_DEFAULT; ++ parser->m_accounting.activationThresholdBytes ++ = EXPAT_BILLION_LAUGHS_ATTACK_PROTECTION_ACTIVATION_THRESHOLD_DEFAULT; ++ } ++ ++ parser->m_entity_stats.countEverOpened = 0; ++ parser->m_entity_stats.currentDepth = 0; ++ parser->m_entity_stats.maximumDepthSeen = 0; ++ if (! isReset) ++ parser->m_entity_stats.debugLevel = getDebugLevel("EXPAT_ENTITY_DEBUG", 0u); ++#else ++ UNUSED_P(isReset); + #endif + } + +@@ -1659,7 +1669,7 @@ XML_ParserReset(XML_Parser parser, const XML_Char *encodingName) { + poolClear(&parser->m_temp2Pool); + FREE(parser, (void *)parser->m_protocolEncodingName); + parser->m_protocolEncodingName = NULL; +- parserInit(parser, encodingName); ++ parserInit(parser, encodingName, /*isReset=*/true); + dtdReset(parser->m_dtd, parser); + #if XML_GE == 1 + parser->m_alloc_tracker.bytesAllocatedWhenLastReset diff --git a/meta/recipes-core/expat/expat/CVE-2026-113351_p5.patch b/meta/recipes-core/expat/expat/CVE-2026-113351_p5.patch new file mode 100644 index 0000000000..03a325422b --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-113351_p5.patch @@ -0,0 +1,70 @@ +From 488381c6972b5cec8764f0d08834b536b07b923d Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Mon, 19 Oct 2026 18:35:15 +0200 +Subject: [PATCH] tests/acc_tests.c: Cover `XML_ParserReset` accounting + neutrality + +CVE: CVE-2026-113351 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/f74501d61e09341a8a2899c65a03a5bbb1fa4535] + +Backport Changes: +- Drop the upstream expat/ prefix to match the release tarball. +- Use the existing XML_SetBillionLaughsAttackProtection APIs and + XML_TRUE return checks instead of the unavailable property APIs. + Rewrap the calls for their older signatures and use the float limit. + +(cherry picked from commit f74501d61e09341a8a2899c65a03a5bbb1fa4535) +Signed-off-by: Darsh Kelaiya +--- + tests/acc_tests.c | 31 +++++++++++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/tests/acc_tests.c b/tests/acc_tests.c +index 5e38dee0..d9f58a49 100644 +--- a/tests/acc_tests.c ++++ b/tests/acc_tests.c +@@ -440,6 +440,36 @@ START_TEST(test_amplification_isolated_external_parser) { + } + END_TEST + ++START_TEST(test_amplification_reset_neutrality) { ++ // Speed up the test, chunk size expected to not matter in this test ++ if (g_chunkSize != 0) ++ return; ++ ++ const char *const doc ++ = "]>&e;"; ++ XML_Parser parser = XML_ParserCreate(NULL); ++ assert_true( ++ XML_SetBillionLaughsAttackProtectionMaximumAmplification(parser, 1.0f) ++ == XML_TRUE); ++ assert_true(XML_SetBillionLaughsAttackProtectionActivationThreshold(parser, 0) ++ == XML_TRUE); ++ ++ assert_true(_XML_Parse_SINGLE_BYTES(parser, doc, (int)strlen(doc), ++ /*isFinal=*/XML_TRUE) ++ == XML_STATUS_ERROR); ++ assert_true(XML_GetErrorCode(parser) == XML_ERROR_AMPLIFICATION_LIMIT_BREACH); ++ ++ assert_true(XML_ParserReset(parser, NULL) == XML_STATUS_OK); ++ ++ assert_true(_XML_Parse_SINGLE_BYTES(parser, doc, (int)strlen(doc), ++ /*isFinal=*/XML_TRUE) ++ == XML_STATUS_ERROR); ++ assert_true(XML_GetErrorCode(parser) == XML_ERROR_AMPLIFICATION_LIMIT_BREACH); ++ ++ XML_ParserFree(parser); ++} ++END_TEST ++ + #endif // XML_GE == 1 + + void +@@ -454,6 +484,7 @@ make_accounting_test_case(Suite *s) { + tcase_add_test(tc_accounting, test_helper_unsigned_char_to_printable); + tcase_add_test__ifdef_xml_dtd(tc_accounting, + test_amplification_isolated_external_parser); ++ tcase_add_test(tc_accounting, test_amplification_reset_neutrality); + #else + UNUSED_P(s); + #endif /* XML_GE == 1 */ diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb index 02a8536440..4f2672c955 100644 --- a/meta/recipes-core/expat/expat_2.8.3.bb +++ b/meta/recipes-core/expat/expat_2.8.3.bb @@ -8,7 +8,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=f4fedd6116da0e171f7cb4d2923d7ac2" VERSION_TAG = "${@d.getVar('PV').replace('.', '_')}" -SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ +SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://run-ptest \ file://CVE-2026-66046-01.patch \ file://CVE-2026-66046-02.patch \ @@ -20,6 +20,11 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-93990-02.patch \ file://CVE-2026-102633.patch \ file://CVE-2026-77214.patch \ + file://CVE-2026-113351_p1.patch \ + file://CVE-2026-113351_p2.patch \ + file://CVE-2026-113351_p3.patch \ + file://CVE-2026-113351_p4.patch \ + file://CVE-2026-113351_p5.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Thu Nov 5 09:17:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103101 Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.30510.1793870243133496268 for ; Thu, 05 Nov 2026 01:17:23 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=T+Gr/ucu; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6750; q=dns/txt; s=iport01; t=1793870243; x=1795079843; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=70CZW4fycfzJfwj5BqyP9v3ScUQHT1vGaauBtPbBcv0=; b=T+Gr/ucuf5YACWxS3Nn6mbUHrxNY7mehNZMj03Y5vQlCgJluxTBMtW0c PFK7Ro1jDvCEcCpvWC3kb8Zn1KxL5H2/iHnzk8pR143VvGs2k8OuOeIVU Kh2+e1Yq6DMbrNSVg4FoUb04lKM/IeMlnPlqBvvubOHRYK2vapXk0fy/M lfflXAlmEUeBV+oah7RW/eo5YXNaScbN49HplB18zm+/6vlxTw2X+XzcU Di2EfwRHBt9p1n3m1hJGB0o0rm6W9Cs7liIP34ccEpj1hiPmK54tXOHzz ijukRa9l+dIQ9paVYrfHMQKQNLz1drVPrvgDyE19o/jmDSKgnDZDJgqB4 w==; X-CSE-ConnectionGUID: jvuu1iXTRWuy1AvHHqXU7Q== X-CSE-MsgGUID: psyvdoj6QHGQgWVMQN2RVw== X-IPAS-Result: A0AbLwA6Sexq/5L/Ja1aglmCV3VgQ0kDlkgDgRObdoEYgX4PAQEBDy4WDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMBJgsBGAEtEBwDAQIvJwQjCBmDAgGCdAMRu38bN4F5M4EBgykBgVTbMwELFAGBOIVAiCNdGAGEfScbG4FygRWCc3aBBYFcAQGIJgSCIoEMgVoeZYwVAoFShnFIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPm4Hki+DCgeBDgErF4FtDxmTOBqSJKERCiiDeIwkjT6HfBozqnELmH2OChaWO4RpgWg8gVlwFYJuATMJShkPji4LC4Ngzk0mMgIJAy8BAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:yRKbbK/nUE8ud0Mk2UcODrUD0X+TJUtcMsCJ2f8bNWPcYEJGY0x3m 2sWXT3Ubv7cN2Kkctt1b4znpkNXv5KBx9FiQANtrytEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtazpJs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2k0I5AFo+dHPVtx6 O1BAS4tTgmzur2PlefTpulE3qzPLeHxN48Z/3UlxjbDALN+ENbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0Mn1lQ/UPrSmM+khXT7ejxJoXqepLE85C7YywkZPL3FbYaII4TbFJ8O9qqej nrd7nr1BRNEDfyw8DW6zFeVoLX1ozyuDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0W5Qd93L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXjlCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1r994cRva1fApEFI/ IronPort-HdrOrdr: A9a23:SF+P6K89ReOeRDWHnWluk+D6I+orL9Y04lQ7vn2ZhyY7TiX+rb HIoB11737JYVoqNU3I3OrwWpVoIkmskaKdn7NwAV7KZmCP0wGVxcNZnO7fKlbbdREWmNQw6U 4ZSdkcNPTASX5nkM39/A60V/wkwNWB7eSUoN229QYKcemvAJsQlzuQzW2gYzRLeDU= X-Talos-CUID: 9a23:xvl+GGhFLD0ArMYT+p4K+2IEyzJucGPA0S7RE3OCNnt4EZSLaX+JyJ47qp87 X-Talos-MUID: 9a23:5oCkSw6YA7bX2yVcgF3K01sxxoxw+LWwBEcPz6wmlPCLChJVAhHHtgqoF9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="545109923" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:17:22 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id 26D1F1800059F; Thu, 5 Nov 2026 09:17:22 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id C36DECBF201; Thu, 5 Nov 2026 01:17:21 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 2/3] expat: fix CVE-2026-117610 Date: Thu, 5 Nov 2026 01:17:18 -0800 Message-Id: <20261105091719.1622520-2-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105091719.1622520-1-dkelaiya@cisco.com> References: <20261105091719.1622520-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:17:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249520 From: Darsh Kelaiya Backport the merged upstream fix [1] identified by the release announcement [2], together with its regression test [3]. An initial empty, non-final external-entity parse must remain in the correct initialization state instead of reaching a handler with invalid state. Use the final merged PR 1444 commits; the earlier advisory reference 7b0d50e4b1d16fafd55876260701e04279a7489d was superseded during review. The regression test uses Expat 2.8.3's existing XCS literals and xcstrcmp helper, so no string-helper refactoring is required. The focused external-entity case crashes the unpatched native library and passes with this fix. The full native unit suite also passes. BitBake was not run. [1] https://github.com/libexpat/libexpat/commit/bfc28346fa3efeb8ca56c17437d24a7344e5feab [2] https://www.openwall.com/lists/oss-security/2026/11/02/6 [3] https://github.com/libexpat/libexpat/commit/cedb704d2cad9d6ef77f8f172104d3e751eccfd2 Signed-off-by: Darsh Kelaiya --- .../expat/expat/CVE-2026-117610_p1.patch | 30 ++++++ .../expat/expat/CVE-2026-117610_p2.patch | 92 +++++++++++++++++++ meta/recipes-core/expat/expat_2.8.3.bb | 2 + 3 files changed, 124 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-117610_p1.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-117610_p2.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-117610_p1.patch b/meta/recipes-core/expat/expat/CVE-2026-117610_p1.patch new file mode 100644 index 0000000000..fd645dae66 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-117610_p1.patch @@ -0,0 +1,30 @@ +From bfc28346fa3efeb8ca56c17437d24a7344e5feab Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Mon, 26 Oct 2026 17:39:32 +0100 +Subject: [PATCH] lib: Fix initial non-final empty subparser call with a + handler + +CVE: CVE-2026-117610 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/bfc28346fa3efeb8ca56c17437d24a7344e5feab] + +Signed-off-by: Darsh Kelaiya +--- + lib/xmlparse.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index a0946be..b17f5e0 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -3233,6 +3233,11 @@ externalEntityInitProcessor2(XML_Parser parser, const char *start, + } + parser->m_eventPtr = start; + return XML_ERROR_PARTIAL_CHAR; ++ case XML_TOK_NONE: ++ if (! parser->m_parsingStatus.finalBuffer) { ++ *endPtr = start; ++ } ++ return XML_ERROR_NONE; + } + parser->m_processor = externalEntityInitProcessor3; + return externalEntityInitProcessor3(parser, start, end, endPtr); diff --git a/meta/recipes-core/expat/expat/CVE-2026-117610_p2.patch b/meta/recipes-core/expat/expat/CVE-2026-117610_p2.patch new file mode 100644 index 0000000000..2ebe6446c4 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-117610_p2.patch @@ -0,0 +1,92 @@ +From cedb704d2cad9d6ef77f8f172104d3e751eccfd2 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Mon, 26 Oct 2026 17:17:57 +0100 +Subject: [PATCH] tests: Add a test for a initial non-final empty subparser + parse + +.. with a handler call + +CVE: CVE-2026-117610 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/cedb704d2cad9d6ef77f8f172104d3e751eccfd2] + +Backport Changes: +- Compare handler data with the existing XCS macro and xcstrcmp test + helper in Expat 2.8.3. This replaces xcsdup_str allocations, + allocation assertions and frees, avoiding the newer xcs helpers. + +Signed-off-by: Darsh Kelaiya +--- + tests/misc_tests.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 55 insertions(+) + +diff --git a/tests/misc_tests.c b/tests/misc_tests.c +index 04538c2..6c82715 100644 +--- a/tests/misc_tests.c ++++ b/tests/misc_tests.c +@@ -957,6 +957,60 @@ START_TEST(test_misc_input_2gb) { + } + END_TEST + ++static void ++comparingPiHandler(void *userData, const XML_Char *target, ++ const XML_Char *data) { ++ UNUSED_P(userData); ++ ++ assert_true(xcstrcmp(target, XCS("target")) == 0); ++ assert_true(xcstrcmp(data, XCS("data")) == 0); ++} ++ ++static int XMLCALL ++piParsingExternalEntityHandler(XML_Parser parent, const XML_Char *context, ++ const XML_Char *base, const XML_Char *systemId, ++ const XML_Char *publicId) { ++ UNUSED_P(base); ++ UNUSED_P(systemId); ++ UNUSED_P(publicId); ++ ++ const char *const doc = ""; ++ ++ XML_Parser subParser = XML_ExternalEntityParserCreate(parent, context, NULL); ++ assert_true(subParser != NULL); ++ ++ // NOTE: Related test "test_empty_ext_param_entity_in_value" could be of ++ // interest ++ assert_true(_XML_Parse_SINGLE_BYTES(subParser, "", 0, /*isFinal=*/XML_FALSE) ++ == XML_STATUS_OK); ++ assert_true(_XML_Parse_SINGLE_BYTES(subParser, doc, (int)strlen(doc), ++ /*isFinal=*/XML_TRUE) ++ == XML_STATUS_OK); ++ ++ XML_ParserFree(subParser); ++ ++ return XML_STATUS_OK; ++} ++ ++START_TEST(test_misc_empty_nonfinal_subparser_parse) { ++ const char *const doc = "\n" ++ "]>\n" ++ "&ext;\n"; ++ ++ XML_Parser parser = XML_ParserCreate(NULL); ++ assert_true(parser != NULL); ++ ++ XML_SetProcessingInstructionHandler(parser, comparingPiHandler); ++ XML_SetExternalEntityRefHandler(parser, piParsingExternalEntityHandler); ++ ++ assert_true(_XML_Parse_SINGLE_BYTES(parser, doc, (int)strlen(doc), ++ /*isFinal=*/XML_TRUE)); ++ ++ XML_ParserFree(parser); ++} ++END_TEST ++ + void + make_miscellaneous_test_case(Suite *s) { + TCase *tc_misc = tcase_create("miscellaneous tests"); +@@ -993,4 +1047,5 @@ make_miscellaneous_test_case(Suite *s) { + tcase_add_test(tc_misc, test_misc_unknown_encoding_callbacks_protected); + tcase_add_test(tc_misc, test_misc_input_2gb); + tcase_add_test(tc_misc, test_misc_low_surrogate_mozilla_bug_2053153); ++ tcase_add_test(tc_misc, test_misc_empty_nonfinal_subparser_parse); + } diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb index 4f2672c955..b6911e79de 100644 --- a/meta/recipes-core/expat/expat_2.8.3.bb +++ b/meta/recipes-core/expat/expat_2.8.3.bb @@ -25,6 +25,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-113351_p3.patch \ file://CVE-2026-113351_p4.patch \ file://CVE-2026-113351_p5.patch \ + file://CVE-2026-117610_p1.patch \ + file://CVE-2026-117610_p2.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Thu Nov 5 09:17:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103103 Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.30267.1793870243403185830 for ; Thu, 05 Nov 2026 01:17:23 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=D4Oozzf+; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=9428; q=dns/txt; s=iport01; t=1793870243; x=1795079843; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=EtRzmsnrTPd+E3ZHttimD5e2e8+G0whNFkBTPkrM2hI=; b=D4Oozzf+m8j/uxVa0axmabqIpoGDizrAPS98tR+ii3hIuTFznkcoXWqX yM4LOMMvGVb+U7U8hqEO6557B4UZasJYkWAOooMYyXlhRmTsneK5Ig5Mk 6zgTgiJQEelw7H18YGXTEFdZhUmze3twgsRlectTHzMfyjtb6zuim94M/ hFDpuLKXDvzLZlhIHV8C1vbFm8tAX3nq5aFZ0KED2Fm1GKCbREweF3V8N I5GwQ8t426FHe1Bvu0hPwgXabEvFmYDRV963+PWxIm5F5AH/E4fyftgvB eAtCPa4ZM01PkjJr280iUU2xSng6wh5VgaopseyTFOLuEit2NC0tbHjA1 g==; X-CSE-ConnectionGUID: o/KbutR2RVSu4mhWo//dbA== X-CSE-MsgGUID: srwzds91Q1SOsqunmHY6Ew== X-IPAS-Result: A0BLAgCwSOxq/5T/Ja1aglmCV3VgQ0kDlkgDniEUgWoPAQEBDy4WDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMBJgsBGAEtEBwDAQIWGScEIwgZgwIBgnQDEbt2GzeBeTOBAYMpAYFU2zMBCxQBgTiFQIgjXRgBhH0nGxuBcoR+gQWBXAEBgRkOeIYHBIIigQyBWh5ljBUCgVKGcUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0McjkQMB4kLwUcJkAbChgYDUgRLDcVGQQ+bgeSL4MRAX4PASsgUCEyEVgkozGCIaERCiiDeIwkjT6HfBozqnELmH2OChaVbk2EaYFoPIFZcBWCbgEzCUoZD44tDAuDYM5NJjICCQMvAQEHAgcOAwuBaJAAAiYHgU8BAQ IronPort-Data: A9a23:fnBaV6I0uHSf+RgOFE+RgJQlxSXFcZb7ZxGr2PjKsXjdYENS02QEn zFLXmuDbPmNZTChfNkka4mw9RsFu5HRn4IxSwAd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8gmYpajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1pS2I8IJEioNxJOnwS8 PwnL3dKYhqq0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSAVLAtQIvIROPB4towMDUY358VW62BI ZBENHw2MESojx5nYj/7DLoyn+qsj3juehVTqUmeouw85G27IAlZjeS2b4KNK4LSLSlTtl2Cu XDK5DWgO0ghE8eG1DyA0kPyq/CayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PK+kEOWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRul/fDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9EBpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:ERs1/KHWtJc++QybpLqEyseALOsnbusQ8zAXPo5KJiC9Ffbo8P xG88576faZslsssTQb6LK90cq7MBfhHOBOgbX5VI3KNGKNhILrFvAG0WKI+VPd8kPFmtK1rZ 0QEJRWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqUuEiWpRGtldB8ATMHfjLnFL X-Talos-CUID: 9a23:fOma5GMB/2BCee5DX25E/lMIIJofTEbAkHLQHEj/TmpjYejA X-Talos-MUID: 9a23:gDpF5Q590W6zLNXVosSto4Otxoxz+bu8BFtcyKxfgO6fLDF2Phes0hmoF9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="543700960" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 09:17:22 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id 2881818000263; Thu, 5 Nov 2026 09:17:22 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id C7971CBF202; Thu, 5 Nov 2026 01:17:21 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: Darsh Kelaiya Subject: [OE-core][wrynose][PATCH 3/3] expat: fix CVE-2026-118370 Date: Thu, 5 Nov 2026 01:17:19 -0800 Message-Id: <20261105091719.1622520-3-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261105091719.1622520-1-dkelaiya@cisco.com> References: <20261105091719.1622520-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 09:17:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249522 From: Darsh Kelaiya Backport the upstream prefix and attribute-index fixes [1,2] identified by the release announcement [3]. Use size_t for storeAtts bookkeeping and reject values that cannot be represented by the existing public int attribute-count interfaces. Include the related tokenizer-count correction [4] so XmlGetAttributes and getAtts do not overflow a signed count or narrow the available attribute capacity before the storeAtts checks. This closes the same large-attribute data path; it corrects a pre-existing issue rather than a regression introduced by the first two fixes. Preserve Expat 2.8.3's PTRCALL annotations on the tokenizer callback and implementation. Validated with the full native unit suite, inline undefined-behavior traps and an arithmetic boundary model. A multi-gigabyte attribute payload and BitBake were not run. [1] https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c [2] https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae [3] https://www.openwall.com/lists/oss-security/2026/11/02/6 [4] https://github.com/libexpat/libexpat/commit/c67cbc6185d1b494f521f2f46280d5982f50f2cf Signed-off-by: Darsh Kelaiya --- .../expat/expat/CVE-2026-118370_p1.patch | 29 +++++++ .../expat/expat/CVE-2026-118370_p2.patch | 58 ++++++++++++++ .../expat/expat/CVE-2026-118370_p3.patch | 77 +++++++++++++++++++ meta/recipes-core/expat/expat_2.8.3.bb | 3 + 4 files changed, 167 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-118370_p1.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-118370_p2.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-118370_p3.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-118370_p1.patch b/meta/recipes-core/expat/expat/CVE-2026-118370_p1.patch new file mode 100644 index 0000000000..0b2e5f48d6 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-118370_p1.patch @@ -0,0 +1,29 @@ +From 621cb2c78b253ee023a86bc91d6ddb048481c04c Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 27 Oct 2026 17:57:19 +0100 +Subject: [PATCH] lib: Protect `nPrefixes` in `storeAtts` from signed integer + overflow + +.. by migrating to `size_t` + +CVE: CVE-2026-118370 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c] + +Signed-off-by: Darsh Kelaiya +--- + lib/xmlparse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index b17f5e0..6fdfbc8 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -3871,7 +3871,7 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr, + DTD *const dtd = parser->m_dtd; /* save one level of indirection */ + int attIndex = 0; + XML_Char *uri; +- int nPrefixes = 0; ++ size_t nPrefixes = 0; + BINDING *binding; + const XML_Char *localPart; + diff --git a/meta/recipes-core/expat/expat/CVE-2026-118370_p2.patch b/meta/recipes-core/expat/expat/CVE-2026-118370_p2.patch new file mode 100644 index 0000000000..0015f4f1cd --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-118370_p2.patch @@ -0,0 +1,58 @@ +From 1bac53c4fc460a03cd9860f39501c7979f6750ae Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Tue, 27 Oct 2026 15:20:33 +0100 +Subject: [PATCH] lib: Protect `attIndex` in `storeAtts` from signed integer + overflow + +.. by migrating to `size_t` + +CVE: CVE-2026-118370 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae] + +Signed-off-by: Darsh Kelaiya +--- + lib/xmlparse.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 6fdfbc8..6c97639 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -3869,7 +3869,7 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr, + TAG_NAME *tagNamePtr, BINDING **bindingsPtr, + enum XML_Account account) { + DTD *const dtd = parser->m_dtd; /* save one level of indirection */ +- int attIndex = 0; ++ size_t attIndex = 0; + XML_Char *uri; + size_t nPrefixes = 0; + BINDING *binding; +@@ -4048,11 +4048,16 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr, + } + + /* set-up for XML_GetSpecifiedAttributeCount and XML_GetIdAttributeIndex */ +- parser->m_nSpecifiedAtts = attIndex; ++ // Detect and reject integer overflow ++ if (attIndex > INT_MAX) ++ return XML_ERROR_NO_MEMORY; ++ parser->m_nSpecifiedAtts = (int)attIndex; + if (elementType->idAtt && (elementType->idAtt->name)[-1]) { +- for (int i = 0; i < attIndex; i += 2) ++ for (size_t i = 0; i < attIndex; i += 2) + if (appAtts[i] == elementType->idAtt->name) { +- parser->m_idAttIndex = i; ++ if (i > INT_MAX) ++ return XML_ERROR_NO_MEMORY; ++ parser->m_idAttIndex = (int)i; + break; + } + } else +@@ -4085,7 +4090,7 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr, + + /* expand prefixed attribute names, check for duplicates, + and clear flags that say whether attributes were specified */ +- int i = 0; ++ size_t i = 0; + if (nPrefixes) { + unsigned int j; /* hash table index */ + unsigned long version = parser->m_nsAttsVersion; diff --git a/meta/recipes-core/expat/expat/CVE-2026-118370_p3.patch b/meta/recipes-core/expat/expat/CVE-2026-118370_p3.patch new file mode 100644 index 0000000000..2ad72abee6 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-118370_p3.patch @@ -0,0 +1,77 @@ +From c67cbc6185d1b494f521f2f46280d5982f50f2cf Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Fri, 30 Oct 2026 18:37:11 +0100 +Subject: [PATCH] lib: Fix integer truncation in `XmlGetAttributes`/`getAtts` + +CVE: CVE-2026-118370 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/c67cbc6185d1b494f521f2f46280d5982f50f2cf] + +Backport Changes: +- Retain PTRCALL on the getAtts callback and implementation for Expat + 2.8.3 calling-convention compatibility, and align the callback + continuation with the retained annotation. + +Signed-off-by: Darsh Kelaiya +--- + lib/xmlparse.c | 5 ++--- + lib/xmltok.h | 4 ++-- + lib/xmltok_impl.c | 6 +++--- + 3 files changed, 7 insertions(+), 8 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 6c97639..2a4e47b 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -3898,8 +3898,7 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr, + return XML_ERROR_NO_MEMORY; + + /* get the attributes from the tokenizer */ +- size_t n = (size_t)XmlGetAttributes(enc, attStr, (int)parser->m_attsSize, +- parser->m_atts); ++ size_t n = XmlGetAttributes(enc, attStr, parser->m_attsSize, parser->m_atts); + + /* Detect and prevent integer overflow */ + if (n > SIZE_MAX - nDefaultAtts) { +@@ -3949,7 +3948,7 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr, + /* Detect and prevent integer overflow. */ + if (n > (size_t)INT_MAX) + return XML_ERROR_NO_MEMORY; +- XmlGetAttributes(enc, attStr, (int)n, parser->m_atts); ++ XmlGetAttributes(enc, attStr, n, parser->m_atts); + } + } + +diff --git a/lib/xmltok.h b/lib/xmltok.h +index bd868b8..4be6fdc 100644 +--- a/lib/xmltok.h ++++ b/lib/xmltok.h +@@ -180,8 +180,8 @@ struct encoding { + const char *); + int(PTRFASTCALL *nameLength)(const ENCODING *, const char *); + const char *(PTRFASTCALL *skipS)(const ENCODING *, const char *); +- int(PTRCALL *getAtts)(const ENCODING *enc, const char *ptr, int attsMax, +- ATTRIBUTE *atts); ++ size_t(PTRCALL *getAtts)(const ENCODING *enc, const char *ptr, size_t attsMax, ++ ATTRIBUTE *atts); + int(PTRFASTCALL *charRefNumber)(const ENCODING *enc, const char *ptr); + int(PTRCALL *predefinedEntityName)(const ENCODING *, const char *, + const char *); +diff --git a/lib/xmltok_impl.c b/lib/xmltok_impl.c +index 2719e06..3955285 100644 +--- a/lib/xmltok_impl.c ++++ b/lib/xmltok_impl.c +@@ -1504,11 +1504,11 @@ PREFIX(isPublicId)(const ENCODING *enc, const char *ptr, const char *end, + first attsMax attributes are stored in atts. + */ + +-static int PTRCALL +-PREFIX(getAtts)(const ENCODING *enc, const char *ptr, int attsMax, ++static size_t PTRCALL ++PREFIX(getAtts)(const ENCODING *enc, const char *ptr, size_t attsMax, + ATTRIBUTE *atts) { + enum { other, inName, inValue } state = inName; +- int nAtts = 0; ++ size_t nAtts = 0; + int open = 0; /* defined when state == inValue; + initialization just to shut up compilers */ + diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb index b6911e79de..89ec156e92 100644 --- a/meta/recipes-core/expat/expat_2.8.3.bb +++ b/meta/recipes-core/expat/expat_2.8.3.bb @@ -27,6 +27,9 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-113351_p5.patch \ file://CVE-2026-117610_p1.patch \ file://CVE-2026-117610_p2.patch \ + file://CVE-2026-118370_p1.patch \ + file://CVE-2026-118370_p2.patch \ + file://CVE-2026-118370_p3.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"