Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package expat for openSUSE:Factory checked in at 2026-10-03 20:13:15 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/expat (Old) and /work/SRC/openSUSE:Factory/.expat.new.1631729 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "expat" Sat Oct 3 20:13:15 2026 rev:89 rq:1382090 version:2.8.5 Changes: -------- --- /work/SRC/openSUSE:Factory/expat/expat.changes 2026-09-09 16:18:27.599296620 +0200 +++ /work/SRC/openSUSE:Factory/.expat.new.1631729/expat.changes 2026-10-03 20:13:23.678253362 +0200 @@ -1,0 +2,21 @@ +Wed Sep 30 15:30:59 UTC 2026 - David Anes <[email protected]> + +- security update: + * CVE-2026-102633: expat: Denial of Service via integer overflow in + expat_realloc (bsc#1283493) + - Added patch expat-CVE-2026-102633.patch + +------------------------------------------------------------------- +Tue Sep 22 14:56:56 UTC 2026 - David Anes <[email protected]> + +- update to 2.8.5 (bsc#1282347, CVE-2026-93990): + * Security fixes: + * CVE-2026-93990: reject high surrogates not followed by a low + surrogate during UTF-16 decoding; malformed UTF-16 could be + smuggled into the application (CVSS 9.8) + * Bug fixes: + * Fix an OOM-related memory leak on a failed overflow check + * Fix memory alignment for architectures with 128bit pointers + * Mark XML_SetHashSalt deprecated + +------------------------------------------------------------------- Old: ---- expat-2.8.4.tar.xz expat-2.8.4.tar.xz.asc New: ---- expat-2.8.5.tar.xz expat-2.8.5.tar.xz.asc expat-CVE-2026-102633.patch ----------(New B)---------- New: expat_realloc (bsc#1283493) - Added patch expat-CVE-2026-102633.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ expat.spec ++++++ --- /var/tmp/diff_new_pack.qOKhV9/_old 2026-10-03 20:13:24.477286818 +0200 +++ /var/tmp/diff_new_pack.qOKhV9/_new 2026-10-03 20:13:24.479286902 +0200 @@ -17,10 +17,10 @@ # -%global unversion 2_8_4 +%global unversion 2_8_5 %define sover 1 Name: expat -Version: 2.8.4 +Version: 2.8.5 Release: 0 Summary: XML Parser Toolkit License: MIT @@ -33,6 +33,8 @@ # https://www.gentoo.org/inside-gentoo/developers/index.html#sping # https://github.com/libexpat/libexpat/issues/537#issuecomment-1003796884 Source4: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x3176ef7db2367f1fca4f306b1f9b0e909af37285#/expat.keyring +# CVE-2026-102633 [bsc#1283493], denial of service via integer overflow in expat_realloc +Patch0: expat-CVE-2026-102633.patch BuildRequires: c++_compiler BuildRequires: pkgconfig ++++++ expat-2.8.4.tar.xz -> expat-2.8.5.tar.xz ++++++ ++++ 9906 lines of diff (skipped) ++++++ expat-CVE-2026-102633.patch ++++++ >From 69edbec09f2cd3e0bd6e0a093b55ea38af902d7d Mon Sep 17 00:00:00 2001 From: Filippo Tedeschi <[email protected]> Date: Thu, 24 Sep 2026 21:14:23 +0200 Subject: [PATCH] lib|tests: Replace assert with runtime overflow check in expat_realloc In expat_realloc, the size passed to realloc_fcn is calculated as sizeof(size_t) + EXPAT_MALLOC_PADDING + size. Previously, expat_realloc relied on an assertion: assert(SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size); under the assumption that preceding accounting checks and parser invariants preclude reaching an overflow state in practice. However, in release builds compiled with NDEBUG, assertions are compiled out. Replace the assert with an explicit runtime check: if (size > SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING) { return NULL; } immediately preceding the addition, ensuring consistent defensive behavior across all build configurations. Also extend test_alloc_tracker_size_recorded in alloc_tests.c to exercise SIZE_MAX and SIZE_MAX / 2 with expat_realloc, verifying that the allocation fails and the recorded size remains unchanged. Signed-off-by: Filippo Tedeschi <[email protected]> --- expat/lib/xmlparse.c | 7 ++++--- expat/tests/alloc_tests.c | 4 ++++ 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c index dfcfb0c2..67005454 100644 --- expat/lib/xmlparse.c +++ b/expat/lib/xmlparse.c @@ -995,9 +995,10 @@ expat_realloc(XML_Parser parser, void *ptr, size_t size, int sourceLine) { } } - // NOTE: Integer overflow detection has already been done for us - // by expat_heap_increase_tolerable(..) above - assert(SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size); + // Detect and prevent integer overflow + if (size > SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING) { + return NULL; + } // Actually allocate mallocedPtr = parser->m_mem.realloc_fcn( diff --git a/expat/tests/alloc_tests.c b/expat/tests/alloc_tests.c index 6be0a073..a5cea463 100644 --- expat/tests/alloc_tests.c +++ b/expat/tests/alloc_tests.c @@ -2136,6 +2136,10 @@ START_TEST(test_alloc_tracker_size_recorded) { assert_true(ptr != NULL); assert_true(sizeRecordedFor(ptr) == 10); + assert_true(expat_realloc(parser, ptr, SIZE_MAX, -1) == NULL); + + assert_true(sizeRecordedFor(ptr) == 10); // i.e. unchanged + assert_true(expat_realloc(parser, ptr, SIZE_MAX / 2, -1) == NULL); assert_true(sizeRecordedFor(ptr) == 10); // i.e. unchanged -- 2.55.0
