Control: tags 1151840 + patch Control: tags 1151841 + patch Control: tags 1152343 + patch Control: tags 1152337 + patch
Hi Laszlo,
Attached is a debdiff for a 2.9.0-1.1 NMU that backports the upstream
fixes for these four bugs from libexpat master (none of them is in a
release yet). I have not uploaded anything; please use as much or as
little of it as you like.
Patches (01-09, after the two existing Debian patches):
01 PR #1431 CVE-2026-113351 fix parser reset (#1151840)
02 d545081f type prerequisite for #1433 on 2.9.0
03 da504c0c type prerequisite for #1433 on 2.9.0
04 PR #1433 CVE-2026-115506 precompute entity sizes (#1151841)
05 PR #1439 required follow-up to #1433
06 PR #1437 missing NULL check for m_startDoctypeDeclHandler
07 facd124e xcsdup_str test helper (from #1442)
08 PR #1444 CVE-2026-117610 empty non-final subparser call (#1152343)
09 PR #1450 CVE-2026-118370 storeAtts integer overflow (#1152337)
Notes:
- #1433 must not go in alone: libexpat issue #1438 reports that a backport
of it to 2.9.0 rejects valid CDATA with default limits; #1439 fixes
that. #1433 also needs d545081f and da504c0c (both after 2.9.0), as the
issue says.
- #1437 and facd124e are only there so the #1444 test applies and builds
(#1437 is a real NULL check fix as well). In 08 I dropped the unrelated
#1449 storeAtts test that shares a hunk in tests/misc_tests.c; nothing
else was edited by hand.
- With all eleven patches applied, the expat/ tree is identical to
R_2_9_0 plus these upstream commits, apart from the two files the
existing Debian patches change.
Testing (sid chroot, amd64):
- debian/rules does not run the upstream test suite, so I ran make check
in the build directory: 5256 checks, 0 failures (stock 2.9.0: 5196
checks, 0 failures; the 60 extra checks are the backported tests).
The buildw (XML_UNICODE) variant cannot build the tests, in stock 2.9.0
as well ("No support for UTF-16 character without wchar_t in tests").
- CVE-2026-117610, with the scenario of upstream's new test (external
entity subparser, empty non-final XML_Parse, PI handler set): 2.9.0-1
segfaults on that valid document; 2.9.0-1.1 parses it and calls the
handler.
- lintian: source tags identical to 2.9.0-1.
CVE-2025-66382 (#1121543) has no upstream fix yet and is not addressed.
Regards,
automationcanadian
expat_2.9.0-1.1.debdiff.gz
Description: application/gzip
