Backport patch to fix CVE-2026-56412. References: https://nvd.nist.gov/vuln/detail/CVE-2026-56412
Upstream fix: https://github.com/libexpat/libexpat/commit/d19e834794060d18c061d94452c35d725393ea58 Signed-off-by: Jakub Szczudlo <[email protected]> --- .../expat/expat/CVE-2026-56412.patch | 45 +++++++++++++++++++ meta/recipes-core/expat/expat_2.7.5.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56412.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-56412.patch b/meta/recipes-core/expat/expat/CVE-2026-56412.patch new file mode 100644 index 0000000000..8959bdec5c --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56412.patch @@ -0,0 +1,45 @@ +From b94cd5b9a6dc7f938a50db2417e4ff60ed35c4a1 Mon Sep 17 00:00:00 2001 +From: hextheshadow <[email protected]> +Date: Sat, 20 Jun 2026 21:07:29 +0500 +Subject: [PATCH] lib: guard XML_TOK_DATA_CHARS handler calls in + doCdataSection() + +(cherry picked from commit d19e834794060d18c061d94452c35d725393ea58) + +CVE: CVE-2026-56412 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1278/commits/d19e834794060d18c061d94452c35d725393ea58] +Signed-off-by: Jakub Szczudlo <[email protected]> +--- + lib/xmlparse.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index a5fa256..1476c7e 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -4812,16 +4812,21 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr, + const enum XML_Convert_Result convert_res = XmlConvert( + enc, &s, next, &dataPtr, (ICHAR *)parser->m_dataBufEnd); + *eventEndPP = next; ++ beforeHandler(parser); + charDataHandler(parser->m_handlerArg, parser->m_dataBuf, + (int)(dataPtr - (ICHAR *)parser->m_dataBuf)); ++ afterHandler(parser); + if ((convert_res == XML_CONVERT_COMPLETED) + || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) + break; + *eventPP = s; + } +- } else ++ } else { ++ beforeHandler(parser); + charDataHandler(parser->m_handlerArg, (const XML_Char *)s, + (int)((const XML_Char *)next - (const XML_Char *)s)); ++ afterHandler(parser); ++ } + } else if (parser->m_defaultHandler) + reportDefault(parser, enc, s, next); + } break; +-- +2.34.1 + diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb index 78e35243c5..6fdae2458f 100644 --- a/meta/recipes-core/expat/expat_2.7.5.bb +++ b/meta/recipes-core/expat/expat_2.7.5.bb @@ -69,6 +69,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-50219-31.patch \ file://CVE-2026-50219-32.patch \ file://CVE-2026-56131.patch \ + file://CVE-2026-56412.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"; -- 2.34.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244129): https://lists.openembedded.org/g/openembedded-core/message/244129 Mute This Topic: https://lists.openembedded.org/mt/120905066/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
