On Mon Aug 24, 2026 at 5:20 PM CEST, Jakub Szczudlo (Nokia) wrote: > Expat does not track whether its public parser APIs are called from inside > a user handler. Re-entering the parser through XML_GetBuffer(), > XML_Parse(), XML_ParseBuffer(), XML_ParserFree() or XML_ParserReset() can > therefore result in use-after-free and memory corruption. > The 32 upstream commits are divided as follows: > * 01 introduces the handler call depth counter and the helper functions > used to enter, leave and detect handler execution. > * 02-04 are preparation patches. They extract handler calls from compound > expressions so that depth tracking can be placed before and after each > invocation without changing handler return-value semantics. > * 05-26 instrument the individual handler types. Each patch covers a > distinct callback path; omitting one would leave a route around the > API guards. > * 27-31 add the actual policy enforcement to XML_GetBuffer(), XML_Parse(), > XML_ParseBuffer(), XML_ParserFree() and XML_ParserReset(). > * 32 adds regression coverage for all five rejected calls. > Documentation and Changes-file commits from the upstream > series are dropped because they do not affect the fix or its test > coverage. > An explicit XML_Parser cast is added to the regression-test handler > because handlers.c is also included by handlers_cxx.cpp and compiled as > C++ in the OE build. > Upstream pull request: > https://github.com/libexpat/libexpat/pull/1246 > > Signed-off-by: Jakub Szczudlo <[email protected]> > --- > .../expat/expat/CVE-2026-50219-01.patch | 61 +++++++ > .../expat/expat/CVE-2026-50219-02.patch | 84 ++++++++++ > .../expat/expat/CVE-2026-50219-03.patch | 92 +++++++++++ > .../expat/expat/CVE-2026-50219-04.patch | 34 ++++ > .../expat/expat/CVE-2026-50219-05.patch | 48 ++++++ > .../expat/expat/CVE-2026-50219-06.patch | 154 ++++++++++++++++++ > .../expat/expat/CVE-2026-50219-07.patch | 32 ++++ > .../expat/expat/CVE-2026-50219-08.patch | 44 +++++ > .../expat/expat/CVE-2026-50219-09.patch | 44 +++++ > .../expat/expat/CVE-2026-50219-10.patch | 35 ++++ > .../expat/expat/CVE-2026-50219-11.patch | 32 ++++ > .../expat/expat/CVE-2026-50219-12.patch | 42 +++++ > .../expat/expat/CVE-2026-50219-13.patch | 49 ++++++ > .../expat/expat/CVE-2026-50219-14.patch | 74 +++++++++ > .../expat/expat/CVE-2026-50219-15.patch | 82 ++++++++++ > .../expat/expat/CVE-2026-50219-16.patch | 46 ++++++ > .../expat/expat/CVE-2026-50219-17.patch | 64 ++++++++ > .../expat/expat/CVE-2026-50219-18.patch | 32 ++++ > .../expat/expat/CVE-2026-50219-19.patch | 87 ++++++++++ > .../expat/expat/CVE-2026-50219-20.patch | 62 +++++++ > .../expat/expat/CVE-2026-50219-21.patch | 46 ++++++ > .../expat/expat/CVE-2026-50219-22.patch | 48 ++++++ > .../expat/expat/CVE-2026-50219-23.patch | 36 ++++ > .../expat/expat/CVE-2026-50219-24.patch | 33 ++++ > .../expat/expat/CVE-2026-50219-25.patch | 35 ++++ > .../expat/expat/CVE-2026-50219-26.patch | 33 ++++ > .../expat/expat/CVE-2026-50219-27.patch | 30 ++++ > .../expat/expat/CVE-2026-50219-28.patch | 30 ++++ > .../expat/expat/CVE-2026-50219-29.patch | 31 ++++ > .../expat/expat/CVE-2026-50219-30.patch | 31 ++++ > .../expat/expat/CVE-2026-50219-31.patch | 31 ++++ > .../expat/expat/CVE-2026-50219-32.patch | 100 ++++++++++++ > meta/recipes-core/expat/expat_2.7.5.bb | 32 ++++ > 33 files changed, 1714 insertions(+) > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-01.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-02.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-03.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-04.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-05.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-06.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-07.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-08.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-09.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-10.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-11.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-12.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-13.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-14.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-15.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-16.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-17.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-18.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-19.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-20.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-21.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-22.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-23.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-24.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-25.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-26.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-27.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-28.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-29.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-30.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-31.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-32.patch
Hello, This whole series has been superseded by the upgrade that has been discussed since: https://patchwork.yoctoproject.org/project/oe-core/patch/[email protected]/ In this case, the upgrade looks like the sane thing to do. Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245969): https://lists.openembedded.org/g/openembedded-core/message/245969 Mute This Topic: https://lists.openembedded.org/mt/120905189/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
