Release 2.9.0 Mon October 5 2026
Security fixes:
#1392 CVE-2026-102633 -- Integer overflow in function
expat_realloc on 32bit platforms
#1393 CVE-2026-77214 -- Validate parameter `len` against available
buffer capacity in XML_ParseBuffer
Bug fixes:
#1387 lib: Handle OOM when copying encodingName in XML_ParserReset
New features:
#1327 lib: Introduce new "Properties API" to get and set
scalar properties for a single parser instance.
There are six new functions:
- XML_GetPropertyBool
- XML_GetPropertyDouble
- XML_GetPropertyUInt64
- XML_SetPropertyBool
- XML_SetPropertyDouble
- XML_SetPropertyUInt64
And two new enums:
- XML_Prop_Error
- XML_Parser_Property
#1323 lib: Introduce five new 64bit location API functions:
- XML_GetCurrentByteCount64
- XML_GetCurrentByteIndex64
- XML_GetCurrentColumnNumber64
- XML_GetCurrentLineNumber64
- XML_GetInputContext64
These five functions closely mirror their predecessors
but are not prone to 32bit integer wrap-around.
Other changes:
#1391 docs: Document the scope of function XML_GetErrorCode
#1395 docs: Document length expectations for XML_ParseBuffer
#1394 lib: Call unknown encoding release before parser teardown
#1370 #1373 lib: Drop (disabled-by-default) attribute info feature
These things are now gone:
- Public function XML_GetAttributeInfo
- Public struct XML_AttrInfo
- Macro XML_ATTR_INFO
These things are now causing build errors:
- Configure option --enable-xml-attr-info
- CMake option -DEXPAT_ATTR_INFO=ON
#1379 #1382 lib: Drop (disabled-by-default) minimum size feature
These things are now gone:
- Macro XML_MIN_SIZE
These things are now causing build errors:
- Configuring with -DXML_MIN_SIZE for CPPFLAGS/CFLAGS
- CMake option -DEXPAT_MIN_SIZE=ON
#1323 #1411 lib: Deprecate macro XML_LARGE_SIZE (use the new 64bit
location API functions instead please)
#1323 lib: Deprecate five location API functions that are cursed
with integer wrap-around:
- XML_GetCurrentByteCount
- XML_GetCurrentByteIndex
- XML_GetCurrentColumnNumber
- XML_GetCurrentLineNumber
- XML_GetInputContext
#1399 lib: Guard against out-of-handler use of XML_DefaultCurrent
#1400 lib: Use size_t for bytesAllocated and peakBytesAllocated
#1401 #1402 ..
#1404 #1405 lib|xmlwf|tests: Unify use of xcslen, xcscmp and xcsncmp
#1406 xmlwf: Add missing `#include "expat.h"`
#1389 #1396 Version info bumped from 13:5:12 (libexpat*.so.1.12.5)
to 14:0:13 (libexpat*.so.1.13.0); see https://verbump.de/
for what these numbers do
Signed-off-by: Richard Purdie <[email protected]>
---
meta/recipes-core/expat/{expat_2.8.5.bb => expat_2.9.0.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-core/expat/{expat_2.8.5.bb => expat_2.9.0.bb} (92%)
diff --git a/meta/recipes-core/expat/expat_2.8.5.bb
b/meta/recipes-core/expat/expat_2.9.0.bb
similarity index 92%
rename from meta/recipes-core/expat/expat_2.8.5.bb
rename to meta/recipes-core/expat/expat_2.9.0.bb
index c032e18c77a..e9bb21bd55c 100644
--- a/meta/recipes-core/expat/expat_2.8.5.bb
+++ b/meta/recipes-core/expat/expat_2.9.0.bb
@@ -15,7 +15,7 @@ SRC_URI =
"${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/";
UPSTREAM_CHECK_REGEX = "releases/tag/R_(?P<pver>.+)"
-SRC_URI[sha256sum] =
"952c03c33a6b337f12dae7a9b0f9dee86f867550d35c994d6bdaaddd37dc8454"
+SRC_URI[sha256sum] =
"775e8a68f81a748a401dc3168318d4a39484eb4f954726f21517c8f42c0ba984"
EXTRA_OECMAKE:class-native += "-DEXPAT_BUILD_DOCS=OFF"
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#247262):
https://lists.openembedded.org/g/openembedded-core/message/247262
Mute This Topic: https://lists.openembedded.org/mt/121600847/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
