Skip to content

Commit bfee7a2

Browse files
StanFromIrelandgpshead
authored andcommitted
gh-161192: Update bundled Expat to 2.10.0 (GH-161202)
(cherry picked from commit a7017f2ca9844893a404be68363b08fdc9973f20) Co-authored-by: Stan Ulbrych <stan@python.org> Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
1 parent ab72b05 commit bfee7a2

18 files changed

Lines changed: 928 additions & 176 deletions

‎Makefile.pre.in‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -644,6 +644,7 @@ LIBEXPAT_OBJS= \
644644
LIBEXPAT_HEADERS= \
645645
Modules/expat/ascii.h \
646646
Modules/expat/asciitab.h \
647+
Modules/expat/entities.h \
647648
Modules/expat/expat.h \
648649
Modules/expat/expat_config.h \
649650
Modules/expat/expat_external.h \
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.10.0
2+
for the fixes to :cve:`2026-113351`, :cve:`2026-115506`, :cve:`2026-117610`
3+
and :cve:`2026-118370`.

‎Misc/sbom.spdx.json‎

Lines changed: 41 additions & 22 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Modules/expat/ascii.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
Copyright (c) 2000 Clark Cooper <coopercc@users.sourceforge.net>
1111
Copyright (c) 2002 Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
1212
Copyright (c) 2007 Karl Waclawek <karl@waclawek.net>
13-
Copyright (c) 2017 Sebastian Pipping <sebastian@pipping.org>
13+
Copyright (c) 2017-2026 Sebastian Pipping <sebastian@pipping.org>
1414
Licensed under the MIT license:
1515
1616
Permission is hereby granted, free of charge, to any person obtaining
@@ -113,6 +113,7 @@
113113
#define ASCII_LT 0x3C
114114
#define ASCII_EQUALS 0x3D
115115
#define ASCII_GT 0x3E
116+
#define ASCII_QUEST 0x3F
116117
#define ASCII_LSQB 0x5B
117118
#define ASCII_RSQB 0x5D
118119
#define ASCII_UNDERSCORE 0x5F

‎Modules/expat/entities.h‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
/* Internal helpers related to entities
2+
__ __ _
3+
___\ \/ /_ __ __ _| |_
4+
/ _ \\ /| '_ \ / _` | __|
5+
| __// \| |_) | (_| | |_
6+
\___/_/\_\ .__/ \__,_|\__|
7+
|_| XML parser
8+
9+
Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
10+
Licensed under the MIT license:
11+
12+
Permission is hereby granted, free of charge, to any person obtaining
13+
a copy of this software and associated documentation files (the
14+
"Software"), to deal in the Software without restriction, including
15+
without limitation the rights to use, copy, modify, merge, publish,
16+
distribute, sublicense, and/or sell copies of the Software, and to permit
17+
persons to whom the Software is furnished to do so, subject to the
18+
following conditions:
19+
20+
The above copyright notice and this permission notice shall be included
21+
in all copies or substantial portions of the Software.
22+
23+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
24+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
25+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
26+
NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
27+
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
28+
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
29+
USE OR OTHER DEALINGS IN THE SOFTWARE.
30+
31+
SPDX-License-Identifier: MIT
32+
*/
33+
34+
#if ! defined(EXPAT_ENTITIES_H)
35+
# define EXPAT_ENTITIES_H 1
36+
37+
# include "expat_config.h" // for XML_GE
38+
# include "expat_external.h" // for XML_Char
39+
# include "internal.h" // for XML_NONTESTING_STATIC
40+
# include <stdbool.h> // for size_t
41+
# include <stddef.h> // for size_t
42+
43+
typedef struct {
44+
const XML_Char *name;
45+
const XML_Char *textPtr;
46+
size_t textLen; /* length in XML_Chars */
47+
size_t processed; /* # of processed bytes - when suspended */
48+
const XML_Char *systemId;
49+
const XML_Char *base;
50+
const XML_Char *publicId;
51+
const XML_Char *notation;
52+
bool open;
53+
bool hasMore; /* true if entity has not been completely processed */
54+
/* An entity can be open while being already completely processed (!hasMore).
55+
The reason is the delayed closing of entities until their inner
56+
entities are processed and closed */
57+
bool is_param;
58+
bool is_internal; /* true if declared in internal subset outside PE */
59+
# if XML_GE == 1
60+
/* Indirect accounting bytes charged when this entity is expanded: 1 per text
61+
character, plus each reference's "&name;"/"%name;" token length and its own
62+
expansion. Matches XML_ACCOUNT_ENTITY_EXPANSION, so it is not the
63+
replacement-text size. 0 means "not computed yet" (an empty entity is 0
64+
too, told apart by textLen == 0). */
65+
XmlBigCount expandedSize;
66+
bool beingAnalyzed; /* on the resolveEntityClosureExpandedSize depth-first
67+
search stack; used for cycle detection */
68+
const XML_Char
69+
*scanPtr; /* cursor position into the entity's replacement text; NULL when
70+
`textPtr` is NULL, else a pointer into the entity value,
71+
ranging from `.textPtr` to `.textPtr + .textLen`. */
72+
# endif /* XML_GE == 1 */
73+
} ENTITY;
74+
75+
# if XML_GE == 1
76+
/* How a scanEntityText call ended. */
77+
enum EntityScanResult {
78+
ENTITY_SCAN_COMPLETE, /* reached end of text; *expandedSize is final */
79+
ENTITY_SCAN_BLOCKED, /* stopped at a defined entity whose expanded
80+
size has not been computed yet; *blockerOut
81+
names the entity whose size to compute
82+
first */
83+
ENTITY_SCAN_OVERFLOW /* the expanded size would exceed XmlBigCount;
84+
callers must abort parsing */
85+
};
86+
87+
XML_NONTESTING_STATIC int isCDataCommentOrPIStart(const XML_Char *pos,
88+
size_t maxLen,
89+
size_t *openTextLen);
90+
91+
XML_NONTESTING_STATIC int isPredefinedEntityName(const XML_Char *name,
92+
size_t nameLen);
93+
94+
XML_NONTESTING_STATIC enum EntityScanResult
95+
scanEntityText(XML_Parser parser, ENTITY *entity, const XML_Char **posPtr,
96+
XmlBigCount *expandedSize, ENTITY **blockerOut);
97+
# endif /* XML_GE == 1 */
98+
99+
#endif // ! defined(EXPAT_ENTITIES_H)

‎Modules/expat/expat.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
Copyright (c) 2024 Taichi Haradaguchi <20001722@ymail.ne.jp>
2222
Copyright (c) 2025 Matthew Fernandez <matthew.fernandez@gmail.com>
2323
Copyright (c) 2026 Braian Plaku <braianplaku@gmail.com>
24+
Copyright (c) 2026 Xisco Fauli <xiscofauli@libreoffice.org>
2425
Licensed under the MIT license:
2526
2627
Permission is hereby granted, free of charge, to any person obtaining
@@ -1084,7 +1085,7 @@ enum XML_Parser_Property {
10841085
# if defined(XML_TESTING)
10851086
XML_PROP_INVALID = 0,
10861087
# endif
1087-
# if XML_GE == 1
1088+
# if defined(XML_GE) && XML_GE == 1
10881089
XML_PROP_ALLOC_TRACKER_ACTIVATION_THRESHOLD = 1, // of type `uint64_t`
10891090
XML_PROP_ALLOC_TRACKER_MAXIMUM_AMPLIFICATION = 2, // of type `double`
10901091
XML_PROP_BILLION_LAUGHS_ACTIVATION_THRESHOLD = 3, // of type `uint64_t`
@@ -1146,7 +1147,7 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled);
11461147
See https://semver.org
11471148
*/
11481149
# define XML_MAJOR_VERSION 2
1149-
# define XML_MINOR_VERSION 9
1150+
# define XML_MINOR_VERSION 10
11501151
# define XML_MICRO_VERSION 0
11511152

11521153
# ifdef __cplusplus

‎Modules/expat/expat_external.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
Copyright (c) 2001-2002 Greg Stein <gstein@users.sourceforge.net>
1313
Copyright (c) 2002-2006 Karl Waclawek <karl@waclawek.net>
1414
Copyright (c) 2016 Cristian Rodríguez <crrodriguez@opensuse.org>
15-
Copyright (c) 2016-2025 Sebastian Pipping <sebastian@pipping.org>
15+
Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
1616
Copyright (c) 2017 Rhodri James <rhodri@wildebeest.org.uk>
1717
Copyright (c) 2018 Yury Gribov <tetra2005@gmail.com>
1818
Copyright (c) 2026 Matthew Fernandez <matthew.fernandez@gmail.com>

‎Modules/expat/internal.h‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
Copyright (c) 2026 Matthew Wozniczka <mattheww@simba.com>
3030
Copyright (c) 2026 Braian Plaku <braianplaku@gmail.com>
3131
Copyright (c) 2026 Florian Schmaus <florian.schmaus@codasip.com>
32+
Copyright (c) 2026 Brooks Davis <brooks@one-eyed-alien.net>
3233
Licensed under the MIT license:
3334
3435
Permission is hereby granted, free of charge, to any person obtaining
@@ -90,11 +91,10 @@
9091
# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u"
9192
# endif
9293
# else
93-
# include <inttypes.h> // PRIdPTR, PRIuPTR
9494
# define EXPAT_FMT_LLX(midpart) "%" midpart "llx"
9595
# define EXPAT_FMT_ULL(midpart) "%" midpart "llu"
96-
# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart PRIdPTR
97-
# define EXPAT_FMT_SIZE_T(midpart) "%" midpart PRIuPTR
96+
# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "td"
97+
# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "zu"
9898
# endif
9999

100100
# ifndef UNUSED_P
@@ -127,6 +127,8 @@ union expat_align {
127127

128128
# include "expat.h" // so we can use type XML_Parser below
129129

130+
typedef unsigned long long XmlBigCount;
131+
130132
void _INTERNAL_trim_to_complete_utf8_characters(const char *from,
131133
const char **fromLimRef);
132134

‎Modules/expat/refresh.sh‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@ fi
1212

1313
# Update this when updating to a new version after verifying that the changes
1414
# the update brings in are good. These values are used for verifying the SBOM, too.
15-
expected_libexpat_tag="R_2_9_0"
16-
expected_libexpat_version="2.9.0"
17-
expected_libexpat_sha256="16afbb9cefead2aa278105cf27d9f597bde7fbf3dbb85015857ca7ca6a4e89ba"
15+
expected_libexpat_tag="R_2_10_0"
16+
expected_libexpat_version="2.10.0"
17+
expected_libexpat_sha256="5466a341f9c692ef7a958a6881311be597f8e1ce345984cf78414f54793dea4c"
1818

1919
expat_dir="$(realpath "$(dirname -- "${BASH_SOURCE[0]}")")"
2020
cd ${expat_dir}
@@ -31,6 +31,7 @@ declare -a lib_files
3131
lib_files=(
3232
ascii.h
3333
asciitab.h
34+
entities.h
3435
expat.h
3536
expat_external.h
3637
fallthrough.h

0 commit comments

Comments
 (0)