[Midnightbsd-cvs] [MidnightBSD/src] 4e48f4: Import expat 2.8.4 (trimmed)

[Lucas Holt]

  Branch: refs/heads/stable/4.0
  Home:   https://github.com/MidnightBSD/src
  Commit: 4e48f4b395b6962c8ffcd8f23cbcd1b8c958a4b2
      https://github.com/MidnightBSD/src/commit/4e48f4b395b6962c8ffcd8f23cbcd1b8c958a4b2
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-09-01 (Tue, 01 Sep 2026)

  Changed paths:
    M Changes
    M README.md
    M configure.ac
    M doc/reference.html
    M doc/xmlwf.1
    M doc/xmlwf.xml
    M fix-xmltest-log.sh
    M lib/expat.h
    M lib/internal.h
    M lib/random_getentropy.c
    M lib/xmlparse.c
    M lib/xmltok.h
    M tests/basic_tests.c
    M tests/misc_tests.c

  Log Message:
  -----------
  Import expat 2.8.4 (trimmed)

Security fixes:

CVE-2026-66046, CVE-2026-76641 -- quadratic runtime in attribute
"isCdata" lookups allowing denial of service through moderately sized
crafted XML input (CWE-407).  Default attribute lookups now go through
a hash table instead of a linear scan.  Closely related to
CVE-2026-45186, fixed in 2.8.1.  CVSS 3.1
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5).

CVE-2026-76957 -- custom encoding callbacks are now protected against
parser re-entry.  Closely related to CVE-2026-50219, CVE-2026-56131 and
CVE-2026-56412, all fixed in 2.8.2.

CVE-2026-76956 -- inverted getentropy() return handling.  getentropy()
returns 0 on success, but the result was assigned to a bool directly,
inverting the test.  This allowed hash flooding denial of service where
getentropy is the only high quality entropy extractor.  CVSS 3.1
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9).

AI-Assisted-by: Claude Opus 5
Signed-off-by: Lucas Holt <luke at foolishgames.com>


  Commit: e0b98f53b20e2cf89e3fd725637a5c7b4d16ec00
      https://github.com/MidnightBSD/src/commit/e0b98f53b20e2cf89e3fd725637a5c7b4d16ec00
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-09-02 (Wed, 02 Sep 2026)

  Changed paths:
    M contrib/expat/Changes
    M contrib/expat/README.md
    M contrib/expat/configure.ac
    M contrib/expat/doc/reference.html
    M contrib/expat/doc/xmlwf.1
    M contrib/expat/doc/xmlwf.xml
    M contrib/expat/fix-xmltest-log.sh
    M contrib/expat/lib/expat.h
    M contrib/expat/lib/internal.h
    M contrib/expat/lib/random_getentropy.c
    M contrib/expat/lib/xmlparse.c
    M contrib/expat/lib/xmltok.h
    M contrib/expat/tests/basic_tests.c
    M contrib/expat/tests/misc_tests.c

  Log Message:
  -----------
  Merge expat 2.8.4 from vendor branch


  Commit: c564b211346a57bebde70b34a5013915a376958f
      https://github.com/MidnightBSD/src/commit/c564b211346a57bebde70b34a5013915a376958f
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-09-02 (Wed, 02 Sep 2026)

  Changed paths:
    M UPDATING
    M lib/libexpat/expat_config.h

  Log Message:
  -----------
  lib/libexpat: update for expat 2.8.4

Bump the version strings in the in-tree expat_config.h to 2.8.4.

SRCS needs no change: 2.8.4 adds no new compilation units.  The trimmed
2.8.4 file set is identical to 2.8.3's, so no Xlist change either.

Note that CVE-2026-76956, the inverted getentropy() return handling
fixed upstream, does not affect us: random_getentropy.c is not in SRCS
and expat_config.h does not define HAVE_GETENTROPY.  libbsdxml draws
entropy through arc4random_buf(), getrandom() and /dev/urandom.

Note the expat 2.8.4 update in UPDATING.

AI-Assisted-by: Claude Opus 5
Signed-off-by: Lucas Holt <luke at foolishgames.com>
(cherry picked from commit 2b54fe85701c90e411e798f01a93608dd0120615)


Compare: https://github.com/MidnightBSD/src/compare/026909d0ee8f...c564b211346a

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications