[Midnightbsd-cvs] [MidnightBSD/src] 6acbb7: Import expat 2.8.5 (trimmed)

Tue Sep 22 12:11:32 EDT 2026

  Branch: refs/heads/stable/4.0
  Home:   https://github.com/MidnightBSD/src
  Commit: 6acbb705bae9f70c51d5784994cabe313664a6dd
      https://github.com/MidnightBSD/src/commit/6acbb705bae9f70c51d5784994cabe313664a6dd
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-09-22 (Tue, 22 Sep 2026)

  Changed paths:
    M Changes
    M Makefile.am
    M Makefile.in
    M README.md
    M configure.ac
    M doc/Makefile.in
    M doc/reference.html
    M doc/xmlwf.1
    M doc/xmlwf.xml
    M examples/Makefile.in
    M fuzz/xml_lpm_fuzzer.cpp
    M fuzz/xml_parse_fuzzer.c
    M fuzz/xml_parsebuffer_fuzzer.c
    M lib/Makefile.am
    M lib/Makefile.in
    M lib/expat.h
    M lib/expat_external.h
    A lib/hash_table.h
    M lib/internal.h
    M lib/xmlparse.c
    M lib/xmlrole.c
    M lib/xmlrole.h
    M lib/xmltok.c
    M lib/xmltok.h
    M lib/xmltok_impl.c
    M lib/xmltok_ns.c
    M tests/Makefile.am
    M tests/Makefile.in
    M tests/acc_tests.h
    M tests/alloc_tests.h
    M tests/basic_tests.c
    M tests/basic_tests.h
    M tests/benchmark/Makefile.in
    M tests/chardata.h
    M tests/common.h
    M tests/dummy.h
    M tests/handlers.h
    A tests/hash_tests.c
    A tests/hash_tests.h
    M tests/memcheck.c
    M tests/memcheck.h
    M tests/minicheck.h
    M tests/misc_tests.c
    M tests/misc_tests.h
    M tests/ns_tests.h
    M tests/nsalloc_tests.c
    M tests/nsalloc_tests.h
    M tests/runtests.c
    M tests/structdata.h
    M tests/xmltest.sh
    M xmlwf/Makefile.in
    M xmlwf/unixfilemap.c
    M xmlwf/xmlfile.c
    M xmlwf/xmlfile.h
    M xmlwf/xmlmime.h
    M xmlwf/xmlwf.c
    M xmlwf/xmlwf_helpgen.py
    M xmlwf/xmlwf_helpgen.sh

  Log Message:
  -----------
  Import expat 2.8.5 (trimmed)

Security fixes:

CVE-2026-93990 -- reject high surrogates not followed by a low
surrogate during UTF-16 decoding.  Previously, malformed UTF-16 could
be smuggled through Expat into the application, with impact depending
on how the application handled it; validating this was Expat's job.
Similar to CVE-2022-25235.  CVSS 3.1
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8).

Bug fixes: an OOM-related memory leak on a failed overflow check, memory
alignment on 128-bit pointer architectures, and xmlwf output file close
error handling.  XML declaration versions other than 1.[0-9]+ are now
rejected, XML_SetHashSalt now emits a deprecation warning, and the
internal FASTCALL/PTRCALL/PTRFASTCALL macros are gone.

AI-Assisted-by: Claude Fable 5.1
Signed-off-by: Lucas Holt <luke at foolishgames.com>

  Commit: 576e926765fd3ba2497494c5a19af773bf2289af
      https://github.com/MidnightBSD/src/commit/576e926765fd3ba2497494c5a19af773bf2289af
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-09-22 (Tue, 22 Sep 2026)

  Changed paths:
    M contrib/expat/Changes
    M contrib/expat/Makefile.am
    M contrib/expat/Makefile.in
    M contrib/expat/README.md
    M contrib/expat/configure.ac
    M contrib/expat/doc/Makefile.in
    M contrib/expat/doc/reference.html
    M contrib/expat/doc/xmlwf.1
    M contrib/expat/doc/xmlwf.xml
    M contrib/expat/examples/Makefile.in
    M contrib/expat/fuzz/xml_lpm_fuzzer.cpp
    M contrib/expat/fuzz/xml_parse_fuzzer.c
    M contrib/expat/fuzz/xml_parsebuffer_fuzzer.c
    M contrib/expat/lib/Makefile.am
    M contrib/expat/lib/Makefile.in
    M contrib/expat/lib/expat.h
    M contrib/expat/lib/expat_external.h
    A contrib/expat/lib/hash_table.h
    M contrib/expat/lib/internal.h
    M contrib/expat/lib/xmlparse.c
    M contrib/expat/lib/xmlrole.c
    M contrib/expat/lib/xmlrole.h
    M contrib/expat/lib/xmltok.c
    M contrib/expat/lib/xmltok.h
    M contrib/expat/lib/xmltok_impl.c
    M contrib/expat/lib/xmltok_ns.c
    M contrib/expat/tests/Makefile.am
    M contrib/expat/tests/Makefile.in
    M contrib/expat/tests/acc_tests.h
    M contrib/expat/tests/alloc_tests.h
    M contrib/expat/tests/basic_tests.c
    M contrib/expat/tests/basic_tests.h
    M contrib/expat/tests/benchmark/Makefile.in
    M contrib/expat/tests/chardata.h
    M contrib/expat/tests/common.h
    M contrib/expat/tests/dummy.h
    M contrib/expat/tests/handlers.h
    A contrib/expat/tests/hash_tests.c
    A contrib/expat/tests/hash_tests.h
    M contrib/expat/tests/memcheck.c
    M contrib/expat/tests/memcheck.h
    M contrib/expat/tests/minicheck.h
    M contrib/expat/tests/misc_tests.c
    M contrib/expat/tests/misc_tests.h
    M contrib/expat/tests/ns_tests.h
    M contrib/expat/tests/nsalloc_tests.c
    M contrib/expat/tests/nsalloc_tests.h
    M contrib/expat/tests/runtests.c
    M contrib/expat/tests/structdata.h
    M contrib/expat/tests/xmltest.sh
    M contrib/expat/xmlwf/Makefile.in
    M contrib/expat/xmlwf/unixfilemap.c
    M contrib/expat/xmlwf/xmlfile.c
    M contrib/expat/xmlwf/xmlfile.h
    M contrib/expat/xmlwf/xmlmime.h
    M contrib/expat/xmlwf/xmlwf.c
    M contrib/expat/xmlwf/xmlwf_helpgen.py
    M contrib/expat/xmlwf/xmlwf_helpgen.sh

  Log Message:
  -----------
  Merge commit '6acbb705ba' into stable/4.0

  Commit: f97e36aa7a33ca2ff91986408e619c6669cfb18d
      https://github.com/MidnightBSD/src/commit/f97e36aa7a33ca2ff91986408e619c6669cfb18d
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-09-22 (Tue, 22 Sep 2026)

  Changed paths:
    M UPDATING
    M lib/libexpat/expat_config.h

  Log Message:
  -----------
  lib/libexpat: update for expat 2.8.5

Bump the version strings in the in-tree expat_config.h to 2.8.5.

SRCS needs no change: the three files new in 2.8.5 are a header
(lib/hash_table.h) and its tests (tests/hash_tests.[ch]), so there
are no new compilation units.  expat_config.h.in is unchanged
upstream, so no other config entries need syncing.  The exported
symbol set of libbsdxml.so.4 is unchanged.

XML_SetHashSalt now carries a deprecation attribute; nothing in the
tree outside contrib/expat calls it.

Note the expat 2.8.5 update in UPDATING.

AI-Assisted-by: Claude Fable 5.1
Signed-off-by: Lucas Holt <luke at foolishgames.com>
(cherry picked from commit 21db3b4ff695a944151d5da1e6dd060633a4e571)

Compare: https://github.com/MidnightBSD/src/compare/8742bbd93fa9...f97e36aa7a33

To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications