expat: Update to version 2.4.4

- Update from 2.4.2 to 2.4.4
- Update of rootfile
- Changelog
   Release 2.4.4 Sun January 30 2022
        Security fixes:
            #550  CVE-2022-23852 -- Fix signed integer overflow
                    (undefined behavior) in function XML_GetBuffer
                    (that is also called by function XML_Parse internally)
                    for when XML_CONTEXT_BYTES is defined to >0 (which is both
                    common and default).
                    Impact is denial of service or more.
            #551  CVE-2022-23990 -- Fix unsigned integer overflow in function
                    doProlog triggered by large content in element type
                    declarations when there is an element declaration handler
                    present (from a prior call to XML_SetElementDeclHandler).
                    Impact is denial of service or more.
        Bug fixes:
            #544 #545  xmlwf: Fix a memory leak on output file opening error
        Other changes:
            #546  Autotools: Fix broken CMake support under Cygwin
            #554  Windows: Add missing files to the installer to fix
                    compilation with CMake from installed sources
            #552 #554  Version info bumped from 9:3:8 to 9:4:8;
                    see https://verbump.de/ for what these numbers do
   Release 2.4.3 Sun January 16 2022
        Security fixes:
            #531 #534  CVE-2021-45960 -- Fix issues with left shifts by >=29 places
                    resulting in
                      a) realloc acting as free
                      b) realloc allocating too few bytes
                      c) undefined behavior
                    depending on architecture and precise value
                    for XML documents with >=2^27+1 prefixed attributes
                    on a single XML tag a la
                    "<r xmlns:a='[..]' a:a123='[..]' [..] />"
                    where XML_ParserCreateNS is used to create the parser
                    (which needs argument "-n" when running xmlwf).
                    Impact is denial of service, or more.
            #532 #538  CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow
                    on variable m_groupSize in function doProlog leading
                    to realloc acting as free.
                    Impact is denial of service or more.
            #539  CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows
                    near memory allocation at multiple places.  Mitre assigned
                    a dedicated CVE for each involved internal C function:
                    - CVE-2022-22822 for function addBinding
                    - CVE-2022-22823 for function build_model
                    - CVE-2022-22824 for function defineAttribute
                    - CVE-2022-22825 for function lookup
                    - CVE-2022-22826 for function nextScaffoldPart
                    - CVE-2022-22827 for function storeAtts
                    Impact is denial of service or more.
        Other changes:
            #535  CMake: Make call to file(GENERATE [..]) work for CMake <3.19
            #541  Autotools|CMake: MinGW: Make run.sh(.in) work for Cygwin
                    and MSYS2 by not going through Wine on these platforms
            #527 #528  Address compiler warnings
            #533 #543  Version info bumped from 9:2:8 to 9:3:8;
                    see https://verbump.de/ for what these numbers do
        Infrastructure:
            #536  CI: Check for realistic minimum CMake version
            #529 #539  CI: Cover compilation with -m32
            #529  CI: Store coverage reports as artifacts for download
            #528  CI: Upgrade Clang from 11 to 13

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>

diff --git a/config/rootfiles/common/expat b/config/rootfiles/common/expat
index ea0c2ded59131902f952497f67e8d22402c0871a..47ce600ad6d2fd19af64e7e1278a06743980376d 100644 (file)
--- a/config/rootfiles/common/expat
+++ b/config/rootfiles/common/expat
@@ -2,22 +2,21 @@
 #usr/include/expat.h
 #usr/include/expat_config.h
 #usr/include/expat_external.h
-#usr/lib/cmake/expat-2.4.2
-#usr/lib/cmake/expat-2.4.2/expat-config-version.cmake
-#usr/lib/cmake/expat-2.4.2/expat-config.cmake
-#usr/lib/cmake/expat-2.4.2/expat-noconfig.cmake
-#usr/lib/cmake/expat-2.4.2/expat.cmake
+#usr/lib/cmake/expat-2.4.4
+#usr/lib/cmake/expat-2.4.4/expat-config-version.cmake
+#usr/lib/cmake/expat-2.4.4/expat-config.cmake
+#usr/lib/cmake/expat-2.4.4/expat-noconfig.cmake
+#usr/lib/cmake/expat-2.4.4/expat.cmake
 #usr/lib/libexpat.a
 #usr/lib/libexpat.la
 #usr/lib/libexpat.so
 usr/lib/libexpat.so.1
-usr/lib/libexpat.so.1.8.2
+usr/lib/libexpat.so.1.8.4
 #usr/lib/pkgconfig/expat.pc
 #usr/share/doc/expat
-#usr/share/doc/expat-2.4.2
-#usr/share/doc/expat-2.4.2/ok.min.css
-#usr/share/doc/expat-2.4.2/reference.html
-#usr/share/doc/expat-2.4.2/style.css
-#usr/share/doc/expat-2.4.2/valid-xhtml10.png
+#usr/share/doc/expat-2.4.4
+#usr/share/doc/expat-2.4.4/ok.min.css
+#usr/share/doc/expat-2.4.4/reference.html
+#usr/share/doc/expat-2.4.4/style.css
 #usr/share/doc/expat/AUTHORS
 #usr/share/doc/expat/changelog

diff --git a/lfs/expat b/lfs/expat
index b2df59ca3d1382123fd6f9a79b9140a7b48582fa..3898889ad9f67f53d58420e722320eb4bf01c24f 100644 (file)
--- a/lfs/expat
+++ b/lfs/expat
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.4.2
+VER        = 2.4.4
 
 THISAPP    = expat-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 58780ad6944d02f6cf6ba332838694b2
+$(DL_FILE)_MD5 = 99392ce3377777ab0dc8b0f14beda793
 
 install : $(TARGET)
 
@@ -76,6 +76,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
        cd $(DIR_APP) && make $(MAKETUNING)
        cd $(DIR_APP) && make install
        cd $(DIR_APP) && install -v -m755 -d /usr/share/doc/$(THISAPP)
-       cd $(DIR_APP) && install -v -m644 doc/*.{html,png,css} /usr/share/doc/$(THISAPP)
+       cd $(DIR_APP) && install -v -m644 doc/*.{html,css} /usr/share/doc/$(THISAPP)
        @rm -rf $(DIR_APP)
        @$(POSTBUILD)