]> git.ipfire.org Git - thirdparty/openembedded/openembedded-core.git/commit
expat: upgrade to 2.7.3
authorRoss Burton <ross.burton@arm.com>
Fri, 26 Sep 2025 16:32:31 +0000 (17:32 +0100)
committerRichard Purdie <richard.purdie@linuxfoundation.org>
Wed, 1 Oct 2025 09:52:51 +0000 (10:52 +0100)
commit6b1833cd2eb78be55ba03da73937358fcf25d9ec
treeb65af6deda988b53c084d43c1e1c01c97658bbd5
parentf9fa240a6788188174c8080a78018ed9ce402f54
expat: upgrade to 2.7.3

Security fixes:
- Fix alignment of internal allocations for some non-amd64 architectures
  (e.g. sparc32); fixes up on the fix to CVE-2025-59375 from #1034 (of
  Expat 2.7.2 and related backports)

- Fix a class of false positives where input should have been rejected
  with error XML_ERROR_ASYNC_ENTITY; regression from CVE-2024-8176 fix
  pull request #973 (of Expat 2.7.0 and related backports). Please check
  the added unit tests for example documents.

Other changes:
- Prove and regression-proof absence of integer overflow from function
  expat_realloc
- Remove "harmless" cast that truncated a size_t to unsigned
- Autotools: Remove "ln -s" discovery
- docs: Be consistent with use of floating point around
  XML_SetAllocTrackerMaximumAmplification
- docs: Make it explicit that XML_GetCurrentColumnNumber starts at 0
- docs: Better integrate the effect of the activation thresholds
- docs: Fix an in-comment typo in expat.h
- docs: Fix a typo in README.md
- docs: Improve change log of release 2.7.2
- xmlwf: Resolve use of functions XML_GetErrorLineNumber and
  XML_GetErrorColumnNumber
- Windows: Normalize .bat files to CRLF line endings
- Version info bumped from 12:0:11 (libexpat*.so.1.11.0) to 12:1:11
  (libexpat*.so.1.11.1); see https://verbump.de/ for what these numbers
  do

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
meta/recipes-core/expat/expat_2.7.3.bb [moved from meta/recipes-core/expat/expat_2.7.2.bb with 92% similarity]