mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-11 21:49:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

expat: fix CVE-2026-56404

Browse Source 
This patch applies the upstream fix shown in [1] as referenced by [2].

[1] babfc48090
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56404

(From OE-Core rev: 5ac52606f2aae12323b29026e3d8af24a9c278bf)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Deepak Rathore
2026-07-31 11:26:18 +05:30
committed by Paul Barker
parent 65887ca9e7
commit 97081e82e0
2 changed files with 46 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
meta/recipes-core/expat/expat/CVE-2026-56404.patch Normal file
View File

@@ -0,0 +1,45 @@
From d8e09a54fa9214e64d8e73057ca6918d08857022 Mon Sep 17 00:00:00 2001
From: netliomax25-code <netliomax25@gmail.com>
Date: Thu, 28 May 2026 12:44:11 +0530
Subject: [PATCH 04/17] lib: protect function addBinding from signed integer
overflow
CVE: CVE-2026-56404
Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/babfc48090977cbf7be24b2c48f6053dca75c164]
(cherry picked from commit babfc48090977cbf7be24b2c48f6053dca75c164)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
expat/lib/xmlparse.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
index 12bbe23e..9d21e136 100644
--- a/expat/lib/xmlparse.c
+++ b/expat/lib/xmlparse.c
@@ -4456,6 +4456,10 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId,
}
for (len = 0; uri[len]; len++) {
+ /* Detect and prevent signed integer overflow */
+ if (len == INT_MAX) {
+ return XML_ERROR_NO_MEMORY;
+ }
if (isXML && (len > xmlLen || uri[len] != xmlNamespace[len]))
isXML = XML_FALSE;
@@ -4496,8 +4500,13 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId,
if (isXMLNS)
return XML_ERROR_RESERVED_NAMESPACE_URI;
- if (parser->m_namespaceSeparator)
+ if (parser->m_namespaceSeparator) {
+ /* Detect and prevent signed integer overflow */
+ if (len == INT_MAX) {
+ return XML_ERROR_NO_MEMORY;
+ }
len++;
+ }
if (parser->m_freeBindingList) {
b = parser->m_freeBindingList;
if (len > b->uriAlloc) {

1
meta/recipes-core/expat/expat_2.6.4.bb
View File

@@ -64,6 +64,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56403_p1.patch;striplevel=2 \
file://CVE-2026-56403_p2.patch;striplevel=2 \
file://CVE-2026-56408.patch;striplevel=2 \
file://CVE-2026-56404.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"