1 __ __ _ 2 ___\ \/ /_ __ __ _| |_ 3 / _ \\ /| '_ \ / _` | __| 4 | __// \| |_) | (_| | |_ 5 \___/_/\_\ .__/ \__,_|\__| 6 |_| XML parser 7 8/////////////////////////////////////////////////////////////////////////////// 9// <blink>Expat has UNFIXED SECURITY ISSUES!</blink> // 10// Please see https://github.com/libexpat/libexpat/issues/1160 for details. // 11// // 12// Starting 2026-08-01, for up to six months my work maintaining libexpat // 13// will be funded by the City of Munich as part of their // 14// Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html) // 15// — thank you! // 16// // 17// If your business relies on Expat beyond January 2027, please consider // 18// funding the maintenance of Expat to ensure its health and security for // 19// you and others. Thank you! // 20// // 21// Sebastian Pipping -- Berlin, 2026-09-22 // 22/////////////////////////////////////////////////////////////////////////////// 23 24Release 2.9.0 Mon October 5 2026 25 Security fixes: 26 #1392 CVE-2026-102633 -- Integer overflow in function 27 expat_realloc on 32bit platforms 28 #1393 CVE-2026-77214 -- Validate parameter `len` against available 29 buffer capacity in XML_ParseBuffer 30 31 Bug fixes: 32 #1387 lib: Handle OOM when copying encodingName in XML_ParserReset 33 34 New features: 35 #1327 lib: Introduce new "Properties API" to get and set 36 scalar properties for a single parser instance. 37 There are six new functions: 38 - XML_GetPropertyBool 39 - XML_GetPropertyDouble 40 - XML_GetPropertyUInt64 41 - XML_SetPropertyBool 42 - XML_SetPropertyDouble 43 - XML_SetPropertyUInt64 44 And two new enums: 45 - XML_Prop_Error 46 - XML_Parser_Property 47 #1323 lib: Introduce five new 64bit location API functions: 48 - XML_GetCurrentByteCount64 49 - XML_GetCurrentByteIndex64 50 - XML_GetCurrentColumnNumber64 51 - XML_GetCurrentLineNumber64 52 - XML_GetInputContext64 53 These five functions closely mirror their predecessors 54 but are not prone to 32bit integer wrap-around. 55 56 Other changes: 57 #1391 docs: Document the scope of function XML_GetErrorCode 58 #1395 docs: Document length expectations for XML_ParseBuffer 59 #1394 lib: Call unknown encoding release before parser teardown 60 #1370 #1373 lib: Drop (disabled-by-default) attribute info feature 61 These things are now gone: 62 - Public function XML_GetAttributeInfo 63 - Public struct XML_AttrInfo 64 - Macro XML_ATTR_INFO 65 These things are now causing build errors: 66 - Configure option --enable-xml-attr-info 67 - CMake option -DEXPAT_ATTR_INFO=ON 68 #1379 #1382 lib: Drop (disabled-by-default) minimum size feature 69 These things are now gone: 70 - Macro XML_MIN_SIZE 71 These things are now causing build errors: 72 - Configuring with -DXML_MIN_SIZE for CPPFLAGS/CFLAGS 73 - CMake option -DEXPAT_MIN_SIZE=ON 74 #1323 #1411 lib: Deprecate macro XML_LARGE_SIZE (use the new 64bit 75 location API functions instead please) 76 #1323 lib: Deprecate five location API functions that are cursed 77 with integer wrap-around: 78 - XML_GetCurrentByteCount 79 - XML_GetCurrentByteIndex 80 - XML_GetCurrentColumnNumber 81 - XML_GetCurrentLineNumber 82 - XML_GetInputContext 83 #1399 lib: Guard against out-of-handler use of XML_DefaultCurrent 84 #1400 lib: Use size_t for bytesAllocated and peakBytesAllocated 85 #1401 #1402 .. 86 #1404 #1405 lib|xmlwf|tests: Unify use of xcslen, xcscmp and xcsncmp 87 #1406 xmlwf: Add missing `#include "expat.h"` 88 #1389 #1396 Version info bumped from 13:5:12 (libexpat*.so.1.12.5) 89 to 14:0:13 (libexpat*.so.1.13.0); see https://verbump.de/ 90 for what these numbers do 91 92 Infrastructure: 93 #1386 CI: Bump MinGW Clang from 23.1.1 to 23.1.2 94 #1410 CI: Bump Fil-C from 0.685 to 0.686 95 #1388 CI: Adapt to breaking changes regarding windows-11-arm image 96 #1403 CI: Limit package cache download runtime 97 98 Special thanks to: 99 Bénédikt Tran 100 Berkay Eren Ürün 101 Fabian Wahle (Hap Security) 102 Filippo Tedeschi 103 Junki Lee 104 Matthew Fernandez 105 Scott Moore 106 Wade Sparks III 107 and 108 City of Munich Open Source Sabbatical 109 VulnCheck 110 111Release 2.8.5 Tue September 22 2026 112 Security fixes: 113 #1282 CVE-2026-93990 -- Reject high surrogates not followed by a 114 low surrogate during UTF-16 decoding; previously, malformed 115 UTF-16 could be smuggled into the application using Expat 116 and could cause arbitrary damage there, depending on how 117 malformed UTF-16 was handled inside the application; 118 validation was not their job but Expat's. This is similar 119 to past vulnerability CVE-2022-25235. 120 Upstream CVSS 3.1 vector: 121 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS score: 9.8) 122 123 Bug fixes: 124 #1346 lib: Fix OOM-related memory leak on a failed overflow check 125 #1371 lib: Fix memory alignment for architectures with 128bit 126 pointers like CHERI-RISC-V 127 #1367 xmlwf: Handle errors when closing output files 128 129 Other changes: 130 #1354 lib: Reject an XML declaration version other than `1.[0-9]+` 131 (which is less strict than XML 1.0r4 (fourth edition) 132 and matches XML 1.0r5 (fifth edition)) 133 #1362 lib: Make Clang, GCC and MSVC warn about use of function 134 XML_SetHashSalt that is deprecated since Expat 2.8.0 135 #1357 lib: Drop internal macros FASTCALL, PTRCALL, PTRFASTCALL 136 #1367 xmlwf: Document that with `-k` the last error determines the 137 xmlwf exit code in `--help` output 138 #1367 xmlwf: Make exit code 3 documentation match exit code 2 more 139 closely in `--help` output 140 #1352 #1353 CMake|Windows: Refrain from adding `/source-charset:utf-8` 141 for MSVC 142 #1366 #1374 Autotools: Be explicit about the minimum required version of 143 GNU Automake, currently version 1.13 of 2012-12-28 144 #1351 Autotools|macOS: Sync CMake templates with CMake 4.4.3 145 #1349 Replace some internal use of XML_Bool with standard bool 146 #1364 tests: Propagate xmltest.sh failures via exit status 147 #1360 tests|xmlwf: Add `#include "expat_config.h"` where missing 148 #1355 tests: Start covering hash table operation 149 #1350 #1369 tests: Drop __cplusplus leftovers 150 #1378 tests: Fix tail pointer when unlinking the last tracked 151 allocation 152 #1376 docs: Emphasize that XML_StopParser is not immediate 153 #1381 docs: Sync XML_FeatureEnum value list in doc/reference.html 154 #1356 #1361 Version info bumped from 13:4:12 (libexpat*.so.1.12.4) 155 to 13:5:12 (libexpat*.so.1.12.5); see https://verbump.de/ 156 for what these numbers do 157 158 Infrastructure: 159 #1347 Add missing .gitignore entries 160 #1360 CI: Detect missing `#include "expat_config.h"` 161 #1368 CI: Bump MinGW Clang from 23.0.1 to 23.1.1 162 #1377 CI: Bump Fil-C from 0.684 to 0.685 163 #1380 CI: Bump Cppcheck from 2.21.0 to 2.22.0 164 #1372 CI: Extract helper script `apply-htmltidy.sh` 165 #1366 #1374 Autotools: Start to also produce .tar.bz3 release tarballs 166 167 Special thanks to: 168 Afonso Januário 169 Braian Plaku 170 Florian Schmaus 171 Huang Wenbin 172 Kamila Szewczyk 173 Kartik Kenchi 174 Leo Camus 175 Matthew Fernandez 176 Stan Ulbrych 177 and 178 City of Munich Open Source Sabbatical 179 180Release 2.8.4 Mon August 31 2026 181 Security fixes: 182 #1321 #1331 CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from 183 "attribute isCdata lookups" that allowed denial of service 184 attacks through moderately sized crafted XML input 185 (CWE-407). 186 The vulnerability is closely related to past CVE-2026-45186 187 that was fixed with Expat 2.8.1. 188 Please note that a layer of compression around XML can 189 significantly reduce the minimum attack payload size. 190 Upstream CVSS 3.1 vector: 191 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) 192 (Note the "AV:N" for network/remote.) 193 #1322 CVE-2026-76957 -- Protect custom encoding callbacks from 194 parser re-entry. The vulnerability is closely related to 195 past issues CVE-2026-50219, CVE-2026-56131 and 196 CVE-2026-56412 that were all fixed with Expat 2.8.2. 197 #1326 CVE-2026-76956 -- Fix inverted getentropy() return handling 198 Allows for hash flooding denial of services in 199 configurations where getentropy is configured or detected 200 as the only high quality entropy extractor. 201 Upstream CVSS 3.1 vector: 202 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 5.9) 203 (Note the "AV:N" for network/remote.) 204 205 Other changes: 206 #1332 #1333 CMake: Only add `/source-charset:utf-8` when `/utf-8` is not 207 present 208 #1315 lib: Resolve (currently unreachable) undefined behavior from 209 overshifting a signed int to the left 210 #1325 #1334 lib: Support read-only hash table lookup with keys that are 211 not zero-terminated 212 #1340 lib: Use a C99 bool for `ENTITY.open` 213 #1319 Fix typo in comment 214 #1320 Sync file headers 215 #1328 #1329 Version info bumped from 13:3:12 (libexpat*.so.1.12.3) 216 to 13:4:12 (libexpat*.so.1.12.4); see https://verbump.de/ 217 for what these numbers do 218 219 Infrastructure: 220 #1317 #1335 CI: Cover compilation and execution with Fil-C 221 #1337 CI: Cover compilation and execution on riscv64 222 #1338 CI: Cover compilation and execution with Clang-based MinGW 223 #1339 CI: Cover compilation and execution on (big-endian) s390x 224 #1316 CI: Run test suite with musl, also 225 #1336 CI: Bump WASI SDK from 33 to 34 226 #1345 CI: Bump Clang from 22 to 23 227 228 Special thanks to: 229 Alberto Maschietto 230 Alexander Bluhm 231 Berkay Eren Ürün 232 Darren Carreras 233 Fabian Wahle (Hap Security) 234 Matteo Forzan 235 Matthew Fernandez 236 Sorrashut Kaewtaworn 237 Wade Sparks III 238 Zeyou Liu 239 and 240 City of Munich Open Source Sabbatical 241 Moonshot AI 242 VulnCheck 243 Z.ai 244 245Release 2.8.3 Mon August 10 2026 246 Security fixes: 247 #1296 CVE-2026-72522 -- Fix an out-of-bounds read and the resulting 248 infinite loop caused by treating low surrogates (Unicode) 249 the same as high surrogates in functions *_toUtf16. 250 Needs Expat compiled with 16bit character support 251 (e.g. with Firefox and/or on Windows) to be affected. 252 Upstream CVSS 3.1 vector: 253 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) 254 (Note the "AV:N" for network/remote, the "AV:L" in NVD by 255 Mitre is mistaken.) 256 Original bug report from Mozilla at: 257 https://bugzilla.mozilla.org/show_bug.cgi?id=2053153 258 259 Bug fixes: 260 #1297 #1300 lib: Fix support for 2+ GiB documents (regression from 2.8.2) 261 #1286 lib: Reject empty version in the XML declaration 262 #1305 #1306 lib: Fix printf format for AIX 263 264 Other changes: 265 #1309 CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX 266 #1295 CMake|Windows: Add a 64bit MinGW toolchain file 267 #1287 #1289 CMake|Windows: Start invoking MSVC with /source-charset:utf-8 268 #1289 CMake|Windows: Start requiring MSVC 2015 Update 2 or later 269 #1300 Document the current wrap-around issues with functions 270 - XML_GetCurrentByteIndex 271 - XML_GetCurrentColumnNumber 272 - XML_GetCurrentLineNumber 273 - XML_GetAttributeInfo 274 explicitly. 275 #1303 Address Clang Static Analyzer 22 warning 276 `core.NullPointerArithm` 277 #1313 #1314 Version info bumped from 13:2:12 (libexpat*.so.1.12.2) 278 to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/ 279 for what these numbers do 280 281 Infrastructure: 282 #1311 CI: Limit workflow runtime and package installation runtime 283 #1310 CI: Pin Cppcheck version for a robust CI 284 #1310 CI: Migrate Cppcheck CI from macOS to Linux 285 #1312 CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten 286 and WASI SDK 287 #1304 CI: Activate AddressSanitizer for MSVC Windows CI 288 #1308 CI: Introduce zizmor static analysis for GitHub Actions 289 #1308 CI: Start using `persist-credentials: false` with Git checkout 290 #1219 CI: Add a 7 day cooldown to Dependabot for GitHub Actions 291 #1302 #1303 CI: Bump Clang from 21 to 22 292 #1293 #1294 Update project status for 2026-08 293 #1301 #1307 Add SPDX license identifiers to the source code 294 295 Special thanks to: 296 Evgeny Kotkov 297 Henri Sivonen 298 Kartik Kenchi 299 Matthew Fernandez 300 Matthew Wozniczka 301 Stan Ulbrych 302 Tuukka Pasanen 303 William Woodruff 304 and 305 Anthropic 306 City of Munich Open Source Sabbatical 307 Mozilla Security Team 308 Subversion 309 zizmor static analysis 310 311Release 2.8.2 Thu June 25 2026 312 Security fixes: 313 #1246 CVE-2026-50219 -- Disallow calls to functions 314 `XML_GetBuffer`, `XML_Parse`, `XML_ParseBuffer`, 315 `XML_ParserFree`, `XML_ParserReset` to guard e.g. 316 Expat bindings from memory corruption; 317 this CPython issue is related: 318 https://github.com/python/cpython/issues/146169 319 #1267 CVE-2026-56131 -- Protect XML_ResumeParser from being called 320 from a handler, plugging a hole in the fix 321 to CVE-2026-50219 322 #1272 CVE-2026-56132 -- Fix out-of-bound scaffolding index store 323 in `doProlog` 324 #1229 #1232 CVE-2026-56403 -- Integer overflow in `storeAtts` 325 #1249 CVE-2026-56404 -- Integer overflow in `addBinding` 326 #1251 CVE-2026-56405 -- Integer overflow in `getAttributeId` 327 #1255 CVE-2026-56406 -- Integer overflow in `XML_ParseBuffer` 328 #1262 CVE-2026-56407 -- Integer overflow in `textLen` handling 329 #565 CVE-2026-56408 -- Integer overflow in `copyString` 330 (commit 16e2efd867ea8567ffa012210b52ef5918e20817) 331 #1259 CVE-2026-56409 -- xmlwf: Integer overflow in output path join 332 #1252 CVE-2026-56410 -- xmlwf: Integer overflow in 333 `resolveSystemId` 334 #1263 CVE-2026-56411 -- xmlwf: Integer overflow in notation list 335 allocation 336 #1278 CVE-2026-56412 -- Guard XML_TOK_DATA_CHARS handler calls in 337 `doCdataSection`, plugging a hole in the fix to 338 CVE-2026-50219 339 340 Bug fixes: 341 #1260 xmlwf: Escape names and base URI in meta output 342 #1266 xmlwf: Pick a safe quote for notation system and public IDs 343 344 Other changes: 345 #1257 CMake|Autotools: Stop using /dev/urandom by default 346 #1244 #1254 CMake: Fix guard for Unix sources of entropy 347 #1183 #1270 CMake|Windows: Add missing export for symbol 348 `XML_SetHashSalt16Bytes` 349 #1236 CMake: Mark option EXPAT_OSSFUZZ_BUILD as advanced 350 #1283 Limit output indentation for EXPAT_ENTITY_DEBUG=1 and 351 allow unlimited indentation via EXPAT_ENTITY_DEBUG=2 352 #565 Replace some loops by use of `memcpy`, `strlen`, `wcslen` 353 #1220 lib: Use a size_t for group sizes 354 #1221 lib: Fix too-conservative integer overflow check when 355 appending raw name 356 #1222 lib: Simplify attribute allocation/management logic 357 #1224 Update fallthrough annotations to satisfy Clang and GCC 358 #1226 lib: Remove unnecessary void * casts in random code 359 #1228 lib: Reduce scope of locals in storeAtts 360 #1230 lib: Count attributes with size_t variables 361 #1238 Minor get-buffer improvements 362 #1239 #1240 lib|tests: Include header expat_config.h first 363 #1241 lib: Shrink size of XML_GetBuffer 364 #1242 lib: Remove a legacy comment 365 #1243 lib: XML_ParserReset: Extract repeated linked-list move logic 366 #1243 lib: Unify entity free lists 367 #1247 lib: Fix use of '0' as boolean literal 368 #1248 lib: Make XML_Index overflow check more intuitive 369 #1256 lib: Use size_t for counting string/URI lengths 370 #1258 lib: XML_GetInputContext: Remove use of 0 for NULL 371 #1261 Comment typo fixes 372 #1275 Teach Memory Sanitizer semantics of randomization functions 373 #1276 #1281 Version info bumped from 13:1:12 (libexpat*.so.1.12.1) 374 to 13:2:12 (libexpat*.so.1.12.2); see https://verbump.de/ 375 for what these numbers do 376 377 Infrastructure: 378 #1231 perl-integration.yml: Bump to XML::Parser 2.59 379 #1237 emscripten.yml: Bump from Ubuntu 22.04 to 24.04 380 #1183 #1271 windows-build.yml: Cover completeness of file 381 libexpat.def.cmake 382 #1274 linux.yml: Make llvm-symbolizer available in CI 383 384 Special thanks to: 385 Alessandro Gario 386 Asher Darden 387 Christoph Reiter 388 Haris Hussain 389 Matthew Fernandez 390 Kartik Kenchi 391 Nick Begg 392 Sajin S 393 Yousef Shanableh 394 and 395 Anthropic 396 Astra Security 397 Trail of Bits 398 399Release 2.8.1 Sun May 10 2026 400 Security fixes: 401 #1216 CVE-2026-45186 -- Fix quadratic runtime from attribute name 402 collision checks that allowed denial of service attacks 403 through moderately sized crafted XML input (CWE-407). 404 Please note that a layer of compression around XML can 405 significantly reduce the minimum attack payload size. 406 Upstream CVSS 3.1 vector: 407 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) 408 (Note the "AV:N" for network/remote and the "AC:L" 409 for low complexity; the NVD entry from Mitre is mistaken.) 410 411 Other changes: 412 #1209 #1213 Drop more casts related to `void *` that C99 does not need 413 #1213 xmlwf: Streamline use of `mmap` 414 #1214 #1217 Version info bumped from 13:0:12 (libexpat*.so.1.12.0) 415 to 13:1:12 (libexpat*.so.1.12.1); see https://verbump.de/ 416 for what these numbers do 417 418 Infrastructure: 419 #1210 CI: Cover compilation with Visual Studio 18 2026 on Windows 420 #1215 CI: Cover compilation for ARM64 on Windows 421 #1212 CI: Bump WASI SDK from 32 to 33 422 423 Special thanks to: 424 Berkay Eren Ürün 425 Matthew Fernandez 426 Nick Wellnhofer 427 Tania Somanna 428 429Release 2.8.0 Fri April 24 2026 430 Security fixes: 431 #47 #1183 CVE-2026-41080 -- The existing hash flooding protection 432 (based on SipHash) only used 4 to 8 bytes of entropy for 433 a salt, when 16 bytes of salt are supported by the 434 implementation of SipHash used by Expat. Now full 16 bytes 435 of entropy are used to improve protection against hash 436 flooding attacks. 437 Existing API function XML_SetHashSalt is now deprecated 438 because of its limitations, and its use should be 439 considered a vulnerability. Please either use the new API 440 function XML_SetHashSalt16Bytes (with known-high-quality 441 entropy input only!) instead, or leave the derivation of 442 a 16-bytes hash salt from high quality entropy to Expat's 443 internal machinery (by *not* calling either of the two 444 XML_SetHashSalt* functions). 445 446 Bug fixes: 447 #1188 Avoid propagating /dev/urandom file descriptor to child 448 processes 449 #1193 Fix interpretation of `errno` after randomization calls 450 #1195 Avoid assuming uint8_t is a character type 451 452 Other changes: 453 #1180 #1199 Add support for `getentropy(3)` as a source of entropy; 454 this helps with protecting against hash flooding attacks, 455 in particular with WASI SDK (where none of the other 456 entropy sources supported by libexpat are available). 457 #1200 Autotools: Add `--without-arc4random` and 458 `--without-arc4random-buf` 459 #1200 Autotools: Make `./configure` output report on available 460 high quality entropy sources 461 #1173 Autotools|macOS: Sync CMake templates with CMake 4.3.0 462 #1201 Autotools|CMake: Improve checks for `arc4random` and 463 `arc4random_buf` e.g. with modern glibc 464 #1201 CMake: Report on availability of functions `arc4random` and 465 `arc4random_buf` 466 #1201 CMake: Mark entropy related build switches as advanced 467 #1189 .. 468 #1203 #1204 Extract new files from entropy extraction code 469 #1194 Stop duplicating C tests 1:1 as C++ ("runtests_cxx") 470 #1202 Fix a comment typo in expat_external.h 471 #1187 Fix grammar in compile error message 472 #1192 examples: Build warning-free with -Wwrite-strings 473 #1171 tests: Address harmless warning from Coverity 474 #1170 #1176 Sync file headers 475 #1190 #1206 Version info bumped from 12:3:11 (libexpat*.so.1.11.3) 476 to 13:0:12 (libexpat*.so.1.12.0); see https://verbump.de/ 477 for what these numbers do 478 479 Infrastructure: 480 #1166 #1167 .. 481 #1172 #1175 .. 482 #1178 #1179 .. 483 #1185 #1205 CI: Make Perl XML::Parser integration tests run against 484 both version 2.47 and the latest release 2.58 485 #1169 CI: Adapt to breaking changes regarding Inno Setup 486 #1173 CI: Adapt to breaking changes regarding CMake 487 #1174 CI: Include public corpus of fuzzer `xml_lpm_fuzzer` with 488 regression testing 489 #1181 #1182 CI: Bump WASI SDK from 30 to 32 490 491 Special thanks to: 492 Jérôme Duval 493 Matthew Fernandez 494 495Release 2.7.5 Tue March 17 2026 496 Security fixes: 497 #1158 CVE-2026-32776 -- Fix NULL function pointer dereference for 498 empty external parameter entities; it takes use of both 499 functions XML_ExternalEntityParserCreate and 500 XML_SetParamEntityParsing for an application to be 501 vulnerable. 502 #1161 #1162 CVE-2026-32777 -- Protect from XML_TOK_INSTANCE_START 503 infinite loop in function entityValueProcessor; it takes 504 use of both functions XML_ExternalEntityParserCreate and 505 XML_SetParamEntityParsing for an application to be 506 vulnerable. 507 #1163 CVE-2026-32778 -- Fix NULL dereference in function setContext 508 on retry after an earlier ouf-of-memory condition; it takes 509 use of function XML_ParserCreateNS or XML_ParserCreate_MM 510 for an application to be vulnerable. 511 #1160 Three more unfixed vulnerabilities left 512 513 Other changes: 514 #1146 #1147 Autotools: Fix condition for symbol versioning check, in 515 particular when compiling with slibtool (not libtool) 516 #1156 Address Cppcheck >=2.20.0 warnings 517 #1153 tests: Make test_buffer_can_grow_to_max work for MinGW on 518 Ubuntu 24.04 519 #1157 #1159 Version info bumped from 12:2:11 (libexpat*.so.1.11.2) 520 to 12:3:11 (libexpat*.so.1.11.3); see https://verbump.de/ 521 for what these numbers do 522 523 Infrastructure: 524 #1148 CI: Fix FreeBSD and Solaris CI 525 #1149 CI: Bump to WASI SDK 30 526 #1153 CI: Adapt to breaking changes with Ubuntu 22.04 527 #1156 CI: Adapt to breaking changes in Cppcheck 528 529 Special thanks to: 530 Berkay Eren Ürün 531 Christian Ng 532 Fabio Scaccabarozzi 533 Francesco Bertolaccini 534 Mark Brand 535 Rhodri James 536 and 537 AddressSanitizer 538 Buttercup 539 OSS-Fuzz / ClusterFuzz 540 Trail of Bits 541 542Release 2.7.4 Sat January 31 2026 543 Security fixes: 544 #1131 CVE-2026-24515 -- Function XML_ExternalEntityParserCreate 545 failed to copy the encoding handler data passed to 546 XML_SetUnknownEncodingHandler from the parent to the new 547 subparser. This can cause a NULL dereference (CWE-476) from 548 external entities that declare use of an unknown encoding. 549 The expected impact is denial of service. It takes use of 550 both functions XML_ExternalEntityParserCreate and 551 XML_SetUnknownEncodingHandler for an application to be 552 vulnerable. 553 #1075 CVE-2026-25210 -- Add missing check for integer overflow 554 related to buffer size determination in function doContent 555 556 Bug fixes: 557 #1073 lib: Fix missing undoing of group size expansion in doProlog 558 failure cases 559 #1107 xmlwf: Fix a memory leak 560 #1104 WASI: Fix format specifiers for 32bit WASI SDK 561 562 Other changes: 563 #1105 lib: Fix strict aliasing 564 #1106 lib: Leverage feature "flexible array member" of C99 565 #1051 lib: Swap (size_t)(-1) for C99 equivalent SIZE_MAX 566 #1109 lib|xmlwf: Return NULL instead of 0 for pointers 567 #1068 lib|Windows: Clean up use of macro _MSC_EXTENSIONS with MSVC 568 #1112 lib: Remove unused import 569 #1110 xmlwf: Warn about XXE in --help output (and man page) 570 #1102 #1103 WASI: Stop using getpid 571 #1113 #1130 Autotools: Drop file expat.m4 that provided obsolete Autoconf 572 macro AM_WITH_EXPAT 573 #1123 Autotools: Limit -Wno-pedantic-ms-format to MinGW 574 #1129 #1134 .. 575 #1087 Autotools|macOS: Sync CMake templates with CMake 4.0 576 #1139 #1140 Autotools|CMake: Introduce off-by-default symbol versioning 577 The related build system flags are: 578 - For Autotools, configure with --enable-symbol-versioning 579 - For CMake, configure with -DEXPAT_SYMBOL_VERSIONING=ON 580 Please double-check for consequences before activating 581 this inside distro packaging. Bug reports welcome! 582 #1117 Autotools|CMake: Remove libbsd support 583 #1105 Autotools|CMake: Stop using -fno-strict-aliasing, and use 584 -Wstrict-aliasing=3 instead 585 #1124 Autotools|CMake: Prefer command gsed (GNU sed) over sed 586 (e.g. for Solaris) inside fix-xmltest-log.sh 587 #1067 CMake: Detect and warn about unusable check_c_compiler_flag 588 #1137 CMake: Drop support for CMake <3.17 589 #1138 CMake|Windows: Fix libexpat.def.cmake version comments 590 591 #1086 #1110 docs: Add warning about external reference handlers and XXE 592 #1066 docs: Be explicit that parent parsers need to outlive 593 subparsers 594 #1089 .. 595 #1090 #1091 .. 596 #1092 #1093 .. 597 #1094 #1098 .. 598 #1115 #1116 docs: Misc non-content improvements to doc/reference.html 599 #1132 #1133 Version info bumped from 12:1:11 (libexpat*.so.1.11.1) 600 to 12:2:11 (libexpat*.so.1.11.2); see https://verbump.de/ 601 for what these numbers do 602 603 Infrastructure: 604 #1119 #1121 Document guidelines for contributing to Expat 605 #1120 Introduce a pull request template 606 #1074 CI: Stop using about-to-be-removed image "macos-13" 607 #1083 #1088 CI: Mitigate random Wine crashes 608 #1104 CI: Cover compilation with WASI SDK 609 #1116 CI: Enforce clean doc XML formatting 610 #1124 .. 611 #1135 #1136 CI: Cover Solaris 11.4 612 #1125 CI: Extend CI coverage of FreeBSD 613 #1139 #1140 CI: Cover symbol versioning 614 #1114 xmlwf: Reformat helpgen code (using Black 25.12.0) 615 #1071 .gitignore: Add files CPackConfig.cmake and 616 CPackSourceConfig.cmake 617 618 Special thanks to: 619 Alfonso Gregory 620 Bénédikt Tran 621 Gordon Messmer 622 Hanno Böck 623 Jakub Kulík 624 Matthew Fernandez 625 Neil Pang 626 Rosen Penev 627 and 628 Artiphishell Inc. 629 630Release 2.7.3 Wed September 24 2025 631 Security fixes: 632 #1046 #1048 Fix alignment of internal allocations for some non-amd64 633 architectures (e.g. sparc32); fixes up on the fix to 634 CVE-2025-59375 from #1034 (of Expat 2.7.2 and related 635 backports) 636 #1059 Fix a class of false positives where input should have been 637 rejected with error XML_ERROR_ASYNC_ENTITY; regression from 638 CVE-2024-8176 fix pull request #973 (of Expat 2.7.0 and 639 related backports). Please check the added unit tests for 640 example documents. 641 642 Other changes: 643 #1043 Prove and regression-proof absence of integer overflow 644 from function expat_realloc 645 #1062 Remove "harmless" cast that truncated a size_t to unsigned 646 #1049 Autotools: Remove "ln -s" discovery 647 #1054 docs: Be consistent with use of floating point around 648 XML_SetAllocTrackerMaximumAmplification 649 #1056 docs: Make it explicit that XML_GetCurrentColumnNumber 650 starts at 0 651 #1057 docs: Better integrate the effect of the activation 652 thresholds 653 #1058 docs: Fix an in-comment typo in expat.h 654 #1045 docs: Fix a typo in README.md 655 #1041 docs: Improve change log of release 2.7.2 656 #1053 xmlwf: Resolve use of functions XML_GetErrorLineNumber 657 and XML_GetErrorColumnNumber 658 #1032 Windows: Normalize .bat files to CRLF line endings 659 #1060 #1061 Version info bumped from 12:0:11 (libexpat*.so.1.11.0) 660 to 12:1:11 (libexpat*.so.1.11.1); see https://verbump.de/ 661 for what these numbers do 662 663 Infrastructure: 664 #1047 #1050 CI: Cleanup UndefinedBehaviorSanitizer fatality 665 #1044 CI|Linux: Stop aborting at first job failure 666 #1052 CI|FreeBSD: Upgrade to FreeBSD 15.0 667 #1039 CI|FreeBSD: Do not install CMake meta-package 668 669 Special thanks to: 670 Bénédikt Tran 671 Berkay Eren Ürün 672 Daniel Engberg 673 Hanno Böck 674 Matthew Fernandez 675 Rolf Eike Beer 676 Sam James 677 Tim Bray 678 and 679 Clang/GCC UndefinedBehaviorSanitizer 680 OSS-Fuzz / ClusterFuzz 681 Z3 Theorem Prover 682 683Release 2.7.2 Tue September 16 2025 684 Security fixes: 685 #1018 #1034 CVE-2025-59375 -- Disallow use of disproportional amounts of 686 dynamic memory from within an Expat parser (e.g. previously 687 a ~250 KiB sized document was able to cause allocation of 688 ~800 MiB from the heap, i.e. an "amplification" of factor 689 ~3,300); once a threshold (that defaults to 64 MiB) is 690 reached, a maximum amplification factor (that defaults to 691 100.0) is enforced, and violating documents are rejected 692 with an out-of-memory error. 693 There are two new API functions to fine-tune this new 694 behavior: 695 - XML_SetAllocTrackerActivationThreshold 696 - XML_SetAllocTrackerMaximumAmplification . 697 If you ever need to increase these defaults for non-attack 698 XML payload, please file a bug report with libexpat. 699 There is also a new environment variable 700 EXPAT_MALLOC_DEBUG=(0|1|2) to control the verbosity 701 of allocations debugging at runtime, disabled by default. 702 Known impact is (reliable and easy) denial of service: 703 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C 704 (Base Score: 7.5, Temporal Score: 7.2) 705 Please note that a layer of compression around XML can 706 significantly reduce the minimum attack payload size. 707 Distributors intending to backport (or cherry-pick) the 708 fix need to copy 99% of the related pull request, not just 709 the "lib: Implement tracking of dynamic memory allocations" 710 commit, to not end up with a state that literally does both 711 too much and too little at the same time. Appending ".diff" 712 to the pull request URL could be of help. 713 714 Other changes: 715 #1008 #1017 Autotools|macOS: Sync CMake templates with CMake 3.31 716 #1007 CMake: Drop support for CMake <3.15 717 #1004 CMake: Fix off_t detection for -Werror 718 #1007 CMake|Windows: Fix -DEXPAT_MSVC_STATIC_CRT=ON 719 #1013 Windows: Drop support for Visual Studio <=16.0/2019 720 #1026 xmlwf: Mention supported environment variables in 721 --help output 722 #1024 xmlwf: Fix (internal) help generator 723 #1034 docs: Promote the contract to call function 724 XML_FreeContentModel when registering a custom 725 element declaration handler (via a call to function 726 XML_SetElementDeclHandler) 727 #1027 docs: Add missing <p>..</p> wrap 728 #994 docs: Drop AppVeyor badge 729 #1000 tests: Fix portable_strndup 730 #1036 Drop casts around malloc/free/realloc that C99 does not need 731 #1010 Replace empty for loops with while loops 732 #1011 Add const with internal XmlInitUnknownEncodingNS 733 #14 #1037 Drop an OpenVMS support leftover 734 #999 #1001 Address more clang-tidy warnings 735 #1030 #1038 Version info bumped from 11:2:10 (libexpat*.so.1.10.2) 736 to 12:0:11 (libexpat*.so.1.11.0); see https://verbump.de/ 737 for what these numbers do 738 739 Infrastructure: 740 #1003 CI: Cover compilation on FreeBSD 741 #1009 #1035 CI: Upgrade Clang from 19 to 21 742 #1031 CI: Make calling Cppcheck without --suppress=objectIndex 743 and --suppress=unknownMacro possible 744 #1013 CI|Windows: Get off of deprecated image "windows-2019" 745 #1008 #1017 .. 746 #1023 #1025 CI: Adapt to breaking changes in GitHub Actions 747 748 Special thanks to: 749 Alexander Bluhm 750 Neil Pang 751 Theo Buehler 752 and 753 GNU Time 754 OSS-Fuzz / ClusterFuzz 755 Perl XML::Parser 756 757Release 2.7.1 Thu March 27 2025 758 Bug fixes: 759 #980 #989 Restore event pointer behavior from Expat 2.6.4 760 (that the fix to CVE-2024-8176 changed in 2.7.0); 761 affected API functions are: 762 - XML_GetCurrentByteCount 763 - XML_GetCurrentByteIndex 764 - XML_GetCurrentColumnNumber 765 - XML_GetCurrentLineNumber 766 - XML_GetInputContext 767 768 Other changes: 769 #976 #977 Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}" 770 with Automake that were missing from 2.7.0 release tarballs 771 #983 #984 Fix printf format specifiers for 32bit Emscripten 772 #992 docs: Promote OpenSSF Best Practices self-certification 773 #978 tests/benchmark: Resolve mistaken double close 774 #986 Address Frama-C warnings 775 #990 #993 Version info bumped from 11:1:10 (libexpat*.so.1.10.1) 776 to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/ 777 for what these numbers do 778 779 Infrastructure: 780 #982 CI: Start running Perl XML::Parser integration tests 781 #987 CI: Enforce Clang Static Analyzer clean code 782 #991 CI: Re-enable warning clang-analyzer-valist.Uninitialized 783 for clang-tidy 784 #981 CI: Cover compilation with musl 785 #983 #984 CI: Cover compilation with 32bit Emscripten 786 #976 #977 CI: Protect against fuzzer files missing from future 787 release archives 788 789 Special thanks to: 790 Berkay Eren Ürün 791 Matthew Fernandez 792 and 793 Perl XML::Parser 794 795Release 2.7.0 Thu March 13 2025 796 Security fixes: 797 #893 #973 CVE-2024-8176 -- Fix crash from chaining a large number 798 of entities caused by stack overflow by resolving use of 799 recursion, for all three uses of entities: 800 - general entities in character data ("<e>&g1;</e>") 801 - general entities in attribute values ("<e k1='&g1;'/>") 802 - parameter entities ("%p1;") 803 Known impact is (reliable and easy) denial of service: 804 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C 805 (Base Score: 7.5, Temporal Score: 7.2) 806 Please note that a layer of compression around XML can 807 significantly reduce the minimum attack payload size. 808 809 Other changes: 810 #935 #937 Autotools: Make generated CMake files look for 811 libexpat.@SO_MAJOR@.dylib on macOS 812 #925 Autotools: Sync CMake templates with CMake 3.29 813 #945 #962 #966 CMake: Drop support for CMake <3.13 814 #942 CMake: Small fuzzing related improvements 815 #921 docs: Add missing documentation of error code 816 XML_ERROR_NOT_STARTED that was introduced with 2.6.4 817 #941 docs: Document need for C++11 compiler for use from C++ 818 #959 tests/benchmark: Fix a (harmless) TOCTTOU 819 #944 Windows: Fix installer target location of file xmlwf.xml 820 for CMake 821 #953 Windows: Address warning -Wunknown-warning-option 822 about -Wno-pedantic-ms-format from LLVM MinGW 823 #971 Address Cppcheck warnings 824 #969 #970 Mass-migrate links from http:// to https:// 825 #947 #958 .. 826 #974 #975 Document changes since the previous release 827 #974 #975 Version info bumped from 11:0:10 (libexpat*.so.1.10.0) 828 to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/ 829 for what these numbers do 830 831 Infrastructure: 832 #926 tests: Increase robustness 833 #927 #932 .. 834 #930 #933 tests: Increase test coverage 835 #617 #950 .. 836 #951 #952 .. 837 #954 #955 .. Fuzzing: Add new fuzzer "xml_lpm_fuzzer" based on 838 #961 Google's libprotobuf-mutator ("LPM") 839 #957 Fuzzing|CI: Start producing fuzzing code coverage reports 840 #936 CI: Pass -q -q for LCOV >=2.1 in coverage.sh 841 #942 CI: Small fuzzing related improvements 842 #139 #203 .. 843 #791 #946 CI: Make GitHub Actions build using MSVC on Windows and 844 produce 32bit and 64bit Windows binaries 845 #956 CI: Get off of about-to-be-removed Ubuntu 20.04 846 #960 #964 CI: Start uploading to Coverity Scan for static analysis 847 #972 CI: Stop loading DTD from the internet to address flaky CI 848 #971 CI: Adapt to breaking changes in Cppcheck 849 850 Special thanks to: 851 Alexander Gieringer 852 Berkay Eren Ürün 853 Hanno Böck 854 Jann Horn 855 Mark Brand 856 Sebastian Andrzej Siewior 857 Snild Dolkow 858 Thomas Pröll 859 Tomas Korbar 860 valord577 861 and 862 Google Project Zero 863 Linutronix 864 Red Hat 865 Siemens 866 867Release 2.6.4 Wed November 6 2024 868 Security fixes: 869 #915 CVE-2024-50602 -- Fix crash within function XML_ResumeParser 870 from a NULL pointer dereference by disallowing function 871 XML_StopParser to (stop or) suspend an unstarted parser. 872 A new error code XML_ERROR_NOT_STARTED was introduced to 873 properly communicate this situation. // CWE-476 CWE-754 874 875 Other changes: 876 #903 CMake: Add alias target "expat::expat" 877 #905 docs: Document use via CMake >=3.18 with FetchContent 878 and SOURCE_SUBDIR and its consequences 879 #902 tests: Reduce use of global parser instance 880 #904 tests: Resolve duplicate handler 881 #317 #918 tests: Improve tests on doctype closing (ex CVE-2019-15903) 882 #914 Fix signedness of format strings 883 #915 For use from C++, expat.h started requiring C++11 due to 884 use of C99 features 885 #919 #920 Version info bumped from 10:3:9 (libexpat*.so.1.9.3) 886 to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/ 887 for what these numbers do 888 889 Infrastructure: 890 #907 CI: Upgrade Clang from 18 to 19 891 #913 CI: Drop macos-12 and add macos-15 892 #910 CI: Adapt to breaking changes in GitHub Actions 893 #898 Add missing entries to .gitignore 894 895 Special thanks to: 896 Hanno Böck 897 José Eduardo Gutiérrez Conejo 898 José Ricardo Cardona Quesada 899 900Release 2.6.3 Wed September 4 2024 901 Security fixes: 902 #887 #890 CVE-2024-45490 -- Calling function XML_ParseBuffer with 903 len < 0 without noticing and then calling XML_GetBuffer 904 will have XML_ParseBuffer fail to recognize the problem 905 and XML_GetBuffer corrupt memory. 906 With the fix, XML_ParseBuffer now complains with error 907 XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse 908 has been doing since Expat 2.2.1, and now documented. 909 Impact is denial of service to potentially artitrary code 910 execution. 911 #888 #891 CVE-2024-45491 -- Internal function dtdCopy can have an 912 integer overflow for nDefaultAtts on 32-bit platforms 913 (where UINT_MAX equals SIZE_MAX). 914 Impact is denial of service to potentially artitrary code 915 execution. 916 #889 #892 CVE-2024-45492 -- Internal function nextScaffoldPart can 917 have an integer overflow for m_groupSize on 32-bit 918 platforms (where UINT_MAX equals SIZE_MAX). 919 Impact is denial of service to potentially artitrary code 920 execution. 921 922 Other changes: 923 #851 #879 Autotools: Sync CMake templates with CMake 3.28 924 #853 Autotools: Always provide path to find(1) for portability 925 #861 Autotools: Ensure that the m4 directory always exists. 926 #870 Autotools: Simplify handling of SIZEOF_VOID_P 927 #869 Autotools: Support non-GNU sed 928 #856 Autotools|CMake: Fix main() to main(void) 929 #865 Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM 930 #863 Autotools|CMake: Stop requiring dos2unix 931 #854 #855 CMake: Fix check for symbols size_t and off_t 932 #864 docs|tests: Convert README to Markdown and update 933 #741 Windows: Drop support for Visual Studio <=15.0/2017 934 #886 Drop needless XML_DTD guards around is_param access 935 #885 Fix typo in a code comment 936 #894 #896 Version info bumped from 10:2:9 (libexpat*.so.1.9.2) 937 to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/ 938 for what these numbers do 939 940 Infrastructure: 941 #880 Readme: Promote the call for help 942 #868 CI: Fix various issues 943 #849 CI: Allow triggering GitHub Actions workflows manually 944 #851 #872 .. 945 #873 #879 CI: Adapt to breaking changes in GitHub Actions 946 947 Special thanks to: 948 Alexander Bluhm 949 Berkay Eren Ürün 950 Dag-Erling Smørgrav 951 Ferenc Géczi 952 TaiYou 953 954Release 2.6.2 Wed March 13 2024 955 Security fixes: 956 #839 #842 CVE-2024-28757 -- Prevent billion laughs attacks with 957 isolated use of external parsers. Please see the commit 958 message of commit 1d50b80cf31de87750103656f6eb693746854aa8 959 for details. 960 961 Bug fixes: 962 #839 #841 Reject direct parameter entity recursion 963 and avoid the related undefined behavior 964 965 Other changes: 966 #847 Autotools: Fix build for DOCBOOK_TO_MAN containing spaces 967 #837 Add missing #821 and #824 to 2.6.1 change log 968 #838 #843 Version info bumped from 10:1:9 (libexpat*.so.1.9.1) 969 to 10:2:9 (libexpat*.so.1.9.2); see https://verbump.de/ 970 for what these numbers do 971 972 Special thanks to: 973 Philippe Antoine 974 Tomas Korbar 975 and 976 Clang UndefinedBehaviorSanitizer 977 OSS-Fuzz / ClusterFuzz 978 979Release 2.6.1 Thu February 29 2024 980 Bug fixes: 981 #817 Make tests independent of CPU speed, and thus more robust 982 #828 #836 Expose billion laughs API with XML_DTD defined and 983 XML_GE undefined, regression from 2.6.0 984 985 Other changes: 986 #829 Hide test-only code behind new internal macro 987 #833 Autotools: Reject expat_config.h.in defining SIZEOF_VOID_P 988 #821 #824 Autotools: Fix "make clean" for case: 989 ./configure --without-docbook && make clean all 990 #819 Address compiler warnings 991 #832 #834 Version info bumped from 10:0:9 (libexpat*.so.1.9.0) 992 to 10:1:9 (libexpat*.so.1.9.1); see https://verbump.de/ 993 for what these numbers do 994 995 Infrastructure: 996 #818 CI: Adapt to breaking changes in clang-format 997 998 Special thanks to: 999 David Hall 1000 Snild Dolkow 1001 1002Release 2.6.0 Tue February 6 2024 1003 Security fixes: 1004 #789 #814 CVE-2023-52425 -- Fix quadratic runtime issues with big tokens 1005 that can cause denial of service, in partial where 1006 dealing with compressed XML input. Applications 1007 that parsed a document in one go -- a single call to 1008 functions XML_Parse or XML_ParseBuffer -- were not affected. 1009 The smaller the chunks/buffers you use for parsing 1010 previously, the bigger the problem prior to the fix. 1011 Backporters should be careful to no omit parts of 1012 pull request #789 and to include earlier pull request #771, 1013 in order to not break the fix. 1014 #777 CVE-2023-52426 -- Fix billion laughs attacks for users 1015 compiling *without* XML_DTD defined (which is not common). 1016 Users with XML_DTD defined have been protected since 1017 Expat >=2.4.0 (and that was CVE-2013-0340 back then). 1018 1019 Bug fixes: 1020 #753 Fix parse-size-dependent "invalid token" error for 1021 external entities that start with a byte order mark 1022 #780 Fix NULL pointer dereference in setContext via 1023 XML_ExternalEntityParserCreate for compilation with 1024 XML_DTD undefined 1025 #812 #813 Protect against closing entities out of order 1026 1027 Other changes: 1028 #723 Improve support for arc4random/arc4random_buf 1029 #771 #788 Improve buffer growth in XML_GetBuffer and XML_Parse 1030 #761 #770 xmlwf: Support --help and --version 1031 #759 #770 xmlwf: Support custom buffer size for XML_GetBuffer and read 1032 #744 xmlwf: Improve language and URL clickability in help output 1033 #673 examples: Add new example "element_declarations.c" 1034 #764 Be stricter about macro XML_CONTEXT_BYTES at build time 1035 #765 Make inclusion to expat_config.h consistent 1036 #726 #727 Autotools: configure.ac: Support --disable-maintainer-mode 1037 #678 #705 .. 1038 #706 #733 #792 Autotools: Sync CMake templates with CMake 3.26 1039 #795 Autotools: Make installation of shipped man page doc/xmlwf.1 1040 independent of docbook2man availability 1041 #815 Autotools|CMake: Add missing -DXML_STATIC to pkg-config file 1042 section "Cflags.private" in order to fix compilation 1043 against static libexpat using pkg-config on Windows 1044 #724 #751 Autotools|CMake: Require a C99 compiler 1045 (a de-facto requirement already since Expat 2.2.2 of 2017) 1046 #793 Autotools|CMake: Fix PACKAGE_BUGREPORT variable 1047 #750 #786 Autotools|CMake: Make test suite require a C++11 compiler 1048 #749 CMake: Require CMake >=3.5.0 1049 #672 CMake: Lowercase off_t and size_t to help a bug in Meson 1050 #746 CMake: Sort xmlwf sources alphabetically 1051 #785 CMake|Windows: Fix generation of DLL file version info 1052 #790 CMake: Build tests/benchmark/benchmark.c as well for 1053 a build with -DEXPAT_BUILD_TESTS=ON 1054 #745 #757 docs: Document the importance of isFinal + adjust tests 1055 accordingly 1056 #736 docs: Improve use of "NULL" and "null" 1057 #713 docs: Be specific about version of XML (XML 1.0r4) 1058 and version of C (C99); (XML 1.0r5 will need a sponsor.) 1059 #762 docs: reference.html: Promote function XML_ParseBuffer more 1060 #779 docs: reference.html: Add HTML anchors to XML_* macros 1061 #760 docs: reference.html: Upgrade to OK.css 1.2.0 1062 #763 #739 docs: Fix typos 1063 #696 docs|CI: Use HTTPS URLs instead of HTTP at various places 1064 #669 #670 .. 1065 #692 #703 .. 1066 #733 #772 Address compiler warnings 1067 #798 #800 Address clang-tidy warnings 1068 #775 #776 Version info bumped from 9:10:8 (libexpat*.so.1.8.10) 1069 to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/ 1070 for what these numbers do 1071 1072 Infrastructure: 1073 #700 #701 docs: Document security policy in file SECURITY.md 1074 #766 docs: Improve parse buffer variables in-code documentation 1075 #674 #738 .. 1076 #740 #747 .. 1077 #748 #781 #782 Refactor coverage and conformance tests 1078 #714 #716 Refactor debug level variables to unsigned long 1079 #671 Improve handling of empty environment variable value 1080 in function getDebugLevel (without visible user effect) 1081 #755 #774 .. 1082 #758 #783 .. 1083 #784 #787 tests: Improve test coverage with regard to parse chunk size 1084 #660 #797 #801 Fuzzing: Improve fuzzing coverage 1085 #367 #799 Fuzzing|CI: Start running OSS-Fuzz fuzzing regression tests 1086 #698 #721 CI: Resolve some Travis CI leftovers 1087 #669 CI: Be robust towards absence of Git tags 1088 #693 #694 CI: Set permissions to "contents: read" for security 1089 #709 CI: Pin all GitHub Actions to specific commits for security 1090 #739 CI: Reject spelling errors using codespell 1091 #798 CI: Enforce clang-tidy clean code 1092 #773 #808 .. 1093 #809 #810 CI: Upgrade Clang from 15 to 18 1094 #796 CI: Start using Clang's Control Flow Integrity sanitizer 1095 #675 #720 #722 CI: Adapt to breaking changes in GitHub Actions Ubuntu images 1096 #689 CI: Adapt to breaking changes in Clang/LLVM Debian packaging 1097 #763 CI: Adapt to breaking changes in codespell 1098 #803 CI: Adapt to breaking changes in Cppcheck 1099 1100 Special thanks to: 1101 Ivan Galkin 1102 Joyce Brum 1103 Philippe Antoine 1104 Rhodri James 1105 Snild Dolkow 1106 spookyahell 1107 Steven Garske 1108 and 1109 Clang AddressSanitizer 1110 Clang UndefinedBehaviorSanitizer 1111 codespell 1112 GCC Farm Project 1113 OSS-Fuzz 1114 Sony Mobile 1115 1116Release 2.5.0 Tue October 25 2022 1117 Security fixes: 1118 #616 #649 #650 CVE-2022-43680 -- Fix heap use-after-free after overeager 1119 destruction of a shared DTD in function 1120 XML_ExternalEntityParserCreate in out-of-memory situations. 1121 Expected impact is denial of service or potentially 1122 arbitrary code execution. 1123 1124 Bug fixes: 1125 #612 #645 Fix corruption from undefined entities 1126 #613 #654 Fix case when parsing was suspended while processing nested 1127 entities 1128 #616 #652 #653 Stop leaking opening tag bindings after a closing tag 1129 mismatch error where a parser is reset through 1130 XML_ParserReset and then reused to parse 1131 #656 CMake: Fix generation of pkg-config file 1132 #658 MinGW|CMake: Fix static library name 1133 1134 Other changes: 1135 #663 Protect header expat_config.h from multiple inclusion 1136 #666 examples: Make use of XML_GetBuffer and be more 1137 consistent across examples 1138 #648 Address compiler warnings 1139 #667 #668 Version info bumped from 9:9:8 to 9:10:8; 1140 see https://verbump.de/ for what these numbers do 1141 1142 Special thanks to: 1143 Jann Horn 1144 Mark Brand 1145 Osyotr 1146 Rhodri James 1147 and 1148 Google Project Zero 1149 1150Release 2.4.9 Tue September 20 2022 1151 Security fixes: 1152 #629 #640 CVE-2022-40674 -- Heap use-after-free vulnerability in 1153 function doContent. Expected impact is denial of service 1154 or potentially arbitrary code execution. 1155 1156 Bug fixes: 1157 #634 MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0 1158 #614 docs: Fix documentation on effect of switch XML_DTD on 1159 symbol visibility in doc/reference.html 1160 1161 Other changes: 1162 #638 MinGW: Make fix-xmltest-log.sh drop more Wine bug output 1163 #596 #625 Autotools: Sync CMake templates with CMake 3.22 1164 #608 CMake: Migrate from use of CMAKE_*_POSTFIX to 1165 dedicated variables EXPAT_*_POSTFIX to stop affecting 1166 other projects 1167 #597 #599 Windows|CMake: Add missing -DXML_STATIC to test runners 1168 and fuzzers 1169 #512 #621 Windows|CMake: Render .def file from a template to fix 1170 linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON 1171 #611 #621 MinGW|CMake: Apply MSVC .def file when linking 1172 #622 #624 MinGW|CMake: Sync library name with GNU Autotools, 1173 i.e. produce libexpat-1.dll rather than libexpat.dll 1174 by default. Filename libexpat.dll.a is unaffected. 1175 #632 MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in 1176 toolchain file "cmake/mingw-toolchain.cmake" to avoid 1177 error "windres: Command not found" on e.g. Ubuntu 20.04 1178 #597 #627 CMake: Unify inconsistent use of set() and option() in 1179 context of public build time options to take need for 1180 set(.. FORCE) in projects using Expat by means of 1181 add_subdirectory(..) off Expat's users' shoulders 1182 #626 #641 Stop exporting API symbols when building a static library 1183 #644 Resolve use of deprecated "fgrep" by "grep -F" 1184 #620 CMake: Make documentation on variables a bit more consistent 1185 #636 CMake: Drop leading whitespace from a #cmakedefine line in 1186 file expat_config.h.cmake 1187 #594 xmlwf: Fix harmless variable mix-up in function nsattcmp 1188 #592 #593 #610 Address Cppcheck warnings 1189 #643 Address Clang 15 compiler warnings 1190 #642 #644 Version info bumped from 9:8:8 to 9:9:8; 1191 see https://verbump.de/ for what these numbers do 1192 1193 Infrastructure: 1194 #597 #598 CI: Windows: Start covering MSVC 2022 1195 #619 CI: macOS: Migrate off deprecated macOS 10.15 1196 #632 CI: Linux: Make migration off deprecated Ubuntu 18.04 work 1197 #643 CI: Upgrade Clang from 14 to 15 1198 #637 apply-clang-format.sh: Add support for BSD find 1199 #633 coverage.sh: Exclude MinGW headers 1200 #635 coverage.sh: Fix name collision for -funsigned-char 1201 1202 Special thanks to: 1203 David Faure 1204 Felix Wilhelm 1205 Frank Bergmann 1206 Rhodri James 1207 Rosen Penev 1208 Thijs Schreijer 1209 Vincent Torri 1210 and 1211 Google Project Zero 1212 1213Release 2.4.8 Mon March 28 2022 1214 Other changes: 1215 #587 pkg-config: Move "-lm" to section "Libs.private" 1216 #587 CMake|MSVC: Fix pkg-config section "Libs" 1217 #55 #582 CMake|macOS: Start using linker arguments 1218 "-compatibility_version <version>" and 1219 "-current_version <version>" in a way compatible with 1220 GNU Libtool 1221 #590 #591 Version info bumped from 9:7:8 to 9:8:8; 1222 see https://verbump.de/ for what these numbers do 1223 1224 Infrastructure: 1225 #589 CI: Upgrade Clang from 13 to 14 1226 1227 Special thanks to: 1228 evpobr 1229 Kai Pastor 1230 Sam James 1231 1232Release 2.4.7 Fri March 4 2022 1233 Bug fixes: 1234 #572 #577 Relax fix to CVE-2022-25236 (introduced with release 2.4.5) 1235 with regard to all valid URI characters (RFC 3986), 1236 i.e. the following set (excluding whitespace): 1237 ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz 1238 0123456789 % -._~ :/?#[]@ !$&'()*+,;= 1239 1240 Other changes: 1241 #555 #570 #581 CMake|Windows: Store Expat version in the DLL 1242 #577 Document consequences of namespace separator choices not just 1243 in doc/reference.html but also in header <expat.h> 1244 #577 Document Expat's lack of validation of namespace URIs against 1245 RFC 3986, and that the XML 1.0r4 specification doesn't 1246 require Expat to validate namespace URIs, and that Expat 1247 may do more in that regard in future releases. 1248 If you find need for strict RFC 3986 URI validation on 1249 application level today, https://uriparser.github.io/ may 1250 be of interest. 1251 #579 Fix documentation of XML_EndDoctypeDeclHandler in <expat.h> 1252 #575 Document that a call to XML_FreeContentModel can be done at 1253 a later time from outside the element declaration handler 1254 #574 Make hardcoded namespace URIs easier to find in code 1255 #573 Update documentation on use of XML_POOR_ENTOPY on Solaris 1256 #569 #571 tests: Resolve use of macros NAN and INFINITY for GNU G++ 1257 4.8.2 on Solaris. 1258 #578 #580 Version info bumped from 9:6:8 to 9:7:8; 1259 see https://verbump.de/ for what these numbers do 1260 1261 Special thanks to: 1262 Jeffrey Walton 1263 Johnny Jazeix 1264 Thijs Schreijer 1265 1266Release 2.4.6 Sun February 20 2022 1267 Bug fixes: 1268 #566 Fix a regression introduced by the fix for CVE-2022-25313 1269 in release 2.4.5 that affects applications that (1) 1270 call function XML_SetElementDeclHandler and (2) are 1271 parsing XML that contains nested element declarations 1272 (e.g. "<!ELEMENT junk ((bar|foo|xyz+), zebra*)>"). 1273 1274 Other changes: 1275 #567 #568 Version info bumped from 9:5:8 to 9:6:8; 1276 see https://verbump.de/ for what these numbers do 1277 1278 Special thanks to: 1279 Matt Sergeant 1280 Samanta Navarro 1281 Sergei Trofimovich 1282 and 1283 NixOS 1284 Perl XML::Parser 1285 1286Release 2.4.5 Fri February 18 2022 1287 Security fixes: 1288 #562 CVE-2022-25235 -- Passing malformed 2- and 3-byte UTF-8 1289 sequences (e.g. from start tag names) to the XML 1290 processing application on top of Expat can cause 1291 arbitrary damage (e.g. code execution) depending 1292 on how invalid UTF-8 is handled inside the XML 1293 processor; validation was not their job but Expat's. 1294 Exploits with code execution are known to exist. 1295 #561 CVE-2022-25236 -- Passing (one or more) namespace separator 1296 characters in "xmlns[:prefix]" attribute values 1297 made Expat send malformed tag names to the XML 1298 processor on top of Expat which can cause 1299 arbitrary damage (e.g. code execution) depending 1300 on such unexpectable cases are handled inside the XML 1301 processor; validation was not their job but Expat's. 1302 Exploits with code execution are known to exist. 1303 #558 CVE-2022-25313 -- Fix stack exhaustion in doctype parsing 1304 that could be triggered by e.g. a 2 megabytes 1305 file with a large number of opening braces. 1306 Expected impact is denial of service or potentially 1307 arbitrary code execution. 1308 #560 CVE-2022-25314 -- Fix integer overflow in function copyString; 1309 only affects the encoding name parameter at parser creation 1310 time which is often hardcoded (rather than user input), 1311 takes a value in the gigabytes to trigger, and a 64-bit 1312 machine. Expected impact is denial of service. 1313 #559 CVE-2022-25315 -- Fix integer overflow in function storeRawNames; 1314 needs input in the gigabytes and a 64-bit machine. 1315 Expected impact is denial of service or potentially 1316 arbitrary code execution. 1317 1318 Other changes: 1319 #557 #564 Version info bumped from 9:4:8 to 9:5:8; 1320 see https://verbump.de/ for what these numbers do 1321 1322 Special thanks to: 1323 Ivan Fratric 1324 Samanta Navarro 1325 and 1326 Google Project Zero 1327 JetBrains 1328 1329Release 2.4.4 Sun January 30 2022 1330 Security fixes: 1331 #550 CVE-2022-23852 -- Fix signed integer overflow 1332 (undefined behavior) in function XML_GetBuffer 1333 (that is also called by function XML_Parse internally) 1334 for when XML_CONTEXT_BYTES is defined to >0 (which is both 1335 common and default). 1336 Impact is denial of service or more. 1337 #551 CVE-2022-23990 -- Fix unsigned integer overflow in function 1338 doProlog triggered by large content in element type 1339 declarations when there is an element declaration handler 1340 present (from a prior call to XML_SetElementDeclHandler). 1341 Impact is denial of service or more. 1342 1343 Bug fixes: 1344 #544 #545 xmlwf: Fix a memory leak on output file opening error 1345 1346 Other changes: 1347 #546 Autotools: Fix broken CMake support under Cygwin 1348 #554 Windows: Add missing files to the installer to fix 1349 compilation with CMake from installed sources 1350 #552 #554 Version info bumped from 9:3:8 to 9:4:8; 1351 see https://verbump.de/ for what these numbers do 1352 1353 Special thanks to: 1354 Carlo Bramini 1355 hwt0415 1356 Roland Illig 1357 Samanta Navarro 1358 and 1359 Clang LeakSan and the Clang team 1360 1361Release 2.4.3 Sun January 16 2022 1362 Security fixes: 1363 #531 #534 CVE-2021-45960 -- Fix issues with left shifts by >=29 places 1364 resulting in 1365 a) realloc acting as free 1366 b) realloc allocating too few bytes 1367 c) undefined behavior 1368 depending on architecture and precise value 1369 for XML documents with >=2^27+1 prefixed attributes 1370 on a single XML tag a la 1371 "<r xmlns:a='[..]' a:a123='[..]' [..] />" 1372 where XML_ParserCreateNS is used to create the parser 1373 (which needs argument "-n" when running xmlwf). 1374 Impact is denial of service, or more. 1375 #532 #538 CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow 1376 on variable m_groupSize in function doProlog leading 1377 to realloc acting as free. 1378 Impact is denial of service or more. 1379 #539 CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows 1380 near memory allocation at multiple places. Mitre assigned 1381 a dedicated CVE for each involved internal C function: 1382 - CVE-2022-22822 for function addBinding 1383 - CVE-2022-22823 for function build_model 1384 - CVE-2022-22824 for function defineAttribute 1385 - CVE-2022-22825 for function lookup 1386 - CVE-2022-22826 for function nextScaffoldPart 1387 - CVE-2022-22827 for function storeAtts 1388 Impact is denial of service or more. 1389 1390 Other changes: 1391 #535 CMake: Make call to file(GENERATE [..]) work for CMake <3.19 1392 #541 Autotools|CMake: MinGW: Make run.sh(.in) work for Cygwin 1393 and MSYS2 by not going through Wine on these platforms 1394 #527 #528 Address compiler warnings 1395 #533 #543 Version info bumped from 9:2:8 to 9:3:8; 1396 see https://verbump.de/ for what these numbers do 1397 1398 Infrastructure: 1399 #536 CI: Check for realistic minimum CMake version 1400 #529 #539 CI: Cover compilation with -m32 1401 #529 CI: Store coverage reports as artifacts for download 1402 #528 CI: Upgrade Clang from 11 to 13 1403 1404 Special thanks to: 1405 An anonymous whitehat 1406 Christopher Degawa 1407 J. Peter Mugaas 1408 Tyson Smith 1409 and 1410 GCC Farm Project 1411 Trend Micro Zero Day Initiative 1412 1413Release 2.4.2 Sun December 19 2021 1414 Other changes: 1415 #509 #510 Link againgst libm for function "isnan" 1416 #513 #514 Include expat_config.h as early as possible 1417 #498 Autotools: Include files with release archives: 1418 - buildconf.sh 1419 - fuzz/*.c 1420 #507 #519 Autotools: Sync CMake templates with CMake 3.20 1421 #495 #524 CMake: MinGW: Fix pkg-config section "Libs" for 1422 - non-release build types (e.g. -DCMAKE_BUILD_TYPE=Debug) 1423 - multi-config CMake generators (e.g. Ninja Multi-Config) 1424 #502 #503 docs: Document that function XML_GetBuffer may return NULL 1425 when asking for a buffer of 0 (zero) bytes size 1426 #522 #523 docs: Fix return value docs for both 1427 XML_SetBillionLaughsAttackProtection* functions 1428 #525 #526 Version info bumped from 9:1:8 to 9:2:8; 1429 see https://verbump.de/ for what these numbers do 1430 1431 Special thanks to: 1432 Donghee Na 1433 Joergen Ibsen 1434 Kai Pastor 1435 1436Release 2.4.1 Sun May 23 2021 1437 Bug fixes: 1438 #488 #490 Autotools: Fix installed header expat_config.h for multilib 1439 systems; regression introduced in 2.4.0 by pull request #486 1440 1441 Other changes: 1442 #491 #492 Version info bumped from 9:0:8 to 9:1:8; 1443 see https://verbump.de/ for what these numbers do 1444 1445 Special thanks to: 1446 Gentoo's QA check "multilib_check_headers" 1447 1448Release 2.4.0 Sun May 23 2021 1449 Security fixes: 1450 #34 #466 #484 CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks 1451 (denial-of-service; flavors targeting CPU time or RAM or both, 1452 leveraging general entities or parameter entities or both) 1453 by tracking and limiting the input amplification factor 1454 (<amplification> := (<direct> + <indirect>) / <direct>). 1455 By conservative default, amplification up to a factor of 100.0 1456 is tolerated and rejection only starts after 8 MiB of output bytes 1457 (=<direct> + <indirect>) have been processed. 1458 The fix adds the following to the API: 1459 - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to 1460 signals this specific condition. 1461 - Two new API functions .. 1462 - XML_SetBillionLaughsAttackProtectionMaximumAmplification and 1463 - XML_SetBillionLaughsAttackProtectionActivationThreshold 1464 .. to further tighten billion laughs protection parameters 1465 when desired. Please see file "doc/reference.html" for details. 1466 If you ever need to increase the defaults for non-attack XML 1467 payload, please file a bug report with libexpat. 1468 - Two new XML_FEATURE_* constants .. 1469 - that can be queried using the XML_GetFeatureList function, and 1470 - that are shown in "xmlwf -v" output. 1471 - Two new environment variable switches .. 1472 - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and 1473 - EXPAT_ENTITY_DEBUG=(0|1) 1474 .. for runtime debugging of accounting and entity processing. 1475 Specific behavior of these values may change in the future. 1476 - Two new command line arguments "-a FACTOR" and "-b BYTES" 1477 for xmlwf to further tighten billion laughs protection 1478 parameters when desired. 1479 If you ever need to increase the defaults for non-attack XML 1480 payload, please file a bug report with libexpat. 1481 1482 Bug fixes: 1483 #332 #470 For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) 1484 or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault 1485 for UTF-16 payloads containing CDATA sections. 1486 #485 #486 Autotools: Fix generated CMake files for non-64bit and 1487 non-Linux platforms (e.g. macOS and MinGW in particular) 1488 that were introduced with release 2.3.0 1489 1490 Other changes: 1491 #468 #469 xmlwf: Improve help output and the xmlwf man page 1492 #463 xmlwf: Improve maintainability through some refactoring 1493 #477 xmlwf: Fix man page DocBook validity 1494 #456 Autotools: Sync CMake templates with CMake 3.18 1495 #458 #459 CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR 1496 and CMAKE_INSTALL_INCLUDEDIR 1497 #471 #481 CMake: Add support for standard variable BUILD_SHARED_LIBS 1498 #457 Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters 1499 #467 Resolve macro HAVE_EXPAT_CONFIG_H 1500 #472 Delete unused legacy helper file "conftools/PrintPath" 1501 #473 #483 Improve attribution 1502 #464 #465 #477 doc/reference.html: Fix XHTML validity 1503 #475 #478 doc/reference.html: Replace the 90s look by OK.css 1504 #479 Version info bumped from 8:0:7 to 9:0:8 1505 due to addition of new symbols and error codes; 1506 see https://verbump.de/ for what these numbers do 1507 1508 Infrastructure: 1509 #456 CI: Enable periodic runs 1510 #457 CI: Start covering the list of exported symbols 1511 #474 CI: Isolate coverage task 1512 #476 #482 CI: Adapt to breaking changes in image "ubuntu-18.04" 1513 #477 CI: Cover well-formedness and DocBook/XHTML validity 1514 of doc/reference.html and doc/xmlwf.xml 1515 1516 Special thanks to: 1517 Dimitry Andric 1518 Eero Helenius 1519 Nick Wellnhofer 1520 Rhodri James 1521 Tomas Korbar 1522 Yury Gribov 1523 and 1524 Clang LeakSan 1525 JetBrains 1526 OSS-Fuzz 1527 1528Release 2.3.0 Thu March 25 2021 1529 Bug fixes: 1530 #438 When calling XML_ParseBuffer without a prior successful call to 1531 XML_GetBuffer as a user, no longer trigger undefined behavior 1532 (by adding an integer to a NULL pointer) but rather return 1533 XML_STATUS_ERROR and set the error code to (new) code 1534 XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) 1535 of Clang 11 (but not Clang 9). 1536 #444 xmlwf: Exit status 2 was used for both: 1537 - malformed input files (documented) and 1538 - invalid command-line arguments (undocumented). 1539 The case of invalid command-line arguments now 1540 has its own exit status 4, resolving the ambiguity. 1541 1542 Other changes: 1543 #439 xmlwf: Add argument -k to allow continuing after 1544 non-fatal errors 1545 #439 xmlwf: Add section about exit status to the -h help output 1546 #422 #426 #447 Windows: Drop support for Visual Studio <=14.0/2015 1547 #434 Windows: CMake: Detect unsupported Visual Studio at 1548 configure time (rather than at compile time) 1549 #382 #428 testrunner: Make verbose mode (argument "-v") report 1550 about passed tests, and make default mode report about 1551 failures, as well. 1552 #442 CMake: Call "enable_language(CXX)" prior to tinkering 1553 with CMAKE_CXX_* variables 1554 #448 Document use of libexpat from a CMake-based project 1555 #451 Autotools: Install CMake files as generated by CMake 3.19.6 1556 so that users with "find_package(expat [..] CONFIG [..])" 1557 are served on distributions that are *not* using the CMake 1558 build system inside for libexpat packaging 1559 #436 #437 Autotools: Drop obsolescent macro AC_HEADER_STDC 1560 #450 #452 Autotools: Resolve use of obsolete macro AC_CONFIG_HEADER 1561 #441 Address compiler warnings 1562 #443 Version info bumped from 7:12:6 to 8:0:7 1563 due to addition of error code XML_ERROR_NO_BUFFER 1564 (see https://verbump.de/ for what these numbers do) 1565 1566 Infrastructure: 1567 #435 #446 Replace Travis CI by GitHub Actions 1568 1569 Special thanks to: 1570 Alexander Richardson 1571 Oleksandr Popovych 1572 Thomas Beutlich 1573 Tim Bray 1574 and 1575 Clang LeakSan, Clang 11 UBSan and the Clang team 1576 1577Release 2.2.10 Sat October 3 2020 1578 Bug fixes: 1579 #390 #395 #398 Fix undefined behavior during parsing caused by 1580 pointer arithmetic with NULL pointers 1581 #404 #405 Fix reading uninitialized variable during parsing 1582 #406 xmlwf: Add missing check for malloc NULL return 1583 1584 Other changes: 1585 #396 Windows: Drop support for Visual Studio <=8.0/2005 1586 #409 Windows: Add missing file "Changes" to the installer 1587 to fix compilation with CMake from installed sources 1588 #403 xmlwf: Document exit codes in xmlwf manpage and 1589 exit with code 3 (rather than code 1) for output errors 1590 when used with "-d DIRECTORY" 1591 #356 #359 MinGW: Provide declaration of rand_s for mingwrt <5.3.0 1592 #383 #392 Autotools: Use -Werror while configure tests the compiler 1593 for supported compile flags to avoid false positives 1594 #383 #393 #394 Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, 1595 e.g. ensure that they have the last word over flags added 1596 while running ./configure 1597 #360 CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis 1598 on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) 1599 #360 CMake: Detect and deny unsupported build combinations 1600 involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) 1601 #360 CMake: Install pre-compiled shipped xmlwf.1 manpage in case 1602 of -DEXPAT_BUILD_DOCS=OFF 1603 #375 #380 #419 CMake: Fix use of Expat by means of add_subdirectory 1604 #407 #408 CMake: Keep expat target name constant at "expat" 1605 (i.e. refrain from using the target name to control 1606 build artifact filenames) 1607 #385 CMake: Fix compilation with -DEXPAT_SHARED_LIBS=OFF for 1608 Windows 1609 CMake: Expose man page compilation as target "xmlwf-manpage" 1610 #413 #414 CMake: Introduce option EXPAT_BUILD_PKGCONFIG 1611 to control generation of pkg-config file "expat.pc" 1612 #424 CMake: Add minimalistic support for building binary packages 1613 with CMake target "package"; based on CPack 1614 #366 CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with 1615 default OFF to build fuzzer code against OSS-Fuzz and 1616 related environment variable LIB_FUZZING_ENGINE 1617 #354 Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF, each 1618 #354 #355 .. 1619 #356 #412 Address compiler warnings 1620 #368 #369 Address pngcheck warnings with doc/*.png images 1621 #425 Version info bumped from 7:11:6 to 7:12:6 1622 1623 Special thanks to: 1624 asavah 1625 Ben Wagner 1626 Bhargava Shastry 1627 Frank Landgraf 1628 Jeffrey Walton 1629 Joe Orton 1630 Kleber Tarcísio 1631 Ma Lin 1632 Maciej Sroczyński 1633 Mohammed Khajapasha 1634 Vadim Zeitlin 1635 and 1636 Cppcheck 2.0 and the Cppcheck team 1637 1638Release 2.2.9 Wed September 25 2019 1639 Other changes: 1640 examples: Drop executable bits from elements.c 1641 #349 Windows: Change the name of the Windows DLLs from expat*.dll 1642 to libexpat*.dll once more (regression from 2.2.8, first 1643 fixed in 1.95.3, issue #61 on SourceForge today, 1644 was issue #432456 back then); needs a fix due 1645 case-insensitive file systems on Windows and the fact that 1646 Perl's XML::Parser::Expat compiles into Expat.dll. 1647 #347 Windows: Only define _CRT_RAND_S if not defined 1648 Version info bumped from 7:10:6 to 7:11:6 1649 1650 Special thanks to: 1651 Ben Wagner 1652 1653Release 2.2.8 Fri September 13 2019 1654 Security fixes: 1655 #317 #318 CVE-2019-15903 -- Fix heap overflow triggered by 1656 XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), 1657 and deny internal entities closing the doctype; 1658 fixed in commit c20b758c332d9a13afbbb276d30db1d183a85d43 1659 1660 Bug fixes: 1661 #240 Fix cases where XML_StopParser did not have any effect 1662 when called from inside of an end element handler 1663 #341 xmlwf: Fix exit code for operation without "-d DIRECTORY"; 1664 previously, only "-d DIRECTORY" would give you a proper 1665 exit code: 1666 # xmlwf -d . <<<'<not well-formed>' 2>/dev/null ; echo $? 1667 2 1668 # xmlwf <<<'<not well-formed>' 2>/dev/null ; echo $? 1669 0 1670 Now both cases return exit code 2. 1671 1672 Other changes: 1673 #299 #302 Windows: Replace LoadLibrary hack to access 1674 unofficial API function SystemFunction036 (RtlGenRandom) 1675 by using official API function rand_s (needs WinXP+) 1676 #325 Windows: Drop support for Visual Studio <=7.1/2003 1677 and document supported compilers in README.md 1678 #286 Windows: Remove COM code from xmlwf; in case it turns 1679 out needed later, there will be a dedicated repository 1680 below https://github.com/libexpat/ for that code 1681 #322 Windows: Remove explicit MSVC solution and project files. 1682 You can generate Visual Studio solution files through 1683 CMake, e.g.: cmake -G"Visual Studio 15 2017" . 1684 #338 xmlwf: Make "xmlwf -h" help output more friendly 1685 #339 examples: Improve elements.c 1686 #244 #264 Autotools: Add argument --enable-xml-attr-info 1687 #239 #301 Autotools: Add arguments 1688 --with-getrandom 1689 --without-getrandom 1690 --with-sys-getrandom 1691 --without-sys-getrandom 1692 #312 #343 Autotools: Fix linking issues with "./configure LD=clang" 1693 Autotools: Fix "make run-xmltest" for out-of-source builds 1694 #329 #336 CMake: Pull all options from Expat <=2.2.7 into namespace 1695 prefix EXPAT_ with the exception of DOCBOOK_TO_MAN: 1696 - BUILD_doc -> EXPAT_BUILD_DOCS (plural) 1697 - BUILD_examples -> EXPAT_BUILD_EXAMPLES 1698 - BUILD_shared -> EXPAT_SHARED_LIBS 1699 - BUILD_tests -> EXPAT_BUILD_TESTS 1700 - BUILD_tools -> EXPAT_BUILD_TOOLS 1701 - DOCBOOK_TO_MAN -> DOCBOOK_TO_MAN (unchanged) 1702 - INSTALL -> EXPAT_ENABLE_INSTALL 1703 - MSVC_USE_STATIC_CRT -> EXPAT_MSVC_STATIC_CRT 1704 - USE_libbsd -> EXPAT_WITH_LIBBSD 1705 - WARNINGS_AS_ERRORS -> EXPAT_WARNINGS_AS_ERRORS 1706 - XML_CONTEXT_BYTES -> EXPAT_CONTEXT_BYTES 1707 - XML_DEV_URANDOM -> EXPAT_DEV_URANDOM 1708 - XML_DTD -> EXPAT_DTD 1709 - XML_NS -> EXPAT_NS 1710 - XML_UNICODE -> EXPAT_CHAR_TYPE=ushort (!) 1711 - XML_UNICODE_WCHAR_T -> EXPAT_CHAR_TYPE=wchar_t (!) 1712 #244 #264 CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), 1713 default OFF 1714 #326 CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), 1715 default OFF 1716 #328 CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), 1717 default OFF 1718 #239 #277 CMake: Add arguments 1719 -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO 1720 -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO 1721 #326 CMake: Install expat_config.h to include directory 1722 #326 CMake: Generate and install configuration files for 1723 future find_package(expat [..] CONFIG [..]) 1724 CMake: Now produces a summary of applied configuration 1725 CMake: Require C++ compiler only when tests are enabled 1726 #330 CMake: Fix compilation for 16bit character types, 1727 i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) 1728 #265 CMake: Fix linking with MinGW 1729 #330 CMake: Add full support for MinGW; to enable, use 1730 -DCMAKE_TOOLCHAIN_FILE=[expat]/cmake/mingw-toolchain.cmake 1731 #330 CMake: Port "make run-xmltest" from GNU Autotools to CMake 1732 #316 CMake: Windows: Make binary postfix match MSVC 1733 Old: expat[d].lib 1734 New: expat[w][d][MD|MT].lib 1735 CMake: Migrate files from Windows to Unix line endings 1736 #308 CMake: Integrate OSS-Fuzz fuzzers, option 1737 -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF 1738 #14 Drop an OpenVMS support leftover 1739 #235 #268 .. 1740 #270 #310 .. 1741 #313 #331 #333 Address compiler warnings 1742 #282 #283 .. 1743 #284 #285 Address cppcheck warnings 1744 #294 #295 Address Clang Static Analyzer warnings 1745 #24 #293 Mass-apply clang-format 9 (and ensure conformance during CI) 1746 Version info bumped from 7:9:6 to 7:10:6 1747 1748 Special thanks to: 1749 David Loffredo 1750 Joonun Jang 1751 Kishore Kunche 1752 Marco Maggi 1753 Mitch Phillips 1754 Mohammed Khajapasha 1755 Rolf Ade 1756 xantares 1757 Zhongyuan Zhou 1758 1759Release 2.2.7 Wed June 19 2019 1760 Security fixes: 1761 #186 #262 CVE-2018-20843 -- Fix extraction of namespace prefixes from 1762 XML names; XML names with multiple colons could end up in 1763 the wrong namespace, and take a high amount of RAM and CPU 1764 resources while processing, opening the door to 1765 use for denial-of-service attacks 1766 1767 Other changes: 1768 #195 #197 Autotools/CMake: Utilize -fvisibility=hidden to stop 1769 exporting non-API symbols 1770 #227 Autotools: Add --without-examples and --without-tests 1771 #228 Autotools: Modernize configure.ac 1772 #245 #246 Autotools: Fix check for -fvisibility=hidden for Clang 1773 #247 #248 Autotools: Fix compilation for lack of docbook2x-man 1774 #236 #258 Autotools: Produce .tar.{gz,lz,xz} release archives 1775 #212 CMake: Make libdir of pkgconfig expat.pc support multilib 1776 #158 #263 CMake: Build man page in PROJECT_BINARY_DIR not _SOURCE_DIR 1777 #219 Remove fallback to bcopy, assume that memmove(3) exists 1778 #257 Use portable "/usr/bin/env bash" shebang (e.g. for OpenBSD) 1779 #243 Windows: Fix syntax of .def module definition files 1780 Version info bumped from 7:8:6 to 7:9:6 1781 1782 Special thanks to: 1783 Benjamin Peterson 1784 Caolán McNamara 1785 Hanno Böck 1786 KangLin 1787 Kishore Kunche 1788 Marco Maggi 1789 Rhodri James 1790 Sebastian Dröge 1791 userwithuid 1792 Yury Gribov 1793 1794Release 2.2.6 Sun August 12 2018 1795 Bug fixes: 1796 #170 #206 Avoid doing arithmetic with NULL pointers in XML_GetBuffer 1797 #204 #205 Fix 2.2.5 regression with suspend-resume while parsing 1798 a document like '<root/>' 1799 1800 Other changes: 1801 #165 #168 Autotools: Fix docbook-related configure syntax error 1802 #166 Autotools: Avoid grep option `-q` for Solaris 1803 #167 Autotools: Support 1804 ./configure DOCBOOK_TO_MAN="xmlto man --skip-validation" 1805 #159 #167 Autotools: Support DOCBOOK_TO_MAN command which produces 1806 xmlwf.1 rather than XMLWF.1; also covers case insensitive 1807 file systems 1808 #181 Autotools: Drop -rpath option passed to libtool 1809 #188 Autotools: Detect and deny SGML docbook2man as ours is XML 1810 #188 Autotools/CMake: Support command db2x_docbook2man as well 1811 #174 CMake: Introduce option WARNINGS_AS_ERRORS, defaults to OFF 1812 #184 #185 CMake: Introduce option MSVC_USE_STATIC_CRT, defaults to OFF 1813 #207 #208 CMake: Introduce option XML_UNICODE and XML_UNICODE_WCHAR_T, 1814 both defaulting to OFF 1815 #175 CMake: Prefer check_symbol_exists over check_function_exists 1816 #176 CMake: Create the same pkg-config file as with GNU Autotools 1817 #178 #179 CMake: Use GNUInstallDirs module to set proper defaults for 1818 install directories 1819 #208 CMake: Utilize expat_config.h.cmake for XML_DEV_URANDOM 1820 #180 Windows: Fix compilation of test suite for Visual Studio 2008 1821 #131 #173 #202 Address compiler warnings 1822 #187 #190 #200 Fix miscellaneous typos 1823 Version info bumped from 7:7:6 to 7:8:6 1824 1825 Special thanks to: 1826 Anton Maklakov 1827 Benjamin Peterson 1828 Brad King 1829 Franek Korta 1830 Frank Rast 1831 Joe Orton 1832 luzpaz 1833 Pedro Vicente 1834 Rainer Jung 1835 Rhodri James 1836 Rolf Ade 1837 Rolf Eike Beer 1838 Thomas Beutlich 1839 Tomasz Kłoczko 1840 1841Release 2.2.5 Tue October 31 2017 1842 Bug fixes: 1843 #8 If the parser runs out of memory, make sure its internal 1844 state reflects the memory it actually has, not the memory 1845 it wanted to have. 1846 #11 The default handler wasn't being called when it should for 1847 a SYSTEM or PUBLIC doctype if an entity declaration handler 1848 was registered. 1849 #137 #138 Fix a case of mistakenly reported parsing success where 1850 XML_StopParser was called from an element handler 1851 #162 Function XML_ErrorString was returning NULL rather than 1852 a message for code XML_ERROR_INVALID_ARGUMENT 1853 introduced with release 2.2.1 1854 1855 Other changes: 1856 #106 xmlwf: Add argument -N adding notation declarations 1857 #75 #106 Test suite: Resolve expected failure cases where xmlwf 1858 output was incomplete 1859 #127 Windows: Fix test suite compilation 1860 #126 #127 Windows: Fix compilation for Visual Studio 2012 1861 Windows: Upgrade shipped project files to Visual Studio 2017 1862 #33 #132 tests: Mass-fix compilation for XML_UNICODE_WCHAR_T 1863 #129 examples: Fix compilation for XML_UNICODE_WCHAR_T 1864 #130 benchmark: Fix compilation for XML_UNICODE_WCHAR_T 1865 #144 xmlwf: Fix compilation for XML_UNICODE_WCHAR_T; still needs 1866 Windows or MinGW for 2-byte wchar_t 1867 #9 Address two Clang Static Analyzer false positives 1868 #59 Resolve troublesome macros hiding parser struct membership 1869 and dereferencing that pointer 1870 #6 Resolve superfluous internal malloc/realloc switch 1871 #153 #155 Improve docbook2x-man detection 1872 #160 Undefine NDEBUG in the test suite (rather than rejecting it) 1873 #161 Address compiler warnings 1874 Version info bumped from 7:6:6 to 7:7:6 1875 1876 Special thanks to: 1877 Benbuck Nason 1878 Hans Wennborg 1879 José Gutiérrez de la Concha 1880 Pedro Monreal Gonzalez 1881 Rhodri James 1882 Rolf Ade 1883 Stephen Groat 1884 and 1885 Core Infrastructure Initiative 1886 1887Release 2.2.4 Sat August 19 2017 1888 Bug fixes: 1889 #115 Fix copying of partial characters for UTF-8 input 1890 1891 Other changes: 1892 #109 Fix "make check" for non-x86 architectures that default 1893 to unsigned type char (-128..127 rather than 0..255) 1894 #109 coverage.sh: Cover -funsigned-char 1895 Autotools: Introduce --without-xmlwf argument 1896 #65 Autotools: Replace handwritten Makefile with GNU Automake 1897 #43 CMake: Auto-detect high quality entropy extractors, add new 1898 option USE_libbsd=ON to use arc4random_buf of libbsd 1899 #74 CMake: Add -fno-strict-aliasing only where supported 1900 #114 CMake: Always honor manually set BUILD_* options 1901 #114 CMake: Compile man page if docbook2x-man is available, only 1902 #117 Include file tests/xmltest.log.expected in source tarball 1903 (required for "make run-xmltest") 1904 #117 Include (existing) Visual Studio 2013 files in source tarball 1905 Improve test suite error output 1906 #111 Fix some typos in documentation 1907 Version info bumped from 7:5:6 to 7:6:6 1908 1909 Special thanks to: 1910 Jakub Wilk 1911 Joe Orton 1912 Lin Tian 1913 Rolf Eike Beer 1914 1915Release 2.2.3 Wed August 2 2017 1916 Security fixes: 1917 #82 CVE-2017-11742 -- Windows: Fix DLL hijacking vulnerability 1918 using Steve Holme's LoadLibrary wrapper for/of cURL 1919 1920 Bug fixes: 1921 #85 Fix a dangling pointer issue related to realloc 1922 1923 Other changes: 1924 Increase code coverage 1925 #91 Linux: Allow getrandom to fail if nonblocking pool has not 1926 yet been initialized and read /dev/urandom then, instead. 1927 This is in line with what recent Python does. 1928 #81 Pre-10.7/Lion macOS: Support entropy from arc4random 1929 #86 Check that a UTF-16 encoding in an XML declaration has the 1930 right endianness 1931 #4 #5 #7 Recover correctly when some reallocations fail 1932 Repair "./configure && make" for systems without any 1933 provider of high quality entropy 1934 and try reading /dev/urandom on those 1935 Ensure that user-defined character encodings have converter 1936 functions when they are needed 1937 Fix mis-leading description of argument -c in xmlwf.1 1938 Rely on macro HAVE_ARC4RANDOM_BUF (rather than __CloudABI__) 1939 for CloudABI 1940 #100 Fix use of SIPHASH_MAIN in siphash.h 1941 #23 Test suite: Fix memory leaks 1942 Version info bumped from 7:4:6 to 7:5:6 1943 1944 Special thanks to: 1945 Chanho Park 1946 Joe Orton 1947 Pascal Cuoq 1948 Rhodri James 1949 Simon McVittie 1950 Vadim Zeitlin 1951 Viktor Szakats 1952 and 1953 Core Infrastructure Initiative 1954 1955Release 2.2.2 Wed July 12 2017 1956 Security fixes: 1957 #43 Protect against compilation without any source of high 1958 quality entropy enabled, e.g. with CMake build system; 1959 commit ff0207e6076e9828e536b8d9cd45c9c92069b895 1960 #60 Windows with _UNICODE: 1961 Unintended use of LoadLibraryW with a non-wide string 1962 resulted in failure to load advapi32.dll and degradation 1963 in quality of used entropy when compiled with _UNICODE for 1964 Windows; you can launch existing binaries with 1965 EXPAT_ENTROPY_DEBUG=1 in the environment to inspect the 1966 quality of entropy used during runtime; commits 1967 * 95b95032f907ef1cd17ee7a9a1768010a825d61d 1968 * 73a5a2e9c081f49f2d775cf7ced864158b68dc80 1969 [MOX-006] Fix non-NULL parser parameter validation in XML_Parse; 1970 resulted in NULL dereference, previously; 1971 commit ac256dafdffc9622ab0dc2c62fcecb0dfcfa71fe 1972 1973 Bug fixes: 1974 #69 Fix improper use of unsigned long long integer literals 1975 1976 Other changes: 1977 #73 Start requiring a C99 compiler 1978 #49 Fix "==" Bashism in configure script 1979 #50 Fix too eager getrandom detection for Debian GNU/kFreeBSD 1980 #52 and macOS 1981 #51 Address lack of stdint.h in Visual Studio 2003 to 2008 1982 #58 Address compile warnings 1983 #68 Fix "./buildconf.sh && ./configure" for some versions 1984 of Dash for /bin/sh 1985 #72 CMake: Ease use of Expat in context of a parent project 1986 with multiple CMakeLists.txt files 1987 #72 CMake: Resolve mistaken executable permissions 1988 #76 Address compile warning with -DNDEBUG (not recommended!) 1989 #77 Address compile warning about macro redefinition 1990 1991 Special thanks to: 1992 Alexander Bluhm 1993 Ben Boeckel 1994 Cătălin Răceanu 1995 Kerin Millar 1996 László Böszörményi 1997 S. P. Zeidler 1998 Segev Finer 1999 Václav Slavík 2000 Victor Stinner 2001 Viktor Szakats 2002 and 2003 Radically Open Security 2004 2005Release 2.2.1 Sat June 17 2017 2006 Security fixes: 2007 CVE-2017-9233 -- External entity infinite loop DoS 2008 Details: https://libexpat.github.io/doc/cve-2017-9233/ 2009 Commit c4bf96bb51dd2a1b0e185374362ee136fe2c9d7f 2010 [MOX-002] CVE-2016-9063 -- Detect integer overflow; commit 2011 d4f735b88d9932bd5039df2335eefdd0723dbe20 2012 (Fixed version of existing downstream patches!) 2013 (SF.net) #539 Fix regression from fix to CVE-2016-0718 cutting off 2014 longer tag names; commits 2015 * 896b6c1fd3b842f377d1b62135dccf0a579cf65d 2016 * af507cef2c93cb8d40062a0abe43a4f4e9158fb2 2017 #16 * 0dbbf43fdb20f593ddf4fa1ff67288000dd4a7fd 2018 #25 More integer overflow detection (function poolGrow); commits 2019 * 810b74e4703dcfdd8f404e3cb177d44684775143 2020 * 44178553f3539ce69d34abee77a05e879a7982ac 2021 [MOX-002] Detect overflow from len=INT_MAX call to XML_Parse; commits 2022 * 4be2cb5afcc018d996f34bbbce6374b7befad47f 2023 * 7e5b71b748491b6e459e5c9a1d090820f94544d8 2024 [MOX-005] #30 Use high quality entropy for hash initialization: 2025 * arc4random_buf on BSD, systems with libbsd 2026 (when configured with --with-libbsd), CloudABI 2027 * RtlGenRandom on Windows XP / Server 2003 and later 2028 * getrandom on Linux 3.17+ 2029 In a way, that's still part of CVE-2016-5300. 2030 https://github.com/libexpat/libexpat/pull/30/commits 2031 [MOX-005] For the low quality entropy extraction fallback code, 2032 the parser instance address can no longer leak, commit 2033 04ad658bd3079dd15cb60fc67087900f0ff4b083 2034 [MOX-003] Prevent use of uninitialised variable; commit 2035 [MOX-004] a4dc944f37b664a3ca7199c624a98ee37babdb4b 2036 Add missing parameter validation to public API functions 2037 and dedicated error code XML_ERROR_INVALID_ARGUMENT: 2038 [MOX-006] * NULL checks; commits 2039 * d37f74b2b7149a3a95a680c4c4cd2a451a51d60a (merge/many) 2040 * 9ed727064b675b7180c98cb3d4f75efba6966681 2041 * 6a747c837c50114dfa413994e07c0ba477be4534 2042 * Negative length (XML_Parse); commit 2043 [MOX-002] 70db8d2538a10f4c022655d6895e4c3e78692e7f 2044 [MOX-001] #35 Change hash algorithm to William Ahern's version of SipHash 2045 to go further with fixing CVE-2012-0876. 2046 https://github.com/libexpat/libexpat/pull/39/commits 2047 2048 Bug fixes: 2049 #32 Fix sharing of hash salt across parsers; 2050 relevant where XML_ExternalEntityParserCreate is called 2051 prior to XML_Parse, in particular (e.g. FBReader) 2052 #28 xmlwf: Auto-disable use of memory-mapping (and parsing 2053 as a single chunk) for files larger than ~1 GB (2^30 bytes) 2054 rather than failing with error "out of memory" 2055 #3 Fix double free after malloc failure in DTD code; commit 2056 7ae9c3d3af433cd4defe95234eae7dc8ed15637f 2057 #17 Fix memory leak on parser error for unbound XML attribute 2058 prefix with new namespaces defined in the same tag; 2059 found by Google's OSS-Fuzz; commits 2060 * 16f87daae5a16132e479e4f71862128c7a915c73 2061 * b47dbc9745932c160893d433220e462bd605f8cd 2062 xmlwf on Windows: Add missing calls to CloseHandle 2063 2064 New features: 2065 #30 Introduced environment switch EXPAT_ENTROPY_DEBUG=1 2066 for runtime debugging of entropy extraction 2067 2068 Other changes: 2069 Increase code coverage 2070 #33 Reject use of XML_UNICODE_WCHAR_T with sizeof(wchar_t) != 2; 2071 XML_UNICODE_WCHAR_T was never meant to be used outside 2072 of Windows; 4-byte wchar_t is common on Linux 2073 (SF.net) #538 Start using -fno-strict-aliasing 2074 (SF.net) #540 Support compilation against cloudlibc of CloudABI 2075 Allow MinGW cross-compilation 2076 (SF.net) #534 CMake: Introduce option "BUILD_doc" (enabled by default) 2077 to bypass compilation of the xmlwf.1 man page 2078 (SF.net) pr2 CMake: Introduce option "INSTALL" (enabled by default) 2079 to bypass installation of expat files 2080 CMake: Fix ninja support 2081 Autotools: Add parameters --enable-xml-context [COUNT] 2082 and --disable-xml-context; default of context of 1024 2083 bytes enabled unchanged 2084 #14 Drop AmigaOS 4.x code and includes 2085 #14 Drop ancient build systems: 2086 * Borland C++ Builder 2087 * OpenVMS 2088 * Open Watcom 2089 * Visual Studio 6.0 2090 * Pre-X Mac OS (MPW Makefile) 2091 If you happen to rely on some of these, please get in 2092 touch for joining with maintenance. 2093 #10 Move from WIN32 to _WIN32 2094 #13 Fix "make run-xmltest" order instability 2095 Address compile warnings 2096 Bump version info from 7:2:6 to 7:3:6 2097 Add AUTHORS file 2098 2099 Infrastructure: 2100 #1 Migrate from SourceForge to GitHub (except downloads): 2101 https://github.com/libexpat/ 2102 #1 Re-create http://libexpat.org/ project website 2103 Start utilizing Travis CI 2104 2105 Special thanks to: 2106 Andy Wang 2107 Don Lewis 2108 Ed Schouten 2109 Karl Waclawek 2110 Pascal Cuoq 2111 Rhodri James 2112 Sergei Nikulov 2113 Tobias Taschner 2114 Viktor Szakats 2115 and 2116 Core Infrastructure Initiative 2117 Mozilla Foundation (MOSS Track 3: Secure Open Source) 2118 Radically Open Security 2119 2120Release 2.2.0 Tue June 21 2016 2121 Security fixes: 2122 #537 CVE-2016-0718 -- Fix crash on malformed input 2123 CVE-2016-4472 -- Improve insufficient fix to CVE-2015-1283 / 2124 CVE-2015-2716 introduced with Expat 2.1.1 2125 #499 CVE-2016-5300 -- Use more entropy for hash initialization 2126 than the original fix to CVE-2012-0876 2127 #519 CVE-2012-6702 -- Resolve troublesome internal call to srand 2128 that was introduced with Expat 2.1.0 2129 when addressing CVE-2012-0876 (issue #496) 2130 2131 Bug fixes: 2132 Fix uninitialized reads of size 1 2133 (e.g. in little2_updatePosition) 2134 Fix detection of UTF-8 character boundaries 2135 2136 Other changes: 2137 #532 Fix compilation for Visual Studio 2010 (keyword "C99") 2138 Autotools: Resolve use of "$<" to better support bmake 2139 Autotools: Add QA script "qa.sh" (and make target "qa") 2140 Autotools: Respect CXXFLAGS if given 2141 Autotools: Fix "make run-xmltest" 2142 Autotools: Have "make run-xmltest" check for expected output 2143 p90 CMake: Fix static build (BUILD_shared=OFF) on Windows 2144 #536 CMake: Add soversion, support -DNO_SONAME=yes to bypass 2145 #323 CMake: Add suffix "d" to differentiate debug from release 2146 CMake: Define WIN32 with CMake on Windows 2147 Annotate memory allocators for GCC 2148 Address all currently known compile warnings 2149 Make sure that API symbols remain visible despite 2150 -fvisibility=hidden 2151 Remove executable flag from source files 2152 Resolve COMPILED_FROM_DSP in favor of WIN32 2153 2154 Special thanks to: 2155 Björn Lindahl 2156 Christian Heimes 2157 Cristian Rodríguez 2158 Daniel Krügler 2159 Gustavo Grieco 2160 Karl Waclawek 2161 László Böszörményi 2162 Marco Grassi 2163 Pascal Cuoq 2164 Sergei Nikulov 2165 Thomas Beutlich 2166 Warren Young 2167 Yann Droneaud 2168 2169Release 2.1.1 Sat March 12 2016 2170 Security fixes: 2171 #582: CVE-2015-1283 - Multiple integer overflows in XML_GetBuffer 2172 2173 Bug fixes: 2174 #502: Fix potential null pointer dereference 2175 #520: Symbol XML_SetHashSalt was not exported 2176 Output of "xmlwf -h" was incomplete 2177 2178 Other changes: 2179 #503: Document behavior of calling XML_SetHashSalt with salt 0 2180 Minor improvements to man page xmlwf(1) 2181 Improvements to the experimental CMake build system 2182 libtool now invoked with --verbose 2183 2184Release 2.1.0 Sat March 24 2012 2185 - Security fixes: 2186 #2958794: CVE-2012-1148 - Memory leak in poolGrow. 2187 #2895533: CVE-2012-1147 - Resource leak in readfilemap.c. 2188 #3496608: CVE-2012-0876 - Hash DOS attack. 2189 #2894085: CVE-2009-3560 - Buffer over-read and crash in big2_toUtf8(). 2190 #1990430: CVE-2009-3720 - Parser crash with special UTF-8 sequences. 2191 - Bug Fixes: 2192 #1742315: Harmful XML_ParserCreateNS suggestion. 2193 #1785430: Expat build fails on linux-amd64 with gcc version>=4.1 -O3. 2194 #1983953, 2517952, 2517962, 2649838: 2195 Build modifications using autoreconf instead of buildconf.sh. 2196 #2815947, #2884086: OBJEXT and EXEEXT support while building. 2197 #2517938: xmlwf should return non-zero exit status if not well-formed. 2198 #2517946: Wrong statement about XMLDecl in xmlwf.1 and xmlwf.sgml. 2199 #2855609: Dangling positionPtr after error. 2200 #2990652: CMake support. 2201 #3010819: UNEXPECTED_STATE with a trailing "%" in entity value. 2202 #3206497: Uninitialized memory returned from XML_Parse. 2203 #3287849: make check fails on mingw-w64. 2204 - Patches: 2205 #1749198: pkg-config support. 2206 #3010222: Fix for bug #3010819. 2207 #3312568: CMake support. 2208 #3446384: Report byte offsets for attr names and values. 2209 - New Features / API changes: 2210 Added new API member XML_SetHashSalt() that allows setting an initial 2211 value (salt) for hash calculations. This is part of the fix for 2212 bug #3496608 to randomize hash parameters. 2213 When compiled with XML_ATTR_INFO defined, adds new API member 2214 XML_GetAttributeInfo() that allows retrieving the byte 2215 offsets for attribute names and values (patch #3446384). 2216 Added CMake build system. 2217 See bug #2990652 and patch #3312568. 2218 Added run-benchmark target to Makefile.in - relies on testdata module 2219 present in the same relative location as in the repository. 2220 2221Release 2.0.1 Tue June 5 2007 2222 - Fixed bugs #1515266, #1515600: The character data handler's calling 2223 of XML_StopParser() was not handled properly; if the parser was 2224 stopped and the handler set to NULL, the parser would segfault. 2225 - Fixed bug #1690883: Expat failed on EBCDIC systems as it assumed 2226 some character constants to be ASCII encoded. 2227 - Minor cleanups of the test harness. 2228 - Fixed xmlwf bug #1513566: "out of memory" error on file size zero. 2229 - Fixed outline.c bug #1543233: missing a final XML_ParserFree() call. 2230 - Fixes and improvements for Windows platform: 2231 bugs #1409451, #1476160, #1548182, #1602769, #1717322. 2232 - Build fixes for various platforms: 2233 HP-UX, Tru64, Solaris 9: patch #1437840, bug #1196180. 2234 All Unix: #1554618 (refreshed config.sub/config.guess). 2235 #1490371, #1613457: support both, DESTDIR and INSTALL_ROOT, 2236 without relying on GNU-Make specific features. 2237 #1647805: Patched configure.in to work better with Intel compiler. 2238 - Fixes to Makefile.in to have make check work correctly: 2239 bugs #1408143, #1535603, #1536684. 2240 - Added Open Watcom support: patch #1523242. 2241 2242Release 2.0.0 Wed Jan 11 2006 2243 - We no longer use the "check" library for C unit testing; we 2244 always use the (partial) internal implementation of the API. 2245 - Report XML_NS setting via XML_GetFeatureList(). 2246 - Fixed headers for use from C++. 2247 - XML_GetCurrentLineNumber() and XML_GetCurrentColumnNumber() 2248 now return unsigned integers. 2249 - Added XML_LARGE_SIZE switch to enable 64-bit integers for 2250 byte indexes and line/column numbers. 2251 - Updated to use libtool 1.5.22 (the most recent). 2252 - Added support for AmigaOS. 2253 - Some mostly minor bug fixes. SF issues include: #1006708, 2254 #1021776, #1023646, #1114960, #1156398, #1221160, #1271642. 2255 2256Release 1.95.8 Fri Jul 23 2004 2257 - Major new feature: suspend/resume. Handlers can now request 2258 that a parse be suspended for later resumption or aborted 2259 altogether. See "Temporarily Stopping Parsing" in the 2260 documentation for more details. 2261 - Some mostly minor bug fixes, but compilation should no 2262 longer generate warnings on most platforms. SF issues 2263 include: #827319, #840173, #846309, #888329, #896188, #923913, 2264 #928113, #961698, #985192. 2265 2266Release 1.95.7 Mon Oct 20 2003 2267 - Fixed enum XML_Status issue (reported on SourceForge many 2268 times), so compilers that are properly picky will be happy. 2269 - Introduced an XMLCALL macro to control the calling 2270 convention used by the Expat API; this macro should be used 2271 to annotate prototypes and definitions of callback 2272 implementations in code compiled with a calling convention 2273 other than the default convention for the host platform. 2274 - Improved ability to build without the configure-generated 2275 expat_config.h header. This is useful for applications 2276 which embed Expat rather than linking in the library. 2277 - Fixed a variety of bugs: see SF issues #458907, #609603, 2278 #676844, #679754, #692878, #692964, #695401, #699323, #699487, 2279 #820946. 2280 - Improved hash table lookups. 2281 - Added more regression tests and improved documentation. 2282 2283Release 1.95.6 Tue Jan 28 2003 2284 - Added XML_FreeContentModel(). 2285 - Added XML_MemMalloc(), XML_MemRealloc(), XML_MemFree(). 2286 - Fixed a variety of bugs: see SF issues #615606, #616863, 2287 #618199, #653180, #673791. 2288 - Enhanced the regression test suite. 2289 - Man page improvements: includes SF issue #632146. 2290 2291Release 1.95.5 Fri Sep 6 2002 2292 - Added XML_UseForeignDTD() for improved SAX2 support. 2293 - Added XML_GetFeatureList(). 2294 - Defined XML_Bool type and the values XML_TRUE and XML_FALSE. 2295 - Use an incomplete struct instead of a void* for the parser 2296 (may not retain). 2297 - Fixed UTF-8 decoding bug that caused legal UTF-8 to be rejected. 2298 - Finally fixed bug where default handler would report DTD 2299 events that were already handled by another handler. 2300 Initial patch contributed by Darryl Miles. 2301 - Removed unnecessary DllMain() function that caused static 2302 linking into a DLL to be difficult. 2303 - Added VC++ projects for building static libraries. 2304 - Reduced line-length for all source code and headers to be 2305 no longer than 80 characters, to help with AS/400 support. 2306 - Reduced memory copying during parsing (SF patch #600964). 2307 - Fixed a variety of bugs: see SF issues #580793, #434664, 2308 #483514, #580503, #581069, #584041, #584183, #584832, #585537, 2309 #596555, #596678, #598352, #598944, #599715, #600479, #600971. 2310 2311Release 1.95.4 Fri Jul 12 2002 2312 - Added support for VMS, contributed by Craig Berry. See 2313 vms/README.vms for more information. 2314 - Added Mac OS (classic) support, with a makefile for MPW, 2315 contributed by Thomas Wegner and Daryle Walker. 2316 - Added Borland C++ Builder 5 / BCC 5.5 support, contributed 2317 by Patrick McConnell (SF patch #538032). 2318 - Fixed a variety of bugs: see SF issues #441449, #563184, 2319 #564342, #566334, #566901, #569461, #570263, #575168, #579196. 2320 - Made skippedEntityHandler conform to SAX2 (see source comment) 2321 - Re-implemented WFC: Entity Declared from XML 1.0 spec and 2322 added a new error "entity declared in parameter entity": 2323 see SF bug report #569461 and SF patch #578161 2324 - Re-implemented section 5.1 from XML 1.0 spec: 2325 see SF bug report #570263 and SF patch #578161 2326 2327Release 1.95.3 Mon Jun 3 2002 2328 - Added a project to the MSVC workspace to create a wchar_t 2329 version of the library; the DLLs are named libexpatw.dll. 2330 - Changed the name of the Windows DLLs from expat.dll to 2331 libexpat.dll; this fixes SF bug #432456. 2332 - Added the XML_ParserReset() API function. 2333 - Fixed XML_SetReturnNSTriplet() to work for element names. 2334 - Made the XML_UNICODE builds usable (thanks, Karl!). 2335 - Allow xmlwf to read from standard input. 2336 - Install a man page for xmlwf on Unix systems. 2337 - Fixed many bugs; see SF bug reports #231864, #461380, #464837, 2338 #466885, #469226, #477667, #484419, #487840, #494749, #496505, 2339 #547350. Other bugs which we can't test as easily may also 2340 have been fixed, especially in the area of build support. 2341 2342Release 1.95.2 Fri Jul 27 2001 2343 - More changes to make MSVC happy with the build; add a single 2344 workspace to support both the library and xmlwf application. 2345 - Added a Windows installer for Windows users; includes 2346 xmlwf.exe. 2347 - Added compile-time constants that can be used to determine the 2348 Expat version 2349 - Removed a lot of GNU-specific dependencies to aide portability 2350 among the various Unix flavors. 2351 - Fix the UTF-8 BOM bug. 2352 - Cleaned up warning messages for several compilers. 2353 - Added the -Wall, -Wstrict-prototypes options for GCC. 2354 2355Release 1.95.1 Sun Oct 22 15:11:36 EDT 2000 2356 - Changes to get expat to build under Microsoft compiler 2357 - Removed all aborts and instead return an UNEXPECTED_STATE error. 2358 - Fixed a bug where a stray '%' in an entity value would cause an 2359 abort. 2360 - Defined XML_SetEndNamespaceDeclHandler. Thanks to Darryl Miles for 2361 finding this oversight. 2362 - Changed default patterns in lib/Makefile.in to fit non-GNU makes 2363 Thanks to robin@unrated.net for reporting and providing an 2364 account to test on. 2365 - The reference had the wrong label for XML_SetStartNamespaceDecl. 2366 Reported by an anonymous user. 2367 2368Release 1.95.0 Fri Sep 29 2000 2369 - XML_ParserCreate_MM 2370 Allows you to set a memory management suite to replace the 2371 standard malloc,realloc, and free. 2372 - XML_SetReturnNSTriplet 2373 If you turn this feature on when namespace processing is in 2374 effect, then qualified, prefixed element and attribute names 2375 are returned as "uri|name|prefix" where '|' is whatever 2376 separator character is used in namespace processing. 2377 - Merged in features from perl-expat 2378 o XML_SetElementDeclHandler 2379 o XML_SetAttlistDeclHandler 2380 o XML_SetXmlDeclHandler 2381 o XML_SetEntityDeclHandler 2382 o StartDoctypeDeclHandler takes 3 additional parameters: 2383 sysid, pubid, has_internal_subset 2384 o Many paired handler setters (like XML_SetElementHandler) 2385 now have corresponding individual handler setters 2386 o XML_GetInputContext for getting the input context of 2387 the current parse position. 2388 - Added reference material 2389 - Packaged into a distribution that builds a sharable library 2390