1 __ __ _ 2 ___\ \/ /_ __ __ _| |_ 3 / _ \\ /| '_ \ / _` | __| 4 | __// \| |_) | (_| | |_ 5 \___/_/\_\ .__/ \__,_|\__| 6 |_| XML parser 7 8!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 9!! <blink>Expat has UNFIXED SECURITY ISSUES!</blink> !! 10!! Please see https://github.com/libexpat/libexpat/issues/1160 for details. !! 11!! !! 12!! Starting 2026-08-01, for up to six months my work maintaining libexpat !! 13!! will be funded by the City of Munich as part of their !! 14!! Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html) !! 15!! — thank you! !! 16!! !! 17!! If your business relies on Expat beyond January 2027, please consider !! 18!! funding the maintenance of Expat to ensure its health and security for !! 19!! you and others. Thank you! !! 20!! !! 21!! Sebastian Pipping -- Berlin, 2026-09-22 !! 22!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 23 24Release 2.8.5 Tue September 22 2026 25 Security fixes: 26 #1282 CVE-2026-93990 -- Reject high surrogates not followed by a 27 low surrogate during UTF-16 decoding; previously, malformed 28 UTF-16 could be smuggled into the application using Expat 29 and could cause arbitrary damage there, depending on how 30 malformed UTF-16 was handled inside the application; 31 validation was not their job but Expat's. This is similar 32 to past vulnerability CVE-2022-25235. 33 Upstream CVSS 3.1 vector: 34 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS score: 9.8) 35 36/////////////////////////////////////////////////////////////////////////////// 37// The next release will drop two (disabled-by-default) features: // 38// // 39// - ATTR_INFO (-DXML_ATTR_INFO, -DEXPAT_ATTR_INFO, --enable-xml-attr-info, // 40// function XML_GetAttributeInfo, struct XML_AttrInfo) // 41// - MIN_SIZE (-DXML_MIN_SIZE, -DEXPAT_MIN_SIZE) // 42// // 43// If you need them in 2026 and beyond, please share your scenario at // 44// GitHub issues #1370 (for ATTR_INFO) and/or #1379 (for MIN_SIZE). Thanks! // 45/////////////////////////////////////////////////////////////////////////////// 46 47 Bug fixes: 48 #1346 lib: Fix OOM-related memory leak on a failed overflow check 49 #1371 lib: Fix memory alignment for architectures with 128bit 50 pointers like CHERI-RISC-V 51 #1367 xmlwf: Handle errors when closing output files 52 53 Other changes: 54 #1354 lib: Reject an XML declaration version other than `1.[0-9]+` 55 (which is less strict than XML 1.0r4 (fourth edition) 56 and matches XML 1.0r5 (fifth edition)) 57 #1362 lib: Make Clang, GCC and MSVC warn about use of function 58 XML_SetHashSalt that is deprecated since Expat 2.8.0 59 #1357 lib: Drop internal macros FASTCALL, PTRCALL, PTRFASTCALL 60 #1367 xmlwf: Document that with `-k` the last error determines the 61 xmlwf exit code in `--help` output 62 #1367 xmlwf: Make exit code 3 documentation match exit code 2 more 63 closely in `--help` output 64 #1352 #1353 CMake|Windows: Refrain from adding `/source-charset:utf-8` 65 for MSVC 66 #1366 #1374 Autotools: Be explicit about the minimum required version of 67 GNU Automake, currently version 1.13 of 2012-12-28 68 #1351 Autotools|macOS: Sync CMake templates with CMake 4.4.3 69 #1349 Replace some internal use of XML_Bool with standard bool 70 #1364 tests: Propagate xmltest.sh failures via exit status 71 #1360 tests|xmlwf: Add `#include "expat_config.h"` where missing 72 #1355 tests: Start covering hash table operation 73 #1350 #1369 tests: Drop __cplusplus leftovers 74 #1378 tests: Fix tail pointer when unlinking the last tracked 75 allocation 76 #1376 docs: Emphasize that XML_StopParser is not immediate 77 #1381 docs: Sync XML_FeatureEnum value list in doc/reference.html 78 #1356 #1361 Version info bumped from 13:4:12 (libexpat*.so.1.12.4) 79 to 13:5:12 (libexpat*.so.1.12.5); see https://verbump.de/ 80 for what these numbers do 81 82 Infrastructure: 83 #1347 Add missing .gitignore entries 84 #1360 CI: Detect missing `#include "expat_config.h"` 85 #1368 CI: Bump MinGW Clang from 23.0.1 to 23.1.1 86 #1377 CI: Bump Fil-C from 0.684 to 0.685 87 #1380 CI: Bump Cppcheck from 2.21.0 to 2.22.0 88 #1372 CI: Extract helper script `apply-htmltidy.sh` 89 #1366 #1374 Autotools: Start to also produce .tar.bz3 release tarballs 90 91 Special thanks to: 92 Afonso Januário 93 Braian Plaku 94 Florian Schmaus 95 Huang Wenbin 96 Kamila Szewczyk 97 Kartik Kenchi 98 Leo Camus 99 Matthew Fernandez 100 Stan Ulbrych 101 and 102 City of Munich Open Source Sabbatical 103 104Release 2.8.4 Mon August 31 2026 105 Security fixes: 106 #1321 #1331 CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from 107 "attribute isCdata lookups" that allowed denial of service 108 attacks through moderately sized crafted XML input 109 (CWE-407). 110 The vulnerability is closely related to past CVE-2026-45186 111 that was fixed with Expat 2.8.1. 112 Please note that a layer of compression around XML can 113 significantly reduce the minimum attack payload size. 114 Upstream CVSS 3.1 vector: 115 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) 116 (Note the "AV:N" for network/remote.) 117 #1322 CVE-2026-76957 -- Protect custom encoding callbacks from 118 parser re-entry. The vulnerability is closely related to 119 past issues CVE-2026-50219, CVE-2026-56131 and 120 CVE-2026-56412 that were all fixed with Expat 2.8.2. 121 #1326 CVE-2026-76956 -- Fix inverted getentropy() return handling 122 Allows for hash flooding denial of services in 123 configurations where getentropy is configured or detected 124 as the only high quality entropy extractor. 125 Upstream CVSS 3.1 vector: 126 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 5.9) 127 (Note the "AV:N" for network/remote.) 128 129 Other changes: 130 #1332 #1333 CMake: Only add `/source-charset:utf-8` when `/utf-8` is not 131 present 132 #1315 lib: Resolve (currently unreachable) undefined behavior from 133 overshifting a signed int to the left 134 #1325 #1334 lib: Support read-only hash table lookup with keys that are 135 not zero-terminated 136 #1340 lib: Use a C99 bool for `ENTITY.open` 137 #1319 Fix typo in comment 138 #1320 Sync file headers 139 #1328 #1329 Version info bumped from 13:3:12 (libexpat*.so.1.12.3) 140 to 13:4:12 (libexpat*.so.1.12.4); see https://verbump.de/ 141 for what these numbers do 142 143 Infrastructure: 144 #1317 #1335 CI: Cover compilation and execution with Fil-C 145 #1337 CI: Cover compilation and execution on riscv64 146 #1338 CI: Cover compilation and execution with Clang-based MinGW 147 #1339 CI: Cover compilation and execution on (big-endian) s390x 148 #1316 CI: Run test suite with musl, also 149 #1336 CI: Bump WASI SDK from 33 to 34 150 #1345 CI: Bump Clang from 22 to 23 151 152 Special thanks to: 153 Alberto Maschietto 154 Alexander Bluhm 155 Berkay Eren Ürün 156 Darren Carreras 157 Fabian Wahle (Hap Security) 158 Matteo Forzan 159 Matthew Fernandez 160 Sorrashut Kaewtaworn 161 Wade Sparks III 162 Zeyou Liu 163 and 164 City of Munich Open Source Sabbatical 165 Moonshot AI 166 VulnCheck 167 Z.ai 168 169Release 2.8.3 Mon August 10 2026 170 Security fixes: 171 #1296 CVE-2026-72522 -- Fix an out-of-bounds read and the resulting 172 infinite loop caused by treating low surrogates (Unicode) 173 the same as high surrogates in functions *_toUtf16. 174 Needs Expat compiled with 16bit character support 175 (e.g. with Firefox and/or on Windows) to be affected. 176 Upstream CVSS 3.1 vector: 177 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) 178 (Note the "AV:N" for network/remote, the "AV:L" in NVD by 179 Mitre is mistaken.) 180 Original bug report from Mozilla at: 181 https://bugzilla.mozilla.org/show_bug.cgi?id=2053153 182 183 Bug fixes: 184 #1297 #1300 lib: Fix support for 2+ GiB documents (regression from 2.8.2) 185 #1286 lib: Reject empty version in the XML declaration 186 #1305 #1306 lib: Fix printf format for AIX 187 188 Other changes: 189 #1309 CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX 190 #1295 CMake|Windows: Add a 64bit MinGW toolchain file 191 #1287 #1289 CMake|Windows: Start invoking MSVC with /source-charset:utf-8 192 #1289 CMake|Windows: Start requiring MSVC 2015 Update 2 or later 193 #1300 Document the current wrap-around issues with functions 194 - XML_GetCurrentByteIndex 195 - XML_GetCurrentColumnNumber 196 - XML_GetCurrentLineNumber 197 - XML_GetAttributeInfo 198 explicitly. 199 #1303 Address Clang Static Analyzer 22 warning 200 `core.NullPointerArithm` 201 #1313 #1314 Version info bumped from 13:2:12 (libexpat*.so.1.12.2) 202 to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/ 203 for what these numbers do 204 205 Infrastructure: 206 #1311 CI: Limit workflow runtime and package installation runtime 207 #1310 CI: Pin Cppcheck version for a robust CI 208 #1310 CI: Migrate Cppcheck CI from macOS to Linux 209 #1312 CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten 210 and WASI SDK 211 #1304 CI: Activate AddressSanitizer for MSVC Windows CI 212 #1308 CI: Introduce zizmor static analysis for GitHub Actions 213 #1308 CI: Start using `persist-credentials: false` with Git checkout 214 #1219 CI: Add a 7 day cooldown to Dependabot for GitHub Actions 215 #1302 #1303 CI: Bump Clang from 21 to 22 216 #1293 #1294 Update project status for 2026-08 217 #1301 #1307 Add SPDX license identifiers to the source code 218 219 Special thanks to: 220 Evgeny Kotkov 221 Henri Sivonen 222 Kartik Kenchi 223 Matthew Fernandez 224 Matthew Wozniczka 225 Stan Ulbrych 226 Tuukka Pasanen 227 William Woodruff 228 and 229 Anthropic 230 City of Munich Open Source Sabbatical 231 Mozilla Security Team 232 Subversion 233 zizmor static analysis 234 235Release 2.8.2 Thu June 25 2026 236 Security fixes: 237 #1246 CVE-2026-50219 -- Disallow calls to functions 238 `XML_GetBuffer`, `XML_Parse`, `XML_ParseBuffer`, 239 `XML_ParserFree`, `XML_ParserReset` to guard e.g. 240 Expat bindings from memory corruption; 241 this CPython issue is related: 242 https://github.com/python/cpython/issues/146169 243 #1267 CVE-2026-56131 -- Protect XML_ResumeParser from being called 244 from a handler, plugging a hole in the fix 245 to CVE-2026-50219 246 #1272 CVE-2026-56132 -- Fix out-of-bound scaffolding index store 247 in `doProlog` 248 #1229 #1232 CVE-2026-56403 -- Integer overflow in `storeAtts` 249 #1249 CVE-2026-56404 -- Integer overflow in `addBinding` 250 #1251 CVE-2026-56405 -- Integer overflow in `getAttributeId` 251 #1255 CVE-2026-56406 -- Integer overflow in `XML_ParseBuffer` 252 #1262 CVE-2026-56407 -- Integer overflow in `textLen` handling 253 #565 CVE-2026-56408 -- Integer overflow in `copyString` 254 (commit 16e2efd867ea8567ffa012210b52ef5918e20817) 255 #1259 CVE-2026-56409 -- xmlwf: Integer overflow in output path join 256 #1252 CVE-2026-56410 -- xmlwf: Integer overflow in 257 `resolveSystemId` 258 #1263 CVE-2026-56411 -- xmlwf: Integer overflow in notation list 259 allocation 260 #1278 CVE-2026-56412 -- Guard XML_TOK_DATA_CHARS handler calls in 261 `doCdataSection`, plugging a hole in the fix to 262 CVE-2026-50219 263 264 Bug fixes: 265 #1260 xmlwf: Escape names and base URI in meta output 266 #1266 xmlwf: Pick a safe quote for notation system and public IDs 267 268 Other changes: 269 #1257 CMake|Autotools: Stop using /dev/urandom by default 270 #1244 #1254 CMake: Fix guard for Unix sources of entropy 271 #1183 #1270 CMake|Windows: Add missing export for symbol 272 `XML_SetHashSalt16Bytes` 273 #1236 CMake: Mark option EXPAT_OSSFUZZ_BUILD as advanced 274 #1283 Limit output indentation for EXPAT_ENTITY_DEBUG=1 and 275 allow unlimited indentation via EXPAT_ENTITY_DEBUG=2 276 #565 Replace some loops by use of `memcpy`, `strlen`, `wcslen` 277 #1220 lib: Use a size_t for group sizes 278 #1221 lib: Fix too-conservative integer overflow check when 279 appending raw name 280 #1222 lib: Simplify attribute allocation/management logic 281 #1224 Update fallthrough annotations to satisfy Clang and GCC 282 #1226 lib: Remove unnecessary void * casts in random code 283 #1228 lib: Reduce scope of locals in storeAtts 284 #1230 lib: Count attributes with size_t variables 285 #1238 Minor get-buffer improvements 286 #1239 #1240 lib|tests: Include header expat_config.h first 287 #1241 lib: Shrink size of XML_GetBuffer 288 #1242 lib: Remove a legacy comment 289 #1243 lib: XML_ParserReset: Extract repeated linked-list move logic 290 #1243 lib: Unify entity free lists 291 #1247 lib: Fix use of '0' as boolean literal 292 #1248 lib: Make XML_Index overflow check more intuitive 293 #1256 lib: Use size_t for counting string/URI lengths 294 #1258 lib: XML_GetInputContext: Remove use of 0 for NULL 295 #1261 Comment typo fixes 296 #1275 Teach Memory Sanitizer semantics of randomization functions 297 #1276 #1281 Version info bumped from 13:1:12 (libexpat*.so.1.12.1) 298 to 13:2:12 (libexpat*.so.1.12.2); see https://verbump.de/ 299 for what these numbers do 300 301 Infrastructure: 302 #1231 perl-integration.yml: Bump to XML::Parser 2.59 303 #1237 emscripten.yml: Bump from Ubuntu 22.04 to 24.04 304 #1183 #1271 windows-build.yml: Cover completeness of file 305 libexpat.def.cmake 306 #1274 linux.yml: Make llvm-symbolizer available in CI 307 308 Special thanks to: 309 Alessandro Gario 310 Asher Darden 311 Christoph Reiter 312 Haris Hussain 313 Matthew Fernandez 314 Kartik Kenchi 315 Nick Begg 316 Sajin S 317 Yousef Shanableh 318 and 319 Anthropic 320 Astra Security 321 Trail of Bits 322 323Release 2.8.1 Sun May 10 2026 324 Security fixes: 325 #1216 CVE-2026-45186 -- Fix quadratic runtime from attribute name 326 collision checks that allowed denial of service attacks 327 through moderately sized crafted XML input (CWE-407). 328 Please note that a layer of compression around XML can 329 significantly reduce the minimum attack payload size. 330 Upstream CVSS 3.1 vector: 331 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) 332 (Note the "AV:N" for network/remote and the "AC:L" 333 for low complexity; the NVD entry from Mitre is mistaken.) 334 335 Other changes: 336 #1209 #1213 Drop more casts related to `void *` that C99 does not need 337 #1213 xmlwf: Streamline use of `mmap` 338 #1214 #1217 Version info bumped from 13:0:12 (libexpat*.so.1.12.0) 339 to 13:1:12 (libexpat*.so.1.12.1); see https://verbump.de/ 340 for what these numbers do 341 342 Infrastructure: 343 #1210 CI: Cover compilation with Visual Studio 18 2026 on Windows 344 #1215 CI: Cover compilation for ARM64 on Windows 345 #1212 CI: Bump WASI SDK from 32 to 33 346 347 Special thanks to: 348 Berkay Eren Ürün 349 Matthew Fernandez 350 Nick Wellnhofer 351 Tania Somanna 352 353Release 2.8.0 Fri April 24 2026 354 Security fixes: 355 #47 #1183 CVE-2026-41080 -- The existing hash flooding protection 356 (based on SipHash) only used 4 to 8 bytes of entropy for 357 a salt, when 16 bytes of salt are supported by the 358 implementation of SipHash used by Expat. Now full 16 bytes 359 of entropy are used to improve protection against hash 360 flooding attacks. 361 Existing API function XML_SetHashSalt is now deprecated 362 because of its limitations, and its use should be 363 considered a vulnerability. Please either use the new API 364 function XML_SetHashSalt16Bytes (with known-high-quality 365 entropy input only!) instead, or leave the derivation of 366 a 16-bytes hash salt from high quality entropy to Expat's 367 internal machinery (by *not* calling either of the two 368 XML_SetHashSalt* functions). 369 370 Bug fixes: 371 #1188 Avoid propagating /dev/urandom file descriptor to child 372 processes 373 #1193 Fix interpretation of `errno` after randomization calls 374 #1195 Avoid assuming uint8_t is a character type 375 376 Other changes: 377 #1180 #1199 Add support for `getentropy(3)` as a source of entropy; 378 this helps with protecting against hash flooding attacks, 379 in particular with WASI SDK (where none of the other 380 entropy sources supported by libexpat are available). 381 #1200 Autotools: Add `--without-arc4random` and 382 `--without-arc4random-buf` 383 #1200 Autotools: Make `./configure` output report on available 384 high quality entropy sources 385 #1173 Autotools|macOS: Sync CMake templates with CMake 4.3.0 386 #1201 Autotools|CMake: Improve checks for `arc4random` and 387 `arc4random_buf` e.g. with modern glibc 388 #1201 CMake: Report on availability of functions `arc4random` and 389 `arc4random_buf` 390 #1201 CMake: Mark entropy related build switches as advanced 391 #1189 .. 392 #1203 #1204 Extract new files from entropy extraction code 393 #1194 Stop duplicating C tests 1:1 as C++ ("runtests_cxx") 394 #1202 Fix a comment typo in expat_external.h 395 #1187 Fix grammar in compile error message 396 #1192 examples: Build warning-free with -Wwrite-strings 397 #1171 tests: Address harmless warning from Coverity 398 #1170 #1176 Sync file headers 399 #1190 #1206 Version info bumped from 12:3:11 (libexpat*.so.1.11.3) 400 to 13:0:12 (libexpat*.so.1.12.0); see https://verbump.de/ 401 for what these numbers do 402 403 Infrastructure: 404 #1166 #1167 .. 405 #1172 #1175 .. 406 #1178 #1179 .. 407 #1185 #1205 CI: Make Perl XML::Parser integration tests run against 408 both version 2.47 and the latest release 2.58 409 #1169 CI: Adapt to breaking changes regarding Inno Setup 410 #1173 CI: Adapt to breaking changes regarding CMake 411 #1174 CI: Include public corpus of fuzzer `xml_lpm_fuzzer` with 412 regression testing 413 #1181 #1182 CI: Bump WASI SDK from 30 to 32 414 415 Special thanks to: 416 Jérôme Duval 417 Matthew Fernandez 418 419Release 2.7.5 Tue March 17 2026 420 Security fixes: 421 #1158 CVE-2026-32776 -- Fix NULL function pointer dereference for 422 empty external parameter entities; it takes use of both 423 functions XML_ExternalEntityParserCreate and 424 XML_SetParamEntityParsing for an application to be 425 vulnerable. 426 #1161 #1162 CVE-2026-32777 -- Protect from XML_TOK_INSTANCE_START 427 infinite loop in function entityValueProcessor; it takes 428 use of both functions XML_ExternalEntityParserCreate and 429 XML_SetParamEntityParsing for an application to be 430 vulnerable. 431 #1163 CVE-2026-32778 -- Fix NULL dereference in function setContext 432 on retry after an earlier ouf-of-memory condition; it takes 433 use of function XML_ParserCreateNS or XML_ParserCreate_MM 434 for an application to be vulnerable. 435 #1160 Three more unfixed vulnerabilities left 436 437 Other changes: 438 #1146 #1147 Autotools: Fix condition for symbol versioning check, in 439 particular when compiling with slibtool (not libtool) 440 #1156 Address Cppcheck >=2.20.0 warnings 441 #1153 tests: Make test_buffer_can_grow_to_max work for MinGW on 442 Ubuntu 24.04 443 #1157 #1159 Version info bumped from 12:2:11 (libexpat*.so.1.11.2) 444 to 12:3:11 (libexpat*.so.1.11.3); see https://verbump.de/ 445 for what these numbers do 446 447 Infrastructure: 448 #1148 CI: Fix FreeBSD and Solaris CI 449 #1149 CI: Bump to WASI SDK 30 450 #1153 CI: Adapt to breaking changes with Ubuntu 22.04 451 #1156 CI: Adapt to breaking changes in Cppcheck 452 453 Special thanks to: 454 Berkay Eren Ürün 455 Christian Ng 456 Fabio Scaccabarozzi 457 Francesco Bertolaccini 458 Mark Brand 459 Rhodri James 460 and 461 AddressSanitizer 462 Buttercup 463 OSS-Fuzz / ClusterFuzz 464 Trail of Bits 465 466Release 2.7.4 Sat January 31 2026 467 Security fixes: 468 #1131 CVE-2026-24515 -- Function XML_ExternalEntityParserCreate 469 failed to copy the encoding handler data passed to 470 XML_SetUnknownEncodingHandler from the parent to the new 471 subparser. This can cause a NULL dereference (CWE-476) from 472 external entities that declare use of an unknown encoding. 473 The expected impact is denial of service. It takes use of 474 both functions XML_ExternalEntityParserCreate and 475 XML_SetUnknownEncodingHandler for an application to be 476 vulnerable. 477 #1075 CVE-2026-25210 -- Add missing check for integer overflow 478 related to buffer size determination in function doContent 479 480 Bug fixes: 481 #1073 lib: Fix missing undoing of group size expansion in doProlog 482 failure cases 483 #1107 xmlwf: Fix a memory leak 484 #1104 WASI: Fix format specifiers for 32bit WASI SDK 485 486 Other changes: 487 #1105 lib: Fix strict aliasing 488 #1106 lib: Leverage feature "flexible array member" of C99 489 #1051 lib: Swap (size_t)(-1) for C99 equivalent SIZE_MAX 490 #1109 lib|xmlwf: Return NULL instead of 0 for pointers 491 #1068 lib|Windows: Clean up use of macro _MSC_EXTENSIONS with MSVC 492 #1112 lib: Remove unused import 493 #1110 xmlwf: Warn about XXE in --help output (and man page) 494 #1102 #1103 WASI: Stop using getpid 495 #1113 #1130 Autotools: Drop file expat.m4 that provided obsolete Autoconf 496 macro AM_WITH_EXPAT 497 #1123 Autotools: Limit -Wno-pedantic-ms-format to MinGW 498 #1129 #1134 .. 499 #1087 Autotools|macOS: Sync CMake templates with CMake 4.0 500 #1139 #1140 Autotools|CMake: Introduce off-by-default symbol versioning 501 The related build system flags are: 502 - For Autotools, configure with --enable-symbol-versioning 503 - For CMake, configure with -DEXPAT_SYMBOL_VERSIONING=ON 504 Please double-check for consequences before activating 505 this inside distro packaging. Bug reports welcome! 506 #1117 Autotools|CMake: Remove libbsd support 507 #1105 Autotools|CMake: Stop using -fno-strict-aliasing, and use 508 -Wstrict-aliasing=3 instead 509 #1124 Autotools|CMake: Prefer command gsed (GNU sed) over sed 510 (e.g. for Solaris) inside fix-xmltest-log.sh 511 #1067 CMake: Detect and warn about unusable check_c_compiler_flag 512 #1137 CMake: Drop support for CMake <3.17 513 #1138 CMake|Windows: Fix libexpat.def.cmake version comments 514 515 #1086 #1110 docs: Add warning about external reference handlers and XXE 516 #1066 docs: Be explicit that parent parsers need to outlive 517 subparsers 518 #1089 .. 519 #1090 #1091 .. 520 #1092 #1093 .. 521 #1094 #1098 .. 522 #1115 #1116 docs: Misc non-content improvements to doc/reference.html 523 #1132 #1133 Version info bumped from 12:1:11 (libexpat*.so.1.11.1) 524 to 12:2:11 (libexpat*.so.1.11.2); see https://verbump.de/ 525 for what these numbers do 526 527 Infrastructure: 528 #1119 #1121 Document guidelines for contributing to Expat 529 #1120 Introduce a pull request template 530 #1074 CI: Stop using about-to-be-removed image "macos-13" 531 #1083 #1088 CI: Mitigate random Wine crashes 532 #1104 CI: Cover compilation with WASI SDK 533 #1116 CI: Enforce clean doc XML formatting 534 #1124 .. 535 #1135 #1136 CI: Cover Solaris 11.4 536 #1125 CI: Extend CI coverage of FreeBSD 537 #1139 #1140 CI: Cover symbol versioning 538 #1114 xmlwf: Reformat helpgen code (using Black 25.12.0) 539 #1071 .gitignore: Add files CPackConfig.cmake and 540 CPackSourceConfig.cmake 541 542 Special thanks to: 543 Alfonso Gregory 544 Bénédikt Tran 545 Gordon Messmer 546 Hanno Böck 547 Jakub Kulík 548 Matthew Fernandez 549 Neil Pang 550 Rosen Penev 551 and 552 Artiphishell Inc. 553 554Release 2.7.3 Wed September 24 2025 555 Security fixes: 556 #1046 #1048 Fix alignment of internal allocations for some non-amd64 557 architectures (e.g. sparc32); fixes up on the fix to 558 CVE-2025-59375 from #1034 (of Expat 2.7.2 and related 559 backports) 560 #1059 Fix a class of false positives where input should have been 561 rejected with error XML_ERROR_ASYNC_ENTITY; regression from 562 CVE-2024-8176 fix pull request #973 (of Expat 2.7.0 and 563 related backports). Please check the added unit tests for 564 example documents. 565 566 Other changes: 567 #1043 Prove and regression-proof absence of integer overflow 568 from function expat_realloc 569 #1062 Remove "harmless" cast that truncated a size_t to unsigned 570 #1049 Autotools: Remove "ln -s" discovery 571 #1054 docs: Be consistent with use of floating point around 572 XML_SetAllocTrackerMaximumAmplification 573 #1056 docs: Make it explicit that XML_GetCurrentColumnNumber 574 starts at 0 575 #1057 docs: Better integrate the effect of the activation 576 thresholds 577 #1058 docs: Fix an in-comment typo in expat.h 578 #1045 docs: Fix a typo in README.md 579 #1041 docs: Improve change log of release 2.7.2 580 #1053 xmlwf: Resolve use of functions XML_GetErrorLineNumber 581 and XML_GetErrorColumnNumber 582 #1032 Windows: Normalize .bat files to CRLF line endings 583 #1060 #1061 Version info bumped from 12:0:11 (libexpat*.so.1.11.0) 584 to 12:1:11 (libexpat*.so.1.11.1); see https://verbump.de/ 585 for what these numbers do 586 587 Infrastructure: 588 #1047 #1050 CI: Cleanup UndefinedBehaviorSanitizer fatality 589 #1044 CI|Linux: Stop aborting at first job failure 590 #1052 CI|FreeBSD: Upgrade to FreeBSD 15.0 591 #1039 CI|FreeBSD: Do not install CMake meta-package 592 593 Special thanks to: 594 Bénédikt Tran 595 Berkay Eren Ürün 596 Daniel Engberg 597 Hanno Böck 598 Matthew Fernandez 599 Rolf Eike Beer 600 Sam James 601 Tim Bray 602 and 603 Clang/GCC UndefinedBehaviorSanitizer 604 OSS-Fuzz / ClusterFuzz 605 Z3 Theorem Prover 606 607Release 2.7.2 Tue September 16 2025 608 Security fixes: 609 #1018 #1034 CVE-2025-59375 -- Disallow use of disproportional amounts of 610 dynamic memory from within an Expat parser (e.g. previously 611 a ~250 KiB sized document was able to cause allocation of 612 ~800 MiB from the heap, i.e. an "amplification" of factor 613 ~3,300); once a threshold (that defaults to 64 MiB) is 614 reached, a maximum amplification factor (that defaults to 615 100.0) is enforced, and violating documents are rejected 616 with an out-of-memory error. 617 There are two new API functions to fine-tune this new 618 behavior: 619 - XML_SetAllocTrackerActivationThreshold 620 - XML_SetAllocTrackerMaximumAmplification . 621 If you ever need to increase these defaults for non-attack 622 XML payload, please file a bug report with libexpat. 623 There is also a new environment variable 624 EXPAT_MALLOC_DEBUG=(0|1|2) to control the verbosity 625 of allocations debugging at runtime, disabled by default. 626 Known impact is (reliable and easy) denial of service: 627 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C 628 (Base Score: 7.5, Temporal Score: 7.2) 629 Please note that a layer of compression around XML can 630 significantly reduce the minimum attack payload size. 631 Distributors intending to backport (or cherry-pick) the 632 fix need to copy 99% of the related pull request, not just 633 the "lib: Implement tracking of dynamic memory allocations" 634 commit, to not end up with a state that literally does both 635 too much and too little at the same time. Appending ".diff" 636 to the pull request URL could be of help. 637 638 Other changes: 639 #1008 #1017 Autotools|macOS: Sync CMake templates with CMake 3.31 640 #1007 CMake: Drop support for CMake <3.15 641 #1004 CMake: Fix off_t detection for -Werror 642 #1007 CMake|Windows: Fix -DEXPAT_MSVC_STATIC_CRT=ON 643 #1013 Windows: Drop support for Visual Studio <=16.0/2019 644 #1026 xmlwf: Mention supported environment variables in 645 --help output 646 #1024 xmlwf: Fix (internal) help generator 647 #1034 docs: Promote the contract to call function 648 XML_FreeContentModel when registering a custom 649 element declaration handler (via a call to function 650 XML_SetElementDeclHandler) 651 #1027 docs: Add missing <p>..</p> wrap 652 #994 docs: Drop AppVeyor badge 653 #1000 tests: Fix portable_strndup 654 #1036 Drop casts around malloc/free/realloc that C99 does not need 655 #1010 Replace empty for loops with while loops 656 #1011 Add const with internal XmlInitUnknownEncodingNS 657 #14 #1037 Drop an OpenVMS support leftover 658 #999 #1001 Address more clang-tidy warnings 659 #1030 #1038 Version info bumped from 11:2:10 (libexpat*.so.1.10.2) 660 to 12:0:11 (libexpat*.so.1.11.0); see https://verbump.de/ 661 for what these numbers do 662 663 Infrastructure: 664 #1003 CI: Cover compilation on FreeBSD 665 #1009 #1035 CI: Upgrade Clang from 19 to 21 666 #1031 CI: Make calling Cppcheck without --suppress=objectIndex 667 and --suppress=unknownMacro possible 668 #1013 CI|Windows: Get off of deprecated image "windows-2019" 669 #1008 #1017 .. 670 #1023 #1025 CI: Adapt to breaking changes in GitHub Actions 671 672 Special thanks to: 673 Alexander Bluhm 674 Neil Pang 675 Theo Buehler 676 and 677 GNU Time 678 OSS-Fuzz / ClusterFuzz 679 Perl XML::Parser 680 681Release 2.7.1 Thu March 27 2025 682 Bug fixes: 683 #980 #989 Restore event pointer behavior from Expat 2.6.4 684 (that the fix to CVE-2024-8176 changed in 2.7.0); 685 affected API functions are: 686 - XML_GetCurrentByteCount 687 - XML_GetCurrentByteIndex 688 - XML_GetCurrentColumnNumber 689 - XML_GetCurrentLineNumber 690 - XML_GetInputContext 691 692 Other changes: 693 #976 #977 Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}" 694 with Automake that were missing from 2.7.0 release tarballs 695 #983 #984 Fix printf format specifiers for 32bit Emscripten 696 #992 docs: Promote OpenSSF Best Practices self-certification 697 #978 tests/benchmark: Resolve mistaken double close 698 #986 Address Frama-C warnings 699 #990 #993 Version info bumped from 11:1:10 (libexpat*.so.1.10.1) 700 to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/ 701 for what these numbers do 702 703 Infrastructure: 704 #982 CI: Start running Perl XML::Parser integration tests 705 #987 CI: Enforce Clang Static Analyzer clean code 706 #991 CI: Re-enable warning clang-analyzer-valist.Uninitialized 707 for clang-tidy 708 #981 CI: Cover compilation with musl 709 #983 #984 CI: Cover compilation with 32bit Emscripten 710 #976 #977 CI: Protect against fuzzer files missing from future 711 release archives 712 713 Special thanks to: 714 Berkay Eren Ürün 715 Matthew Fernandez 716 and 717 Perl XML::Parser 718 719Release 2.7.0 Thu March 13 2025 720 Security fixes: 721 #893 #973 CVE-2024-8176 -- Fix crash from chaining a large number 722 of entities caused by stack overflow by resolving use of 723 recursion, for all three uses of entities: 724 - general entities in character data ("<e>&g1;</e>") 725 - general entities in attribute values ("<e k1='&g1;'/>") 726 - parameter entities ("%p1;") 727 Known impact is (reliable and easy) denial of service: 728 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C 729 (Base Score: 7.5, Temporal Score: 7.2) 730 Please note that a layer of compression around XML can 731 significantly reduce the minimum attack payload size. 732 733 Other changes: 734 #935 #937 Autotools: Make generated CMake files look for 735 libexpat.@SO_MAJOR@.dylib on macOS 736 #925 Autotools: Sync CMake templates with CMake 3.29 737 #945 #962 #966 CMake: Drop support for CMake <3.13 738 #942 CMake: Small fuzzing related improvements 739 #921 docs: Add missing documentation of error code 740 XML_ERROR_NOT_STARTED that was introduced with 2.6.4 741 #941 docs: Document need for C++11 compiler for use from C++ 742 #959 tests/benchmark: Fix a (harmless) TOCTTOU 743 #944 Windows: Fix installer target location of file xmlwf.xml 744 for CMake 745 #953 Windows: Address warning -Wunknown-warning-option 746 about -Wno-pedantic-ms-format from LLVM MinGW 747 #971 Address Cppcheck warnings 748 #969 #970 Mass-migrate links from http:// to https:// 749 #947 #958 .. 750 #974 #975 Document changes since the previous release 751 #974 #975 Version info bumped from 11:0:10 (libexpat*.so.1.10.0) 752 to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/ 753 for what these numbers do 754 755 Infrastructure: 756 #926 tests: Increase robustness 757 #927 #932 .. 758 #930 #933 tests: Increase test coverage 759 #617 #950 .. 760 #951 #952 .. 761 #954 #955 .. Fuzzing: Add new fuzzer "xml_lpm_fuzzer" based on 762 #961 Google's libprotobuf-mutator ("LPM") 763 #957 Fuzzing|CI: Start producing fuzzing code coverage reports 764 #936 CI: Pass -q -q for LCOV >=2.1 in coverage.sh 765 #942 CI: Small fuzzing related improvements 766 #139 #203 .. 767 #791 #946 CI: Make GitHub Actions build using MSVC on Windows and 768 produce 32bit and 64bit Windows binaries 769 #956 CI: Get off of about-to-be-removed Ubuntu 20.04 770 #960 #964 CI: Start uploading to Coverity Scan for static analysis 771 #972 CI: Stop loading DTD from the internet to address flaky CI 772 #971 CI: Adapt to breaking changes in Cppcheck 773 774 Special thanks to: 775 Alexander Gieringer 776 Berkay Eren Ürün 777 Hanno Böck 778 Jann Horn 779 Mark Brand 780 Sebastian Andrzej Siewior 781 Snild Dolkow 782 Thomas Pröll 783 Tomas Korbar 784 valord577 785 and 786 Google Project Zero 787 Linutronix 788 Red Hat 789 Siemens 790 791Release 2.6.4 Wed November 6 2024 792 Security fixes: 793 #915 CVE-2024-50602 -- Fix crash within function XML_ResumeParser 794 from a NULL pointer dereference by disallowing function 795 XML_StopParser to (stop or) suspend an unstarted parser. 796 A new error code XML_ERROR_NOT_STARTED was introduced to 797 properly communicate this situation. // CWE-476 CWE-754 798 799 Other changes: 800 #903 CMake: Add alias target "expat::expat" 801 #905 docs: Document use via CMake >=3.18 with FetchContent 802 and SOURCE_SUBDIR and its consequences 803 #902 tests: Reduce use of global parser instance 804 #904 tests: Resolve duplicate handler 805 #317 #918 tests: Improve tests on doctype closing (ex CVE-2019-15903) 806 #914 Fix signedness of format strings 807 #915 For use from C++, expat.h started requiring C++11 due to 808 use of C99 features 809 #919 #920 Version info bumped from 10:3:9 (libexpat*.so.1.9.3) 810 to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/ 811 for what these numbers do 812 813 Infrastructure: 814 #907 CI: Upgrade Clang from 18 to 19 815 #913 CI: Drop macos-12 and add macos-15 816 #910 CI: Adapt to breaking changes in GitHub Actions 817 #898 Add missing entries to .gitignore 818 819 Special thanks to: 820 Hanno Böck 821 José Eduardo Gutiérrez Conejo 822 José Ricardo Cardona Quesada 823 824Release 2.6.3 Wed September 4 2024 825 Security fixes: 826 #887 #890 CVE-2024-45490 -- Calling function XML_ParseBuffer with 827 len < 0 without noticing and then calling XML_GetBuffer 828 will have XML_ParseBuffer fail to recognize the problem 829 and XML_GetBuffer corrupt memory. 830 With the fix, XML_ParseBuffer now complains with error 831 XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse 832 has been doing since Expat 2.2.1, and now documented. 833 Impact is denial of service to potentially artitrary code 834 execution. 835 #888 #891 CVE-2024-45491 -- Internal function dtdCopy can have an 836 integer overflow for nDefaultAtts on 32-bit platforms 837 (where UINT_MAX equals SIZE_MAX). 838 Impact is denial of service to potentially artitrary code 839 execution. 840 #889 #892 CVE-2024-45492 -- Internal function nextScaffoldPart can 841 have an integer overflow for m_groupSize on 32-bit 842 platforms (where UINT_MAX equals SIZE_MAX). 843 Impact is denial of service to potentially artitrary code 844 execution. 845 846 Other changes: 847 #851 #879 Autotools: Sync CMake templates with CMake 3.28 848 #853 Autotools: Always provide path to find(1) for portability 849 #861 Autotools: Ensure that the m4 directory always exists. 850 #870 Autotools: Simplify handling of SIZEOF_VOID_P 851 #869 Autotools: Support non-GNU sed 852 #856 Autotools|CMake: Fix main() to main(void) 853 #865 Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM 854 #863 Autotools|CMake: Stop requiring dos2unix 855 #854 #855 CMake: Fix check for symbols size_t and off_t 856 #864 docs|tests: Convert README to Markdown and update 857 #741 Windows: Drop support for Visual Studio <=15.0/2017 858 #886 Drop needless XML_DTD guards around is_param access 859 #885 Fix typo in a code comment 860 #894 #896 Version info bumped from 10:2:9 (libexpat*.so.1.9.2) 861 to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/ 862 for what these numbers do 863 864 Infrastructure: 865 #880 Readme: Promote the call for help 866 #868 CI: Fix various issues 867 #849 CI: Allow triggering GitHub Actions workflows manually 868 #851 #872 .. 869 #873 #879 CI: Adapt to breaking changes in GitHub Actions 870 871 Special thanks to: 872 Alexander Bluhm 873 Berkay Eren Ürün 874 Dag-Erling Smørgrav 875 Ferenc Géczi 876 TaiYou 877 878Release 2.6.2 Wed March 13 2024 879 Security fixes: 880 #839 #842 CVE-2024-28757 -- Prevent billion laughs attacks with 881 isolated use of external parsers. Please see the commit 882 message of commit 1d50b80cf31de87750103656f6eb693746854aa8 883 for details. 884 885 Bug fixes: 886 #839 #841 Reject direct parameter entity recursion 887 and avoid the related undefined behavior 888 889 Other changes: 890 #847 Autotools: Fix build for DOCBOOK_TO_MAN containing spaces 891 #837 Add missing #821 and #824 to 2.6.1 change log 892 #838 #843 Version info bumped from 10:1:9 (libexpat*.so.1.9.1) 893 to 10:2:9 (libexpat*.so.1.9.2); see https://verbump.de/ 894 for what these numbers do 895 896 Special thanks to: 897 Philippe Antoine 898 Tomas Korbar 899 and 900 Clang UndefinedBehaviorSanitizer 901 OSS-Fuzz / ClusterFuzz 902 903Release 2.6.1 Thu February 29 2024 904 Bug fixes: 905 #817 Make tests independent of CPU speed, and thus more robust 906 #828 #836 Expose billion laughs API with XML_DTD defined and 907 XML_GE undefined, regression from 2.6.0 908 909 Other changes: 910 #829 Hide test-only code behind new internal macro 911 #833 Autotools: Reject expat_config.h.in defining SIZEOF_VOID_P 912 #821 #824 Autotools: Fix "make clean" for case: 913 ./configure --without-docbook && make clean all 914 #819 Address compiler warnings 915 #832 #834 Version info bumped from 10:0:9 (libexpat*.so.1.9.0) 916 to 10:1:9 (libexpat*.so.1.9.1); see https://verbump.de/ 917 for what these numbers do 918 919 Infrastructure: 920 #818 CI: Adapt to breaking changes in clang-format 921 922 Special thanks to: 923 David Hall 924 Snild Dolkow 925 926Release 2.6.0 Tue February 6 2024 927 Security fixes: 928 #789 #814 CVE-2023-52425 -- Fix quadratic runtime issues with big tokens 929 that can cause denial of service, in partial where 930 dealing with compressed XML input. Applications 931 that parsed a document in one go -- a single call to 932 functions XML_Parse or XML_ParseBuffer -- were not affected. 933 The smaller the chunks/buffers you use for parsing 934 previously, the bigger the problem prior to the fix. 935 Backporters should be careful to no omit parts of 936 pull request #789 and to include earlier pull request #771, 937 in order to not break the fix. 938 #777 CVE-2023-52426 -- Fix billion laughs attacks for users 939 compiling *without* XML_DTD defined (which is not common). 940 Users with XML_DTD defined have been protected since 941 Expat >=2.4.0 (and that was CVE-2013-0340 back then). 942 943 Bug fixes: 944 #753 Fix parse-size-dependent "invalid token" error for 945 external entities that start with a byte order mark 946 #780 Fix NULL pointer dereference in setContext via 947 XML_ExternalEntityParserCreate for compilation with 948 XML_DTD undefined 949 #812 #813 Protect against closing entities out of order 950 951 Other changes: 952 #723 Improve support for arc4random/arc4random_buf 953 #771 #788 Improve buffer growth in XML_GetBuffer and XML_Parse 954 #761 #770 xmlwf: Support --help and --version 955 #759 #770 xmlwf: Support custom buffer size for XML_GetBuffer and read 956 #744 xmlwf: Improve language and URL clickability in help output 957 #673 examples: Add new example "element_declarations.c" 958 #764 Be stricter about macro XML_CONTEXT_BYTES at build time 959 #765 Make inclusion to expat_config.h consistent 960 #726 #727 Autotools: configure.ac: Support --disable-maintainer-mode 961 #678 #705 .. 962 #706 #733 #792 Autotools: Sync CMake templates with CMake 3.26 963 #795 Autotools: Make installation of shipped man page doc/xmlwf.1 964 independent of docbook2man availability 965 #815 Autotools|CMake: Add missing -DXML_STATIC to pkg-config file 966 section "Cflags.private" in order to fix compilation 967 against static libexpat using pkg-config on Windows 968 #724 #751 Autotools|CMake: Require a C99 compiler 969 (a de-facto requirement already since Expat 2.2.2 of 2017) 970 #793 Autotools|CMake: Fix PACKAGE_BUGREPORT variable 971 #750 #786 Autotools|CMake: Make test suite require a C++11 compiler 972 #749 CMake: Require CMake >=3.5.0 973 #672 CMake: Lowercase off_t and size_t to help a bug in Meson 974 #746 CMake: Sort xmlwf sources alphabetically 975 #785 CMake|Windows: Fix generation of DLL file version info 976 #790 CMake: Build tests/benchmark/benchmark.c as well for 977 a build with -DEXPAT_BUILD_TESTS=ON 978 #745 #757 docs: Document the importance of isFinal + adjust tests 979 accordingly 980 #736 docs: Improve use of "NULL" and "null" 981 #713 docs: Be specific about version of XML (XML 1.0r4) 982 and version of C (C99); (XML 1.0r5 will need a sponsor.) 983 #762 docs: reference.html: Promote function XML_ParseBuffer more 984 #779 docs: reference.html: Add HTML anchors to XML_* macros 985 #760 docs: reference.html: Upgrade to OK.css 1.2.0 986 #763 #739 docs: Fix typos 987 #696 docs|CI: Use HTTPS URLs instead of HTTP at various places 988 #669 #670 .. 989 #692 #703 .. 990 #733 #772 Address compiler warnings 991 #798 #800 Address clang-tidy warnings 992 #775 #776 Version info bumped from 9:10:8 (libexpat*.so.1.8.10) 993 to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/ 994 for what these numbers do 995 996 Infrastructure: 997 #700 #701 docs: Document security policy in file SECURITY.md 998 #766 docs: Improve parse buffer variables in-code documentation 999 #674 #738 .. 1000 #740 #747 .. 1001 #748 #781 #782 Refactor coverage and conformance tests 1002 #714 #716 Refactor debug level variables to unsigned long 1003 #671 Improve handling of empty environment variable value 1004 in function getDebugLevel (without visible user effect) 1005 #755 #774 .. 1006 #758 #783 .. 1007 #784 #787 tests: Improve test coverage with regard to parse chunk size 1008 #660 #797 #801 Fuzzing: Improve fuzzing coverage 1009 #367 #799 Fuzzing|CI: Start running OSS-Fuzz fuzzing regression tests 1010 #698 #721 CI: Resolve some Travis CI leftovers 1011 #669 CI: Be robust towards absence of Git tags 1012 #693 #694 CI: Set permissions to "contents: read" for security 1013 #709 CI: Pin all GitHub Actions to specific commits for security 1014 #739 CI: Reject spelling errors using codespell 1015 #798 CI: Enforce clang-tidy clean code 1016 #773 #808 .. 1017 #809 #810 CI: Upgrade Clang from 15 to 18 1018 #796 CI: Start using Clang's Control Flow Integrity sanitizer 1019 #675 #720 #722 CI: Adapt to breaking changes in GitHub Actions Ubuntu images 1020 #689 CI: Adapt to breaking changes in Clang/LLVM Debian packaging 1021 #763 CI: Adapt to breaking changes in codespell 1022 #803 CI: Adapt to breaking changes in Cppcheck 1023 1024 Special thanks to: 1025 Ivan Galkin 1026 Joyce Brum 1027 Philippe Antoine 1028 Rhodri James 1029 Snild Dolkow 1030 spookyahell 1031 Steven Garske 1032 and 1033 Clang AddressSanitizer 1034 Clang UndefinedBehaviorSanitizer 1035 codespell 1036 GCC Farm Project 1037 OSS-Fuzz 1038 Sony Mobile 1039 1040Release 2.5.0 Tue October 25 2022 1041 Security fixes: 1042 #616 #649 #650 CVE-2022-43680 -- Fix heap use-after-free after overeager 1043 destruction of a shared DTD in function 1044 XML_ExternalEntityParserCreate in out-of-memory situations. 1045 Expected impact is denial of service or potentially 1046 arbitrary code execution. 1047 1048 Bug fixes: 1049 #612 #645 Fix corruption from undefined entities 1050 #613 #654 Fix case when parsing was suspended while processing nested 1051 entities 1052 #616 #652 #653 Stop leaking opening tag bindings after a closing tag 1053 mismatch error where a parser is reset through 1054 XML_ParserReset and then reused to parse 1055 #656 CMake: Fix generation of pkg-config file 1056 #658 MinGW|CMake: Fix static library name 1057 1058 Other changes: 1059 #663 Protect header expat_config.h from multiple inclusion 1060 #666 examples: Make use of XML_GetBuffer and be more 1061 consistent across examples 1062 #648 Address compiler warnings 1063 #667 #668 Version info bumped from 9:9:8 to 9:10:8; 1064 see https://verbump.de/ for what these numbers do 1065 1066 Special thanks to: 1067 Jann Horn 1068 Mark Brand 1069 Osyotr 1070 Rhodri James 1071 and 1072 Google Project Zero 1073 1074Release 2.4.9 Tue September 20 2022 1075 Security fixes: 1076 #629 #640 CVE-2022-40674 -- Heap use-after-free vulnerability in 1077 function doContent. Expected impact is denial of service 1078 or potentially arbitrary code execution. 1079 1080 Bug fixes: 1081 #634 MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0 1082 #614 docs: Fix documentation on effect of switch XML_DTD on 1083 symbol visibility in doc/reference.html 1084 1085 Other changes: 1086 #638 MinGW: Make fix-xmltest-log.sh drop more Wine bug output 1087 #596 #625 Autotools: Sync CMake templates with CMake 3.22 1088 #608 CMake: Migrate from use of CMAKE_*_POSTFIX to 1089 dedicated variables EXPAT_*_POSTFIX to stop affecting 1090 other projects 1091 #597 #599 Windows|CMake: Add missing -DXML_STATIC to test runners 1092 and fuzzers 1093 #512 #621 Windows|CMake: Render .def file from a template to fix 1094 linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON 1095 #611 #621 MinGW|CMake: Apply MSVC .def file when linking 1096 #622 #624 MinGW|CMake: Sync library name with GNU Autotools, 1097 i.e. produce libexpat-1.dll rather than libexpat.dll 1098 by default. Filename libexpat.dll.a is unaffected. 1099 #632 MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in 1100 toolchain file "cmake/mingw-toolchain.cmake" to avoid 1101 error "windres: Command not found" on e.g. Ubuntu 20.04 1102 #597 #627 CMake: Unify inconsistent use of set() and option() in 1103 context of public build time options to take need for 1104 set(.. FORCE) in projects using Expat by means of 1105 add_subdirectory(..) off Expat's users' shoulders 1106 #626 #641 Stop exporting API symbols when building a static library 1107 #644 Resolve use of deprecated "fgrep" by "grep -F" 1108 #620 CMake: Make documentation on variables a bit more consistent 1109 #636 CMake: Drop leading whitespace from a #cmakedefine line in 1110 file expat_config.h.cmake 1111 #594 xmlwf: Fix harmless variable mix-up in function nsattcmp 1112 #592 #593 #610 Address Cppcheck warnings 1113 #643 Address Clang 15 compiler warnings 1114 #642 #644 Version info bumped from 9:8:8 to 9:9:8; 1115 see https://verbump.de/ for what these numbers do 1116 1117 Infrastructure: 1118 #597 #598 CI: Windows: Start covering MSVC 2022 1119 #619 CI: macOS: Migrate off deprecated macOS 10.15 1120 #632 CI: Linux: Make migration off deprecated Ubuntu 18.04 work 1121 #643 CI: Upgrade Clang from 14 to 15 1122 #637 apply-clang-format.sh: Add support for BSD find 1123 #633 coverage.sh: Exclude MinGW headers 1124 #635 coverage.sh: Fix name collision for -funsigned-char 1125 1126 Special thanks to: 1127 David Faure 1128 Felix Wilhelm 1129 Frank Bergmann 1130 Rhodri James 1131 Rosen Penev 1132 Thijs Schreijer 1133 Vincent Torri 1134 and 1135 Google Project Zero 1136 1137Release 2.4.8 Mon March 28 2022 1138 Other changes: 1139 #587 pkg-config: Move "-lm" to section "Libs.private" 1140 #587 CMake|MSVC: Fix pkg-config section "Libs" 1141 #55 #582 CMake|macOS: Start using linker arguments 1142 "-compatibility_version <version>" and 1143 "-current_version <version>" in a way compatible with 1144 GNU Libtool 1145 #590 #591 Version info bumped from 9:7:8 to 9:8:8; 1146 see https://verbump.de/ for what these numbers do 1147 1148 Infrastructure: 1149 #589 CI: Upgrade Clang from 13 to 14 1150 1151 Special thanks to: 1152 evpobr 1153 Kai Pastor 1154 Sam James 1155 1156Release 2.4.7 Fri March 4 2022 1157 Bug fixes: 1158 #572 #577 Relax fix to CVE-2022-25236 (introduced with release 2.4.5) 1159 with regard to all valid URI characters (RFC 3986), 1160 i.e. the following set (excluding whitespace): 1161 ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz 1162 0123456789 % -._~ :/?#[]@ !$&'()*+,;= 1163 1164 Other changes: 1165 #555 #570 #581 CMake|Windows: Store Expat version in the DLL 1166 #577 Document consequences of namespace separator choices not just 1167 in doc/reference.html but also in header <expat.h> 1168 #577 Document Expat's lack of validation of namespace URIs against 1169 RFC 3986, and that the XML 1.0r4 specification doesn't 1170 require Expat to validate namespace URIs, and that Expat 1171 may do more in that regard in future releases. 1172 If you find need for strict RFC 3986 URI validation on 1173 application level today, https://uriparser.github.io/ may 1174 be of interest. 1175 #579 Fix documentation of XML_EndDoctypeDeclHandler in <expat.h> 1176 #575 Document that a call to XML_FreeContentModel can be done at 1177 a later time from outside the element declaration handler 1178 #574 Make hardcoded namespace URIs easier to find in code 1179 #573 Update documentation on use of XML_POOR_ENTOPY on Solaris 1180 #569 #571 tests: Resolve use of macros NAN and INFINITY for GNU G++ 1181 4.8.2 on Solaris. 1182 #578 #580 Version info bumped from 9:6:8 to 9:7:8; 1183 see https://verbump.de/ for what these numbers do 1184 1185 Special thanks to: 1186 Jeffrey Walton 1187 Johnny Jazeix 1188 Thijs Schreijer 1189 1190Release 2.4.6 Sun February 20 2022 1191 Bug fixes: 1192 #566 Fix a regression introduced by the fix for CVE-2022-25313 1193 in release 2.4.5 that affects applications that (1) 1194 call function XML_SetElementDeclHandler and (2) are 1195 parsing XML that contains nested element declarations 1196 (e.g. "<!ELEMENT junk ((bar|foo|xyz+), zebra*)>"). 1197 1198 Other changes: 1199 #567 #568 Version info bumped from 9:5:8 to 9:6:8; 1200 see https://verbump.de/ for what these numbers do 1201 1202 Special thanks to: 1203 Matt Sergeant 1204 Samanta Navarro 1205 Sergei Trofimovich 1206 and 1207 NixOS 1208 Perl XML::Parser 1209 1210Release 2.4.5 Fri February 18 2022 1211 Security fixes: 1212 #562 CVE-2022-25235 -- Passing malformed 2- and 3-byte UTF-8 1213 sequences (e.g. from start tag names) to the XML 1214 processing application on top of Expat can cause 1215 arbitrary damage (e.g. code execution) depending 1216 on how invalid UTF-8 is handled inside the XML 1217 processor; validation was not their job but Expat's. 1218 Exploits with code execution are known to exist. 1219 #561 CVE-2022-25236 -- Passing (one or more) namespace separator 1220 characters in "xmlns[:prefix]" attribute values 1221 made Expat send malformed tag names to the XML 1222 processor on top of Expat which can cause 1223 arbitrary damage (e.g. code execution) depending 1224 on such unexpectable cases are handled inside the XML 1225 processor; validation was not their job but Expat's. 1226 Exploits with code execution are known to exist. 1227 #558 CVE-2022-25313 -- Fix stack exhaustion in doctype parsing 1228 that could be triggered by e.g. a 2 megabytes 1229 file with a large number of opening braces. 1230 Expected impact is denial of service or potentially 1231 arbitrary code execution. 1232 #560 CVE-2022-25314 -- Fix integer overflow in function copyString; 1233 only affects the encoding name parameter at parser creation 1234 time which is often hardcoded (rather than user input), 1235 takes a value in the gigabytes to trigger, and a 64-bit 1236 machine. Expected impact is denial of service. 1237 #559 CVE-2022-25315 -- Fix integer overflow in function storeRawNames; 1238 needs input in the gigabytes and a 64-bit machine. 1239 Expected impact is denial of service or potentially 1240 arbitrary code execution. 1241 1242 Other changes: 1243 #557 #564 Version info bumped from 9:4:8 to 9:5:8; 1244 see https://verbump.de/ for what these numbers do 1245 1246 Special thanks to: 1247 Ivan Fratric 1248 Samanta Navarro 1249 and 1250 Google Project Zero 1251 JetBrains 1252 1253Release 2.4.4 Sun January 30 2022 1254 Security fixes: 1255 #550 CVE-2022-23852 -- Fix signed integer overflow 1256 (undefined behavior) in function XML_GetBuffer 1257 (that is also called by function XML_Parse internally) 1258 for when XML_CONTEXT_BYTES is defined to >0 (which is both 1259 common and default). 1260 Impact is denial of service or more. 1261 #551 CVE-2022-23990 -- Fix unsigned integer overflow in function 1262 doProlog triggered by large content in element type 1263 declarations when there is an element declaration handler 1264 present (from a prior call to XML_SetElementDeclHandler). 1265 Impact is denial of service or more. 1266 1267 Bug fixes: 1268 #544 #545 xmlwf: Fix a memory leak on output file opening error 1269 1270 Other changes: 1271 #546 Autotools: Fix broken CMake support under Cygwin 1272 #554 Windows: Add missing files to the installer to fix 1273 compilation with CMake from installed sources 1274 #552 #554 Version info bumped from 9:3:8 to 9:4:8; 1275 see https://verbump.de/ for what these numbers do 1276 1277 Special thanks to: 1278 Carlo Bramini 1279 hwt0415 1280 Roland Illig 1281 Samanta Navarro 1282 and 1283 Clang LeakSan and the Clang team 1284 1285Release 2.4.3 Sun January 16 2022 1286 Security fixes: 1287 #531 #534 CVE-2021-45960 -- Fix issues with left shifts by >=29 places 1288 resulting in 1289 a) realloc acting as free 1290 b) realloc allocating too few bytes 1291 c) undefined behavior 1292 depending on architecture and precise value 1293 for XML documents with >=2^27+1 prefixed attributes 1294 on a single XML tag a la 1295 "<r xmlns:a='[..]' a:a123='[..]' [..] />" 1296 where XML_ParserCreateNS is used to create the parser 1297 (which needs argument "-n" when running xmlwf). 1298 Impact is denial of service, or more. 1299 #532 #538 CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow 1300 on variable m_groupSize in function doProlog leading 1301 to realloc acting as free. 1302 Impact is denial of service or more. 1303 #539 CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows 1304 near memory allocation at multiple places. Mitre assigned 1305 a dedicated CVE for each involved internal C function: 1306 - CVE-2022-22822 for function addBinding 1307 - CVE-2022-22823 for function build_model 1308 - CVE-2022-22824 for function defineAttribute 1309 - CVE-2022-22825 for function lookup 1310 - CVE-2022-22826 for function nextScaffoldPart 1311 - CVE-2022-22827 for function storeAtts 1312 Impact is denial of service or more. 1313 1314 Other changes: 1315 #535 CMake: Make call to file(GENERATE [..]) work for CMake <3.19 1316 #541 Autotools|CMake: MinGW: Make run.sh(.in) work for Cygwin 1317 and MSYS2 by not going through Wine on these platforms 1318 #527 #528 Address compiler warnings 1319 #533 #543 Version info bumped from 9:2:8 to 9:3:8; 1320 see https://verbump.de/ for what these numbers do 1321 1322 Infrastructure: 1323 #536 CI: Check for realistic minimum CMake version 1324 #529 #539 CI: Cover compilation with -m32 1325 #529 CI: Store coverage reports as artifacts for download 1326 #528 CI: Upgrade Clang from 11 to 13 1327 1328 Special thanks to: 1329 An anonymous whitehat 1330 Christopher Degawa 1331 J. Peter Mugaas 1332 Tyson Smith 1333 and 1334 GCC Farm Project 1335 Trend Micro Zero Day Initiative 1336 1337Release 2.4.2 Sun December 19 2021 1338 Other changes: 1339 #509 #510 Link againgst libm for function "isnan" 1340 #513 #514 Include expat_config.h as early as possible 1341 #498 Autotools: Include files with release archives: 1342 - buildconf.sh 1343 - fuzz/*.c 1344 #507 #519 Autotools: Sync CMake templates with CMake 3.20 1345 #495 #524 CMake: MinGW: Fix pkg-config section "Libs" for 1346 - non-release build types (e.g. -DCMAKE_BUILD_TYPE=Debug) 1347 - multi-config CMake generators (e.g. Ninja Multi-Config) 1348 #502 #503 docs: Document that function XML_GetBuffer may return NULL 1349 when asking for a buffer of 0 (zero) bytes size 1350 #522 #523 docs: Fix return value docs for both 1351 XML_SetBillionLaughsAttackProtection* functions 1352 #525 #526 Version info bumped from 9:1:8 to 9:2:8; 1353 see https://verbump.de/ for what these numbers do 1354 1355 Special thanks to: 1356 Donghee Na 1357 Joergen Ibsen 1358 Kai Pastor 1359 1360Release 2.4.1 Sun May 23 2021 1361 Bug fixes: 1362 #488 #490 Autotools: Fix installed header expat_config.h for multilib 1363 systems; regression introduced in 2.4.0 by pull request #486 1364 1365 Other changes: 1366 #491 #492 Version info bumped from 9:0:8 to 9:1:8; 1367 see https://verbump.de/ for what these numbers do 1368 1369 Special thanks to: 1370 Gentoo's QA check "multilib_check_headers" 1371 1372Release 2.4.0 Sun May 23 2021 1373 Security fixes: 1374 #34 #466 #484 CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks 1375 (denial-of-service; flavors targeting CPU time or RAM or both, 1376 leveraging general entities or parameter entities or both) 1377 by tracking and limiting the input amplification factor 1378 (<amplification> := (<direct> + <indirect>) / <direct>). 1379 By conservative default, amplification up to a factor of 100.0 1380 is tolerated and rejection only starts after 8 MiB of output bytes 1381 (=<direct> + <indirect>) have been processed. 1382 The fix adds the following to the API: 1383 - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to 1384 signals this specific condition. 1385 - Two new API functions .. 1386 - XML_SetBillionLaughsAttackProtectionMaximumAmplification and 1387 - XML_SetBillionLaughsAttackProtectionActivationThreshold 1388 .. to further tighten billion laughs protection parameters 1389 when desired. Please see file "doc/reference.html" for details. 1390 If you ever need to increase the defaults for non-attack XML 1391 payload, please file a bug report with libexpat. 1392 - Two new XML_FEATURE_* constants .. 1393 - that can be queried using the XML_GetFeatureList function, and 1394 - that are shown in "xmlwf -v" output. 1395 - Two new environment variable switches .. 1396 - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and 1397 - EXPAT_ENTITY_DEBUG=(0|1) 1398 .. for runtime debugging of accounting and entity processing. 1399 Specific behavior of these values may change in the future. 1400 - Two new command line arguments "-a FACTOR" and "-b BYTES" 1401 for xmlwf to further tighten billion laughs protection 1402 parameters when desired. 1403 If you ever need to increase the defaults for non-attack XML 1404 payload, please file a bug report with libexpat. 1405 1406 Bug fixes: 1407 #332 #470 For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) 1408 or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault 1409 for UTF-16 payloads containing CDATA sections. 1410 #485 #486 Autotools: Fix generated CMake files for non-64bit and 1411 non-Linux platforms (e.g. macOS and MinGW in particular) 1412 that were introduced with release 2.3.0 1413 1414 Other changes: 1415 #468 #469 xmlwf: Improve help output and the xmlwf man page 1416 #463 xmlwf: Improve maintainability through some refactoring 1417 #477 xmlwf: Fix man page DocBook validity 1418 #456 Autotools: Sync CMake templates with CMake 3.18 1419 #458 #459 CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR 1420 and CMAKE_INSTALL_INCLUDEDIR 1421 #471 #481 CMake: Add support for standard variable BUILD_SHARED_LIBS 1422 #457 Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters 1423 #467 Resolve macro HAVE_EXPAT_CONFIG_H 1424 #472 Delete unused legacy helper file "conftools/PrintPath" 1425 #473 #483 Improve attribution 1426 #464 #465 #477 doc/reference.html: Fix XHTML validity 1427 #475 #478 doc/reference.html: Replace the 90s look by OK.css 1428 #479 Version info bumped from 8:0:7 to 9:0:8 1429 due to addition of new symbols and error codes; 1430 see https://verbump.de/ for what these numbers do 1431 1432 Infrastructure: 1433 #456 CI: Enable periodic runs 1434 #457 CI: Start covering the list of exported symbols 1435 #474 CI: Isolate coverage task 1436 #476 #482 CI: Adapt to breaking changes in image "ubuntu-18.04" 1437 #477 CI: Cover well-formedness and DocBook/XHTML validity 1438 of doc/reference.html and doc/xmlwf.xml 1439 1440 Special thanks to: 1441 Dimitry Andric 1442 Eero Helenius 1443 Nick Wellnhofer 1444 Rhodri James 1445 Tomas Korbar 1446 Yury Gribov 1447 and 1448 Clang LeakSan 1449 JetBrains 1450 OSS-Fuzz 1451 1452Release 2.3.0 Thu March 25 2021 1453 Bug fixes: 1454 #438 When calling XML_ParseBuffer without a prior successful call to 1455 XML_GetBuffer as a user, no longer trigger undefined behavior 1456 (by adding an integer to a NULL pointer) but rather return 1457 XML_STATUS_ERROR and set the error code to (new) code 1458 XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) 1459 of Clang 11 (but not Clang 9). 1460 #444 xmlwf: Exit status 2 was used for both: 1461 - malformed input files (documented) and 1462 - invalid command-line arguments (undocumented). 1463 The case of invalid command-line arguments now 1464 has its own exit status 4, resolving the ambiguity. 1465 1466 Other changes: 1467 #439 xmlwf: Add argument -k to allow continuing after 1468 non-fatal errors 1469 #439 xmlwf: Add section about exit status to the -h help output 1470 #422 #426 #447 Windows: Drop support for Visual Studio <=14.0/2015 1471 #434 Windows: CMake: Detect unsupported Visual Studio at 1472 configure time (rather than at compile time) 1473 #382 #428 testrunner: Make verbose mode (argument "-v") report 1474 about passed tests, and make default mode report about 1475 failures, as well. 1476 #442 CMake: Call "enable_language(CXX)" prior to tinkering 1477 with CMAKE_CXX_* variables 1478 #448 Document use of libexpat from a CMake-based project 1479 #451 Autotools: Install CMake files as generated by CMake 3.19.6 1480 so that users with "find_package(expat [..] CONFIG [..])" 1481 are served on distributions that are *not* using the CMake 1482 build system inside for libexpat packaging 1483 #436 #437 Autotools: Drop obsolescent macro AC_HEADER_STDC 1484 #450 #452 Autotools: Resolve use of obsolete macro AC_CONFIG_HEADER 1485 #441 Address compiler warnings 1486 #443 Version info bumped from 7:12:6 to 8:0:7 1487 due to addition of error code XML_ERROR_NO_BUFFER 1488 (see https://verbump.de/ for what these numbers do) 1489 1490 Infrastructure: 1491 #435 #446 Replace Travis CI by GitHub Actions 1492 1493 Special thanks to: 1494 Alexander Richardson 1495 Oleksandr Popovych 1496 Thomas Beutlich 1497 Tim Bray 1498 and 1499 Clang LeakSan, Clang 11 UBSan and the Clang team 1500 1501Release 2.2.10 Sat October 3 2020 1502 Bug fixes: 1503 #390 #395 #398 Fix undefined behavior during parsing caused by 1504 pointer arithmetic with NULL pointers 1505 #404 #405 Fix reading uninitialized variable during parsing 1506 #406 xmlwf: Add missing check for malloc NULL return 1507 1508 Other changes: 1509 #396 Windows: Drop support for Visual Studio <=8.0/2005 1510 #409 Windows: Add missing file "Changes" to the installer 1511 to fix compilation with CMake from installed sources 1512 #403 xmlwf: Document exit codes in xmlwf manpage and 1513 exit with code 3 (rather than code 1) for output errors 1514 when used with "-d DIRECTORY" 1515 #356 #359 MinGW: Provide declaration of rand_s for mingwrt <5.3.0 1516 #383 #392 Autotools: Use -Werror while configure tests the compiler 1517 for supported compile flags to avoid false positives 1518 #383 #393 #394 Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, 1519 e.g. ensure that they have the last word over flags added 1520 while running ./configure 1521 #360 CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis 1522 on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) 1523 #360 CMake: Detect and deny unsupported build combinations 1524 involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) 1525 #360 CMake: Install pre-compiled shipped xmlwf.1 manpage in case 1526 of -DEXPAT_BUILD_DOCS=OFF 1527 #375 #380 #419 CMake: Fix use of Expat by means of add_subdirectory 1528 #407 #408 CMake: Keep expat target name constant at "expat" 1529 (i.e. refrain from using the target name to control 1530 build artifact filenames) 1531 #385 CMake: Fix compilation with -DEXPAT_SHARED_LIBS=OFF for 1532 Windows 1533 CMake: Expose man page compilation as target "xmlwf-manpage" 1534 #413 #414 CMake: Introduce option EXPAT_BUILD_PKGCONFIG 1535 to control generation of pkg-config file "expat.pc" 1536 #424 CMake: Add minimalistic support for building binary packages 1537 with CMake target "package"; based on CPack 1538 #366 CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with 1539 default OFF to build fuzzer code against OSS-Fuzz and 1540 related environment variable LIB_FUZZING_ENGINE 1541 #354 Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF, each 1542 #354 #355 .. 1543 #356 #412 Address compiler warnings 1544 #368 #369 Address pngcheck warnings with doc/*.png images 1545 #425 Version info bumped from 7:11:6 to 7:12:6 1546 1547 Special thanks to: 1548 asavah 1549 Ben Wagner 1550 Bhargava Shastry 1551 Frank Landgraf 1552 Jeffrey Walton 1553 Joe Orton 1554 Kleber Tarcísio 1555 Ma Lin 1556 Maciej Sroczyński 1557 Mohammed Khajapasha 1558 Vadim Zeitlin 1559 and 1560 Cppcheck 2.0 and the Cppcheck team 1561 1562Release 2.2.9 Wed September 25 2019 1563 Other changes: 1564 examples: Drop executable bits from elements.c 1565 #349 Windows: Change the name of the Windows DLLs from expat*.dll 1566 to libexpat*.dll once more (regression from 2.2.8, first 1567 fixed in 1.95.3, issue #61 on SourceForge today, 1568 was issue #432456 back then); needs a fix due 1569 case-insensitive file systems on Windows and the fact that 1570 Perl's XML::Parser::Expat compiles into Expat.dll. 1571 #347 Windows: Only define _CRT_RAND_S if not defined 1572 Version info bumped from 7:10:6 to 7:11:6 1573 1574 Special thanks to: 1575 Ben Wagner 1576 1577Release 2.2.8 Fri September 13 2019 1578 Security fixes: 1579 #317 #318 CVE-2019-15903 -- Fix heap overflow triggered by 1580 XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), 1581 and deny internal entities closing the doctype; 1582 fixed in commit c20b758c332d9a13afbbb276d30db1d183a85d43 1583 1584 Bug fixes: 1585 #240 Fix cases where XML_StopParser did not have any effect 1586 when called from inside of an end element handler 1587 #341 xmlwf: Fix exit code for operation without "-d DIRECTORY"; 1588 previously, only "-d DIRECTORY" would give you a proper 1589 exit code: 1590 # xmlwf -d . <<<'<not well-formed>' 2>/dev/null ; echo $? 1591 2 1592 # xmlwf <<<'<not well-formed>' 2>/dev/null ; echo $? 1593 0 1594 Now both cases return exit code 2. 1595 1596 Other changes: 1597 #299 #302 Windows: Replace LoadLibrary hack to access 1598 unofficial API function SystemFunction036 (RtlGenRandom) 1599 by using official API function rand_s (needs WinXP+) 1600 #325 Windows: Drop support for Visual Studio <=7.1/2003 1601 and document supported compilers in README.md 1602 #286 Windows: Remove COM code from xmlwf; in case it turns 1603 out needed later, there will be a dedicated repository 1604 below https://github.com/libexpat/ for that code 1605 #322 Windows: Remove explicit MSVC solution and project files. 1606 You can generate Visual Studio solution files through 1607 CMake, e.g.: cmake -G"Visual Studio 15 2017" . 1608 #338 xmlwf: Make "xmlwf -h" help output more friendly 1609 #339 examples: Improve elements.c 1610 #244 #264 Autotools: Add argument --enable-xml-attr-info 1611 #239 #301 Autotools: Add arguments 1612 --with-getrandom 1613 --without-getrandom 1614 --with-sys-getrandom 1615 --without-sys-getrandom 1616 #312 #343 Autotools: Fix linking issues with "./configure LD=clang" 1617 Autotools: Fix "make run-xmltest" for out-of-source builds 1618 #329 #336 CMake: Pull all options from Expat <=2.2.7 into namespace 1619 prefix EXPAT_ with the exception of DOCBOOK_TO_MAN: 1620 - BUILD_doc -> EXPAT_BUILD_DOCS (plural) 1621 - BUILD_examples -> EXPAT_BUILD_EXAMPLES 1622 - BUILD_shared -> EXPAT_SHARED_LIBS 1623 - BUILD_tests -> EXPAT_BUILD_TESTS 1624 - BUILD_tools -> EXPAT_BUILD_TOOLS 1625 - DOCBOOK_TO_MAN -> DOCBOOK_TO_MAN (unchanged) 1626 - INSTALL -> EXPAT_ENABLE_INSTALL 1627 - MSVC_USE_STATIC_CRT -> EXPAT_MSVC_STATIC_CRT 1628 - USE_libbsd -> EXPAT_WITH_LIBBSD 1629 - WARNINGS_AS_ERRORS -> EXPAT_WARNINGS_AS_ERRORS 1630 - XML_CONTEXT_BYTES -> EXPAT_CONTEXT_BYTES 1631 - XML_DEV_URANDOM -> EXPAT_DEV_URANDOM 1632 - XML_DTD -> EXPAT_DTD 1633 - XML_NS -> EXPAT_NS 1634 - XML_UNICODE -> EXPAT_CHAR_TYPE=ushort (!) 1635 - XML_UNICODE_WCHAR_T -> EXPAT_CHAR_TYPE=wchar_t (!) 1636 #244 #264 CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), 1637 default OFF 1638 #326 CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), 1639 default OFF 1640 #328 CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), 1641 default OFF 1642 #239 #277 CMake: Add arguments 1643 -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO 1644 -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO 1645 #326 CMake: Install expat_config.h to include directory 1646 #326 CMake: Generate and install configuration files for 1647 future find_package(expat [..] CONFIG [..]) 1648 CMake: Now produces a summary of applied configuration 1649 CMake: Require C++ compiler only when tests are enabled 1650 #330 CMake: Fix compilation for 16bit character types, 1651 i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) 1652 #265 CMake: Fix linking with MinGW 1653 #330 CMake: Add full support for MinGW; to enable, use 1654 -DCMAKE_TOOLCHAIN_FILE=[expat]/cmake/mingw-toolchain.cmake 1655 #330 CMake: Port "make run-xmltest" from GNU Autotools to CMake 1656 #316 CMake: Windows: Make binary postfix match MSVC 1657 Old: expat[d].lib 1658 New: expat[w][d][MD|MT].lib 1659 CMake: Migrate files from Windows to Unix line endings 1660 #308 CMake: Integrate OSS-Fuzz fuzzers, option 1661 -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF 1662 #14 Drop an OpenVMS support leftover 1663 #235 #268 .. 1664 #270 #310 .. 1665 #313 #331 #333 Address compiler warnings 1666 #282 #283 .. 1667 #284 #285 Address cppcheck warnings 1668 #294 #295 Address Clang Static Analyzer warnings 1669 #24 #293 Mass-apply clang-format 9 (and ensure conformance during CI) 1670 Version info bumped from 7:9:6 to 7:10:6 1671 1672 Special thanks to: 1673 David Loffredo 1674 Joonun Jang 1675 Kishore Kunche 1676 Marco Maggi 1677 Mitch Phillips 1678 Mohammed Khajapasha 1679 Rolf Ade 1680 xantares 1681 Zhongyuan Zhou 1682 1683Release 2.2.7 Wed June 19 2019 1684 Security fixes: 1685 #186 #262 CVE-2018-20843 -- Fix extraction of namespace prefixes from 1686 XML names; XML names with multiple colons could end up in 1687 the wrong namespace, and take a high amount of RAM and CPU 1688 resources while processing, opening the door to 1689 use for denial-of-service attacks 1690 1691 Other changes: 1692 #195 #197 Autotools/CMake: Utilize -fvisibility=hidden to stop 1693 exporting non-API symbols 1694 #227 Autotools: Add --without-examples and --without-tests 1695 #228 Autotools: Modernize configure.ac 1696 #245 #246 Autotools: Fix check for -fvisibility=hidden for Clang 1697 #247 #248 Autotools: Fix compilation for lack of docbook2x-man 1698 #236 #258 Autotools: Produce .tar.{gz,lz,xz} release archives 1699 #212 CMake: Make libdir of pkgconfig expat.pc support multilib 1700 #158 #263 CMake: Build man page in PROJECT_BINARY_DIR not _SOURCE_DIR 1701 #219 Remove fallback to bcopy, assume that memmove(3) exists 1702 #257 Use portable "/usr/bin/env bash" shebang (e.g. for OpenBSD) 1703 #243 Windows: Fix syntax of .def module definition files 1704 Version info bumped from 7:8:6 to 7:9:6 1705 1706 Special thanks to: 1707 Benjamin Peterson 1708 Caolán McNamara 1709 Hanno Böck 1710 KangLin 1711 Kishore Kunche 1712 Marco Maggi 1713 Rhodri James 1714 Sebastian Dröge 1715 userwithuid 1716 Yury Gribov 1717 1718Release 2.2.6 Sun August 12 2018 1719 Bug fixes: 1720 #170 #206 Avoid doing arithmetic with NULL pointers in XML_GetBuffer 1721 #204 #205 Fix 2.2.5 regression with suspend-resume while parsing 1722 a document like '<root/>' 1723 1724 Other changes: 1725 #165 #168 Autotools: Fix docbook-related configure syntax error 1726 #166 Autotools: Avoid grep option `-q` for Solaris 1727 #167 Autotools: Support 1728 ./configure DOCBOOK_TO_MAN="xmlto man --skip-validation" 1729 #159 #167 Autotools: Support DOCBOOK_TO_MAN command which produces 1730 xmlwf.1 rather than XMLWF.1; also covers case insensitive 1731 file systems 1732 #181 Autotools: Drop -rpath option passed to libtool 1733 #188 Autotools: Detect and deny SGML docbook2man as ours is XML 1734 #188 Autotools/CMake: Support command db2x_docbook2man as well 1735 #174 CMake: Introduce option WARNINGS_AS_ERRORS, defaults to OFF 1736 #184 #185 CMake: Introduce option MSVC_USE_STATIC_CRT, defaults to OFF 1737 #207 #208 CMake: Introduce option XML_UNICODE and XML_UNICODE_WCHAR_T, 1738 both defaulting to OFF 1739 #175 CMake: Prefer check_symbol_exists over check_function_exists 1740 #176 CMake: Create the same pkg-config file as with GNU Autotools 1741 #178 #179 CMake: Use GNUInstallDirs module to set proper defaults for 1742 install directories 1743 #208 CMake: Utilize expat_config.h.cmake for XML_DEV_URANDOM 1744 #180 Windows: Fix compilation of test suite for Visual Studio 2008 1745 #131 #173 #202 Address compiler warnings 1746 #187 #190 #200 Fix miscellaneous typos 1747 Version info bumped from 7:7:6 to 7:8:6 1748 1749 Special thanks to: 1750 Anton Maklakov 1751 Benjamin Peterson 1752 Brad King 1753 Franek Korta 1754 Frank Rast 1755 Joe Orton 1756 luzpaz 1757 Pedro Vicente 1758 Rainer Jung 1759 Rhodri James 1760 Rolf Ade 1761 Rolf Eike Beer 1762 Thomas Beutlich 1763 Tomasz Kłoczko 1764 1765Release 2.2.5 Tue October 31 2017 1766 Bug fixes: 1767 #8 If the parser runs out of memory, make sure its internal 1768 state reflects the memory it actually has, not the memory 1769 it wanted to have. 1770 #11 The default handler wasn't being called when it should for 1771 a SYSTEM or PUBLIC doctype if an entity declaration handler 1772 was registered. 1773 #137 #138 Fix a case of mistakenly reported parsing success where 1774 XML_StopParser was called from an element handler 1775 #162 Function XML_ErrorString was returning NULL rather than 1776 a message for code XML_ERROR_INVALID_ARGUMENT 1777 introduced with release 2.2.1 1778 1779 Other changes: 1780 #106 xmlwf: Add argument -N adding notation declarations 1781 #75 #106 Test suite: Resolve expected failure cases where xmlwf 1782 output was incomplete 1783 #127 Windows: Fix test suite compilation 1784 #126 #127 Windows: Fix compilation for Visual Studio 2012 1785 Windows: Upgrade shipped project files to Visual Studio 2017 1786 #33 #132 tests: Mass-fix compilation for XML_UNICODE_WCHAR_T 1787 #129 examples: Fix compilation for XML_UNICODE_WCHAR_T 1788 #130 benchmark: Fix compilation for XML_UNICODE_WCHAR_T 1789 #144 xmlwf: Fix compilation for XML_UNICODE_WCHAR_T; still needs 1790 Windows or MinGW for 2-byte wchar_t 1791 #9 Address two Clang Static Analyzer false positives 1792 #59 Resolve troublesome macros hiding parser struct membership 1793 and dereferencing that pointer 1794 #6 Resolve superfluous internal malloc/realloc switch 1795 #153 #155 Improve docbook2x-man detection 1796 #160 Undefine NDEBUG in the test suite (rather than rejecting it) 1797 #161 Address compiler warnings 1798 Version info bumped from 7:6:6 to 7:7:6 1799 1800 Special thanks to: 1801 Benbuck Nason 1802 Hans Wennborg 1803 José Gutiérrez de la Concha 1804 Pedro Monreal Gonzalez 1805 Rhodri James 1806 Rolf Ade 1807 Stephen Groat 1808 and 1809 Core Infrastructure Initiative 1810 1811Release 2.2.4 Sat August 19 2017 1812 Bug fixes: 1813 #115 Fix copying of partial characters for UTF-8 input 1814 1815 Other changes: 1816 #109 Fix "make check" for non-x86 architectures that default 1817 to unsigned type char (-128..127 rather than 0..255) 1818 #109 coverage.sh: Cover -funsigned-char 1819 Autotools: Introduce --without-xmlwf argument 1820 #65 Autotools: Replace handwritten Makefile with GNU Automake 1821 #43 CMake: Auto-detect high quality entropy extractors, add new 1822 option USE_libbsd=ON to use arc4random_buf of libbsd 1823 #74 CMake: Add -fno-strict-aliasing only where supported 1824 #114 CMake: Always honor manually set BUILD_* options 1825 #114 CMake: Compile man page if docbook2x-man is available, only 1826 #117 Include file tests/xmltest.log.expected in source tarball 1827 (required for "make run-xmltest") 1828 #117 Include (existing) Visual Studio 2013 files in source tarball 1829 Improve test suite error output 1830 #111 Fix some typos in documentation 1831 Version info bumped from 7:5:6 to 7:6:6 1832 1833 Special thanks to: 1834 Jakub Wilk 1835 Joe Orton 1836 Lin Tian 1837 Rolf Eike Beer 1838 1839Release 2.2.3 Wed August 2 2017 1840 Security fixes: 1841 #82 CVE-2017-11742 -- Windows: Fix DLL hijacking vulnerability 1842 using Steve Holme's LoadLibrary wrapper for/of cURL 1843 1844 Bug fixes: 1845 #85 Fix a dangling pointer issue related to realloc 1846 1847 Other changes: 1848 Increase code coverage 1849 #91 Linux: Allow getrandom to fail if nonblocking pool has not 1850 yet been initialized and read /dev/urandom then, instead. 1851 This is in line with what recent Python does. 1852 #81 Pre-10.7/Lion macOS: Support entropy from arc4random 1853 #86 Check that a UTF-16 encoding in an XML declaration has the 1854 right endianness 1855 #4 #5 #7 Recover correctly when some reallocations fail 1856 Repair "./configure && make" for systems without any 1857 provider of high quality entropy 1858 and try reading /dev/urandom on those 1859 Ensure that user-defined character encodings have converter 1860 functions when they are needed 1861 Fix mis-leading description of argument -c in xmlwf.1 1862 Rely on macro HAVE_ARC4RANDOM_BUF (rather than __CloudABI__) 1863 for CloudABI 1864 #100 Fix use of SIPHASH_MAIN in siphash.h 1865 #23 Test suite: Fix memory leaks 1866 Version info bumped from 7:4:6 to 7:5:6 1867 1868 Special thanks to: 1869 Chanho Park 1870 Joe Orton 1871 Pascal Cuoq 1872 Rhodri James 1873 Simon McVittie 1874 Vadim Zeitlin 1875 Viktor Szakats 1876 and 1877 Core Infrastructure Initiative 1878 1879Release 2.2.2 Wed July 12 2017 1880 Security fixes: 1881 #43 Protect against compilation without any source of high 1882 quality entropy enabled, e.g. with CMake build system; 1883 commit ff0207e6076e9828e536b8d9cd45c9c92069b895 1884 #60 Windows with _UNICODE: 1885 Unintended use of LoadLibraryW with a non-wide string 1886 resulted in failure to load advapi32.dll and degradation 1887 in quality of used entropy when compiled with _UNICODE for 1888 Windows; you can launch existing binaries with 1889 EXPAT_ENTROPY_DEBUG=1 in the environment to inspect the 1890 quality of entropy used during runtime; commits 1891 * 95b95032f907ef1cd17ee7a9a1768010a825d61d 1892 * 73a5a2e9c081f49f2d775cf7ced864158b68dc80 1893 [MOX-006] Fix non-NULL parser parameter validation in XML_Parse; 1894 resulted in NULL dereference, previously; 1895 commit ac256dafdffc9622ab0dc2c62fcecb0dfcfa71fe 1896 1897 Bug fixes: 1898 #69 Fix improper use of unsigned long long integer literals 1899 1900 Other changes: 1901 #73 Start requiring a C99 compiler 1902 #49 Fix "==" Bashism in configure script 1903 #50 Fix too eager getrandom detection for Debian GNU/kFreeBSD 1904 #52 and macOS 1905 #51 Address lack of stdint.h in Visual Studio 2003 to 2008 1906 #58 Address compile warnings 1907 #68 Fix "./buildconf.sh && ./configure" for some versions 1908 of Dash for /bin/sh 1909 #72 CMake: Ease use of Expat in context of a parent project 1910 with multiple CMakeLists.txt files 1911 #72 CMake: Resolve mistaken executable permissions 1912 #76 Address compile warning with -DNDEBUG (not recommended!) 1913 #77 Address compile warning about macro redefinition 1914 1915 Special thanks to: 1916 Alexander Bluhm 1917 Ben Boeckel 1918 Cătălin Răceanu 1919 Kerin Millar 1920 László Böszörményi 1921 S. P. Zeidler 1922 Segev Finer 1923 Václav Slavík 1924 Victor Stinner 1925 Viktor Szakats 1926 and 1927 Radically Open Security 1928 1929Release 2.2.1 Sat June 17 2017 1930 Security fixes: 1931 CVE-2017-9233 -- External entity infinite loop DoS 1932 Details: https://libexpat.github.io/doc/cve-2017-9233/ 1933 Commit c4bf96bb51dd2a1b0e185374362ee136fe2c9d7f 1934 [MOX-002] CVE-2016-9063 -- Detect integer overflow; commit 1935 d4f735b88d9932bd5039df2335eefdd0723dbe20 1936 (Fixed version of existing downstream patches!) 1937 (SF.net) #539 Fix regression from fix to CVE-2016-0718 cutting off 1938 longer tag names; commits 1939 * 896b6c1fd3b842f377d1b62135dccf0a579cf65d 1940 * af507cef2c93cb8d40062a0abe43a4f4e9158fb2 1941 #16 * 0dbbf43fdb20f593ddf4fa1ff67288000dd4a7fd 1942 #25 More integer overflow detection (function poolGrow); commits 1943 * 810b74e4703dcfdd8f404e3cb177d44684775143 1944 * 44178553f3539ce69d34abee77a05e879a7982ac 1945 [MOX-002] Detect overflow from len=INT_MAX call to XML_Parse; commits 1946 * 4be2cb5afcc018d996f34bbbce6374b7befad47f 1947 * 7e5b71b748491b6e459e5c9a1d090820f94544d8 1948 [MOX-005] #30 Use high quality entropy for hash initialization: 1949 * arc4random_buf on BSD, systems with libbsd 1950 (when configured with --with-libbsd), CloudABI 1951 * RtlGenRandom on Windows XP / Server 2003 and later 1952 * getrandom on Linux 3.17+ 1953 In a way, that's still part of CVE-2016-5300. 1954 https://github.com/libexpat/libexpat/pull/30/commits 1955 [MOX-005] For the low quality entropy extraction fallback code, 1956 the parser instance address can no longer leak, commit 1957 04ad658bd3079dd15cb60fc67087900f0ff4b083 1958 [MOX-003] Prevent use of uninitialised variable; commit 1959 [MOX-004] a4dc944f37b664a3ca7199c624a98ee37babdb4b 1960 Add missing parameter validation to public API functions 1961 and dedicated error code XML_ERROR_INVALID_ARGUMENT: 1962 [MOX-006] * NULL checks; commits 1963 * d37f74b2b7149a3a95a680c4c4cd2a451a51d60a (merge/many) 1964 * 9ed727064b675b7180c98cb3d4f75efba6966681 1965 * 6a747c837c50114dfa413994e07c0ba477be4534 1966 * Negative length (XML_Parse); commit 1967 [MOX-002] 70db8d2538a10f4c022655d6895e4c3e78692e7f 1968 [MOX-001] #35 Change hash algorithm to William Ahern's version of SipHash 1969 to go further with fixing CVE-2012-0876. 1970 https://github.com/libexpat/libexpat/pull/39/commits 1971 1972 Bug fixes: 1973 #32 Fix sharing of hash salt across parsers; 1974 relevant where XML_ExternalEntityParserCreate is called 1975 prior to XML_Parse, in particular (e.g. FBReader) 1976 #28 xmlwf: Auto-disable use of memory-mapping (and parsing 1977 as a single chunk) for files larger than ~1 GB (2^30 bytes) 1978 rather than failing with error "out of memory" 1979 #3 Fix double free after malloc failure in DTD code; commit 1980 7ae9c3d3af433cd4defe95234eae7dc8ed15637f 1981 #17 Fix memory leak on parser error for unbound XML attribute 1982 prefix with new namespaces defined in the same tag; 1983 found by Google's OSS-Fuzz; commits 1984 * 16f87daae5a16132e479e4f71862128c7a915c73 1985 * b47dbc9745932c160893d433220e462bd605f8cd 1986 xmlwf on Windows: Add missing calls to CloseHandle 1987 1988 New features: 1989 #30 Introduced environment switch EXPAT_ENTROPY_DEBUG=1 1990 for runtime debugging of entropy extraction 1991 1992 Other changes: 1993 Increase code coverage 1994 #33 Reject use of XML_UNICODE_WCHAR_T with sizeof(wchar_t) != 2; 1995 XML_UNICODE_WCHAR_T was never meant to be used outside 1996 of Windows; 4-byte wchar_t is common on Linux 1997 (SF.net) #538 Start using -fno-strict-aliasing 1998 (SF.net) #540 Support compilation against cloudlibc of CloudABI 1999 Allow MinGW cross-compilation 2000 (SF.net) #534 CMake: Introduce option "BUILD_doc" (enabled by default) 2001 to bypass compilation of the xmlwf.1 man page 2002 (SF.net) pr2 CMake: Introduce option "INSTALL" (enabled by default) 2003 to bypass installation of expat files 2004 CMake: Fix ninja support 2005 Autotools: Add parameters --enable-xml-context [COUNT] 2006 and --disable-xml-context; default of context of 1024 2007 bytes enabled unchanged 2008 #14 Drop AmigaOS 4.x code and includes 2009 #14 Drop ancient build systems: 2010 * Borland C++ Builder 2011 * OpenVMS 2012 * Open Watcom 2013 * Visual Studio 6.0 2014 * Pre-X Mac OS (MPW Makefile) 2015 If you happen to rely on some of these, please get in 2016 touch for joining with maintenance. 2017 #10 Move from WIN32 to _WIN32 2018 #13 Fix "make run-xmltest" order instability 2019 Address compile warnings 2020 Bump version info from 7:2:6 to 7:3:6 2021 Add AUTHORS file 2022 2023 Infrastructure: 2024 #1 Migrate from SourceForge to GitHub (except downloads): 2025 https://github.com/libexpat/ 2026 #1 Re-create http://libexpat.org/ project website 2027 Start utilizing Travis CI 2028 2029 Special thanks to: 2030 Andy Wang 2031 Don Lewis 2032 Ed Schouten 2033 Karl Waclawek 2034 Pascal Cuoq 2035 Rhodri James 2036 Sergei Nikulov 2037 Tobias Taschner 2038 Viktor Szakats 2039 and 2040 Core Infrastructure Initiative 2041 Mozilla Foundation (MOSS Track 3: Secure Open Source) 2042 Radically Open Security 2043 2044Release 2.2.0 Tue June 21 2016 2045 Security fixes: 2046 #537 CVE-2016-0718 -- Fix crash on malformed input 2047 CVE-2016-4472 -- Improve insufficient fix to CVE-2015-1283 / 2048 CVE-2015-2716 introduced with Expat 2.1.1 2049 #499 CVE-2016-5300 -- Use more entropy for hash initialization 2050 than the original fix to CVE-2012-0876 2051 #519 CVE-2012-6702 -- Resolve troublesome internal call to srand 2052 that was introduced with Expat 2.1.0 2053 when addressing CVE-2012-0876 (issue #496) 2054 2055 Bug fixes: 2056 Fix uninitialized reads of size 1 2057 (e.g. in little2_updatePosition) 2058 Fix detection of UTF-8 character boundaries 2059 2060 Other changes: 2061 #532 Fix compilation for Visual Studio 2010 (keyword "C99") 2062 Autotools: Resolve use of "$<" to better support bmake 2063 Autotools: Add QA script "qa.sh" (and make target "qa") 2064 Autotools: Respect CXXFLAGS if given 2065 Autotools: Fix "make run-xmltest" 2066 Autotools: Have "make run-xmltest" check for expected output 2067 p90 CMake: Fix static build (BUILD_shared=OFF) on Windows 2068 #536 CMake: Add soversion, support -DNO_SONAME=yes to bypass 2069 #323 CMake: Add suffix "d" to differentiate debug from release 2070 CMake: Define WIN32 with CMake on Windows 2071 Annotate memory allocators for GCC 2072 Address all currently known compile warnings 2073 Make sure that API symbols remain visible despite 2074 -fvisibility=hidden 2075 Remove executable flag from source files 2076 Resolve COMPILED_FROM_DSP in favor of WIN32 2077 2078 Special thanks to: 2079 Björn Lindahl 2080 Christian Heimes 2081 Cristian Rodríguez 2082 Daniel Krügler 2083 Gustavo Grieco 2084 Karl Waclawek 2085 László Böszörményi 2086 Marco Grassi 2087 Pascal Cuoq 2088 Sergei Nikulov 2089 Thomas Beutlich 2090 Warren Young 2091 Yann Droneaud 2092 2093Release 2.1.1 Sat March 12 2016 2094 Security fixes: 2095 #582: CVE-2015-1283 - Multiple integer overflows in XML_GetBuffer 2096 2097 Bug fixes: 2098 #502: Fix potential null pointer dereference 2099 #520: Symbol XML_SetHashSalt was not exported 2100 Output of "xmlwf -h" was incomplete 2101 2102 Other changes: 2103 #503: Document behavior of calling XML_SetHashSalt with salt 0 2104 Minor improvements to man page xmlwf(1) 2105 Improvements to the experimental CMake build system 2106 libtool now invoked with --verbose 2107 2108Release 2.1.0 Sat March 24 2012 2109 - Security fixes: 2110 #2958794: CVE-2012-1148 - Memory leak in poolGrow. 2111 #2895533: CVE-2012-1147 - Resource leak in readfilemap.c. 2112 #3496608: CVE-2012-0876 - Hash DOS attack. 2113 #2894085: CVE-2009-3560 - Buffer over-read and crash in big2_toUtf8(). 2114 #1990430: CVE-2009-3720 - Parser crash with special UTF-8 sequences. 2115 - Bug Fixes: 2116 #1742315: Harmful XML_ParserCreateNS suggestion. 2117 #1785430: Expat build fails on linux-amd64 with gcc version>=4.1 -O3. 2118 #1983953, 2517952, 2517962, 2649838: 2119 Build modifications using autoreconf instead of buildconf.sh. 2120 #2815947, #2884086: OBJEXT and EXEEXT support while building. 2121 #2517938: xmlwf should return non-zero exit status if not well-formed. 2122 #2517946: Wrong statement about XMLDecl in xmlwf.1 and xmlwf.sgml. 2123 #2855609: Dangling positionPtr after error. 2124 #2990652: CMake support. 2125 #3010819: UNEXPECTED_STATE with a trailing "%" in entity value. 2126 #3206497: Uninitialized memory returned from XML_Parse. 2127 #3287849: make check fails on mingw-w64. 2128 - Patches: 2129 #1749198: pkg-config support. 2130 #3010222: Fix for bug #3010819. 2131 #3312568: CMake support. 2132 #3446384: Report byte offsets for attr names and values. 2133 - New Features / API changes: 2134 Added new API member XML_SetHashSalt() that allows setting an initial 2135 value (salt) for hash calculations. This is part of the fix for 2136 bug #3496608 to randomize hash parameters. 2137 When compiled with XML_ATTR_INFO defined, adds new API member 2138 XML_GetAttributeInfo() that allows retrieving the byte 2139 offsets for attribute names and values (patch #3446384). 2140 Added CMake build system. 2141 See bug #2990652 and patch #3312568. 2142 Added run-benchmark target to Makefile.in - relies on testdata module 2143 present in the same relative location as in the repository. 2144 2145Release 2.0.1 Tue June 5 2007 2146 - Fixed bugs #1515266, #1515600: The character data handler's calling 2147 of XML_StopParser() was not handled properly; if the parser was 2148 stopped and the handler set to NULL, the parser would segfault. 2149 - Fixed bug #1690883: Expat failed on EBCDIC systems as it assumed 2150 some character constants to be ASCII encoded. 2151 - Minor cleanups of the test harness. 2152 - Fixed xmlwf bug #1513566: "out of memory" error on file size zero. 2153 - Fixed outline.c bug #1543233: missing a final XML_ParserFree() call. 2154 - Fixes and improvements for Windows platform: 2155 bugs #1409451, #1476160, #1548182, #1602769, #1717322. 2156 - Build fixes for various platforms: 2157 HP-UX, Tru64, Solaris 9: patch #1437840, bug #1196180. 2158 All Unix: #1554618 (refreshed config.sub/config.guess). 2159 #1490371, #1613457: support both, DESTDIR and INSTALL_ROOT, 2160 without relying on GNU-Make specific features. 2161 #1647805: Patched configure.in to work better with Intel compiler. 2162 - Fixes to Makefile.in to have make check work correctly: 2163 bugs #1408143, #1535603, #1536684. 2164 - Added Open Watcom support: patch #1523242. 2165 2166Release 2.0.0 Wed Jan 11 2006 2167 - We no longer use the "check" library for C unit testing; we 2168 always use the (partial) internal implementation of the API. 2169 - Report XML_NS setting via XML_GetFeatureList(). 2170 - Fixed headers for use from C++. 2171 - XML_GetCurrentLineNumber() and XML_GetCurrentColumnNumber() 2172 now return unsigned integers. 2173 - Added XML_LARGE_SIZE switch to enable 64-bit integers for 2174 byte indexes and line/column numbers. 2175 - Updated to use libtool 1.5.22 (the most recent). 2176 - Added support for AmigaOS. 2177 - Some mostly minor bug fixes. SF issues include: #1006708, 2178 #1021776, #1023646, #1114960, #1156398, #1221160, #1271642. 2179 2180Release 1.95.8 Fri Jul 23 2004 2181 - Major new feature: suspend/resume. Handlers can now request 2182 that a parse be suspended for later resumption or aborted 2183 altogether. See "Temporarily Stopping Parsing" in the 2184 documentation for more details. 2185 - Some mostly minor bug fixes, but compilation should no 2186 longer generate warnings on most platforms. SF issues 2187 include: #827319, #840173, #846309, #888329, #896188, #923913, 2188 #928113, #961698, #985192. 2189 2190Release 1.95.7 Mon Oct 20 2003 2191 - Fixed enum XML_Status issue (reported on SourceForge many 2192 times), so compilers that are properly picky will be happy. 2193 - Introduced an XMLCALL macro to control the calling 2194 convention used by the Expat API; this macro should be used 2195 to annotate prototypes and definitions of callback 2196 implementations in code compiled with a calling convention 2197 other than the default convention for the host platform. 2198 - Improved ability to build without the configure-generated 2199 expat_config.h header. This is useful for applications 2200 which embed Expat rather than linking in the library. 2201 - Fixed a variety of bugs: see SF issues #458907, #609603, 2202 #676844, #679754, #692878, #692964, #695401, #699323, #699487, 2203 #820946. 2204 - Improved hash table lookups. 2205 - Added more regression tests and improved documentation. 2206 2207Release 1.95.6 Tue Jan 28 2003 2208 - Added XML_FreeContentModel(). 2209 - Added XML_MemMalloc(), XML_MemRealloc(), XML_MemFree(). 2210 - Fixed a variety of bugs: see SF issues #615606, #616863, 2211 #618199, #653180, #673791. 2212 - Enhanced the regression test suite. 2213 - Man page improvements: includes SF issue #632146. 2214 2215Release 1.95.5 Fri Sep 6 2002 2216 - Added XML_UseForeignDTD() for improved SAX2 support. 2217 - Added XML_GetFeatureList(). 2218 - Defined XML_Bool type and the values XML_TRUE and XML_FALSE. 2219 - Use an incomplete struct instead of a void* for the parser 2220 (may not retain). 2221 - Fixed UTF-8 decoding bug that caused legal UTF-8 to be rejected. 2222 - Finally fixed bug where default handler would report DTD 2223 events that were already handled by another handler. 2224 Initial patch contributed by Darryl Miles. 2225 - Removed unnecessary DllMain() function that caused static 2226 linking into a DLL to be difficult. 2227 - Added VC++ projects for building static libraries. 2228 - Reduced line-length for all source code and headers to be 2229 no longer than 80 characters, to help with AS/400 support. 2230 - Reduced memory copying during parsing (SF patch #600964). 2231 - Fixed a variety of bugs: see SF issues #580793, #434664, 2232 #483514, #580503, #581069, #584041, #584183, #584832, #585537, 2233 #596555, #596678, #598352, #598944, #599715, #600479, #600971. 2234 2235Release 1.95.4 Fri Jul 12 2002 2236 - Added support for VMS, contributed by Craig Berry. See 2237 vms/README.vms for more information. 2238 - Added Mac OS (classic) support, with a makefile for MPW, 2239 contributed by Thomas Wegner and Daryle Walker. 2240 - Added Borland C++ Builder 5 / BCC 5.5 support, contributed 2241 by Patrick McConnell (SF patch #538032). 2242 - Fixed a variety of bugs: see SF issues #441449, #563184, 2243 #564342, #566334, #566901, #569461, #570263, #575168, #579196. 2244 - Made skippedEntityHandler conform to SAX2 (see source comment) 2245 - Re-implemented WFC: Entity Declared from XML 1.0 spec and 2246 added a new error "entity declared in parameter entity": 2247 see SF bug report #569461 and SF patch #578161 2248 - Re-implemented section 5.1 from XML 1.0 spec: 2249 see SF bug report #570263 and SF patch #578161 2250 2251Release 1.95.3 Mon Jun 3 2002 2252 - Added a project to the MSVC workspace to create a wchar_t 2253 version of the library; the DLLs are named libexpatw.dll. 2254 - Changed the name of the Windows DLLs from expat.dll to 2255 libexpat.dll; this fixes SF bug #432456. 2256 - Added the XML_ParserReset() API function. 2257 - Fixed XML_SetReturnNSTriplet() to work for element names. 2258 - Made the XML_UNICODE builds usable (thanks, Karl!). 2259 - Allow xmlwf to read from standard input. 2260 - Install a man page for xmlwf on Unix systems. 2261 - Fixed many bugs; see SF bug reports #231864, #461380, #464837, 2262 #466885, #469226, #477667, #484419, #487840, #494749, #496505, 2263 #547350. Other bugs which we can't test as easily may also 2264 have been fixed, especially in the area of build support. 2265 2266Release 1.95.2 Fri Jul 27 2001 2267 - More changes to make MSVC happy with the build; add a single 2268 workspace to support both the library and xmlwf application. 2269 - Added a Windows installer for Windows users; includes 2270 xmlwf.exe. 2271 - Added compile-time constants that can be used to determine the 2272 Expat version 2273 - Removed a lot of GNU-specific dependencies to aide portability 2274 among the various Unix flavors. 2275 - Fix the UTF-8 BOM bug. 2276 - Cleaned up warning messages for several compilers. 2277 - Added the -Wall, -Wstrict-prototypes options for GCC. 2278 2279Release 1.95.1 Sun Oct 22 15:11:36 EDT 2000 2280 - Changes to get expat to build under Microsoft compiler 2281 - Removed all aborts and instead return an UNEXPECTED_STATE error. 2282 - Fixed a bug where a stray '%' in an entity value would cause an 2283 abort. 2284 - Defined XML_SetEndNamespaceDeclHandler. Thanks to Darryl Miles for 2285 finding this oversight. 2286 - Changed default patterns in lib/Makefile.in to fit non-GNU makes 2287 Thanks to robin@unrated.net for reporting and providing an 2288 account to test on. 2289 - The reference had the wrong label for XML_SetStartNamespaceDecl. 2290 Reported by an anonymous user. 2291 2292Release 1.95.0 Fri Sep 29 2000 2293 - XML_ParserCreate_MM 2294 Allows you to set a memory management suite to replace the 2295 standard malloc,realloc, and free. 2296 - XML_SetReturnNSTriplet 2297 If you turn this feature on when namespace processing is in 2298 effect, then qualified, prefixed element and attribute names 2299 are returned as "uri|name|prefix" where '|' is whatever 2300 separator character is used in namespace processing. 2301 - Merged in features from perl-expat 2302 o XML_SetElementDeclHandler 2303 o XML_SetAttlistDeclHandler 2304 o XML_SetXmlDeclHandler 2305 o XML_SetEntityDeclHandler 2306 o StartDoctypeDeclHandler takes 3 additional parameters: 2307 sysid, pubid, has_internal_subset 2308 o Many paired handler setters (like XML_SetElementHandler) 2309 now have corresponding individual handler setters 2310 o XML_GetInputContext for getting the input context of 2311 the current parse position. 2312 - Added reference material 2313 - Packaged into a distribution that builds a sharable library 2314