1 __ __ _ 2 ___\ \/ /_ __ __ _| |_ 3 / _ \\ /| '_ \ / _` | __| 4 | __// \| |_) | (_| | |_ 5 \___/_/\_\ .__/ \__,_|\__| 6 |_| XML parser 7 8!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 9!! <blink>Expat has UNFIXED SECURITY ISSUES!</blink> !! 10!! Please see https://github.com/libexpat/libexpat/issues/1160 for details. !! 11!! !! 12!! Starting 2026-08-01, for up to six months my work maintaining libexpat !! 13!! will be funded by the City of Munich as part of their !! 14!! Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html) !! 15!! — thank you! !! 16!! Sebastian Pipping -- Berlin, 2026-08-03 !! 17!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 18 19Release 2.8.4 Mon August 31 2026 20 Security fixes: 21 #1321 #1331 CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from 22 "attribute isCdata lookups" that allowed denial of service 23 attacks through moderately sized crafted XML input 24 (CWE-407). 25 The vulnerability is closely related to past CVE-2026-45186 26 that was fixed with Expat 2.8.1. 27 Please note that a layer of compression around XML can 28 significantly reduce the minimum attack payload size. 29 Upstream CVSS 3.1 vector: 30 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) 31 (Note the "AV:N" for network/remote.) 32 #1322 CVE-2026-76957 -- Protect custom encoding callbacks from 33 parser re-entry. The vulnerability is closely related to 34 past issues CVE-2026-50219, CVE-2026-56131 and 35 CVE-2026-56412 that were all fixed with Expat 2.8.2. 36 #1326 CVE-2026-76956 -- Fix inverted getentropy() return handling 37 Allows for hash flooding denial of services in 38 configurations where getentropy is configured or detected 39 as the only high quality entropy extractor. 40 Upstream CVSS 3.1 vector: 41 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 5.9) 42 (Note the "AV:N" for network/remote.) 43 44 Other changes: 45 #1332 #1333 CMake: Only add `/source-charset:utf-8` when `/utf-8` is not 46 present 47 #1315 lib: Resolve (currently unreachable) undefined behavior from 48 overshifting a signed int to the left 49 #1325 #1334 lib: Support read-only hash table lookup with keys that are 50 not zero-terminated 51 #1340 lib: Use a C99 bool for `ENTITY.open` 52 #1319 Fix typo in comment 53 #1320 Sync file headers 54 #1328 #1329 Version info bumped from 13:3:12 (libexpat*.so.1.12.3) 55 to 13:4:12 (libexpat*.so.1.12.4); see https://verbump.de/ 56 for what these numbers do 57 58 Infrastructure: 59 #1317 #1335 CI: Cover compilation and execution with Fil-C 60 #1337 CI: Cover compilation and execution on riscv64 61 #1338 CI: Cover compilation and execution with Clang-based MinGW 62 #1339 CI: Cover compilation and execution on (big-endian) s390x 63 #1316 CI: Run test suite with musl, also 64 #1336 CI: Bump WASI SDK from 33 to 34 65 #1345 CI: Bump Clang from 22 to 23 66 67 Special thanks to: 68 Alberto Maschietto 69 Alexander Bluhm 70 Berkay Eren Ürün 71 Darren Carreras 72 Fabian Wahle (Hap Security) 73 Matteo Forzan 74 Matthew Fernandez 75 Sorrashut Kaewtaworn 76 Wade Sparks III 77 Zeyou Liu 78 and 79 City of Munich Open Source Sabbatical 80 Moonshot AI 81 VulnCheck 82 Z.ai 83 84Release 2.8.3 Mon August 10 2026 85 Security fixes: 86 #1296 CVE-2026-72522 -- Fix an out-of-bounds read and the resulting 87 infinite loop caused by treating low surrogates (Unicode) 88 the same as high surrogates in functions *_toUtf16. 89 Needs Expat compiled with 16bit character support 90 (e.g. with Firefox and/or on Windows) to be affected. 91 Upstream CVSS 3.1 vector: 92 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) 93 (Note the "AV:N" for network/remote, the "AV:L" in NVD by 94 Mitre is mistaken.) 95 Original bug report from Mozilla at: 96 https://bugzilla.mozilla.org/show_bug.cgi?id=2053153 97 98 Bug fixes: 99 #1297 #1300 lib: Fix support for 2+ GiB documents (regression from 2.8.2) 100 #1286 lib: Reject empty version in the XML declaration 101 #1305 #1306 lib: Fix printf format for AIX 102 103 Other changes: 104 #1309 CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX 105 #1295 CMake|Windows: Add a 64bit MinGW toolchain file 106 #1287 #1289 CMake|Windows: Start invoking MSVC with /source-charset:utf-8 107 #1289 CMake|Windows: Start requiring MSVC 2015 Update 2 or later 108 #1300 Document the current wrap-around issues with functions 109 - XML_GetCurrentByteIndex 110 - XML_GetCurrentColumnNumber 111 - XML_GetCurrentLineNumber 112 - XML_GetAttributeInfo 113 explicitly. 114 #1303 Address Clang Static Analyzer 22 warning 115 `core.NullPointerArithm` 116 #1313 #1314 Version info bumped from 13:2:12 (libexpat*.so.1.12.2) 117 to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/ 118 for what these numbers do 119 120 Infrastructure: 121 #1311 CI: Limit workflow runtime and package installation runtime 122 #1310 CI: Pin Cppcheck version for a robust CI 123 #1310 CI: Migrate Cppcheck CI from macOS to Linux 124 #1312 CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten 125 and WASI SDK 126 #1304 CI: Activate AddressSanitizer for MSVC Windows CI 127 #1308 CI: Introduce zizmor static analysis for GitHub Actions 128 #1308 CI: Start using `persist-credentials: false` with Git checkout 129 #1219 CI: Add a 7 day cooldown to Dependabot for GitHub Actions 130 #1302 #1303 CI: Bump Clang from 21 to 22 131 #1293 #1294 Update project status for 2026-08 132 #1301 #1307 Add SPDX license identifiers to the source code 133 134 Special thanks to: 135 Evgeny Kotkov 136 Henri Sivonen 137 Kartik Kenchi 138 Matthew Fernandez 139 Matthew Wozniczka 140 Stan Ulbrych 141 Tuukka Pasanen 142 William Woodruff 143 and 144 Anthropic 145 City of Munich Open Source Sabbatical 146 Mozilla Security Team 147 Subversion 148 zizmor static analysis 149 150Release 2.8.2 Thu June 25 2026 151 Security fixes: 152 #1246 CVE-2026-50219 -- Disallow calls to functions 153 `XML_GetBuffer`, `XML_Parse`, `XML_ParseBuffer`, 154 `XML_ParserFree`, `XML_ParserReset` to guard e.g. 155 Expat bindings from memory corruption; 156 this CPython issue is related: 157 https://github.com/python/cpython/issues/146169 158 #1267 CVE-2026-56131 -- Protect XML_ResumeParser from being called 159 from a handler, plugging a hole in the fix 160 to CVE-2026-50219 161 #1272 CVE-2026-56132 -- Fix out-of-bound scaffolding index store 162 in `doProlog` 163 #1229 #1232 CVE-2026-56403 -- Integer overflow in `storeAtts` 164 #1249 CVE-2026-56404 -- Integer overflow in `addBinding` 165 #1251 CVE-2026-56405 -- Integer overflow in `getAttributeId` 166 #1255 CVE-2026-56406 -- Integer overflow in `XML_ParseBuffer` 167 #1262 CVE-2026-56407 -- Integer overflow in `textLen` handling 168 #565 CVE-2026-56408 -- Integer overflow in `copyString` 169 (commit 16e2efd867ea8567ffa012210b52ef5918e20817) 170 #1259 CVE-2026-56409 -- xmlwf: Integer overflow in output path join 171 #1252 CVE-2026-56410 -- xmlwf: Integer overflow in 172 `resolveSystemId` 173 #1263 CVE-2026-56411 -- xmlwf: Integer overflow in notation list 174 allocation 175 #1278 CVE-2026-56412 -- Guard XML_TOK_DATA_CHARS handler calls in 176 `doCdataSection`, plugging a hole in the fix to 177 CVE-2026-50219 178 179 Bug fixes: 180 #1260 xmlwf: Escape names and base URI in meta output 181 #1266 xmlwf: Pick a safe quote for notation system and public IDs 182 183 Other changes: 184 #1257 CMake|Autotools: Stop using /dev/urandom by default 185 #1244 #1254 CMake: Fix guard for Unix sources of entropy 186 #1183 #1270 CMake|Windows: Add missing export for symbol 187 `XML_SetHashSalt16Bytes` 188 #1236 CMake: Mark option EXPAT_OSSFUZZ_BUILD as advanced 189 #1283 Limit output indentation for EXPAT_ENTITY_DEBUG=1 and 190 allow unlimited indentation via EXPAT_ENTITY_DEBUG=2 191 #565 Replace some loops by use of `memcpy`, `strlen`, `wcslen` 192 #1220 lib: Use a size_t for group sizes 193 #1221 lib: Fix too-conservative integer overflow check when 194 appending raw name 195 #1222 lib: Simplify attribute allocation/management logic 196 #1224 Update fallthrough annotations to satisfy Clang and GCC 197 #1226 lib: Remove unnecessary void * casts in random code 198 #1228 lib: Reduce scope of locals in storeAtts 199 #1230 lib: Count attributes with size_t variables 200 #1238 Minor get-buffer improvements 201 #1239 #1240 lib|tests: Include header expat_config.h first 202 #1241 lib: Shrink size of XML_GetBuffer 203 #1242 lib: Remove a legacy comment 204 #1243 lib: XML_ParserReset: Extract repeated linked-list move logic 205 #1243 lib: Unify entity free lists 206 #1247 lib: Fix use of '0' as boolean literal 207 #1248 lib: Make XML_Index overflow check more intuitive 208 #1256 lib: Use size_t for counting string/URI lengths 209 #1258 lib: XML_GetInputContext: Remove use of 0 for NULL 210 #1261 Comment typo fixes 211 #1275 Teach Memory Sanitizer semantics of randomization functions 212 #1276 #1281 Version info bumped from 13:1:12 (libexpat*.so.1.12.1) 213 to 13:2:12 (libexpat*.so.1.12.2); see https://verbump.de/ 214 for what these numbers do 215 216 Infrastructure: 217 #1231 perl-integration.yml: Bump to XML::Parser 2.59 218 #1237 emscripten.yml: Bump from Ubuntu 22.04 to 24.04 219 #1183 #1271 windows-build.yml: Cover completeness of file 220 libexpat.def.cmake 221 #1274 linux.yml: Make llvm-symbolizer available in CI 222 223 Special thanks to: 224 Alessandro Gario 225 Asher Darden 226 Christoph Reiter 227 Haris Hussain 228 Matthew Fernandez 229 Kartik Kenchi 230 Nick Begg 231 Sajin S 232 Yousef Shanableh 233 and 234 Anthropic 235 Astra Security 236 Trail of Bits 237 238Release 2.8.1 Sun May 10 2026 239 Security fixes: 240 #1216 CVE-2026-45186 -- Fix quadratic runtime from attribute name 241 collision checks that allowed denial of service attacks 242 through moderately sized crafted XML input (CWE-407). 243 Please note that a layer of compression around XML can 244 significantly reduce the minimum attack payload size. 245 Upstream CVSS 3.1 vector: 246 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) 247 (Note the "AV:N" for network/remote and the "AC:L" 248 for low complexity; the NVD entry from Mitre is mistaken.) 249 250 Other changes: 251 #1209 #1213 Drop more casts related to `void *` that C99 does not need 252 #1213 xmlwf: Streamline use of `mmap` 253 #1214 #1217 Version info bumped from 13:0:12 (libexpat*.so.1.12.0) 254 to 13:1:12 (libexpat*.so.1.12.1); see https://verbump.de/ 255 for what these numbers do 256 257 Infrastructure: 258 #1210 CI: Cover compilation with Visual Studio 18 2026 on Windows 259 #1215 CI: Cover compilation for ARM64 on Windows 260 #1212 CI: Bump WASI SDK from 32 to 33 261 262 Special thanks to: 263 Berkay Eren Ürün 264 Matthew Fernandez 265 Nick Wellnhofer 266 Tania Somanna 267 268Release 2.8.0 Fri April 24 2026 269 Security fixes: 270 #47 #1183 CVE-2026-41080 -- The existing hash flooding protection 271 (based on SipHash) only used 4 to 8 bytes of entropy for 272 a salt, when 16 bytes of salt are supported by the 273 implementation of SipHash used by Expat. Now full 16 bytes 274 of entropy are used to improve protection against hash 275 flooding attacks. 276 Existing API function XML_SetHashSalt is now deprecated 277 because of its limitations, and its use should be 278 considered a vulnerability. Please either use the new API 279 function XML_SetHashSalt16Bytes (with known-high-quality 280 entropy input only!) instead, or leave the derivation of 281 a 16-bytes hash salt from high quality entropy to Expat's 282 internal machinery (by *not* calling either of the two 283 XML_SetHashSalt* functions). 284 285 Bug fixes: 286 #1188 Avoid propagating /dev/urandom file descriptor to child 287 processes 288 #1193 Fix interpretation of `errno` after randomization calls 289 #1195 Avoid assuming uint8_t is a character type 290 291 Other changes: 292 #1180 #1199 Add support for `getentropy(3)` as a source of entropy; 293 this helps with protecting against hash flooding attacks, 294 in particular with WASI SDK (where none of the other 295 entropy sources supported by libexpat are available). 296 #1200 Autotools: Add `--without-arc4random` and 297 `--without-arc4random-buf` 298 #1200 Autotools: Make `./configure` output report on available 299 high quality entropy sources 300 #1173 Autotools|macOS: Sync CMake templates with CMake 4.3.0 301 #1201 Autotools|CMake: Improve checks for `arc4random` and 302 `arc4random_buf` e.g. with modern glibc 303 #1201 CMake: Report on availability of functions `arc4random` and 304 `arc4random_buf` 305 #1201 CMake: Mark entropy related build switches as advanced 306 #1189 .. 307 #1203 #1204 Extract new files from entropy extraction code 308 #1194 Stop duplicating C tests 1:1 as C++ ("runtests_cxx") 309 #1202 Fix a comment typo in expat_external.h 310 #1187 Fix grammar in compile error message 311 #1192 examples: Build warning-free with -Wwrite-strings 312 #1171 tests: Address harmless warning from Coverity 313 #1170 #1176 Sync file headers 314 #1190 #1206 Version info bumped from 12:3:11 (libexpat*.so.1.11.3) 315 to 13:0:12 (libexpat*.so.1.12.0); see https://verbump.de/ 316 for what these numbers do 317 318 Infrastructure: 319 #1166 #1167 .. 320 #1172 #1175 .. 321 #1178 #1179 .. 322 #1185 #1205 CI: Make Perl XML::Parser integration tests run against 323 both version 2.47 and the latest release 2.58 324 #1169 CI: Adapt to breaking changes regarding Inno Setup 325 #1173 CI: Adapt to breaking changes regarding CMake 326 #1174 CI: Include public corpus of fuzzer `xml_lpm_fuzzer` with 327 regression testing 328 #1181 #1182 CI: Bump WASI SDK from 30 to 32 329 330 Special thanks to: 331 Jérôme Duval 332 Matthew Fernandez 333 334Release 2.7.5 Tue March 17 2026 335 Security fixes: 336 #1158 CVE-2026-32776 -- Fix NULL function pointer dereference for 337 empty external parameter entities; it takes use of both 338 functions XML_ExternalEntityParserCreate and 339 XML_SetParamEntityParsing for an application to be 340 vulnerable. 341 #1161 #1162 CVE-2026-32777 -- Protect from XML_TOK_INSTANCE_START 342 infinite loop in function entityValueProcessor; it takes 343 use of both functions XML_ExternalEntityParserCreate and 344 XML_SetParamEntityParsing for an application to be 345 vulnerable. 346 #1163 CVE-2026-32778 -- Fix NULL dereference in function setContext 347 on retry after an earlier ouf-of-memory condition; it takes 348 use of function XML_ParserCreateNS or XML_ParserCreate_MM 349 for an application to be vulnerable. 350 #1160 Three more unfixed vulnerabilities left 351 352 Other changes: 353 #1146 #1147 Autotools: Fix condition for symbol versioning check, in 354 particular when compiling with slibtool (not libtool) 355 #1156 Address Cppcheck >=2.20.0 warnings 356 #1153 tests: Make test_buffer_can_grow_to_max work for MinGW on 357 Ubuntu 24.04 358 #1157 #1159 Version info bumped from 12:2:11 (libexpat*.so.1.11.2) 359 to 12:3:11 (libexpat*.so.1.11.3); see https://verbump.de/ 360 for what these numbers do 361 362 Infrastructure: 363 #1148 CI: Fix FreeBSD and Solaris CI 364 #1149 CI: Bump to WASI SDK 30 365 #1153 CI: Adapt to breaking changes with Ubuntu 22.04 366 #1156 CI: Adapt to breaking changes in Cppcheck 367 368 Special thanks to: 369 Berkay Eren Ürün 370 Christian Ng 371 Fabio Scaccabarozzi 372 Francesco Bertolaccini 373 Mark Brand 374 Rhodri James 375 and 376 AddressSanitizer 377 Buttercup 378 OSS-Fuzz / ClusterFuzz 379 Trail of Bits 380 381Release 2.7.4 Sat January 31 2026 382 Security fixes: 383 #1131 CVE-2026-24515 -- Function XML_ExternalEntityParserCreate 384 failed to copy the encoding handler data passed to 385 XML_SetUnknownEncodingHandler from the parent to the new 386 subparser. This can cause a NULL dereference (CWE-476) from 387 external entities that declare use of an unknown encoding. 388 The expected impact is denial of service. It takes use of 389 both functions XML_ExternalEntityParserCreate and 390 XML_SetUnknownEncodingHandler for an application to be 391 vulnerable. 392 #1075 CVE-2026-25210 -- Add missing check for integer overflow 393 related to buffer size determination in function doContent 394 395 Bug fixes: 396 #1073 lib: Fix missing undoing of group size expansion in doProlog 397 failure cases 398 #1107 xmlwf: Fix a memory leak 399 #1104 WASI: Fix format specifiers for 32bit WASI SDK 400 401 Other changes: 402 #1105 lib: Fix strict aliasing 403 #1106 lib: Leverage feature "flexible array member" of C99 404 #1051 lib: Swap (size_t)(-1) for C99 equivalent SIZE_MAX 405 #1109 lib|xmlwf: Return NULL instead of 0 for pointers 406 #1068 lib|Windows: Clean up use of macro _MSC_EXTENSIONS with MSVC 407 #1112 lib: Remove unused import 408 #1110 xmlwf: Warn about XXE in --help output (and man page) 409 #1102 #1103 WASI: Stop using getpid 410 #1113 #1130 Autotools: Drop file expat.m4 that provided obsolete Autoconf 411 macro AM_WITH_EXPAT 412 #1123 Autotools: Limit -Wno-pedantic-ms-format to MinGW 413 #1129 #1134 .. 414 #1087 Autotools|macOS: Sync CMake templates with CMake 4.0 415 #1139 #1140 Autotools|CMake: Introduce off-by-default symbol versioning 416 The related build system flags are: 417 - For Autotools, configure with --enable-symbol-versioning 418 - For CMake, configure with -DEXPAT_SYMBOL_VERSIONING=ON 419 Please double-check for consequences before activating 420 this inside distro packaging. Bug reports welcome! 421 #1117 Autotools|CMake: Remove libbsd support 422 #1105 Autotools|CMake: Stop using -fno-strict-aliasing, and use 423 -Wstrict-aliasing=3 instead 424 #1124 Autotools|CMake: Prefer command gsed (GNU sed) over sed 425 (e.g. for Solaris) inside fix-xmltest-log.sh 426 #1067 CMake: Detect and warn about unusable check_c_compiler_flag 427 #1137 CMake: Drop support for CMake <3.17 428 #1138 CMake|Windows: Fix libexpat.def.cmake version comments 429 430 #1086 #1110 docs: Add warning about external reference handlers and XXE 431 #1066 docs: Be explicit that parent parsers need to outlive 432 subparsers 433 #1089 .. 434 #1090 #1091 .. 435 #1092 #1093 .. 436 #1094 #1098 .. 437 #1115 #1116 docs: Misc non-content improvements to doc/reference.html 438 #1132 #1133 Version info bumped from 12:1:11 (libexpat*.so.1.11.1) 439 to 12:2:11 (libexpat*.so.1.11.2); see https://verbump.de/ 440 for what these numbers do 441 442 Infrastructure: 443 #1119 #1121 Document guidelines for contributing to Expat 444 #1120 Introduce a pull request template 445 #1074 CI: Stop using about-to-be-removed image "macos-13" 446 #1083 #1088 CI: Mitigate random Wine crashes 447 #1104 CI: Cover compilation with WASI SDK 448 #1116 CI: Enforce clean doc XML formatting 449 #1124 .. 450 #1135 #1136 CI: Cover Solaris 11.4 451 #1125 CI: Extend CI coverage of FreeBSD 452 #1139 #1140 CI: Cover symbol versioning 453 #1114 xmlwf: Reformat helpgen code (using Black 25.12.0) 454 #1071 .gitignore: Add files CPackConfig.cmake and 455 CPackSourceConfig.cmake 456 457 Special thanks to: 458 Alfonso Gregory 459 Bénédikt Tran 460 Gordon Messmer 461 Hanno Böck 462 Jakub Kulík 463 Matthew Fernandez 464 Neil Pang 465 Rosen Penev 466 and 467 Artiphishell Inc. 468 469Release 2.7.3 Wed September 24 2025 470 Security fixes: 471 #1046 #1048 Fix alignment of internal allocations for some non-amd64 472 architectures (e.g. sparc32); fixes up on the fix to 473 CVE-2025-59375 from #1034 (of Expat 2.7.2 and related 474 backports) 475 #1059 Fix a class of false positives where input should have been 476 rejected with error XML_ERROR_ASYNC_ENTITY; regression from 477 CVE-2024-8176 fix pull request #973 (of Expat 2.7.0 and 478 related backports). Please check the added unit tests for 479 example documents. 480 481 Other changes: 482 #1043 Prove and regression-proof absence of integer overflow 483 from function expat_realloc 484 #1062 Remove "harmless" cast that truncated a size_t to unsigned 485 #1049 Autotools: Remove "ln -s" discovery 486 #1054 docs: Be consistent with use of floating point around 487 XML_SetAllocTrackerMaximumAmplification 488 #1056 docs: Make it explicit that XML_GetCurrentColumnNumber 489 starts at 0 490 #1057 docs: Better integrate the effect of the activation 491 thresholds 492 #1058 docs: Fix an in-comment typo in expat.h 493 #1045 docs: Fix a typo in README.md 494 #1041 docs: Improve change log of release 2.7.2 495 #1053 xmlwf: Resolve use of functions XML_GetErrorLineNumber 496 and XML_GetErrorColumnNumber 497 #1032 Windows: Normalize .bat files to CRLF line endings 498 #1060 #1061 Version info bumped from 12:0:11 (libexpat*.so.1.11.0) 499 to 12:1:11 (libexpat*.so.1.11.1); see https://verbump.de/ 500 for what these numbers do 501 502 Infrastructure: 503 #1047 #1050 CI: Cleanup UndefinedBehaviorSanitizer fatality 504 #1044 CI|Linux: Stop aborting at first job failure 505 #1052 CI|FreeBSD: Upgrade to FreeBSD 15.0 506 #1039 CI|FreeBSD: Do not install CMake meta-package 507 508 Special thanks to: 509 Bénédikt Tran 510 Berkay Eren Ürün 511 Daniel Engberg 512 Hanno Böck 513 Matthew Fernandez 514 Rolf Eike Beer 515 Sam James 516 Tim Bray 517 and 518 Clang/GCC UndefinedBehaviorSanitizer 519 OSS-Fuzz / ClusterFuzz 520 Z3 Theorem Prover 521 522Release 2.7.2 Tue September 16 2025 523 Security fixes: 524 #1018 #1034 CVE-2025-59375 -- Disallow use of disproportional amounts of 525 dynamic memory from within an Expat parser (e.g. previously 526 a ~250 KiB sized document was able to cause allocation of 527 ~800 MiB from the heap, i.e. an "amplification" of factor 528 ~3,300); once a threshold (that defaults to 64 MiB) is 529 reached, a maximum amplification factor (that defaults to 530 100.0) is enforced, and violating documents are rejected 531 with an out-of-memory error. 532 There are two new API functions to fine-tune this new 533 behavior: 534 - XML_SetAllocTrackerActivationThreshold 535 - XML_SetAllocTrackerMaximumAmplification . 536 If you ever need to increase these defaults for non-attack 537 XML payload, please file a bug report with libexpat. 538 There is also a new environment variable 539 EXPAT_MALLOC_DEBUG=(0|1|2) to control the verbosity 540 of allocations debugging at runtime, disabled by default. 541 Known impact is (reliable and easy) denial of service: 542 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C 543 (Base Score: 7.5, Temporal Score: 7.2) 544 Please note that a layer of compression around XML can 545 significantly reduce the minimum attack payload size. 546 Distributors intending to backport (or cherry-pick) the 547 fix need to copy 99% of the related pull request, not just 548 the "lib: Implement tracking of dynamic memory allocations" 549 commit, to not end up with a state that literally does both 550 too much and too little at the same time. Appending ".diff" 551 to the pull request URL could be of help. 552 553 Other changes: 554 #1008 #1017 Autotools|macOS: Sync CMake templates with CMake 3.31 555 #1007 CMake: Drop support for CMake <3.15 556 #1004 CMake: Fix off_t detection for -Werror 557 #1007 CMake|Windows: Fix -DEXPAT_MSVC_STATIC_CRT=ON 558 #1013 Windows: Drop support for Visual Studio <=16.0/2019 559 #1026 xmlwf: Mention supported environment variables in 560 --help output 561 #1024 xmlwf: Fix (internal) help generator 562 #1034 docs: Promote the contract to call function 563 XML_FreeContentModel when registering a custom 564 element declaration handler (via a call to function 565 XML_SetElementDeclHandler) 566 #1027 docs: Add missing <p>..</p> wrap 567 #994 docs: Drop AppVeyor badge 568 #1000 tests: Fix portable_strndup 569 #1036 Drop casts around malloc/free/realloc that C99 does not need 570 #1010 Replace empty for loops with while loops 571 #1011 Add const with internal XmlInitUnknownEncodingNS 572 #14 #1037 Drop an OpenVMS support leftover 573 #999 #1001 Address more clang-tidy warnings 574 #1030 #1038 Version info bumped from 11:2:10 (libexpat*.so.1.10.2) 575 to 12:0:11 (libexpat*.so.1.11.0); see https://verbump.de/ 576 for what these numbers do 577 578 Infrastructure: 579 #1003 CI: Cover compilation on FreeBSD 580 #1009 #1035 CI: Upgrade Clang from 19 to 21 581 #1031 CI: Make calling Cppcheck without --suppress=objectIndex 582 and --suppress=unknownMacro possible 583 #1013 CI|Windows: Get off of deprecated image "windows-2019" 584 #1008 #1017 .. 585 #1023 #1025 CI: Adapt to breaking changes in GitHub Actions 586 587 Special thanks to: 588 Alexander Bluhm 589 Neil Pang 590 Theo Buehler 591 and 592 GNU Time 593 OSS-Fuzz / ClusterFuzz 594 Perl XML::Parser 595 596Release 2.7.1 Thu March 27 2025 597 Bug fixes: 598 #980 #989 Restore event pointer behavior from Expat 2.6.4 599 (that the fix to CVE-2024-8176 changed in 2.7.0); 600 affected API functions are: 601 - XML_GetCurrentByteCount 602 - XML_GetCurrentByteIndex 603 - XML_GetCurrentColumnNumber 604 - XML_GetCurrentLineNumber 605 - XML_GetInputContext 606 607 Other changes: 608 #976 #977 Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}" 609 with Automake that were missing from 2.7.0 release tarballs 610 #983 #984 Fix printf format specifiers for 32bit Emscripten 611 #992 docs: Promote OpenSSF Best Practices self-certification 612 #978 tests/benchmark: Resolve mistaken double close 613 #986 Address Frama-C warnings 614 #990 #993 Version info bumped from 11:1:10 (libexpat*.so.1.10.1) 615 to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/ 616 for what these numbers do 617 618 Infrastructure: 619 #982 CI: Start running Perl XML::Parser integration tests 620 #987 CI: Enforce Clang Static Analyzer clean code 621 #991 CI: Re-enable warning clang-analyzer-valist.Uninitialized 622 for clang-tidy 623 #981 CI: Cover compilation with musl 624 #983 #984 CI: Cover compilation with 32bit Emscripten 625 #976 #977 CI: Protect against fuzzer files missing from future 626 release archives 627 628 Special thanks to: 629 Berkay Eren Ürün 630 Matthew Fernandez 631 and 632 Perl XML::Parser 633 634Release 2.7.0 Thu March 13 2025 635 Security fixes: 636 #893 #973 CVE-2024-8176 -- Fix crash from chaining a large number 637 of entities caused by stack overflow by resolving use of 638 recursion, for all three uses of entities: 639 - general entities in character data ("<e>&g1;</e>") 640 - general entities in attribute values ("<e k1='&g1;'/>") 641 - parameter entities ("%p1;") 642 Known impact is (reliable and easy) denial of service: 643 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C 644 (Base Score: 7.5, Temporal Score: 7.2) 645 Please note that a layer of compression around XML can 646 significantly reduce the minimum attack payload size. 647 648 Other changes: 649 #935 #937 Autotools: Make generated CMake files look for 650 libexpat.@SO_MAJOR@.dylib on macOS 651 #925 Autotools: Sync CMake templates with CMake 3.29 652 #945 #962 #966 CMake: Drop support for CMake <3.13 653 #942 CMake: Small fuzzing related improvements 654 #921 docs: Add missing documentation of error code 655 XML_ERROR_NOT_STARTED that was introduced with 2.6.4 656 #941 docs: Document need for C++11 compiler for use from C++ 657 #959 tests/benchmark: Fix a (harmless) TOCTTOU 658 #944 Windows: Fix installer target location of file xmlwf.xml 659 for CMake 660 #953 Windows: Address warning -Wunknown-warning-option 661 about -Wno-pedantic-ms-format from LLVM MinGW 662 #971 Address Cppcheck warnings 663 #969 #970 Mass-migrate links from http:// to https:// 664 #947 #958 .. 665 #974 #975 Document changes since the previous release 666 #974 #975 Version info bumped from 11:0:10 (libexpat*.so.1.10.0) 667 to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/ 668 for what these numbers do 669 670 Infrastructure: 671 #926 tests: Increase robustness 672 #927 #932 .. 673 #930 #933 tests: Increase test coverage 674 #617 #950 .. 675 #951 #952 .. 676 #954 #955 .. Fuzzing: Add new fuzzer "xml_lpm_fuzzer" based on 677 #961 Google's libprotobuf-mutator ("LPM") 678 #957 Fuzzing|CI: Start producing fuzzing code coverage reports 679 #936 CI: Pass -q -q for LCOV >=2.1 in coverage.sh 680 #942 CI: Small fuzzing related improvements 681 #139 #203 .. 682 #791 #946 CI: Make GitHub Actions build using MSVC on Windows and 683 produce 32bit and 64bit Windows binaries 684 #956 CI: Get off of about-to-be-removed Ubuntu 20.04 685 #960 #964 CI: Start uploading to Coverity Scan for static analysis 686 #972 CI: Stop loading DTD from the internet to address flaky CI 687 #971 CI: Adapt to breaking changes in Cppcheck 688 689 Special thanks to: 690 Alexander Gieringer 691 Berkay Eren Ürün 692 Hanno Böck 693 Jann Horn 694 Mark Brand 695 Sebastian Andrzej Siewior 696 Snild Dolkow 697 Thomas Pröll 698 Tomas Korbar 699 valord577 700 and 701 Google Project Zero 702 Linutronix 703 Red Hat 704 Siemens 705 706Release 2.6.4 Wed November 6 2024 707 Security fixes: 708 #915 CVE-2024-50602 -- Fix crash within function XML_ResumeParser 709 from a NULL pointer dereference by disallowing function 710 XML_StopParser to (stop or) suspend an unstarted parser. 711 A new error code XML_ERROR_NOT_STARTED was introduced to 712 properly communicate this situation. // CWE-476 CWE-754 713 714 Other changes: 715 #903 CMake: Add alias target "expat::expat" 716 #905 docs: Document use via CMake >=3.18 with FetchContent 717 and SOURCE_SUBDIR and its consequences 718 #902 tests: Reduce use of global parser instance 719 #904 tests: Resolve duplicate handler 720 #317 #918 tests: Improve tests on doctype closing (ex CVE-2019-15903) 721 #914 Fix signedness of format strings 722 #915 For use from C++, expat.h started requiring C++11 due to 723 use of C99 features 724 #919 #920 Version info bumped from 10:3:9 (libexpat*.so.1.9.3) 725 to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/ 726 for what these numbers do 727 728 Infrastructure: 729 #907 CI: Upgrade Clang from 18 to 19 730 #913 CI: Drop macos-12 and add macos-15 731 #910 CI: Adapt to breaking changes in GitHub Actions 732 #898 Add missing entries to .gitignore 733 734 Special thanks to: 735 Hanno Böck 736 José Eduardo Gutiérrez Conejo 737 José Ricardo Cardona Quesada 738 739Release 2.6.3 Wed September 4 2024 740 Security fixes: 741 #887 #890 CVE-2024-45490 -- Calling function XML_ParseBuffer with 742 len < 0 without noticing and then calling XML_GetBuffer 743 will have XML_ParseBuffer fail to recognize the problem 744 and XML_GetBuffer corrupt memory. 745 With the fix, XML_ParseBuffer now complains with error 746 XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse 747 has been doing since Expat 2.2.1, and now documented. 748 Impact is denial of service to potentially artitrary code 749 execution. 750 #888 #891 CVE-2024-45491 -- Internal function dtdCopy can have an 751 integer overflow for nDefaultAtts on 32-bit platforms 752 (where UINT_MAX equals SIZE_MAX). 753 Impact is denial of service to potentially artitrary code 754 execution. 755 #889 #892 CVE-2024-45492 -- Internal function nextScaffoldPart can 756 have an integer overflow for m_groupSize on 32-bit 757 platforms (where UINT_MAX equals SIZE_MAX). 758 Impact is denial of service to potentially artitrary code 759 execution. 760 761 Other changes: 762 #851 #879 Autotools: Sync CMake templates with CMake 3.28 763 #853 Autotools: Always provide path to find(1) for portability 764 #861 Autotools: Ensure that the m4 directory always exists. 765 #870 Autotools: Simplify handling of SIZEOF_VOID_P 766 #869 Autotools: Support non-GNU sed 767 #856 Autotools|CMake: Fix main() to main(void) 768 #865 Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM 769 #863 Autotools|CMake: Stop requiring dos2unix 770 #854 #855 CMake: Fix check for symbols size_t and off_t 771 #864 docs|tests: Convert README to Markdown and update 772 #741 Windows: Drop support for Visual Studio <=15.0/2017 773 #886 Drop needless XML_DTD guards around is_param access 774 #885 Fix typo in a code comment 775 #894 #896 Version info bumped from 10:2:9 (libexpat*.so.1.9.2) 776 to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/ 777 for what these numbers do 778 779 Infrastructure: 780 #880 Readme: Promote the call for help 781 #868 CI: Fix various issues 782 #849 CI: Allow triggering GitHub Actions workflows manually 783 #851 #872 .. 784 #873 #879 CI: Adapt to breaking changes in GitHub Actions 785 786 Special thanks to: 787 Alexander Bluhm 788 Berkay Eren Ürün 789 Dag-Erling Smørgrav 790 Ferenc Géczi 791 TaiYou 792 793Release 2.6.2 Wed March 13 2024 794 Security fixes: 795 #839 #842 CVE-2024-28757 -- Prevent billion laughs attacks with 796 isolated use of external parsers. Please see the commit 797 message of commit 1d50b80cf31de87750103656f6eb693746854aa8 798 for details. 799 800 Bug fixes: 801 #839 #841 Reject direct parameter entity recursion 802 and avoid the related undefined behavior 803 804 Other changes: 805 #847 Autotools: Fix build for DOCBOOK_TO_MAN containing spaces 806 #837 Add missing #821 and #824 to 2.6.1 change log 807 #838 #843 Version info bumped from 10:1:9 (libexpat*.so.1.9.1) 808 to 10:2:9 (libexpat*.so.1.9.2); see https://verbump.de/ 809 for what these numbers do 810 811 Special thanks to: 812 Philippe Antoine 813 Tomas Korbar 814 and 815 Clang UndefinedBehaviorSanitizer 816 OSS-Fuzz / ClusterFuzz 817 818Release 2.6.1 Thu February 29 2024 819 Bug fixes: 820 #817 Make tests independent of CPU speed, and thus more robust 821 #828 #836 Expose billion laughs API with XML_DTD defined and 822 XML_GE undefined, regression from 2.6.0 823 824 Other changes: 825 #829 Hide test-only code behind new internal macro 826 #833 Autotools: Reject expat_config.h.in defining SIZEOF_VOID_P 827 #821 #824 Autotools: Fix "make clean" for case: 828 ./configure --without-docbook && make clean all 829 #819 Address compiler warnings 830 #832 #834 Version info bumped from 10:0:9 (libexpat*.so.1.9.0) 831 to 10:1:9 (libexpat*.so.1.9.1); see https://verbump.de/ 832 for what these numbers do 833 834 Infrastructure: 835 #818 CI: Adapt to breaking changes in clang-format 836 837 Special thanks to: 838 David Hall 839 Snild Dolkow 840 841Release 2.6.0 Tue February 6 2024 842 Security fixes: 843 #789 #814 CVE-2023-52425 -- Fix quadratic runtime issues with big tokens 844 that can cause denial of service, in partial where 845 dealing with compressed XML input. Applications 846 that parsed a document in one go -- a single call to 847 functions XML_Parse or XML_ParseBuffer -- were not affected. 848 The smaller the chunks/buffers you use for parsing 849 previously, the bigger the problem prior to the fix. 850 Backporters should be careful to no omit parts of 851 pull request #789 and to include earlier pull request #771, 852 in order to not break the fix. 853 #777 CVE-2023-52426 -- Fix billion laughs attacks for users 854 compiling *without* XML_DTD defined (which is not common). 855 Users with XML_DTD defined have been protected since 856 Expat >=2.4.0 (and that was CVE-2013-0340 back then). 857 858 Bug fixes: 859 #753 Fix parse-size-dependent "invalid token" error for 860 external entities that start with a byte order mark 861 #780 Fix NULL pointer dereference in setContext via 862 XML_ExternalEntityParserCreate for compilation with 863 XML_DTD undefined 864 #812 #813 Protect against closing entities out of order 865 866 Other changes: 867 #723 Improve support for arc4random/arc4random_buf 868 #771 #788 Improve buffer growth in XML_GetBuffer and XML_Parse 869 #761 #770 xmlwf: Support --help and --version 870 #759 #770 xmlwf: Support custom buffer size for XML_GetBuffer and read 871 #744 xmlwf: Improve language and URL clickability in help output 872 #673 examples: Add new example "element_declarations.c" 873 #764 Be stricter about macro XML_CONTEXT_BYTES at build time 874 #765 Make inclusion to expat_config.h consistent 875 #726 #727 Autotools: configure.ac: Support --disable-maintainer-mode 876 #678 #705 .. 877 #706 #733 #792 Autotools: Sync CMake templates with CMake 3.26 878 #795 Autotools: Make installation of shipped man page doc/xmlwf.1 879 independent of docbook2man availability 880 #815 Autotools|CMake: Add missing -DXML_STATIC to pkg-config file 881 section "Cflags.private" in order to fix compilation 882 against static libexpat using pkg-config on Windows 883 #724 #751 Autotools|CMake: Require a C99 compiler 884 (a de-facto requirement already since Expat 2.2.2 of 2017) 885 #793 Autotools|CMake: Fix PACKAGE_BUGREPORT variable 886 #750 #786 Autotools|CMake: Make test suite require a C++11 compiler 887 #749 CMake: Require CMake >=3.5.0 888 #672 CMake: Lowercase off_t and size_t to help a bug in Meson 889 #746 CMake: Sort xmlwf sources alphabetically 890 #785 CMake|Windows: Fix generation of DLL file version info 891 #790 CMake: Build tests/benchmark/benchmark.c as well for 892 a build with -DEXPAT_BUILD_TESTS=ON 893 #745 #757 docs: Document the importance of isFinal + adjust tests 894 accordingly 895 #736 docs: Improve use of "NULL" and "null" 896 #713 docs: Be specific about version of XML (XML 1.0r4) 897 and version of C (C99); (XML 1.0r5 will need a sponsor.) 898 #762 docs: reference.html: Promote function XML_ParseBuffer more 899 #779 docs: reference.html: Add HTML anchors to XML_* macros 900 #760 docs: reference.html: Upgrade to OK.css 1.2.0 901 #763 #739 docs: Fix typos 902 #696 docs|CI: Use HTTPS URLs instead of HTTP at various places 903 #669 #670 .. 904 #692 #703 .. 905 #733 #772 Address compiler warnings 906 #798 #800 Address clang-tidy warnings 907 #775 #776 Version info bumped from 9:10:8 (libexpat*.so.1.8.10) 908 to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/ 909 for what these numbers do 910 911 Infrastructure: 912 #700 #701 docs: Document security policy in file SECURITY.md 913 #766 docs: Improve parse buffer variables in-code documentation 914 #674 #738 .. 915 #740 #747 .. 916 #748 #781 #782 Refactor coverage and conformance tests 917 #714 #716 Refactor debug level variables to unsigned long 918 #671 Improve handling of empty environment variable value 919 in function getDebugLevel (without visible user effect) 920 #755 #774 .. 921 #758 #783 .. 922 #784 #787 tests: Improve test coverage with regard to parse chunk size 923 #660 #797 #801 Fuzzing: Improve fuzzing coverage 924 #367 #799 Fuzzing|CI: Start running OSS-Fuzz fuzzing regression tests 925 #698 #721 CI: Resolve some Travis CI leftovers 926 #669 CI: Be robust towards absence of Git tags 927 #693 #694 CI: Set permissions to "contents: read" for security 928 #709 CI: Pin all GitHub Actions to specific commits for security 929 #739 CI: Reject spelling errors using codespell 930 #798 CI: Enforce clang-tidy clean code 931 #773 #808 .. 932 #809 #810 CI: Upgrade Clang from 15 to 18 933 #796 CI: Start using Clang's Control Flow Integrity sanitizer 934 #675 #720 #722 CI: Adapt to breaking changes in GitHub Actions Ubuntu images 935 #689 CI: Adapt to breaking changes in Clang/LLVM Debian packaging 936 #763 CI: Adapt to breaking changes in codespell 937 #803 CI: Adapt to breaking changes in Cppcheck 938 939 Special thanks to: 940 Ivan Galkin 941 Joyce Brum 942 Philippe Antoine 943 Rhodri James 944 Snild Dolkow 945 spookyahell 946 Steven Garske 947 and 948 Clang AddressSanitizer 949 Clang UndefinedBehaviorSanitizer 950 codespell 951 GCC Farm Project 952 OSS-Fuzz 953 Sony Mobile 954 955Release 2.5.0 Tue October 25 2022 956 Security fixes: 957 #616 #649 #650 CVE-2022-43680 -- Fix heap use-after-free after overeager 958 destruction of a shared DTD in function 959 XML_ExternalEntityParserCreate in out-of-memory situations. 960 Expected impact is denial of service or potentially 961 arbitrary code execution. 962 963 Bug fixes: 964 #612 #645 Fix corruption from undefined entities 965 #613 #654 Fix case when parsing was suspended while processing nested 966 entities 967 #616 #652 #653 Stop leaking opening tag bindings after a closing tag 968 mismatch error where a parser is reset through 969 XML_ParserReset and then reused to parse 970 #656 CMake: Fix generation of pkg-config file 971 #658 MinGW|CMake: Fix static library name 972 973 Other changes: 974 #663 Protect header expat_config.h from multiple inclusion 975 #666 examples: Make use of XML_GetBuffer and be more 976 consistent across examples 977 #648 Address compiler warnings 978 #667 #668 Version info bumped from 9:9:8 to 9:10:8; 979 see https://verbump.de/ for what these numbers do 980 981 Special thanks to: 982 Jann Horn 983 Mark Brand 984 Osyotr 985 Rhodri James 986 and 987 Google Project Zero 988 989Release 2.4.9 Tue September 20 2022 990 Security fixes: 991 #629 #640 CVE-2022-40674 -- Heap use-after-free vulnerability in 992 function doContent. Expected impact is denial of service 993 or potentially arbitrary code execution. 994 995 Bug fixes: 996 #634 MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0 997 #614 docs: Fix documentation on effect of switch XML_DTD on 998 symbol visibility in doc/reference.html 999 1000 Other changes: 1001 #638 MinGW: Make fix-xmltest-log.sh drop more Wine bug output 1002 #596 #625 Autotools: Sync CMake templates with CMake 3.22 1003 #608 CMake: Migrate from use of CMAKE_*_POSTFIX to 1004 dedicated variables EXPAT_*_POSTFIX to stop affecting 1005 other projects 1006 #597 #599 Windows|CMake: Add missing -DXML_STATIC to test runners 1007 and fuzzers 1008 #512 #621 Windows|CMake: Render .def file from a template to fix 1009 linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON 1010 #611 #621 MinGW|CMake: Apply MSVC .def file when linking 1011 #622 #624 MinGW|CMake: Sync library name with GNU Autotools, 1012 i.e. produce libexpat-1.dll rather than libexpat.dll 1013 by default. Filename libexpat.dll.a is unaffected. 1014 #632 MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in 1015 toolchain file "cmake/mingw-toolchain.cmake" to avoid 1016 error "windres: Command not found" on e.g. Ubuntu 20.04 1017 #597 #627 CMake: Unify inconsistent use of set() and option() in 1018 context of public build time options to take need for 1019 set(.. FORCE) in projects using Expat by means of 1020 add_subdirectory(..) off Expat's users' shoulders 1021 #626 #641 Stop exporting API symbols when building a static library 1022 #644 Resolve use of deprecated "fgrep" by "grep -F" 1023 #620 CMake: Make documentation on variables a bit more consistent 1024 #636 CMake: Drop leading whitespace from a #cmakedefine line in 1025 file expat_config.h.cmake 1026 #594 xmlwf: Fix harmless variable mix-up in function nsattcmp 1027 #592 #593 #610 Address Cppcheck warnings 1028 #643 Address Clang 15 compiler warnings 1029 #642 #644 Version info bumped from 9:8:8 to 9:9:8; 1030 see https://verbump.de/ for what these numbers do 1031 1032 Infrastructure: 1033 #597 #598 CI: Windows: Start covering MSVC 2022 1034 #619 CI: macOS: Migrate off deprecated macOS 10.15 1035 #632 CI: Linux: Make migration off deprecated Ubuntu 18.04 work 1036 #643 CI: Upgrade Clang from 14 to 15 1037 #637 apply-clang-format.sh: Add support for BSD find 1038 #633 coverage.sh: Exclude MinGW headers 1039 #635 coverage.sh: Fix name collision for -funsigned-char 1040 1041 Special thanks to: 1042 David Faure 1043 Felix Wilhelm 1044 Frank Bergmann 1045 Rhodri James 1046 Rosen Penev 1047 Thijs Schreijer 1048 Vincent Torri 1049 and 1050 Google Project Zero 1051 1052Release 2.4.8 Mon March 28 2022 1053 Other changes: 1054 #587 pkg-config: Move "-lm" to section "Libs.private" 1055 #587 CMake|MSVC: Fix pkg-config section "Libs" 1056 #55 #582 CMake|macOS: Start using linker arguments 1057 "-compatibility_version <version>" and 1058 "-current_version <version>" in a way compatible with 1059 GNU Libtool 1060 #590 #591 Version info bumped from 9:7:8 to 9:8:8; 1061 see https://verbump.de/ for what these numbers do 1062 1063 Infrastructure: 1064 #589 CI: Upgrade Clang from 13 to 14 1065 1066 Special thanks to: 1067 evpobr 1068 Kai Pastor 1069 Sam James 1070 1071Release 2.4.7 Fri March 4 2022 1072 Bug fixes: 1073 #572 #577 Relax fix to CVE-2022-25236 (introduced with release 2.4.5) 1074 with regard to all valid URI characters (RFC 3986), 1075 i.e. the following set (excluding whitespace): 1076 ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz 1077 0123456789 % -._~ :/?#[]@ !$&'()*+,;= 1078 1079 Other changes: 1080 #555 #570 #581 CMake|Windows: Store Expat version in the DLL 1081 #577 Document consequences of namespace separator choices not just 1082 in doc/reference.html but also in header <expat.h> 1083 #577 Document Expat's lack of validation of namespace URIs against 1084 RFC 3986, and that the XML 1.0r4 specification doesn't 1085 require Expat to validate namespace URIs, and that Expat 1086 may do more in that regard in future releases. 1087 If you find need for strict RFC 3986 URI validation on 1088 application level today, https://uriparser.github.io/ may 1089 be of interest. 1090 #579 Fix documentation of XML_EndDoctypeDeclHandler in <expat.h> 1091 #575 Document that a call to XML_FreeContentModel can be done at 1092 a later time from outside the element declaration handler 1093 #574 Make hardcoded namespace URIs easier to find in code 1094 #573 Update documentation on use of XML_POOR_ENTOPY on Solaris 1095 #569 #571 tests: Resolve use of macros NAN and INFINITY for GNU G++ 1096 4.8.2 on Solaris. 1097 #578 #580 Version info bumped from 9:6:8 to 9:7:8; 1098 see https://verbump.de/ for what these numbers do 1099 1100 Special thanks to: 1101 Jeffrey Walton 1102 Johnny Jazeix 1103 Thijs Schreijer 1104 1105Release 2.4.6 Sun February 20 2022 1106 Bug fixes: 1107 #566 Fix a regression introduced by the fix for CVE-2022-25313 1108 in release 2.4.5 that affects applications that (1) 1109 call function XML_SetElementDeclHandler and (2) are 1110 parsing XML that contains nested element declarations 1111 (e.g. "<!ELEMENT junk ((bar|foo|xyz+), zebra*)>"). 1112 1113 Other changes: 1114 #567 #568 Version info bumped from 9:5:8 to 9:6:8; 1115 see https://verbump.de/ for what these numbers do 1116 1117 Special thanks to: 1118 Matt Sergeant 1119 Samanta Navarro 1120 Sergei Trofimovich 1121 and 1122 NixOS 1123 Perl XML::Parser 1124 1125Release 2.4.5 Fri February 18 2022 1126 Security fixes: 1127 #562 CVE-2022-25235 -- Passing malformed 2- and 3-byte UTF-8 1128 sequences (e.g. from start tag names) to the XML 1129 processing application on top of Expat can cause 1130 arbitrary damage (e.g. code execution) depending 1131 on how invalid UTF-8 is handled inside the XML 1132 processor; validation was not their job but Expat's. 1133 Exploits with code execution are known to exist. 1134 #561 CVE-2022-25236 -- Passing (one or more) namespace separator 1135 characters in "xmlns[:prefix]" attribute values 1136 made Expat send malformed tag names to the XML 1137 processor on top of Expat which can cause 1138 arbitrary damage (e.g. code execution) depending 1139 on such unexpectable cases are handled inside the XML 1140 processor; validation was not their job but Expat's. 1141 Exploits with code execution are known to exist. 1142 #558 CVE-2022-25313 -- Fix stack exhaustion in doctype parsing 1143 that could be triggered by e.g. a 2 megabytes 1144 file with a large number of opening braces. 1145 Expected impact is denial of service or potentially 1146 arbitrary code execution. 1147 #560 CVE-2022-25314 -- Fix integer overflow in function copyString; 1148 only affects the encoding name parameter at parser creation 1149 time which is often hardcoded (rather than user input), 1150 takes a value in the gigabytes to trigger, and a 64-bit 1151 machine. Expected impact is denial of service. 1152 #559 CVE-2022-25315 -- Fix integer overflow in function storeRawNames; 1153 needs input in the gigabytes and a 64-bit machine. 1154 Expected impact is denial of service or potentially 1155 arbitrary code execution. 1156 1157 Other changes: 1158 #557 #564 Version info bumped from 9:4:8 to 9:5:8; 1159 see https://verbump.de/ for what these numbers do 1160 1161 Special thanks to: 1162 Ivan Fratric 1163 Samanta Navarro 1164 and 1165 Google Project Zero 1166 JetBrains 1167 1168Release 2.4.4 Sun January 30 2022 1169 Security fixes: 1170 #550 CVE-2022-23852 -- Fix signed integer overflow 1171 (undefined behavior) in function XML_GetBuffer 1172 (that is also called by function XML_Parse internally) 1173 for when XML_CONTEXT_BYTES is defined to >0 (which is both 1174 common and default). 1175 Impact is denial of service or more. 1176 #551 CVE-2022-23990 -- Fix unsigned integer overflow in function 1177 doProlog triggered by large content in element type 1178 declarations when there is an element declaration handler 1179 present (from a prior call to XML_SetElementDeclHandler). 1180 Impact is denial of service or more. 1181 1182 Bug fixes: 1183 #544 #545 xmlwf: Fix a memory leak on output file opening error 1184 1185 Other changes: 1186 #546 Autotools: Fix broken CMake support under Cygwin 1187 #554 Windows: Add missing files to the installer to fix 1188 compilation with CMake from installed sources 1189 #552 #554 Version info bumped from 9:3:8 to 9:4:8; 1190 see https://verbump.de/ for what these numbers do 1191 1192 Special thanks to: 1193 Carlo Bramini 1194 hwt0415 1195 Roland Illig 1196 Samanta Navarro 1197 and 1198 Clang LeakSan and the Clang team 1199 1200Release 2.4.3 Sun January 16 2022 1201 Security fixes: 1202 #531 #534 CVE-2021-45960 -- Fix issues with left shifts by >=29 places 1203 resulting in 1204 a) realloc acting as free 1205 b) realloc allocating too few bytes 1206 c) undefined behavior 1207 depending on architecture and precise value 1208 for XML documents with >=2^27+1 prefixed attributes 1209 on a single XML tag a la 1210 "<r xmlns:a='[..]' a:a123='[..]' [..] />" 1211 where XML_ParserCreateNS is used to create the parser 1212 (which needs argument "-n" when running xmlwf). 1213 Impact is denial of service, or more. 1214 #532 #538 CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow 1215 on variable m_groupSize in function doProlog leading 1216 to realloc acting as free. 1217 Impact is denial of service or more. 1218 #539 CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows 1219 near memory allocation at multiple places. Mitre assigned 1220 a dedicated CVE for each involved internal C function: 1221 - CVE-2022-22822 for function addBinding 1222 - CVE-2022-22823 for function build_model 1223 - CVE-2022-22824 for function defineAttribute 1224 - CVE-2022-22825 for function lookup 1225 - CVE-2022-22826 for function nextScaffoldPart 1226 - CVE-2022-22827 for function storeAtts 1227 Impact is denial of service or more. 1228 1229 Other changes: 1230 #535 CMake: Make call to file(GENERATE [..]) work for CMake <3.19 1231 #541 Autotools|CMake: MinGW: Make run.sh(.in) work for Cygwin 1232 and MSYS2 by not going through Wine on these platforms 1233 #527 #528 Address compiler warnings 1234 #533 #543 Version info bumped from 9:2:8 to 9:3:8; 1235 see https://verbump.de/ for what these numbers do 1236 1237 Infrastructure: 1238 #536 CI: Check for realistic minimum CMake version 1239 #529 #539 CI: Cover compilation with -m32 1240 #529 CI: Store coverage reports as artifacts for download 1241 #528 CI: Upgrade Clang from 11 to 13 1242 1243 Special thanks to: 1244 An anonymous whitehat 1245 Christopher Degawa 1246 J. Peter Mugaas 1247 Tyson Smith 1248 and 1249 GCC Farm Project 1250 Trend Micro Zero Day Initiative 1251 1252Release 2.4.2 Sun December 19 2021 1253 Other changes: 1254 #509 #510 Link againgst libm for function "isnan" 1255 #513 #514 Include expat_config.h as early as possible 1256 #498 Autotools: Include files with release archives: 1257 - buildconf.sh 1258 - fuzz/*.c 1259 #507 #519 Autotools: Sync CMake templates with CMake 3.20 1260 #495 #524 CMake: MinGW: Fix pkg-config section "Libs" for 1261 - non-release build types (e.g. -DCMAKE_BUILD_TYPE=Debug) 1262 - multi-config CMake generators (e.g. Ninja Multi-Config) 1263 #502 #503 docs: Document that function XML_GetBuffer may return NULL 1264 when asking for a buffer of 0 (zero) bytes size 1265 #522 #523 docs: Fix return value docs for both 1266 XML_SetBillionLaughsAttackProtection* functions 1267 #525 #526 Version info bumped from 9:1:8 to 9:2:8; 1268 see https://verbump.de/ for what these numbers do 1269 1270 Special thanks to: 1271 Donghee Na 1272 Joergen Ibsen 1273 Kai Pastor 1274 1275Release 2.4.1 Sun May 23 2021 1276 Bug fixes: 1277 #488 #490 Autotools: Fix installed header expat_config.h for multilib 1278 systems; regression introduced in 2.4.0 by pull request #486 1279 1280 Other changes: 1281 #491 #492 Version info bumped from 9:0:8 to 9:1:8; 1282 see https://verbump.de/ for what these numbers do 1283 1284 Special thanks to: 1285 Gentoo's QA check "multilib_check_headers" 1286 1287Release 2.4.0 Sun May 23 2021 1288 Security fixes: 1289 #34 #466 #484 CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks 1290 (denial-of-service; flavors targeting CPU time or RAM or both, 1291 leveraging general entities or parameter entities or both) 1292 by tracking and limiting the input amplification factor 1293 (<amplification> := (<direct> + <indirect>) / <direct>). 1294 By conservative default, amplification up to a factor of 100.0 1295 is tolerated and rejection only starts after 8 MiB of output bytes 1296 (=<direct> + <indirect>) have been processed. 1297 The fix adds the following to the API: 1298 - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to 1299 signals this specific condition. 1300 - Two new API functions .. 1301 - XML_SetBillionLaughsAttackProtectionMaximumAmplification and 1302 - XML_SetBillionLaughsAttackProtectionActivationThreshold 1303 .. to further tighten billion laughs protection parameters 1304 when desired. Please see file "doc/reference.html" for details. 1305 If you ever need to increase the defaults for non-attack XML 1306 payload, please file a bug report with libexpat. 1307 - Two new XML_FEATURE_* constants .. 1308 - that can be queried using the XML_GetFeatureList function, and 1309 - that are shown in "xmlwf -v" output. 1310 - Two new environment variable switches .. 1311 - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and 1312 - EXPAT_ENTITY_DEBUG=(0|1) 1313 .. for runtime debugging of accounting and entity processing. 1314 Specific behavior of these values may change in the future. 1315 - Two new command line arguments "-a FACTOR" and "-b BYTES" 1316 for xmlwf to further tighten billion laughs protection 1317 parameters when desired. 1318 If you ever need to increase the defaults for non-attack XML 1319 payload, please file a bug report with libexpat. 1320 1321 Bug fixes: 1322 #332 #470 For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) 1323 or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault 1324 for UTF-16 payloads containing CDATA sections. 1325 #485 #486 Autotools: Fix generated CMake files for non-64bit and 1326 non-Linux platforms (e.g. macOS and MinGW in particular) 1327 that were introduced with release 2.3.0 1328 1329 Other changes: 1330 #468 #469 xmlwf: Improve help output and the xmlwf man page 1331 #463 xmlwf: Improve maintainability through some refactoring 1332 #477 xmlwf: Fix man page DocBook validity 1333 #456 Autotools: Sync CMake templates with CMake 3.18 1334 #458 #459 CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR 1335 and CMAKE_INSTALL_INCLUDEDIR 1336 #471 #481 CMake: Add support for standard variable BUILD_SHARED_LIBS 1337 #457 Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters 1338 #467 Resolve macro HAVE_EXPAT_CONFIG_H 1339 #472 Delete unused legacy helper file "conftools/PrintPath" 1340 #473 #483 Improve attribution 1341 #464 #465 #477 doc/reference.html: Fix XHTML validity 1342 #475 #478 doc/reference.html: Replace the 90s look by OK.css 1343 #479 Version info bumped from 8:0:7 to 9:0:8 1344 due to addition of new symbols and error codes; 1345 see https://verbump.de/ for what these numbers do 1346 1347 Infrastructure: 1348 #456 CI: Enable periodic runs 1349 #457 CI: Start covering the list of exported symbols 1350 #474 CI: Isolate coverage task 1351 #476 #482 CI: Adapt to breaking changes in image "ubuntu-18.04" 1352 #477 CI: Cover well-formedness and DocBook/XHTML validity 1353 of doc/reference.html and doc/xmlwf.xml 1354 1355 Special thanks to: 1356 Dimitry Andric 1357 Eero Helenius 1358 Nick Wellnhofer 1359 Rhodri James 1360 Tomas Korbar 1361 Yury Gribov 1362 and 1363 Clang LeakSan 1364 JetBrains 1365 OSS-Fuzz 1366 1367Release 2.3.0 Thu March 25 2021 1368 Bug fixes: 1369 #438 When calling XML_ParseBuffer without a prior successful call to 1370 XML_GetBuffer as a user, no longer trigger undefined behavior 1371 (by adding an integer to a NULL pointer) but rather return 1372 XML_STATUS_ERROR and set the error code to (new) code 1373 XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) 1374 of Clang 11 (but not Clang 9). 1375 #444 xmlwf: Exit status 2 was used for both: 1376 - malformed input files (documented) and 1377 - invalid command-line arguments (undocumented). 1378 The case of invalid command-line arguments now 1379 has its own exit status 4, resolving the ambiguity. 1380 1381 Other changes: 1382 #439 xmlwf: Add argument -k to allow continuing after 1383 non-fatal errors 1384 #439 xmlwf: Add section about exit status to the -h help output 1385 #422 #426 #447 Windows: Drop support for Visual Studio <=14.0/2015 1386 #434 Windows: CMake: Detect unsupported Visual Studio at 1387 configure time (rather than at compile time) 1388 #382 #428 testrunner: Make verbose mode (argument "-v") report 1389 about passed tests, and make default mode report about 1390 failures, as well. 1391 #442 CMake: Call "enable_language(CXX)" prior to tinkering 1392 with CMAKE_CXX_* variables 1393 #448 Document use of libexpat from a CMake-based project 1394 #451 Autotools: Install CMake files as generated by CMake 3.19.6 1395 so that users with "find_package(expat [..] CONFIG [..])" 1396 are served on distributions that are *not* using the CMake 1397 build system inside for libexpat packaging 1398 #436 #437 Autotools: Drop obsolescent macro AC_HEADER_STDC 1399 #450 #452 Autotools: Resolve use of obsolete macro AC_CONFIG_HEADER 1400 #441 Address compiler warnings 1401 #443 Version info bumped from 7:12:6 to 8:0:7 1402 due to addition of error code XML_ERROR_NO_BUFFER 1403 (see https://verbump.de/ for what these numbers do) 1404 1405 Infrastructure: 1406 #435 #446 Replace Travis CI by GitHub Actions 1407 1408 Special thanks to: 1409 Alexander Richardson 1410 Oleksandr Popovych 1411 Thomas Beutlich 1412 Tim Bray 1413 and 1414 Clang LeakSan, Clang 11 UBSan and the Clang team 1415 1416Release 2.2.10 Sat October 3 2020 1417 Bug fixes: 1418 #390 #395 #398 Fix undefined behavior during parsing caused by 1419 pointer arithmetic with NULL pointers 1420 #404 #405 Fix reading uninitialized variable during parsing 1421 #406 xmlwf: Add missing check for malloc NULL return 1422 1423 Other changes: 1424 #396 Windows: Drop support for Visual Studio <=8.0/2005 1425 #409 Windows: Add missing file "Changes" to the installer 1426 to fix compilation with CMake from installed sources 1427 #403 xmlwf: Document exit codes in xmlwf manpage and 1428 exit with code 3 (rather than code 1) for output errors 1429 when used with "-d DIRECTORY" 1430 #356 #359 MinGW: Provide declaration of rand_s for mingwrt <5.3.0 1431 #383 #392 Autotools: Use -Werror while configure tests the compiler 1432 for supported compile flags to avoid false positives 1433 #383 #393 #394 Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, 1434 e.g. ensure that they have the last word over flags added 1435 while running ./configure 1436 #360 CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis 1437 on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) 1438 #360 CMake: Detect and deny unsupported build combinations 1439 involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) 1440 #360 CMake: Install pre-compiled shipped xmlwf.1 manpage in case 1441 of -DEXPAT_BUILD_DOCS=OFF 1442 #375 #380 #419 CMake: Fix use of Expat by means of add_subdirectory 1443 #407 #408 CMake: Keep expat target name constant at "expat" 1444 (i.e. refrain from using the target name to control 1445 build artifact filenames) 1446 #385 CMake: Fix compilation with -DEXPAT_SHARED_LIBS=OFF for 1447 Windows 1448 CMake: Expose man page compilation as target "xmlwf-manpage" 1449 #413 #414 CMake: Introduce option EXPAT_BUILD_PKGCONFIG 1450 to control generation of pkg-config file "expat.pc" 1451 #424 CMake: Add minimalistic support for building binary packages 1452 with CMake target "package"; based on CPack 1453 #366 CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with 1454 default OFF to build fuzzer code against OSS-Fuzz and 1455 related environment variable LIB_FUZZING_ENGINE 1456 #354 Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF, each 1457 #354 #355 .. 1458 #356 #412 Address compiler warnings 1459 #368 #369 Address pngcheck warnings with doc/*.png images 1460 #425 Version info bumped from 7:11:6 to 7:12:6 1461 1462 Special thanks to: 1463 asavah 1464 Ben Wagner 1465 Bhargava Shastry 1466 Frank Landgraf 1467 Jeffrey Walton 1468 Joe Orton 1469 Kleber Tarcísio 1470 Ma Lin 1471 Maciej Sroczyński 1472 Mohammed Khajapasha 1473 Vadim Zeitlin 1474 and 1475 Cppcheck 2.0 and the Cppcheck team 1476 1477Release 2.2.9 Wed September 25 2019 1478 Other changes: 1479 examples: Drop executable bits from elements.c 1480 #349 Windows: Change the name of the Windows DLLs from expat*.dll 1481 to libexpat*.dll once more (regression from 2.2.8, first 1482 fixed in 1.95.3, issue #61 on SourceForge today, 1483 was issue #432456 back then); needs a fix due 1484 case-insensitive file systems on Windows and the fact that 1485 Perl's XML::Parser::Expat compiles into Expat.dll. 1486 #347 Windows: Only define _CRT_RAND_S if not defined 1487 Version info bumped from 7:10:6 to 7:11:6 1488 1489 Special thanks to: 1490 Ben Wagner 1491 1492Release 2.2.8 Fri September 13 2019 1493 Security fixes: 1494 #317 #318 CVE-2019-15903 -- Fix heap overflow triggered by 1495 XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), 1496 and deny internal entities closing the doctype; 1497 fixed in commit c20b758c332d9a13afbbb276d30db1d183a85d43 1498 1499 Bug fixes: 1500 #240 Fix cases where XML_StopParser did not have any effect 1501 when called from inside of an end element handler 1502 #341 xmlwf: Fix exit code for operation without "-d DIRECTORY"; 1503 previously, only "-d DIRECTORY" would give you a proper 1504 exit code: 1505 # xmlwf -d . <<<'<not well-formed>' 2>/dev/null ; echo $? 1506 2 1507 # xmlwf <<<'<not well-formed>' 2>/dev/null ; echo $? 1508 0 1509 Now both cases return exit code 2. 1510 1511 Other changes: 1512 #299 #302 Windows: Replace LoadLibrary hack to access 1513 unofficial API function SystemFunction036 (RtlGenRandom) 1514 by using official API function rand_s (needs WinXP+) 1515 #325 Windows: Drop support for Visual Studio <=7.1/2003 1516 and document supported compilers in README.md 1517 #286 Windows: Remove COM code from xmlwf; in case it turns 1518 out needed later, there will be a dedicated repository 1519 below https://github.com/libexpat/ for that code 1520 #322 Windows: Remove explicit MSVC solution and project files. 1521 You can generate Visual Studio solution files through 1522 CMake, e.g.: cmake -G"Visual Studio 15 2017" . 1523 #338 xmlwf: Make "xmlwf -h" help output more friendly 1524 #339 examples: Improve elements.c 1525 #244 #264 Autotools: Add argument --enable-xml-attr-info 1526 #239 #301 Autotools: Add arguments 1527 --with-getrandom 1528 --without-getrandom 1529 --with-sys-getrandom 1530 --without-sys-getrandom 1531 #312 #343 Autotools: Fix linking issues with "./configure LD=clang" 1532 Autotools: Fix "make run-xmltest" for out-of-source builds 1533 #329 #336 CMake: Pull all options from Expat <=2.2.7 into namespace 1534 prefix EXPAT_ with the exception of DOCBOOK_TO_MAN: 1535 - BUILD_doc -> EXPAT_BUILD_DOCS (plural) 1536 - BUILD_examples -> EXPAT_BUILD_EXAMPLES 1537 - BUILD_shared -> EXPAT_SHARED_LIBS 1538 - BUILD_tests -> EXPAT_BUILD_TESTS 1539 - BUILD_tools -> EXPAT_BUILD_TOOLS 1540 - DOCBOOK_TO_MAN -> DOCBOOK_TO_MAN (unchanged) 1541 - INSTALL -> EXPAT_ENABLE_INSTALL 1542 - MSVC_USE_STATIC_CRT -> EXPAT_MSVC_STATIC_CRT 1543 - USE_libbsd -> EXPAT_WITH_LIBBSD 1544 - WARNINGS_AS_ERRORS -> EXPAT_WARNINGS_AS_ERRORS 1545 - XML_CONTEXT_BYTES -> EXPAT_CONTEXT_BYTES 1546 - XML_DEV_URANDOM -> EXPAT_DEV_URANDOM 1547 - XML_DTD -> EXPAT_DTD 1548 - XML_NS -> EXPAT_NS 1549 - XML_UNICODE -> EXPAT_CHAR_TYPE=ushort (!) 1550 - XML_UNICODE_WCHAR_T -> EXPAT_CHAR_TYPE=wchar_t (!) 1551 #244 #264 CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), 1552 default OFF 1553 #326 CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), 1554 default OFF 1555 #328 CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), 1556 default OFF 1557 #239 #277 CMake: Add arguments 1558 -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO 1559 -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO 1560 #326 CMake: Install expat_config.h to include directory 1561 #326 CMake: Generate and install configuration files for 1562 future find_package(expat [..] CONFIG [..]) 1563 CMake: Now produces a summary of applied configuration 1564 CMake: Require C++ compiler only when tests are enabled 1565 #330 CMake: Fix compilation for 16bit character types, 1566 i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) 1567 #265 CMake: Fix linking with MinGW 1568 #330 CMake: Add full support for MinGW; to enable, use 1569 -DCMAKE_TOOLCHAIN_FILE=[expat]/cmake/mingw-toolchain.cmake 1570 #330 CMake: Port "make run-xmltest" from GNU Autotools to CMake 1571 #316 CMake: Windows: Make binary postfix match MSVC 1572 Old: expat[d].lib 1573 New: expat[w][d][MD|MT].lib 1574 CMake: Migrate files from Windows to Unix line endings 1575 #308 CMake: Integrate OSS-Fuzz fuzzers, option 1576 -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF 1577 #14 Drop an OpenVMS support leftover 1578 #235 #268 .. 1579 #270 #310 .. 1580 #313 #331 #333 Address compiler warnings 1581 #282 #283 .. 1582 #284 #285 Address cppcheck warnings 1583 #294 #295 Address Clang Static Analyzer warnings 1584 #24 #293 Mass-apply clang-format 9 (and ensure conformance during CI) 1585 Version info bumped from 7:9:6 to 7:10:6 1586 1587 Special thanks to: 1588 David Loffredo 1589 Joonun Jang 1590 Kishore Kunche 1591 Marco Maggi 1592 Mitch Phillips 1593 Mohammed Khajapasha 1594 Rolf Ade 1595 xantares 1596 Zhongyuan Zhou 1597 1598Release 2.2.7 Wed June 19 2019 1599 Security fixes: 1600 #186 #262 CVE-2018-20843 -- Fix extraction of namespace prefixes from 1601 XML names; XML names with multiple colons could end up in 1602 the wrong namespace, and take a high amount of RAM and CPU 1603 resources while processing, opening the door to 1604 use for denial-of-service attacks 1605 1606 Other changes: 1607 #195 #197 Autotools/CMake: Utilize -fvisibility=hidden to stop 1608 exporting non-API symbols 1609 #227 Autotools: Add --without-examples and --without-tests 1610 #228 Autotools: Modernize configure.ac 1611 #245 #246 Autotools: Fix check for -fvisibility=hidden for Clang 1612 #247 #248 Autotools: Fix compilation for lack of docbook2x-man 1613 #236 #258 Autotools: Produce .tar.{gz,lz,xz} release archives 1614 #212 CMake: Make libdir of pkgconfig expat.pc support multilib 1615 #158 #263 CMake: Build man page in PROJECT_BINARY_DIR not _SOURCE_DIR 1616 #219 Remove fallback to bcopy, assume that memmove(3) exists 1617 #257 Use portable "/usr/bin/env bash" shebang (e.g. for OpenBSD) 1618 #243 Windows: Fix syntax of .def module definition files 1619 Version info bumped from 7:8:6 to 7:9:6 1620 1621 Special thanks to: 1622 Benjamin Peterson 1623 Caolán McNamara 1624 Hanno Böck 1625 KangLin 1626 Kishore Kunche 1627 Marco Maggi 1628 Rhodri James 1629 Sebastian Dröge 1630 userwithuid 1631 Yury Gribov 1632 1633Release 2.2.6 Sun August 12 2018 1634 Bug fixes: 1635 #170 #206 Avoid doing arithmetic with NULL pointers in XML_GetBuffer 1636 #204 #205 Fix 2.2.5 regression with suspend-resume while parsing 1637 a document like '<root/>' 1638 1639 Other changes: 1640 #165 #168 Autotools: Fix docbook-related configure syntax error 1641 #166 Autotools: Avoid grep option `-q` for Solaris 1642 #167 Autotools: Support 1643 ./configure DOCBOOK_TO_MAN="xmlto man --skip-validation" 1644 #159 #167 Autotools: Support DOCBOOK_TO_MAN command which produces 1645 xmlwf.1 rather than XMLWF.1; also covers case insensitive 1646 file systems 1647 #181 Autotools: Drop -rpath option passed to libtool 1648 #188 Autotools: Detect and deny SGML docbook2man as ours is XML 1649 #188 Autotools/CMake: Support command db2x_docbook2man as well 1650 #174 CMake: Introduce option WARNINGS_AS_ERRORS, defaults to OFF 1651 #184 #185 CMake: Introduce option MSVC_USE_STATIC_CRT, defaults to OFF 1652 #207 #208 CMake: Introduce option XML_UNICODE and XML_UNICODE_WCHAR_T, 1653 both defaulting to OFF 1654 #175 CMake: Prefer check_symbol_exists over check_function_exists 1655 #176 CMake: Create the same pkg-config file as with GNU Autotools 1656 #178 #179 CMake: Use GNUInstallDirs module to set proper defaults for 1657 install directories 1658 #208 CMake: Utilize expat_config.h.cmake for XML_DEV_URANDOM 1659 #180 Windows: Fix compilation of test suite for Visual Studio 2008 1660 #131 #173 #202 Address compiler warnings 1661 #187 #190 #200 Fix miscellaneous typos 1662 Version info bumped from 7:7:6 to 7:8:6 1663 1664 Special thanks to: 1665 Anton Maklakov 1666 Benjamin Peterson 1667 Brad King 1668 Franek Korta 1669 Frank Rast 1670 Joe Orton 1671 luzpaz 1672 Pedro Vicente 1673 Rainer Jung 1674 Rhodri James 1675 Rolf Ade 1676 Rolf Eike Beer 1677 Thomas Beutlich 1678 Tomasz Kłoczko 1679 1680Release 2.2.5 Tue October 31 2017 1681 Bug fixes: 1682 #8 If the parser runs out of memory, make sure its internal 1683 state reflects the memory it actually has, not the memory 1684 it wanted to have. 1685 #11 The default handler wasn't being called when it should for 1686 a SYSTEM or PUBLIC doctype if an entity declaration handler 1687 was registered. 1688 #137 #138 Fix a case of mistakenly reported parsing success where 1689 XML_StopParser was called from an element handler 1690 #162 Function XML_ErrorString was returning NULL rather than 1691 a message for code XML_ERROR_INVALID_ARGUMENT 1692 introduced with release 2.2.1 1693 1694 Other changes: 1695 #106 xmlwf: Add argument -N adding notation declarations 1696 #75 #106 Test suite: Resolve expected failure cases where xmlwf 1697 output was incomplete 1698 #127 Windows: Fix test suite compilation 1699 #126 #127 Windows: Fix compilation for Visual Studio 2012 1700 Windows: Upgrade shipped project files to Visual Studio 2017 1701 #33 #132 tests: Mass-fix compilation for XML_UNICODE_WCHAR_T 1702 #129 examples: Fix compilation for XML_UNICODE_WCHAR_T 1703 #130 benchmark: Fix compilation for XML_UNICODE_WCHAR_T 1704 #144 xmlwf: Fix compilation for XML_UNICODE_WCHAR_T; still needs 1705 Windows or MinGW for 2-byte wchar_t 1706 #9 Address two Clang Static Analyzer false positives 1707 #59 Resolve troublesome macros hiding parser struct membership 1708 and dereferencing that pointer 1709 #6 Resolve superfluous internal malloc/realloc switch 1710 #153 #155 Improve docbook2x-man detection 1711 #160 Undefine NDEBUG in the test suite (rather than rejecting it) 1712 #161 Address compiler warnings 1713 Version info bumped from 7:6:6 to 7:7:6 1714 1715 Special thanks to: 1716 Benbuck Nason 1717 Hans Wennborg 1718 José Gutiérrez de la Concha 1719 Pedro Monreal Gonzalez 1720 Rhodri James 1721 Rolf Ade 1722 Stephen Groat 1723 and 1724 Core Infrastructure Initiative 1725 1726Release 2.2.4 Sat August 19 2017 1727 Bug fixes: 1728 #115 Fix copying of partial characters for UTF-8 input 1729 1730 Other changes: 1731 #109 Fix "make check" for non-x86 architectures that default 1732 to unsigned type char (-128..127 rather than 0..255) 1733 #109 coverage.sh: Cover -funsigned-char 1734 Autotools: Introduce --without-xmlwf argument 1735 #65 Autotools: Replace handwritten Makefile with GNU Automake 1736 #43 CMake: Auto-detect high quality entropy extractors, add new 1737 option USE_libbsd=ON to use arc4random_buf of libbsd 1738 #74 CMake: Add -fno-strict-aliasing only where supported 1739 #114 CMake: Always honor manually set BUILD_* options 1740 #114 CMake: Compile man page if docbook2x-man is available, only 1741 #117 Include file tests/xmltest.log.expected in source tarball 1742 (required for "make run-xmltest") 1743 #117 Include (existing) Visual Studio 2013 files in source tarball 1744 Improve test suite error output 1745 #111 Fix some typos in documentation 1746 Version info bumped from 7:5:6 to 7:6:6 1747 1748 Special thanks to: 1749 Jakub Wilk 1750 Joe Orton 1751 Lin Tian 1752 Rolf Eike Beer 1753 1754Release 2.2.3 Wed August 2 2017 1755 Security fixes: 1756 #82 CVE-2017-11742 -- Windows: Fix DLL hijacking vulnerability 1757 using Steve Holme's LoadLibrary wrapper for/of cURL 1758 1759 Bug fixes: 1760 #85 Fix a dangling pointer issue related to realloc 1761 1762 Other changes: 1763 Increase code coverage 1764 #91 Linux: Allow getrandom to fail if nonblocking pool has not 1765 yet been initialized and read /dev/urandom then, instead. 1766 This is in line with what recent Python does. 1767 #81 Pre-10.7/Lion macOS: Support entropy from arc4random 1768 #86 Check that a UTF-16 encoding in an XML declaration has the 1769 right endianness 1770 #4 #5 #7 Recover correctly when some reallocations fail 1771 Repair "./configure && make" for systems without any 1772 provider of high quality entropy 1773 and try reading /dev/urandom on those 1774 Ensure that user-defined character encodings have converter 1775 functions when they are needed 1776 Fix mis-leading description of argument -c in xmlwf.1 1777 Rely on macro HAVE_ARC4RANDOM_BUF (rather than __CloudABI__) 1778 for CloudABI 1779 #100 Fix use of SIPHASH_MAIN in siphash.h 1780 #23 Test suite: Fix memory leaks 1781 Version info bumped from 7:4:6 to 7:5:6 1782 1783 Special thanks to: 1784 Chanho Park 1785 Joe Orton 1786 Pascal Cuoq 1787 Rhodri James 1788 Simon McVittie 1789 Vadim Zeitlin 1790 Viktor Szakats 1791 and 1792 Core Infrastructure Initiative 1793 1794Release 2.2.2 Wed July 12 2017 1795 Security fixes: 1796 #43 Protect against compilation without any source of high 1797 quality entropy enabled, e.g. with CMake build system; 1798 commit ff0207e6076e9828e536b8d9cd45c9c92069b895 1799 #60 Windows with _UNICODE: 1800 Unintended use of LoadLibraryW with a non-wide string 1801 resulted in failure to load advapi32.dll and degradation 1802 in quality of used entropy when compiled with _UNICODE for 1803 Windows; you can launch existing binaries with 1804 EXPAT_ENTROPY_DEBUG=1 in the environment to inspect the 1805 quality of entropy used during runtime; commits 1806 * 95b95032f907ef1cd17ee7a9a1768010a825d61d 1807 * 73a5a2e9c081f49f2d775cf7ced864158b68dc80 1808 [MOX-006] Fix non-NULL parser parameter validation in XML_Parse; 1809 resulted in NULL dereference, previously; 1810 commit ac256dafdffc9622ab0dc2c62fcecb0dfcfa71fe 1811 1812 Bug fixes: 1813 #69 Fix improper use of unsigned long long integer literals 1814 1815 Other changes: 1816 #73 Start requiring a C99 compiler 1817 #49 Fix "==" Bashism in configure script 1818 #50 Fix too eager getrandom detection for Debian GNU/kFreeBSD 1819 #52 and macOS 1820 #51 Address lack of stdint.h in Visual Studio 2003 to 2008 1821 #58 Address compile warnings 1822 #68 Fix "./buildconf.sh && ./configure" for some versions 1823 of Dash for /bin/sh 1824 #72 CMake: Ease use of Expat in context of a parent project 1825 with multiple CMakeLists.txt files 1826 #72 CMake: Resolve mistaken executable permissions 1827 #76 Address compile warning with -DNDEBUG (not recommended!) 1828 #77 Address compile warning about macro redefinition 1829 1830 Special thanks to: 1831 Alexander Bluhm 1832 Ben Boeckel 1833 Cătălin Răceanu 1834 Kerin Millar 1835 László Böszörményi 1836 S. P. Zeidler 1837 Segev Finer 1838 Václav Slavík 1839 Victor Stinner 1840 Viktor Szakats 1841 and 1842 Radically Open Security 1843 1844Release 2.2.1 Sat June 17 2017 1845 Security fixes: 1846 CVE-2017-9233 -- External entity infinite loop DoS 1847 Details: https://libexpat.github.io/doc/cve-2017-9233/ 1848 Commit c4bf96bb51dd2a1b0e185374362ee136fe2c9d7f 1849 [MOX-002] CVE-2016-9063 -- Detect integer overflow; commit 1850 d4f735b88d9932bd5039df2335eefdd0723dbe20 1851 (Fixed version of existing downstream patches!) 1852 (SF.net) #539 Fix regression from fix to CVE-2016-0718 cutting off 1853 longer tag names; commits 1854 * 896b6c1fd3b842f377d1b62135dccf0a579cf65d 1855 * af507cef2c93cb8d40062a0abe43a4f4e9158fb2 1856 #16 * 0dbbf43fdb20f593ddf4fa1ff67288000dd4a7fd 1857 #25 More integer overflow detection (function poolGrow); commits 1858 * 810b74e4703dcfdd8f404e3cb177d44684775143 1859 * 44178553f3539ce69d34abee77a05e879a7982ac 1860 [MOX-002] Detect overflow from len=INT_MAX call to XML_Parse; commits 1861 * 4be2cb5afcc018d996f34bbbce6374b7befad47f 1862 * 7e5b71b748491b6e459e5c9a1d090820f94544d8 1863 [MOX-005] #30 Use high quality entropy for hash initialization: 1864 * arc4random_buf on BSD, systems with libbsd 1865 (when configured with --with-libbsd), CloudABI 1866 * RtlGenRandom on Windows XP / Server 2003 and later 1867 * getrandom on Linux 3.17+ 1868 In a way, that's still part of CVE-2016-5300. 1869 https://github.com/libexpat/libexpat/pull/30/commits 1870 [MOX-005] For the low quality entropy extraction fallback code, 1871 the parser instance address can no longer leak, commit 1872 04ad658bd3079dd15cb60fc67087900f0ff4b083 1873 [MOX-003] Prevent use of uninitialised variable; commit 1874 [MOX-004] a4dc944f37b664a3ca7199c624a98ee37babdb4b 1875 Add missing parameter validation to public API functions 1876 and dedicated error code XML_ERROR_INVALID_ARGUMENT: 1877 [MOX-006] * NULL checks; commits 1878 * d37f74b2b7149a3a95a680c4c4cd2a451a51d60a (merge/many) 1879 * 9ed727064b675b7180c98cb3d4f75efba6966681 1880 * 6a747c837c50114dfa413994e07c0ba477be4534 1881 * Negative length (XML_Parse); commit 1882 [MOX-002] 70db8d2538a10f4c022655d6895e4c3e78692e7f 1883 [MOX-001] #35 Change hash algorithm to William Ahern's version of SipHash 1884 to go further with fixing CVE-2012-0876. 1885 https://github.com/libexpat/libexpat/pull/39/commits 1886 1887 Bug fixes: 1888 #32 Fix sharing of hash salt across parsers; 1889 relevant where XML_ExternalEntityParserCreate is called 1890 prior to XML_Parse, in particular (e.g. FBReader) 1891 #28 xmlwf: Auto-disable use of memory-mapping (and parsing 1892 as a single chunk) for files larger than ~1 GB (2^30 bytes) 1893 rather than failing with error "out of memory" 1894 #3 Fix double free after malloc failure in DTD code; commit 1895 7ae9c3d3af433cd4defe95234eae7dc8ed15637f 1896 #17 Fix memory leak on parser error for unbound XML attribute 1897 prefix with new namespaces defined in the same tag; 1898 found by Google's OSS-Fuzz; commits 1899 * 16f87daae5a16132e479e4f71862128c7a915c73 1900 * b47dbc9745932c160893d433220e462bd605f8cd 1901 xmlwf on Windows: Add missing calls to CloseHandle 1902 1903 New features: 1904 #30 Introduced environment switch EXPAT_ENTROPY_DEBUG=1 1905 for runtime debugging of entropy extraction 1906 1907 Other changes: 1908 Increase code coverage 1909 #33 Reject use of XML_UNICODE_WCHAR_T with sizeof(wchar_t) != 2; 1910 XML_UNICODE_WCHAR_T was never meant to be used outside 1911 of Windows; 4-byte wchar_t is common on Linux 1912 (SF.net) #538 Start using -fno-strict-aliasing 1913 (SF.net) #540 Support compilation against cloudlibc of CloudABI 1914 Allow MinGW cross-compilation 1915 (SF.net) #534 CMake: Introduce option "BUILD_doc" (enabled by default) 1916 to bypass compilation of the xmlwf.1 man page 1917 (SF.net) pr2 CMake: Introduce option "INSTALL" (enabled by default) 1918 to bypass installation of expat files 1919 CMake: Fix ninja support 1920 Autotools: Add parameters --enable-xml-context [COUNT] 1921 and --disable-xml-context; default of context of 1024 1922 bytes enabled unchanged 1923 #14 Drop AmigaOS 4.x code and includes 1924 #14 Drop ancient build systems: 1925 * Borland C++ Builder 1926 * OpenVMS 1927 * Open Watcom 1928 * Visual Studio 6.0 1929 * Pre-X Mac OS (MPW Makefile) 1930 If you happen to rely on some of these, please get in 1931 touch for joining with maintenance. 1932 #10 Move from WIN32 to _WIN32 1933 #13 Fix "make run-xmltest" order instability 1934 Address compile warnings 1935 Bump version info from 7:2:6 to 7:3:6 1936 Add AUTHORS file 1937 1938 Infrastructure: 1939 #1 Migrate from SourceForge to GitHub (except downloads): 1940 https://github.com/libexpat/ 1941 #1 Re-create http://libexpat.org/ project website 1942 Start utilizing Travis CI 1943 1944 Special thanks to: 1945 Andy Wang 1946 Don Lewis 1947 Ed Schouten 1948 Karl Waclawek 1949 Pascal Cuoq 1950 Rhodri James 1951 Sergei Nikulov 1952 Tobias Taschner 1953 Viktor Szakats 1954 and 1955 Core Infrastructure Initiative 1956 Mozilla Foundation (MOSS Track 3: Secure Open Source) 1957 Radically Open Security 1958 1959Release 2.2.0 Tue June 21 2016 1960 Security fixes: 1961 #537 CVE-2016-0718 -- Fix crash on malformed input 1962 CVE-2016-4472 -- Improve insufficient fix to CVE-2015-1283 / 1963 CVE-2015-2716 introduced with Expat 2.1.1 1964 #499 CVE-2016-5300 -- Use more entropy for hash initialization 1965 than the original fix to CVE-2012-0876 1966 #519 CVE-2012-6702 -- Resolve troublesome internal call to srand 1967 that was introduced with Expat 2.1.0 1968 when addressing CVE-2012-0876 (issue #496) 1969 1970 Bug fixes: 1971 Fix uninitialized reads of size 1 1972 (e.g. in little2_updatePosition) 1973 Fix detection of UTF-8 character boundaries 1974 1975 Other changes: 1976 #532 Fix compilation for Visual Studio 2010 (keyword "C99") 1977 Autotools: Resolve use of "$<" to better support bmake 1978 Autotools: Add QA script "qa.sh" (and make target "qa") 1979 Autotools: Respect CXXFLAGS if given 1980 Autotools: Fix "make run-xmltest" 1981 Autotools: Have "make run-xmltest" check for expected output 1982 p90 CMake: Fix static build (BUILD_shared=OFF) on Windows 1983 #536 CMake: Add soversion, support -DNO_SONAME=yes to bypass 1984 #323 CMake: Add suffix "d" to differentiate debug from release 1985 CMake: Define WIN32 with CMake on Windows 1986 Annotate memory allocators for GCC 1987 Address all currently known compile warnings 1988 Make sure that API symbols remain visible despite 1989 -fvisibility=hidden 1990 Remove executable flag from source files 1991 Resolve COMPILED_FROM_DSP in favor of WIN32 1992 1993 Special thanks to: 1994 Björn Lindahl 1995 Christian Heimes 1996 Cristian Rodríguez 1997 Daniel Krügler 1998 Gustavo Grieco 1999 Karl Waclawek 2000 László Böszörményi 2001 Marco Grassi 2002 Pascal Cuoq 2003 Sergei Nikulov 2004 Thomas Beutlich 2005 Warren Young 2006 Yann Droneaud 2007 2008Release 2.1.1 Sat March 12 2016 2009 Security fixes: 2010 #582: CVE-2015-1283 - Multiple integer overflows in XML_GetBuffer 2011 2012 Bug fixes: 2013 #502: Fix potential null pointer dereference 2014 #520: Symbol XML_SetHashSalt was not exported 2015 Output of "xmlwf -h" was incomplete 2016 2017 Other changes: 2018 #503: Document behavior of calling XML_SetHashSalt with salt 0 2019 Minor improvements to man page xmlwf(1) 2020 Improvements to the experimental CMake build system 2021 libtool now invoked with --verbose 2022 2023Release 2.1.0 Sat March 24 2012 2024 - Security fixes: 2025 #2958794: CVE-2012-1148 - Memory leak in poolGrow. 2026 #2895533: CVE-2012-1147 - Resource leak in readfilemap.c. 2027 #3496608: CVE-2012-0876 - Hash DOS attack. 2028 #2894085: CVE-2009-3560 - Buffer over-read and crash in big2_toUtf8(). 2029 #1990430: CVE-2009-3720 - Parser crash with special UTF-8 sequences. 2030 - Bug Fixes: 2031 #1742315: Harmful XML_ParserCreateNS suggestion. 2032 #1785430: Expat build fails on linux-amd64 with gcc version>=4.1 -O3. 2033 #1983953, 2517952, 2517962, 2649838: 2034 Build modifications using autoreconf instead of buildconf.sh. 2035 #2815947, #2884086: OBJEXT and EXEEXT support while building. 2036 #2517938: xmlwf should return non-zero exit status if not well-formed. 2037 #2517946: Wrong statement about XMLDecl in xmlwf.1 and xmlwf.sgml. 2038 #2855609: Dangling positionPtr after error. 2039 #2990652: CMake support. 2040 #3010819: UNEXPECTED_STATE with a trailing "%" in entity value. 2041 #3206497: Uninitialized memory returned from XML_Parse. 2042 #3287849: make check fails on mingw-w64. 2043 - Patches: 2044 #1749198: pkg-config support. 2045 #3010222: Fix for bug #3010819. 2046 #3312568: CMake support. 2047 #3446384: Report byte offsets for attr names and values. 2048 - New Features / API changes: 2049 Added new API member XML_SetHashSalt() that allows setting an initial 2050 value (salt) for hash calculations. This is part of the fix for 2051 bug #3496608 to randomize hash parameters. 2052 When compiled with XML_ATTR_INFO defined, adds new API member 2053 XML_GetAttributeInfo() that allows retrieving the byte 2054 offsets for attribute names and values (patch #3446384). 2055 Added CMake build system. 2056 See bug #2990652 and patch #3312568. 2057 Added run-benchmark target to Makefile.in - relies on testdata module 2058 present in the same relative location as in the repository. 2059 2060Release 2.0.1 Tue June 5 2007 2061 - Fixed bugs #1515266, #1515600: The character data handler's calling 2062 of XML_StopParser() was not handled properly; if the parser was 2063 stopped and the handler set to NULL, the parser would segfault. 2064 - Fixed bug #1690883: Expat failed on EBCDIC systems as it assumed 2065 some character constants to be ASCII encoded. 2066 - Minor cleanups of the test harness. 2067 - Fixed xmlwf bug #1513566: "out of memory" error on file size zero. 2068 - Fixed outline.c bug #1543233: missing a final XML_ParserFree() call. 2069 - Fixes and improvements for Windows platform: 2070 bugs #1409451, #1476160, #1548182, #1602769, #1717322. 2071 - Build fixes for various platforms: 2072 HP-UX, Tru64, Solaris 9: patch #1437840, bug #1196180. 2073 All Unix: #1554618 (refreshed config.sub/config.guess). 2074 #1490371, #1613457: support both, DESTDIR and INSTALL_ROOT, 2075 without relying on GNU-Make specific features. 2076 #1647805: Patched configure.in to work better with Intel compiler. 2077 - Fixes to Makefile.in to have make check work correctly: 2078 bugs #1408143, #1535603, #1536684. 2079 - Added Open Watcom support: patch #1523242. 2080 2081Release 2.0.0 Wed Jan 11 2006 2082 - We no longer use the "check" library for C unit testing; we 2083 always use the (partial) internal implementation of the API. 2084 - Report XML_NS setting via XML_GetFeatureList(). 2085 - Fixed headers for use from C++. 2086 - XML_GetCurrentLineNumber() and XML_GetCurrentColumnNumber() 2087 now return unsigned integers. 2088 - Added XML_LARGE_SIZE switch to enable 64-bit integers for 2089 byte indexes and line/column numbers. 2090 - Updated to use libtool 1.5.22 (the most recent). 2091 - Added support for AmigaOS. 2092 - Some mostly minor bug fixes. SF issues include: #1006708, 2093 #1021776, #1023646, #1114960, #1156398, #1221160, #1271642. 2094 2095Release 1.95.8 Fri Jul 23 2004 2096 - Major new feature: suspend/resume. Handlers can now request 2097 that a parse be suspended for later resumption or aborted 2098 altogether. See "Temporarily Stopping Parsing" in the 2099 documentation for more details. 2100 - Some mostly minor bug fixes, but compilation should no 2101 longer generate warnings on most platforms. SF issues 2102 include: #827319, #840173, #846309, #888329, #896188, #923913, 2103 #928113, #961698, #985192. 2104 2105Release 1.95.7 Mon Oct 20 2003 2106 - Fixed enum XML_Status issue (reported on SourceForge many 2107 times), so compilers that are properly picky will be happy. 2108 - Introduced an XMLCALL macro to control the calling 2109 convention used by the Expat API; this macro should be used 2110 to annotate prototypes and definitions of callback 2111 implementations in code compiled with a calling convention 2112 other than the default convention for the host platform. 2113 - Improved ability to build without the configure-generated 2114 expat_config.h header. This is useful for applications 2115 which embed Expat rather than linking in the library. 2116 - Fixed a variety of bugs: see SF issues #458907, #609603, 2117 #676844, #679754, #692878, #692964, #695401, #699323, #699487, 2118 #820946. 2119 - Improved hash table lookups. 2120 - Added more regression tests and improved documentation. 2121 2122Release 1.95.6 Tue Jan 28 2003 2123 - Added XML_FreeContentModel(). 2124 - Added XML_MemMalloc(), XML_MemRealloc(), XML_MemFree(). 2125 - Fixed a variety of bugs: see SF issues #615606, #616863, 2126 #618199, #653180, #673791. 2127 - Enhanced the regression test suite. 2128 - Man page improvements: includes SF issue #632146. 2129 2130Release 1.95.5 Fri Sep 6 2002 2131 - Added XML_UseForeignDTD() for improved SAX2 support. 2132 - Added XML_GetFeatureList(). 2133 - Defined XML_Bool type and the values XML_TRUE and XML_FALSE. 2134 - Use an incomplete struct instead of a void* for the parser 2135 (may not retain). 2136 - Fixed UTF-8 decoding bug that caused legal UTF-8 to be rejected. 2137 - Finally fixed bug where default handler would report DTD 2138 events that were already handled by another handler. 2139 Initial patch contributed by Darryl Miles. 2140 - Removed unnecessary DllMain() function that caused static 2141 linking into a DLL to be difficult. 2142 - Added VC++ projects for building static libraries. 2143 - Reduced line-length for all source code and headers to be 2144 no longer than 80 characters, to help with AS/400 support. 2145 - Reduced memory copying during parsing (SF patch #600964). 2146 - Fixed a variety of bugs: see SF issues #580793, #434664, 2147 #483514, #580503, #581069, #584041, #584183, #584832, #585537, 2148 #596555, #596678, #598352, #598944, #599715, #600479, #600971. 2149 2150Release 1.95.4 Fri Jul 12 2002 2151 - Added support for VMS, contributed by Craig Berry. See 2152 vms/README.vms for more information. 2153 - Added Mac OS (classic) support, with a makefile for MPW, 2154 contributed by Thomas Wegner and Daryle Walker. 2155 - Added Borland C++ Builder 5 / BCC 5.5 support, contributed 2156 by Patrick McConnell (SF patch #538032). 2157 - Fixed a variety of bugs: see SF issues #441449, #563184, 2158 #564342, #566334, #566901, #569461, #570263, #575168, #579196. 2159 - Made skippedEntityHandler conform to SAX2 (see source comment) 2160 - Re-implemented WFC: Entity Declared from XML 1.0 spec and 2161 added a new error "entity declared in parameter entity": 2162 see SF bug report #569461 and SF patch #578161 2163 - Re-implemented section 5.1 from XML 1.0 spec: 2164 see SF bug report #570263 and SF patch #578161 2165 2166Release 1.95.3 Mon Jun 3 2002 2167 - Added a project to the MSVC workspace to create a wchar_t 2168 version of the library; the DLLs are named libexpatw.dll. 2169 - Changed the name of the Windows DLLs from expat.dll to 2170 libexpat.dll; this fixes SF bug #432456. 2171 - Added the XML_ParserReset() API function. 2172 - Fixed XML_SetReturnNSTriplet() to work for element names. 2173 - Made the XML_UNICODE builds usable (thanks, Karl!). 2174 - Allow xmlwf to read from standard input. 2175 - Install a man page for xmlwf on Unix systems. 2176 - Fixed many bugs; see SF bug reports #231864, #461380, #464837, 2177 #466885, #469226, #477667, #484419, #487840, #494749, #496505, 2178 #547350. Other bugs which we can't test as easily may also 2179 have been fixed, especially in the area of build support. 2180 2181Release 1.95.2 Fri Jul 27 2001 2182 - More changes to make MSVC happy with the build; add a single 2183 workspace to support both the library and xmlwf application. 2184 - Added a Windows installer for Windows users; includes 2185 xmlwf.exe. 2186 - Added compile-time constants that can be used to determine the 2187 Expat version 2188 - Removed a lot of GNU-specific dependencies to aide portability 2189 among the various Unix flavors. 2190 - Fix the UTF-8 BOM bug. 2191 - Cleaned up warning messages for several compilers. 2192 - Added the -Wall, -Wstrict-prototypes options for GCC. 2193 2194Release 1.95.1 Sun Oct 22 15:11:36 EDT 2000 2195 - Changes to get expat to build under Microsoft compiler 2196 - Removed all aborts and instead return an UNEXPECTED_STATE error. 2197 - Fixed a bug where a stray '%' in an entity value would cause an 2198 abort. 2199 - Defined XML_SetEndNamespaceDeclHandler. Thanks to Darryl Miles for 2200 finding this oversight. 2201 - Changed default patterns in lib/Makefile.in to fit non-GNU makes 2202 Thanks to robin@unrated.net for reporting and providing an 2203 account to test on. 2204 - The reference had the wrong label for XML_SetStartNamespaceDecl. 2205 Reported by an anonymous user. 2206 2207Release 1.95.0 Fri Sep 29 2000 2208 - XML_ParserCreate_MM 2209 Allows you to set a memory management suite to replace the 2210 standard malloc,realloc, and free. 2211 - XML_SetReturnNSTriplet 2212 If you turn this feature on when namespace processing is in 2213 effect, then qualified, prefixed element and attribute names 2214 are returned as "uri|name|prefix" where '|' is whatever 2215 separator character is used in namespace processing. 2216 - Merged in features from perl-expat 2217 o XML_SetElementDeclHandler 2218 o XML_SetAttlistDeclHandler 2219 o XML_SetXmlDeclHandler 2220 o XML_SetEntityDeclHandler 2221 o StartDoctypeDeclHandler takes 3 additional parameters: 2222 sysid, pubid, has_internal_subset 2223 o Many paired handler setters (like XML_SetElementHandler) 2224 now have corresponding individual handler setters 2225 o XML_GetInputContext for getting the input context of 2226 the current parse position. 2227 - Added reference material 2228 - Packaged into a distribution that builds a sharable library 2229