From: "Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)" <deeratho@cisco.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][wrynose][PATCH v2 00/10] expat: Security fixes
Date: Mon, 20 Jul 2026 17:46:05 +0530 [thread overview]
Message-ID: <20260720121615.2520859-1-deeratho@cisco.com> (raw)
In-Reply-To: <20260710130809.2817559-1-deeratho@cisco.com>
From: Deepak Rathore <deeratho@cisco.com>
This v2 series backports security fixes for Expat 2.7.5 in Wrynose.
The listed CVEs affect versions before 2.8.2, so this series carries
the relevant upstream fixes instead of upgrading the stable-branch
recipe.
Changes in v2:
- Regenerate the patch mails with the Wrynose subject prefix:
[wrynose][PATCH v2 nn/10].
- Drop the Wrynose-only stdint.h include from CVE-2026-56403_p2.patch
and CVE-2026-56410_p1.patch because current Wrynose already provides
it through expat.h via OE-Core commit 21042df15008.
- Remove the now-unnecessary Backport Changes note from
CVE-2026-56403_p2.patch and keep only the remaining 2.7.5 context
note for CVE-2026-56410_p1.patch.
- Refresh all the patches on top of latest wrynose branch merge commit.
- CVE-2026-56403: Signed integer overflow in storeAtts namespace URI
construction, with related xcsdup overflow hardening from the same
upstream pull request. Fixed by adding overflow guards before length
conversion, allocation, and copy operations.
Upstream: https://github.com/libexpat/libexpat/commit/12dc6d8d3d65f79471a94d8565f6bf1cf245f648
https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15
- CVE-2026-56408: copyString could overflow while calculating the
allocation size for a copied string. Fixed by adding the upstream
allocation overflow guard while keeping the Wrynose 2.7.5 copyString
structure.
Upstream: https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817
- CVE-2026-56404: addBinding could hit signed integer overflow while
calculating namespace binding lengths. Fixed by adding upstream
length and allocation bounds checks in the binding path.
Upstream: https://github.com/libexpat/libexpat/commit/babfc48090977cbf7be24b2c48f6053dca75c164
- CVE-2026-56405: getAttributeId could hit signed integer overflow
while sizing attribute ID storage. Fixed by applying the upstream
overflow checks around the attribute name allocation.
Upstream: https://github.com/libexpat/libexpat/commit/2c6c42d33689f6b266a5267b639e03cde17e53c0
- CVE-2026-56410: xmlwf resolveSystemId could overflow while joining
base and system identifiers. Fixed by guarding both the length sum
and the allocation multiplication.
Upstream: https://github.com/libexpat/libexpat/commit/deeb97f7c88d17a16b0ea2521a13733abc283347
https://github.com/libexpat/libexpat/commit/cee20e91bf14dc7f6d2fc48f0d70d86b2dc3afea
- CVE-2026-56406: XML_GetBuffer was missing the overflow protection
already used by XML_Parse. Fixed by adding the XML_Index overflow
check, with the prerequisite XML_INDEX_MAX helper backported first.
Upstream: https://github.com/libexpat/libexpat/commit/252ff1a307b1490ce0f430632791e7e52d7e43fd
https://github.com/libexpat/libexpat/commit/99d8454fdf900a6d00c2a52748e6c0eeb507574d
- CVE-2026-56409: xmlwf output path construction could overflow while
joining output directory and file name components. Fixed by adding
upstream bounds checks before allocation.
Upstream: https://github.com/libexpat/libexpat/commit/61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e
- CVE-2026-56411: xmlwf notation list allocation could overflow while
sizing the notation table. Fixed by applying the upstream allocation
checks.
Upstream: https://github.com/libexpat/libexpat/commit/528a4e5017e1bd3b48b689fd0c131df940ae3ea5
- CVE-2026-56407: Entity textLen handling could exceed signed integer
limits. Fixed by capping entity textLen before storing it in the
signed field.
Upstream: https://github.com/libexpat/libexpat/commit/30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13
- CVE-2026-56132: Shared DTD scaffolding could store past the
scaffIndex allocation after parser-specific group sizes diverged.
Fixed by tracking scaffIndexSize separately, growing scaffIndex from
its actual allocation size, and backporting the regression test and
related follow-up cleanups.
Upstream: https://github.com/libexpat/libexpat/commit/3a4eaf47af8fd7abda38ea2c08308c91152061f3
https://github.com/libexpat/libexpat/commit/58400483d7c97be316d7a77739c0a6af5d55932e
https://github.com/libexpat/libexpat/commit/353919b3b9f2174073a557ac7d517a5f3cd0cbbf
https://github.com/libexpat/libexpat/commit/bca93b4ba9e15fd84425568d772b69baebf790e4
https://github.com/libexpat/libexpat/commit/08baa7ef9d168b99094249998fd78f8d190526e5
Deepak Rathore (10):
expat: fix CVE-2026-56403
expat: fix CVE-2026-56408
expat: fix CVE-2026-56404
expat: fix CVE-2026-56405
expat: fix CVE-2026-56410
expat: fix CVE-2026-56406
expat: fix CVE-2026-56409
expat: fix CVE-2026-56411
expat: fix CVE-2026-56407
expat: fix CVE-2026-56132
.../expat/expat/CVE-2026-56132_p1.patch | 90 +++++++++++++++++++
.../expat/expat/CVE-2026-56132_p2.patch | 63 +++++++++++++
.../expat/expat/CVE-2026-56132_p3.patch | 77 ++++++++++++++++
.../expat/expat/CVE-2026-56132_p4.patch | 63 +++++++++++++
.../expat/expat/CVE-2026-56132_p5.patch | 58 ++++++++++++
.../expat/expat/CVE-2026-56403_p1.patch | 83 +++++++++++++++++++
.../expat/expat/CVE-2026-56403_p2.patch | 40 +++++++++
.../expat/expat/CVE-2026-56404.patch | 47 ++++++++++
.../expat/expat/CVE-2026-56405.patch | 32 +++++++
.../expat/CVE-2026-56406-dependent.patch | 58 ++++++++++++
.../expat/expat/CVE-2026-56406.patch | 37 ++++++++
.../expat/expat/CVE-2026-56407.patch | 44 +++++++++
.../expat/expat/CVE-2026-56408.patch | 36 ++++++++
.../expat/expat/CVE-2026-56409.patch | 53 +++++++++++
.../expat/expat/CVE-2026-56410_p1.patch | 40 +++++++++
.../expat/expat/CVE-2026-56410_p2.patch | 41 +++++++++
.../expat/expat/CVE-2026-56411.patch | 47 ++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 17 ++++
18 files changed, 926 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56404.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56405.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56407.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56408.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56409.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56411.patch
--
2.35.6
next prev parent reply other threads:[~2026-07-20 12:19 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-10 13:08 [OE-core][wrynose][PATCH 01/10] expat: fix CVE-2026-56403 Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-17 15:23 ` Yoann Congal
2026-07-20 12:24 ` Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 12:16 ` Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) [this message]
2026-07-20 12:16 ` [OE-core][wrynose][PATCH v2 " Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 12:16 ` [OE-core][wrynose][PATCH v2 02/10] expat: fix CVE-2026-56408 Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 12:16 ` [OE-core][wrynose][PATCH v2 03/10] expat: fix CVE-2026-56404 Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 12:16 ` [OE-core][wrynose][PATCH v2 04/10] expat: fix CVE-2026-56405 Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 12:16 ` [OE-core][wrynose][PATCH v2 05/10] expat: fix CVE-2026-56410 Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 12:16 ` [OE-core][wrynose][PATCH v2 06/10] expat: fix CVE-2026-56406 Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 12:16 ` [OE-core][wrynose][PATCH v2 07/10] expat: fix CVE-2026-56409 Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 12:16 ` [OE-core][wrynose][PATCH v2 08/10] expat: fix CVE-2026-56411 Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 12:16 ` [OE-core][wrynose][PATCH v2 09/10] expat: fix CVE-2026-56407 Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 12:16 ` [OE-core][wrynose][PATCH v2 10/10] expat: fix CVE-2026-56132 Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260720121615.2520859-1-deeratho@cisco.com \
--to=deeratho@cisco.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox