.gitignore

@@ -1 +1 @@
-SOURCES/expat-2.5.0.tar.gz
+SOURCES/expat-2.4.8.tar.bz2

.mingw-expat.metadata

@@ -1 +1 @@
-03d9882ede56aa48919fbf50fe17614630257a82 SOURCES/expat-2.5.0.tar.gz
+5bc8aed3107a04ba2a35d45646eb079e6abbfe1d SOURCES/expat-2.4.8.tar.bz2

SOURCES/expat-2.4.8-Ensure-raw-tagnames-are-safe-exiting-internalEntityParser.patch

@@ -0,0 +1,122 @@
+commit bfecc1f11ab5f0cc2aa3dc5cb87d3236a87ce61d
+Author: Tomas Korbar <tkorbar@redhat.com>
+Date:   Fri Sep 30 10:52:04 2022 +0200
+
+    Fix CVE-2022-40674
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index e986156..1352a89 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5826,10 +5826,15 @@ internalEntityProcessor(XML_Parser parser, const char *s, const char *end,
+   {
+     parser->m_processor = contentProcessor;
+     /* see externalEntityContentProcessor vs contentProcessor */
+-    return doContent(parser, parser->m_parentParser ? 1 : 0, parser->m_encoding,
+-                     s, end, nextPtr,
+-                     (XML_Bool)! parser->m_parsingStatus.finalBuffer,
+-                     XML_ACCOUNT_DIRECT);
++    result = doContent(parser, parser->m_parentParser ? 1 : 0, parser->m_encoding,
++                      s, end, nextPtr,
++                      (XML_Bool)! parser->m_parsingStatus.finalBuffer,
++                      XML_ACCOUNT_DIRECT);
++    if (result == XML_ERROR_NONE) {
++      if (! storeRawNames(parser))
++        return XML_ERROR_NO_MEMORY;
++    }
++    return result;
+   }
+ }
+ 
+diff --git a/tests/runtests.c b/tests/runtests.c
+index ea371b4..193e103 100644
+--- a/tests/runtests.c
++++ b/tests/runtests.c
+@@ -5008,6 +5008,78 @@ START_TEST(test_resume_entity_with_syntax_error) {
+ }
+ END_TEST
+ 
++void
++suspending_comment_handler(void *userData, const XML_Char *UNUSED_P(data)) {
++  XML_Parser parser = (XML_Parser)userData;
++  XML_StopParser(parser, XML_TRUE);
++}
++
++START_TEST(test_suspend_resume_internal_entity_issue_629) {
++  const char *const text
++      = "<!DOCTYPE a [<!ENTITY e '<!--COMMENT-->a'>]><a>&e;<b>\n"
++        "<"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "/>"
++        "</b></a>";
++  const size_t firstChunkSizeBytes = 54;
++
++  XML_Parser parser = XML_ParserCreate(NULL);
++  XML_SetUserData(parser, parser);
++  XML_SetCommentHandler(parser, suspending_comment_handler);
++
++  if (XML_Parse(parser, text, (int)firstChunkSizeBytes, XML_FALSE)
++      != XML_STATUS_SUSPENDED)
++    xml_failure(parser);
++  if (XML_ResumeParser(parser) != XML_STATUS_OK)
++    xml_failure(parser);
++  if (XML_Parse(parser, text + firstChunkSizeBytes,
++                (int)(strlen(text) - firstChunkSizeBytes), XML_TRUE)
++      != XML_STATUS_OK)
++    xml_failure(parser);
++  XML_ParserFree(parser);
++}
++END_TEST
++
++
+ /* Test suspending and resuming in a parameter entity substitution */
+ static void XMLCALL
+ element_decl_suspender(void *userData, const XML_Char *name,
+@@ -12017,6 +12089,7 @@ make_suite(void) {
+   tcase_add_test(tc_basic, test_hash_collision);
+   tcase_add_test__ifdef_xml_dtd(tc_basic, test_suspend_resume_internal_entity);
+   tcase_add_test__ifdef_xml_dtd(tc_basic, test_resume_entity_with_syntax_error);
++  tcase_add_test__ifdef_xml_dtd(tc_basic, test_suspend_resume_internal_entity_issue_629);
+   tcase_add_test__ifdef_xml_dtd(tc_basic, test_suspend_resume_parameter_entity);
+   tcase_add_test(tc_basic, test_restart_on_error);
+   tcase_add_test(tc_basic, test_reject_lt_in_attribute_value);
+

SOURCES/expat-2.5.0-CVE-2024-28757.patch

@@ -1,172 +0,0 @@
-commit cd3b344e0dbd19a812d0b4f34f9d089ed7c5c411
-Author: Tomas Korbar <tkorbar@redhat.com>
-Date:   Tue Mar 19 15:12:18 2024 +0100
-
-    Fix CVE-2024-28757
-    
-    Upstream PRs #841 and #842
-
-diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
-index 2ae64e9..0896b16 100644
---- a/expat/lib/xmlparse.c
-+++ b/expat/lib/xmlparse.c
-@@ -6164,7 +6164,7 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc,
-           dtd->keepProcessing = dtd->standalone;
-           goto endEntityValue;
-         }
--        if (entity->open) {
-+        if (entity->open || (entity == parser->m_declEntity)) {
-           if (enc == parser->m_encoding)
-             parser->m_eventPtr = entityTextPtr;
-           result = XML_ERROR_RECURSIVE_ENTITY_REF;
-@@ -7680,6 +7680,8 @@ copyString(const XML_Char *s, const XML_Memory_Handling_Suite *memsuite) {
- 
- static float
- accountingGetCurrentAmplification(XML_Parser rootParser) {
-+  //                                          1.........1.........12 => 22
-+  const size_t lenOfShortestInclude = sizeof("<!ENTITY a SYSTEM 'b'>") - 1;
-   const XmlBigCount countBytesOutput
-       = rootParser->m_accounting.countBytesDirect
-         + rootParser->m_accounting.countBytesIndirect;
-@@ -7687,7 +7689,9 @@ accountingGetCurrentAmplification(XML_Parser rootParser) {
-       = rootParser->m_accounting.countBytesDirect
-             ? (countBytesOutput
-                / (float)(rootParser->m_accounting.countBytesDirect))
--            : 1.0f;
-+            : ((lenOfShortestInclude
-+                + rootParser->m_accounting.countBytesIndirect)
-+               / (float)lenOfShortestInclude);
-   assert(! rootParser->m_parentParser);
-   return amplificationFactor;
- }
-diff --git a/expat/tests/runtests.c b/expat/tests/runtests.c
-index 941f61d..93adc45 100644
---- a/expat/tests/runtests.c
-+++ b/expat/tests/runtests.c
-@@ -1788,6 +1788,48 @@ START_TEST(test_wfc_no_recursive_entity_refs) {
- }
- END_TEST
- 
-+START_TEST(test_recursive_external_parameter_entity_2) {
-+  struct TestCase {
-+    const char *doc;
-+    enum XML_Status expectedStatus;
-+  };
-+
-+  struct TestCase cases[] = {
-+      {"<!ENTITY % p1 '%p1;'>", XML_STATUS_ERROR},
-+      {"<!ENTITY % p1 '%p1;'>"
-+       "<!ENTITY % p1 'first declaration wins'>",
-+       XML_STATUS_ERROR},
-+      {"<!ENTITY % p1 'first declaration wins'>"
-+       "<!ENTITY % p1 '%p1;'>",
-+       XML_STATUS_OK},
-+      {"<!ENTITY % p1 '&#37;p1;'>", XML_STATUS_OK},
-+  };
-+
-+  for (size_t i = 0; i < sizeof(cases) / sizeof(cases[0]); i++) {
-+    const char *const doc = cases[i].doc;
-+    const enum XML_Status expectedStatus = cases[i].expectedStatus;
-+
-+    XML_Parser parser = XML_ParserCreate(NULL);
-+    assert_true(parser != NULL);
-+
-+    XML_Parser ext_parser = XML_ExternalEntityParserCreate(parser, NULL, NULL);
-+    assert_true(ext_parser != NULL);
-+
-+    const enum XML_Status actualStatus
-+        = _XML_Parse_SINGLE_BYTES(ext_parser, doc, (int)strlen(doc), XML_TRUE);
-+
-+    assert_true(actualStatus == expectedStatus);
-+    if (actualStatus != XML_STATUS_OK) {
-+      assert_true(XML_GetErrorCode(ext_parser)
-+                  == XML_ERROR_RECURSIVE_ENTITY_REF);
-+    }
-+
-+    XML_ParserFree(ext_parser);
-+    XML_ParserFree(parser);
-+  }
-+}
-+END_TEST
-+
- /* Test incomplete external entities are faulted */
- START_TEST(test_ext_entity_invalid_parse) {
-   const char *text = "<!DOCTYPE doc [\n"
-@@ -12719,6 +12761,60 @@ START_TEST(test_helper_unsigned_char_to_printable) {
-     fail("unsignedCharToPrintable result mistaken");
- }
- END_TEST
-+
-+START_TEST(test_amplification_isolated_external_parser) {
-+  // NOTE: Length 44 is precisely twice the length of "<!ENTITY a SYSTEM 'b'>"
-+  // (22) that is used in function accountingGetCurrentAmplification in
-+  // xmlparse.c.
-+  //                  1.........1.........1.........1.........1..4 => 44
-+  const char doc[] = "<!ENTITY % p1 '123456789_123456789_1234567'>";
-+  const int docLen = (int)sizeof(doc) - 1;
-+  const float maximumToleratedAmplification = 2.0f;
-+
-+  struct TestCase {
-+    int offsetOfThreshold;
-+    enum XML_Status expectedStatus;
-+  };
-+
-+  struct TestCase cases[] = {
-+      {-2, XML_STATUS_ERROR}, {-1, XML_STATUS_ERROR}, {0, XML_STATUS_ERROR},
-+      {+1, XML_STATUS_OK},    {+2, XML_STATUS_OK},
-+  };
-+
-+  for (size_t i = 0; i < sizeof(cases) / sizeof(cases[0]); i++) {
-+    const int offsetOfThreshold = cases[i].offsetOfThreshold;
-+    const enum XML_Status expectedStatus = cases[i].expectedStatus;
-+    const unsigned long long activationThresholdBytes
-+        = docLen + offsetOfThreshold;
-+
-+    XML_Parser parser = XML_ParserCreate(NULL);
-+    assert_true(parser != NULL);
-+
-+    assert_true(XML_SetBillionLaughsAttackProtectionMaximumAmplification(
-+                    parser, maximumToleratedAmplification)
-+                == XML_TRUE);
-+    assert_true(XML_SetBillionLaughsAttackProtectionActivationThreshold(
-+                    parser, activationThresholdBytes)
-+                == XML_TRUE);
-+
-+    XML_Parser ext_parser = XML_ExternalEntityParserCreate(parser, NULL, NULL);
-+    assert_true(ext_parser != NULL);
-+
-+    const enum XML_Status actualStatus
-+        = _XML_Parse_SINGLE_BYTES(ext_parser, doc, docLen, XML_TRUE);
-+
-+    assert_true(actualStatus == expectedStatus);
-+    if (actualStatus != XML_STATUS_OK) {
-+      assert_true(XML_GetErrorCode(ext_parser)
-+                  == XML_ERROR_AMPLIFICATION_LIMIT_BREACH);
-+    }
-+
-+    XML_ParserFree(ext_parser);
-+    XML_ParserFree(parser);
-+  }
-+}
-+END_TEST
-+
- #endif // defined(XML_DTD)
- 
- static Suite *
-@@ -12871,6 +12967,8 @@ make_suite(void) {
-   tcase_add_test__ifdef_xml_dtd(tc_basic, test_skipped_parameter_entity);
-   tcase_add_test__ifdef_xml_dtd(tc_basic,
-                                 test_recursive_external_parameter_entity);
-+  tcase_add_test__ifdef_xml_dtd(tc_basic,
-+                                test_recursive_external_parameter_entity_2);
-   tcase_add_test(tc_basic, test_undefined_ext_entity_in_external_dtd);
-   tcase_add_test(tc_basic, test_suspend_xdecl);
-   tcase_add_test(tc_basic, test_abort_epilog);
-@@ -13120,6 +13218,7 @@ make_suite(void) {
-   tcase_add_test(tc_accounting, test_accounting_precision);
-   tcase_add_test(tc_accounting, test_billion_laughs_attack_protection_api);
-   tcase_add_test(tc_accounting, test_helper_unsigned_char_to_printable);
-+  tcase_add_test(tc_accounting, test_amplification_isolated_external_parser);
- #endif
- 
-   return s;

SOURCES/expat-2.5.0-CVE-2024-45490.patch

@@ -1,129 +0,0 @@
-commit 05d87eb116ddde35bfa4e4c1d2ec7bcbda38c09b
-Author: Tomas Korbar <tkorbar@redhat.com>
-Date:   Wed Sep 11 13:48:58 2024 +0200
-
-    Fix CVE-2024-45490
-    
-    https://github.com/libexpat/libexpat/pull/890
-
-diff --git a/expat/doc/reference.html b/expat/doc/reference.html
-index a10f3cb..d618bd8 100644
---- a/expat/doc/reference.html
-+++ b/expat/doc/reference.html
-@@ -1098,7 +1098,9 @@ containing part (or perhaps all) of the document. The number of bytes of s
- that are part of the document is indicated by <code>len</code>. This means
- that <code>s</code> doesn't have to be null terminated. It also means that
- if <code>len</code> is larger than the number of bytes in the block of
--memory that <code>s</code> points at, then a memory fault is likely. The
-+memory that <code>s</code> points at, then a memory fault is likely.
-+Negative values for <code>len</code> are rejected since Expat 2.2.1.
-+The
- <code>isFinal</code> parameter informs the parser that this is the last
- piece of the document. Frequently, the last piece is empty (i.e.
- <code>len</code> is zero.)
-@@ -1114,11 +1116,17 @@ XML_ParseBuffer(XML_Parser p,
-                 int isFinal);
- </pre>
- <div class="fcndef">
-+<p>
- This is just like <code><a href= "#XML_Parse" >XML_Parse</a></code>,
- except in this case Expat provides the buffer.  By obtaining the
- buffer from Expat with the <code><a href= "#XML_GetBuffer"
- >XML_GetBuffer</a></code> function, the application can avoid double
- copying of the input.
-+</p>
-+
-+<p>
-+Negative values for <code>len</code> are rejected since Expat 2.6.3.
-+</p>
- </div>
- 
- <h4 id="XML_GetBuffer">XML_GetBuffer</h4>
-diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
-index 0896b16..f54e258 100644
---- a/expat/lib/xmlparse.c
-+++ b/expat/lib/xmlparse.c
-@@ -1998,6 +1998,12 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) {
- 
-   if (parser == NULL)
-     return XML_STATUS_ERROR;
-+
-+  if (len < 0) {
-+    parser->m_errorCode = XML_ERROR_INVALID_ARGUMENT;
-+    return XML_STATUS_ERROR;
-+  }
-+
-   switch (parser->m_parsingStatus.parsing) {
-   case XML_SUSPENDED:
-     parser->m_errorCode = XML_ERROR_SUSPENDED;
-diff --git a/expat/tests/runtests.c b/expat/tests/runtests.c
-index 93adc45..ed88f9f 100644
---- a/expat/tests/runtests.c
-+++ b/expat/tests/runtests.c
-@@ -3856,6 +3856,57 @@ START_TEST(test_empty_parse) {
- }
- END_TEST
- 
-+/* Test XML_Parse for len < 0 */
-+START_TEST(test_negative_len_parse) {
-+  const char *const doc = "<root/>";
-+  for (int isFinal = 0; isFinal < 2; isFinal++) {
-+    XML_Parser parser = XML_ParserCreate(NULL);
-+
-+    if (XML_GetErrorCode(parser) != XML_ERROR_NONE)
-+      fail("There was not supposed to be any initial parse error.");
-+
-+    const enum XML_Status status = XML_Parse(parser, doc, -1, isFinal);
-+
-+    if (status != XML_STATUS_ERROR)
-+      fail("Negative len was expected to fail the parse but did not.");
-+
-+    if (XML_GetErrorCode(parser) != XML_ERROR_INVALID_ARGUMENT)
-+      fail("Parse error does not match XML_ERROR_INVALID_ARGUMENT.");
-+
-+    XML_ParserFree(parser);
-+  }
-+}
-+END_TEST
-+
-+/* Test XML_ParseBuffer for len < 0 */
-+START_TEST(test_negative_len_parse_buffer) {
-+  const char *const doc = "<root/>";
-+  for (int isFinal = 0; isFinal < 2; isFinal++) {
-+    XML_Parser parser = XML_ParserCreate(NULL);
-+
-+    if (XML_GetErrorCode(parser) != XML_ERROR_NONE)
-+      fail("There was not supposed to be any initial parse error.");
-+
-+    void *const buffer = XML_GetBuffer(parser, (int)strlen(doc));
-+
-+    if (buffer == NULL)
-+      fail("XML_GetBuffer failed.");
-+
-+    memcpy(buffer, doc, strlen(doc));
-+
-+    const enum XML_Status status = XML_ParseBuffer(parser, -1, isFinal);
-+
-+    if (status != XML_STATUS_ERROR)
-+      fail("Negative len was expected to fail the parse but did not.");
-+
-+    if (XML_GetErrorCode(parser) != XML_ERROR_INVALID_ARGUMENT)
-+      fail("Parse error does not match XML_ERROR_INVALID_ARGUMENT.");
-+
-+    XML_ParserFree(parser);
-+  }
-+}
-+END_TEST
-+
- /* Test odd corners of the XML_GetBuffer interface */
- static enum XML_Status
- get_feature(enum XML_FeatureEnum feature_id, long *presult) {
-@@ -12937,6 +12988,8 @@ make_suite(void) {
-   tcase_add_test__ifdef_xml_dtd(tc_basic, test_user_parameters);
-   tcase_add_test__ifdef_xml_dtd(tc_basic, test_ext_entity_ref_parameter);
-   tcase_add_test(tc_basic, test_empty_parse);
-+  tcase_add_test(tc_basic, test_negative_len_parse);
-+  tcase_add_test(tc_basic, test_negative_len_parse_buffer);
-   tcase_add_test(tc_basic, test_get_buffer_1);
-   tcase_add_test(tc_basic, test_get_buffer_2);
- #if defined(XML_CONTEXT_BYTES)

SOURCES/expat-2.5.0-CVE-2024-45491.patch

@@ -1,31 +0,0 @@
-From 8e439a9947e9dc80a395c0c7456545d8d9d9e421 Mon Sep 17 00:00:00 2001
-From: Sebastian Pipping <sebastian@pipping.org>
-Date: Mon, 19 Aug 2024 22:34:13 +0200
-Subject: [PATCH] lib: Detect integer overflow in dtdCopy
-
-Reported by TaiYou
----
- expat/lib/xmlparse.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
-index 91682c188..e2327bdcf 100644
---- a/expat/lib/xmlparse.c
-+++ b/expat/lib/xmlparse.c
-@@ -7016,6 +7016,16 @@ dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd,
-     if (! newE)
-       return 0;
-     if (oldE->nDefaultAtts) {
-+      /* Detect and prevent integer overflow.
-+       * The preprocessor guard addresses the "always false" warning
-+       * from -Wtype-limits on platforms where
-+       * sizeof(int) < sizeof(size_t), e.g. on x86_64. */
-+#if UINT_MAX >= SIZE_MAX
-+      if ((size_t)oldE->nDefaultAtts
-+          > ((size_t)(-1) / sizeof(DEFAULT_ATTRIBUTE))) {
-+        return 0;
-+      }
-+#endif
-       newE->defaultAtts
-           = ms->malloc_fcn(oldE->nDefaultAtts * sizeof(DEFAULT_ATTRIBUTE));
-       if (! newE->defaultAtts) {

SOURCES/expat-2.5.0-CVE-2024-45492.patch

@@ -1,30 +0,0 @@
-From 9bf0f2c16ee86f644dd1432507edff94c08dc232 Mon Sep 17 00:00:00 2001
-From: Sebastian Pipping <sebastian@pipping.org>
-Date: Mon, 19 Aug 2024 22:37:16 +0200
-Subject: [PATCH] lib: Detect integer overflow in function nextScaffoldPart
-
-Reported by TaiYou
----
- expat/lib/xmlparse.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
-index 91682c188..f737575ea 100644
---- a/expat/lib/xmlparse.c
-+++ b/expat/lib/xmlparse.c
-@@ -7558,6 +7558,15 @@ nextScaffoldPart(XML_Parser parser) {
-   int next;
- 
-   if (! dtd->scaffIndex) {
-+    /* Detect and prevent integer overflow.
-+     * The preprocessor guard addresses the "always false" warning
-+     * from -Wtype-limits on platforms where
-+     * sizeof(unsigned int) < sizeof(size_t), e.g. on x86_64. */
-+#if UINT_MAX >= SIZE_MAX
-+    if (parser->m_groupSize > ((size_t)(-1) / sizeof(int))) {
-+      return -1;
-+    }
-+#endif
-     dtd->scaffIndex = (int *)MALLOC(parser, parser->m_groupSize * sizeof(int));
-     if (! dtd->scaffIndex)
-       return -1;

SOURCES/expat-2.5.0-CVE-2024-50602.patch

@@ -1,108 +0,0 @@
-commit 38905b99bb78a6a691ed8358f30030116783656c
-Author: Tomas Korbar <tkorbar@redhat.com>
-Date:   Thu Nov 7 15:00:46 2024 +0100
-
-    Fix CVE-2024-50602
-    
-    See https://github.com/libexpat/libexpat/pull/915
-
-diff --git a/expat/lib/expat.h b/expat/lib/expat.h
-index 842dd70..69b0ba1 100644
---- a/expat/lib/expat.h
-+++ b/expat/lib/expat.h
-@@ -128,7 +128,9 @@ enum XML_Error {
-   /* Added in 2.3.0. */
-   XML_ERROR_NO_BUFFER,
-   /* Added in 2.4.0. */
--  XML_ERROR_AMPLIFICATION_LIMIT_BREACH
-+  XML_ERROR_AMPLIFICATION_LIMIT_BREACH,
-+  /* Added in 2.6.4. */
-+  XML_ERROR_NOT_STARTED,
- };
- 
- enum XML_Content_Type {
-diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
-index e0c2873..8b2af91 100644
---- a/expat/lib/xmlparse.c
-+++ b/expat/lib/xmlparse.c
-@@ -2193,6 +2193,9 @@ XML_StopParser(XML_Parser parser, XML_Bool resumable) {
-   if (parser == NULL)
-     return XML_STATUS_ERROR;
-   switch (parser->m_parsingStatus.parsing) {
-+  case XML_INITIALIZED:
-+    parser->m_errorCode = XML_ERROR_NOT_STARTED;
-+    return XML_STATUS_ERROR;
-   case XML_SUSPENDED:
-     if (resumable) {
-       parser->m_errorCode = XML_ERROR_SUSPENDED;
-@@ -2203,7 +2206,7 @@ XML_StopParser(XML_Parser parser, XML_Bool resumable) {
-   case XML_FINISHED:
-     parser->m_errorCode = XML_ERROR_FINISHED;
-     return XML_STATUS_ERROR;
--  default:
-+  case XML_PARSING:
-     if (resumable) {
- #ifdef XML_DTD
-       if (parser->m_isParamEntity) {
-@@ -2214,6 +2217,9 @@ XML_StopParser(XML_Parser parser, XML_Bool resumable) {
-       parser->m_parsingStatus.parsing = XML_SUSPENDED;
-     } else
-       parser->m_parsingStatus.parsing = XML_FINISHED;
-+    break;
-+  default:
-+    assert(0);
-   }
-   return XML_STATUS_OK;
- }
-@@ -2478,6 +2484,9 @@ XML_ErrorString(enum XML_Error code) {
-   case XML_ERROR_AMPLIFICATION_LIMIT_BREACH:
-     return XML_L(
-         "limit on input amplification factor (from DTD and entities) breached");
-+  /* Added in 2.6.4. */
-+  case XML_ERROR_NOT_STARTED:
-+    return XML_L("parser not started");
-   }
-   return NULL;
- }
-diff --git a/expat/tests/runtests.c b/expat/tests/runtests.c
-index ed88f9f..5769aa0 100644
---- a/expat/tests/runtests.c
-+++ b/expat/tests/runtests.c
-@@ -8711,6 +8711,28 @@ START_TEST(test_misc_tag_mismatch_reset_leak) {
- }
- END_TEST
- 
-+START_TEST(test_misc_resumeparser_not_crashing) {
-+  XML_Parser parser = XML_ParserCreate(NULL);
-+  XML_GetBuffer(parser, 1);
-+  XML_StopParser(parser, /*resumable=*/XML_TRUE);
-+  XML_ResumeParser(parser); // could crash here, previously
-+  XML_ParserFree(parser);
-+}
-+END_TEST
-+
-+START_TEST(test_misc_stopparser_rejects_unstarted_parser) {
-+  const XML_Bool cases[] = {XML_TRUE, XML_FALSE};
-+  for (size_t i = 0; i < sizeof(cases) / sizeof(cases[0]); i++) {
-+    const XML_Bool resumable = cases[i];
-+    XML_Parser parser = XML_ParserCreate(NULL);
-+    assert_true(XML_GetErrorCode(parser) == XML_ERROR_NONE);
-+    assert_true(XML_StopParser(parser, resumable) == XML_STATUS_ERROR);
-+    assert_true(XML_GetErrorCode(parser) == XML_ERROR_NOT_STARTED);
-+    XML_ParserFree(parser);
-+  }
-+}
-+END_TEST
-+
- static void
- alloc_setup(void) {
-   XML_Memory_Handling_Suite memsuite = {duff_allocator, duff_reallocator, free};
-@@ -13176,6 +13198,8 @@ make_suite(void) {
-   tcase_add_test__ifdef_xml_dtd(
-       tc_misc, test_misc_deny_internal_entity_closing_doctype_issue_317);
-   tcase_add_test(tc_misc, test_misc_tag_mismatch_reset_leak);
-+  tcase_add_test(tc_misc, test_misc_resumeparser_not_crashing);
-+  tcase_add_test(tc_misc, test_misc_stopparser_rejects_unstarted_parser);
- 
-   suite_add_tcase(s, tc_alloc);
-   tcase_add_checked_fixture(tc_alloc, alloc_setup, alloc_teardown);

SPECS/mingw-expat.spec

@@ -1,19 +1,19 @@
 %{?mingw_package_header}
-%global unversion 2_5_0
 
 Name:           mingw-expat
-Version:        %(echo %{unversion} | sed 's/_/./g')
+Version:        2.4.8
 Release:        2%{?dist}
 Summary:        MinGW Windows port of expat XML parser library
 
 License:        MIT
-URL:            https://libexpat.github.io/
-Source0:        https://github.com/libexpat/libexpat/archive/R_%{unversion}.tar.gz#/expat-%{version}.tar.gz
+URL:            http://www.libexpat.org/
+Source0:        http://downloads.sourceforge.net/expat/expat-%{version}.tar.bz2
+
+Patch0001:      expat-2.4.8-Ensure-raw-tagnames-are-safe-exiting-internalEntityParser.patch
 
 BuildArch:      noarch
 ExclusiveArch: %{ix86} x86_64
 
-BuildRequires: autoconf, automake, libtool, xmlto, gcc-c++, docbook2X
 BuildRequires: make
 BuildRequires:  mingw32-filesystem >= 95
 BuildRequires:  mingw32-gcc
@@ -23,14 +23,6 @@ BuildRequires:  mingw64-filesystem >= 95
 BuildRequires:  mingw64-gcc
 BuildRequires:  mingw64-binutils
 
-Patch0: expat-2.5.0-CVE-2023-52425.patch
-Patch1: expat-2.5.0-CVE-2024-28757.patch
-Patch2: expat-2.5.0-CVE-2024-45490.patch
-Patch3: expat-2.5.0-CVE-2024-45491.patch
-Patch4: expat-2.5.0-CVE-2024-45492.patch
-Patch5: expat-2.5.0-CVE-2024-50602.patch
-Patch6: expat-2.5.0-CVE-2024-8176.patch
-Patch7: expat-2.5.0-CVE-2025-59375.patch
 
 %description
 This is expat, the C library for parsing XML, written by James Clark. Expat
@@ -83,20 +75,9 @@ Static version of the MinGW Windows expat XML parser library.
 
 
 %prep
-%setup -q -n libexpat-R_%{unversion}/expat
-pushd ..
-%patch -P0 -p1 -b .CVE-2023-52425
-%patch -P1 -p1 -b .CVE-2024-28757
-%patch -P2 -p1 -b .CVE-2024-45490
-%patch -P3 -p1 -b .CVE-2024-45491
-%patch -P4 -p1 -b .CVE-2024-45492
-%patch -P5 -p1 -b .CVE-2024-50602
-%patch -P6 -p1 -b .CVE-2024-8176
-%patch -P7 -p1 -b .CVE-2025-59375
-popd
+%setup -q -n expat-%{version}
+%patch0001 -p1 -b .CVE-2022-40674
 
-sed -i 's/install-data-hook/do-nothing-please/' lib/Makefile.am
-autoreconf -fi
 
 %build
 %mingw_configure
@@ -110,10 +91,10 @@ autoreconf -fi
 find $RPM_BUILD_ROOT -name "*.la" -delete
 
 # Remove documentation which duplicates that found in the native package.
-rm -r $RPM_BUILD_ROOT%{mingw32_docdir}
-rm -r $RPM_BUILD_ROOT%{mingw32_mandir}/man1
-rm -r $RPM_BUILD_ROOT%{mingw64_docdir}
-rm -r $RPM_BUILD_ROOT%{mingw64_mandir}/man1
+rm -rf $RPM_BUILD_ROOT%{mingw32_docdir}
+rm -rf $RPM_BUILD_ROOT%{mingw32_mandir}/man1
+rm -rf $RPM_BUILD_ROOT%{mingw64_docdir}
+rm -rf $RPM_BUILD_ROOT%{mingw64_mandir}/man1
 
 # Win32
 %files -n mingw32-expat
@@ -122,11 +103,10 @@ rm -r $RPM_BUILD_ROOT%{mingw64_mandir}/man1
 %{mingw32_bindir}/xmlwf.exe
 %{mingw32_libdir}/libexpat.dll.a
 %{mingw32_libdir}/pkgconfig/expat.pc
+%{mingw32_libdir}/cmake/expat-%{version}/
 %{mingw32_includedir}/expat.h
 %{mingw32_includedir}/expat_config.h
 %{mingw32_includedir}/expat_external.h
-# Add CMake config files
-%{mingw32_libdir}/cmake/expat-%{version}/*
 
 %files -n mingw32-expat-static
 %{mingw32_libdir}/libexpat.a
@@ -138,27 +118,28 @@ rm -r $RPM_BUILD_ROOT%{mingw64_mandir}/man1
 %{mingw64_bindir}/xmlwf.exe
 %{mingw64_libdir}/libexpat.dll.a
 %{mingw64_libdir}/pkgconfig/expat.pc
+%{mingw64_libdir}/cmake/expat-%{version}/
 %{mingw64_includedir}/expat.h
 %{mingw64_includedir}/expat_config.h
 %{mingw64_includedir}/expat_external.h
-# Add CMake config files
-%{mingw64_libdir}/cmake/expat-%{version}/*
 
 %files -n mingw64-expat-static
 %{mingw64_libdir}/libexpat.a
 
 
 %changelog
-* Wed Nov 26 2025 Lili Zhu <lizhu@redhat.com> - 2.5.0-2
-- Add xmlwf.exe back to mingw-expat.
+* Wed Jan 04 2023 Uri Lublin <uril@redhat.com> - 2.4.8-2
+- Fix CVE-2022-40674
+  Resolves: rhbz#2130833
 
-* Thu Nov 20 2025 Lili Zhu <lizhu@redhat.com> - 2.5.0-1
-- Rebase to version 2.5.0
-- Fix the following CVEs
-  CVE-2023-52425 CVE-2024-28757 CVE-2024-45490
-  CVE-2024-45491 CVE-2024-45492 CVE-2024-50602
-  CVE-2024-8176 CVE-2025-59375
-- Resolves: RHEL-114628
+* Mon May 02 2022 Uri Lublin <uril@redhat.com> - 2.4.8-1
+- Update to 2.4.8 and pick up CVEs fixes
+- Resolves: rhbz#2050504 CVE-2022-23990
+- Resolves: rhbz#2057023 CVE-2022-25236
+- Resolves: rhbz#2057037 CVE-2022-25235
+- Resolves: rhbz#2057094 CVE-2022-25313
+- Resolves: rhbz#2057099 CVE-2022-25314
+- Resolves: rhbz#2057127 CVE-2022-25315
 
 * Wed Jun 10 2020 Uri Lublin <uril@redhat.com> - 2.2.4-5
 - Rebuild