diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py index 302bd3676a8144..144db91a0f0317 100644 --- a/Lib/http/cookiejar.py +++ b/Lib/http/cookiejar.py @@ -2056,7 +2056,8 @@ def _really_load(self, f, filename, ignore_discard, ignore_expires): assert domain_specified == initial_dot discard = False - if expires == "": + # curl and Wget set expires to 0 for session cookies. + if expires == "0" or expires == "": expires = None discard = True @@ -2108,7 +2109,9 @@ def save(self, filename=None, ignore_discard=False, ignore_expires=False): if cookie.expires is not None: expires = str(cookie.expires) else: - expires = "" + # curl and Wget use 0 for session cookies, and ignore + # the line if this field is empty. + expires = "0" if cookie.value is None: # cookies.txt regards 'Set-Cookie: foo' as a cookie # with no name, whereas http.cookiejar regards it as a diff --git a/Lib/socket.py b/Lib/socket.py index 2a4f875f76b069..21a852155abb3b 100644 --- a/Lib/socket.py +++ b/Lib/socket.py @@ -327,8 +327,18 @@ def makefile(self, mode="r", buffering=None, *, rawmode += "w" raw = SocketIO(self, rawmode) self._io_refs += 1 + line_buffering = False if buffering is None: buffering = -1 + if buffering == 1: + if binary: + import warnings + warnings.warn("line buffering (buffering=1) isn't supported " + "in binary mode, the default buffer size will " + "be used", RuntimeWarning, 2) + else: + line_buffering = True + buffering = -1 if buffering < 0: buffering = io.DEFAULT_BUFFER_SIZE if buffering == 0: @@ -345,7 +355,8 @@ def makefile(self, mode="r", buffering=None, *, if binary: return buffer encoding = io.text_encoding(encoding) - text = io.TextIOWrapper(buffer, encoding, errors, newline) + text = io.TextIOWrapper( + buffer, encoding, errors, newline, line_buffering) text.mode = mode return text diff --git a/Lib/test/test_http_cookiejar.py b/Lib/test/test_http_cookiejar.py index 7f39b5c772bd10..218181f1185365 100644 --- a/Lib/test/test_http_cookiejar.py +++ b/Lib/test/test_http_cookiejar.py @@ -16,7 +16,7 @@ CookieJar, DefaultCookiePolicy, LWPCookieJar, MozillaCookieJar, LoadError, lwp_cookie_str, DEFAULT_HTTP_PORT, escape_path, reach, is_HDN, domain_match, user_domain_match, request_path, - request_port, request_host) + request_port, request_host, NETSCAPE_HEADER_TEXT) mswindows = (sys.platform == "win32") @@ -2048,6 +2048,63 @@ def test_session_cookies(self): # we didn't have session cookies in the first place self.assertNotEqual(counter["session_before"], 0) + def test_save_session_cookies(self): + # Session cookies are saved with 0 in the expiration time field, + # as curl and Wget do (gh-61366). + filename = os_helper.TESTFN + self.addCleanup(os_helper.unlink, filename) + expires = int(time.time() + 3600) + c = MozillaCookieJar() + c.set_cookie(Cookie(0, "perm", "bar", None, False, + "www.foo.com", True, False, "/", False, False, + expires, False, None, None, {})) + c.set_cookie(Cookie(0, "session", "bar", None, False, + "www.foo.com", True, False, "/", False, False, + None, True, None, None, {})) + c.save(filename, ignore_discard=True) + + saved = {} + with open(filename) as f: + for line in f: + if line.strip() and not line.startswith("#"): + fields = line.split("\t") + saved[fields[5]] = fields[4] + self.assertEqual(saved, {"perm": str(expires), "session": "0"}) + + # The saved file can be read back. + c = MozillaCookieJar() + c.revert(filename, ignore_discard=True) + self.assertEqual(sorted(cookie.name for cookie in c), + ["perm", "session"]) + + def test_load_session_cookies(self): + # curl and Wget write 0 in the expires field for session cookies, + # while we write an empty field. Both should be read (gh-61366). + filename = os_helper.TESTFN + self.addCleanup(os_helper.unlink, filename) + expires = int(time.time() + 3600) + with open(filename, "w") as f: + f.write(NETSCAPE_HEADER_TEXT) + f.write("www.foo.com\tFALSE\t/\tFALSE\t%u\tperm\tbar\n" % expires) + f.write("www.foo.com\tFALSE\t/\tFALSE\t0\tcurl_session\tbar\n") + f.write("www.foo.com\tFALSE\t/\tFALSE\t\tour_session\tbar\n") + + c = MozillaCookieJar() + c.revert(filename) + self.assertEqual([cookie.name for cookie in c], ["perm"]) + + c = MozillaCookieJar() + c.revert(filename, ignore_discard=True) + self.assertEqual(sorted(cookie.name for cookie in c), + ["curl_session", "our_session", "perm"]) + for cookie in c: + if cookie.name == "perm": + self.assertEqual(cookie.expires, expires) + self.assertFalse(cookie.discard) + else: + self.assertIsNone(cookie.expires) + self.assertTrue(cookie.discard) + if __name__ == "__main__": unittest.main() diff --git a/Lib/test/test_socket.py b/Lib/test/test_socket.py index 7bb50f7b8aa47e..e4b3d848923f8c 100644 --- a/Lib/test/test_socket.py +++ b/Lib/test/test_socket.py @@ -1969,6 +1969,25 @@ def test_makefile_mode(self): with sock.makefile(mode, encoding=encoding) as fp: self.assertEqual(fp.mode, mode) + def test_makefile_line_buffering(self): + with socket.socket() as sock: + for mode in 'r', 'w': + with self.subTest(mode=mode): + with sock.makefile(mode, buffering=1, + encoding="utf-8") as fp: + self.assertTrue(fp.line_buffering) + + def test_makefile_line_buffering_binary(self): + # Line buffering is not supported in binary mode, as in open(). + with socket.socket() as sock: + for mode in 'rb', 'wb': + with self.subTest(mode=mode): + with self.assertWarnsRegex( + RuntimeWarning, + "line buffering .* isn't supported in binary " + "mode"): + sock.makefile(mode, buffering=1).close() + def test_makefile_invalid_mode(self): for mode in 'rt', 'x', '+', 'a': with self.subTest(mode=mode): @@ -5761,10 +5780,20 @@ def testReadline(self): # Performing file readline test line = self.read_file.readline() self.assertEqual(line, self.read_msg) + # Readline mode + if self.bufsize == 1 and self.read_mode == "r": + self.assertTrue(self.read_file.line_buffering) def _testReadline(self): self.write_file.write(self.write_msg) - self.write_file.flush() + # Readline mode: no need to flush + if self.bufsize == 1 and self.write_mode == "w": + self.assertTrue(self.write_file.line_buffering) + else: + self.write_file.flush() + # Prevent garbage collection from flushing + # until the server has finished + self.assertTrue(self.serv_finished.wait(5.0)) def testCloseAfterMakefile(self): # The file returned by makefile should keep the socket open. @@ -5922,11 +5951,6 @@ def _testWriteNonBlocking(self): self.serv_skipped = "failed to saturate the socket buffer" -class LineBufferedFileObjectClassTestCase(FileObjectClassTestCase): - - bufsize = 1 # Default-buffered for reading; line-buffered for writing - - class SmallBufferedFileObjectClassTestCase(FileObjectClassTestCase): bufsize = 2 # Exercise the buffering code @@ -5962,6 +5986,16 @@ class UnicodeReadWriteFileObjectClassTestCase(FileObjectClassTestCase): newline = '' +class UnicodeLineBufferedFileObjectClassTestCase(FileObjectClassTestCase): + + bufsize = 1 # Default-buffered for reading; line-buffered for writing + read_mode = 'r' + read_msg = MSG.decode('utf-8') + write_mode = 'w' + write_msg = MSG.decode('utf-8') + newline = '' + + class NetworkConnectionTest(object): """Prove network connection.""" diff --git a/Misc/NEWS.d/next/Library/2019-02-08-17-33-49.gh-issue-61366.k6W5Sp.rst b/Misc/NEWS.d/next/Library/2019-02-08-17-33-49.gh-issue-61366.k6W5Sp.rst new file mode 100644 index 00000000000000..2a286a6b62a8f1 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2019-02-08-17-33-49.gh-issue-61366.k6W5Sp.rst @@ -0,0 +1,3 @@ +:class:`http.cookiejar.MozillaCookieJar` now reads session cookies written +by curl and Wget, which use ``0`` in the expiration time field. +Contributed by Jérémie Detrey. diff --git a/Misc/NEWS.d/next/Library/2021-09-09-10-15-54.gh-issue-75245.tLeTkn.rst b/Misc/NEWS.d/next/Library/2021-09-09-10-15-54.gh-issue-75245.tLeTkn.rst new file mode 100644 index 00000000000000..e690f4e2c14e3d --- /dev/null +++ b/Misc/NEWS.d/next/Library/2021-09-09-10-15-54.gh-issue-75245.tLeTkn.rst @@ -0,0 +1,5 @@ +:meth:`socket.socket.makefile` now supports line buffering (``buffering=1``) +in text mode, as :func:`open` does and as it worked in Python 2. Previously +it silently used block buffering. In binary mode it now emits +a :exc:`RuntimeWarning` and uses the default buffer size, also as :func:`open` +does. diff --git a/Misc/NEWS.d/next/Library/2026-08-12-09-30-00.gh-issue-61366.Wr7cKm.rst b/Misc/NEWS.d/next/Library/2026-08-12-09-30-00.gh-issue-61366.Wr7cKm.rst new file mode 100644 index 00000000000000..662d55f05abda6 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-08-12-09-30-00.gh-issue-61366.Wr7cKm.rst @@ -0,0 +1,3 @@ +:meth:`!http.cookiejar.MozillaCookieJar.save` now writes ``0`` in the +expiration time field for session cookies, as curl and Wget do. Previously +this field was left empty, and such lines were ignored by curl and Wget. diff --git a/Misc/NEWS.d/next/Security/2026-08-11-15-24-21.gh-issue-155558.yDsXZC.rst b/Misc/NEWS.d/next/Security/2026-08-11-15-24-21.gh-issue-155558.yDsXZC.rst new file mode 100644 index 00000000000000..439366c8633e82 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2026-08-11-15-24-21.gh-issue-155558.yDsXZC.rst @@ -0,0 +1,2 @@ +Update bundled `libexpat `_ to version 2.8.3 +for the fix to :cve:`2026-72522`. diff --git a/Misc/sbom.spdx.json b/Misc/sbom.spdx.json index fbc7ca631d70e2..3e4feba10c8559 100644 --- a/Misc/sbom.spdx.json +++ b/Misc/sbom.spdx.json @@ -20,11 +20,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "b0235fa3cf845a7d68e8e66dd344d5e32e8951b5" + "checksumValue": "27529094aa9998963bbacdab4dd77f23691adc93" }, { "algorithm": "SHA256", - "checksumValue": "42f8b392c70366743eacbc60ce021389ccaa333598dd49eef6ee5c93698ca205" + "checksumValue": "5ce49460794894b78f97060f634c129d13f2e9cc9b8dacd829f4be2dbc6e0649" } ], "fileName": "Modules/expat/ascii.h" @@ -34,11 +34,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "cbb53d16ca1f35ee9c9e296116efd222ae611ed9" + "checksumValue": "f0c9b25759ccf57fd65eb4356c2762f25c0e9a6f" }, { "algorithm": "SHA256", - "checksumValue": "1cc0ae749019fc0e488cd1cf245f6beaa6d4f7c55a1fc797e5aa40a408bc266b" + "checksumValue": "5792cb56f285c8876b988d875a70d49019bc7e6d5ebcd0f8224b24e695301832" } ], "fileName": "Modules/expat/asciitab.h" @@ -48,11 +48,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "00c5e72b384f5c305be613729184ad37bb491238" + "checksumValue": "7baecf6e04769cfb0c5ce2a6e3241e3a0bb8c9e9" }, { "algorithm": "SHA256", - "checksumValue": "eb43180fbdca40e36d9558060e6e654ef4c451ca656ad679e9e1269eb45456b3" + "checksumValue": "d3f19ed52dc975741ecc5a0fc553f910a241d60c76fa4621356d0cdb0490ca28" } ], "fileName": "Modules/expat/expat.h" @@ -62,11 +62,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "d8f9211d52ff0384e229e4d4d56adae5db2d7f91" + "checksumValue": "288700b1dd47ec564d2159a0a519bbc2f273b9e9" }, { "algorithm": "SHA256", - "checksumValue": "b77f8192baf90aaa41f7023bc68fd1f22ab2552f98758271a1e090544537def5" + "checksumValue": "d55e546603baf0b7085d6ff1d8f38d56d6de009a1731186509103c5d292c1a75" } ], "fileName": "Modules/expat/expat_external.h" @@ -76,11 +76,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "69db5031480c50a1e35a51190bd64fcb816b6caf" + "checksumValue": "378f1dffca32e580be8fb445677950cd1c4c4ea8" }, { "algorithm": "SHA256", - "checksumValue": "3dac2e4fdec819ede1b081ef776f2421c98ab509f69d5647a21d63d651179df2" + "checksumValue": "5e42477487bca7e7caac6b832ab940f39a1a20b8765c945374e4f6c2670f55b6" } ], "fileName": "Modules/expat/fallthrough.h" @@ -90,11 +90,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "1b0e9014c0baa4c6254d2b5e6a67c70148309c34" + "checksumValue": "19b25ac4e504efa5e51ce639c83be053da587543" }, { "algorithm": "SHA256", - "checksumValue": "ad8b01e9f323cc4208bcd22241df383d7e8641fe3c8b3415aa513de82531f89f" + "checksumValue": "a9cd6f2cf5199ae3c29d22ee4913736fcd984f62132146a0352c88549700e83f" } ], "fileName": "Modules/expat/iasciitab.h" @@ -104,11 +104,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "2555e70b29c1efc0af40879daafd12f8b36aca2c" + "checksumValue": "476a11d9872f8f38844e398c5486ad183ffe2dcf" }, { "algorithm": "SHA256", - "checksumValue": "4feb1df53898a48ae0ae04b5d0352c90395c8e693e5c2675f8ced41903d6fa94" + "checksumValue": "89f661fa3fa5f7892d83a13ecd685a56aace3fe740abce88a863031114ee2cef" } ], "fileName": "Modules/expat/internal.h" @@ -118,11 +118,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "d335ecca380e331a0ea7dc33838a4decd93ec1e4" + "checksumValue": "8d31198775c89582e37cd0dcac4e87a718cc17cb" }, { "algorithm": "SHA256", - "checksumValue": "eab66226da100372e01e42e1cbcd8ac2bbbb5c1b5f95d735289cc85c7a8fc2ba" + "checksumValue": "b0daf8a75c690e895421f765ddb2ae2fbc1ba14694e06a3215dba84f1ff3427d" } ], "fileName": "Modules/expat/latin1tab.h" @@ -132,11 +132,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "abdf1b9e9642176466ecbb77d5f48e502d01d0d8" + "checksumValue": "19ff1e65b76536a4595c38d21a500cbc7b86c408" }, { "algorithm": "SHA256", - "checksumValue": "10c66f1cf9dc28608d57cb19adc8c7c654800e8b5b1b9be176eaed802deca2d9" + "checksumValue": "377ca054fdc531360f42a5cb7c522bcbf88b6c67aebc2e29544c37d14e836bde" } ], "fileName": "Modules/expat/memory_sanitizer.h" @@ -146,11 +146,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "cf2bc9626c945826602ba9170786e9a2a44645e4" + "checksumValue": "19ecc1cf2a899fe1b80de263c8b09d6de451c6b8" }, { "algorithm": "SHA256", - "checksumValue": "67dcf415d37a4b692a6a8bb46f990c02d83f2ef3d01a65cd61c8594a084246f2" + "checksumValue": "8f78e64f11e2b23df8b32cb5528cfeda6215acd6abf6bcf1ad59fdc7b1ffd105" } ], "fileName": "Modules/expat/nametab.h" @@ -160,11 +160,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "6648f9c12a8d6f77a6eab5ef5c7caa976e7549aa" + "checksumValue": "bcde3e9100b62b87d2b2d628bdacddf415782bdb" }, { "algorithm": "SHA256", - "checksumValue": "c1be28dd62282e668d4daedfe756edb68b7da165c442202bb06a9e597cd5c289" + "checksumValue": "12ecc9915bccb793ea8bb543cc7d002e226f4e4d6b97ec9839dca41cbe4e2e27" } ], "fileName": "Modules/expat/siphash.h" @@ -174,11 +174,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "b77c8fcfb551553c81d6fbd94c798c8aa04ad021" + "checksumValue": "30276d76d64af27de1d0de06160c5b58c884ee8b" }, { "algorithm": "SHA256", - "checksumValue": "8cd26bd461d334d5e1caedb3af4518d401749f2fc66d56208542b29085159c18" + "checksumValue": "3fa349a3a19143366e80a58d9aa950152ef9cd7903f557f971051410b47f335c" } ], "fileName": "Modules/expat/utf8tab.h" @@ -188,11 +188,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "a3a8c44efd55dbf2cfea8fcee009ec63120ec0a3" + "checksumValue": "d296304ae595486ec094e341fed8a8450d4cedbe" }, { "algorithm": "SHA256", - "checksumValue": "e70948500d34dfcba4e9f0b305319dfe2a937c7cbfb687905128b56e1a6f8b33" + "checksumValue": "0ab6446eb98abc492ae341ef7607b535e44dedf52633fdc7c6e1a1361aec3922" } ], "fileName": "Modules/expat/winconfig.h" @@ -202,11 +202,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "69fa7a25f555164f089fdcf290f3af6a1731621f" + "checksumValue": "ecac5a698350e3c9e6c899bbcbfb62875ecf326e" }, { "algorithm": "SHA256", - "checksumValue": "071345c5ccfbe2e46a02839331ee60ee20048348b4408964bff48c4355473b9e" + "checksumValue": "1210979a688301412f46e058d0497fa3c1c63c296c2e015834cda0f0b314875d" } ], "fileName": "Modules/expat/xcsinc.c" @@ -216,11 +216,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "a5a5dd44ee8eeb73f42fa42ca1499cd282ddf6a6" + "checksumValue": "0939e3fe0ebb21a5b8ed9d9fdd33cde75ee5658a" }, { "algorithm": "SHA256", - "checksumValue": "5d2c99b576744edd9545cefe613e0577617f57e16c86387edc13d45710dc97d2" + "checksumValue": "da48375e85bdc2f97da4445169aafc0b363f150a1a8275dd417e6d84cfc3e443" } ], "fileName": "Modules/expat/xmlparse.c" @@ -230,11 +230,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "c8769fcb93f00272a6e6ca560be633649c817ff7" + "checksumValue": "6e046b576085df9bb8f6b18f60ccf0f7a40308b5" }, { "algorithm": "SHA256", - "checksumValue": "5b81f0eb0e144b611dbd1bc9e6037075a16bff94f823d57a81eb2a3e4999e91a" + "checksumValue": "db4004fa2cabc811fc493b5b04b44cd336d19434bc653725f090131e43a89406" } ], "fileName": "Modules/expat/xmlrole.c" @@ -244,11 +244,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "ac2964cca107f62dd133bfd4736a9a17defbc401" + "checksumValue": "4a3bf2554da3a7b02b0f2d4d07f446f7f6e34af5" }, { "algorithm": "SHA256", - "checksumValue": "92e41f373b67f6e0dcd7735faef3c3f1e2c17fe59e007e6b74beef6a2e70fa88" + "checksumValue": "486faffdfcd0c1668406648220c6638c98ddfe044d04d66551999ab8e02564fa" } ], "fileName": "Modules/expat/xmlrole.h" @@ -258,11 +258,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "08dba893b34338e64b66f1044f542aa6760dbab1" + "checksumValue": "c3377af96ec7fef8b502967ac818e3bfea04f584" }, { "algorithm": "SHA256", - "checksumValue": "0c842b1876503e699517994317805dd2298d9e11c94dcc87c2ecb6c2b8e00bc0" + "checksumValue": "f2732a8e91fd901d75431d35edc421e1ff3893a275c4de1cc855b3d4deadfd37" } ], "fileName": "Modules/expat/xmltok.c" @@ -272,11 +272,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "d126831eaa5158cff187a8c93f4bc1c8118f3b17" + "checksumValue": "8e4bf167669dddff38269486f33eccb0fde0c7ca" }, { "algorithm": "SHA256", - "checksumValue": "91bf003a725a675761ea8d92cebc299a76fd28c3a950572f41bc7ce5327ee7b5" + "checksumValue": "20013b75027e04e324452a002100076e30ec20e0f28b318f392317f99a4c4115" } ], "fileName": "Modules/expat/xmltok.h" @@ -286,11 +286,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "3ccb9335589c3ff60aae50ac79b2cdac57999bee" + "checksumValue": "9f1c475da821ccf2763594c9b79175544af08d7a" }, { "algorithm": "SHA256", - "checksumValue": "94eeaef9ed46d10f80f748924fbf41f950b4859d6f234f61fdb2c8f1a8e77bd1" + "checksumValue": "c7b197b596192ad3f8c872ae9c0524e7dd85da10cb4bfdf29d630e12782dfbf7" } ], "fileName": "Modules/expat/xmltok_impl.c" @@ -300,11 +300,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "788332fe8040bed71172cddedb69abd848cc62f7" + "checksumValue": "f862ff6393d47ac1ad9cd0f5f844b43e7c21a20e" }, { "algorithm": "SHA256", - "checksumValue": "f05ad4fe5e98429a7349ff04f57192cac58c324601f2a2e5e697ab0bc05d36d5" + "checksumValue": "a5053c69219d12788088de9bd670537e1c784302766c331afe6b253460d0417d" } ], "fileName": "Modules/expat/xmltok_impl.h" @@ -314,11 +314,11 @@ "checksums": [ { "algorithm": "SHA1", - "checksumValue": "41b8c8fc275882c76d4210b7d40a18e506b07147" + "checksumValue": "974e4255236de201a718a1e5fc1c772356153415" }, { "algorithm": "SHA256", - "checksumValue": "b2188c7e5fa5b33e355cf6cf342dfb8f6e23859f2a6b1ddf79841d7f84f7b196" + "checksumValue": "3c0c930dfdd484f98c6a32bd397919f3d2ee3701e6023effb463512af1849499" } ], "fileName": "Modules/expat/xmltok_ns.c" @@ -1044,14 +1044,14 @@ "checksums": [ { "algorithm": "SHA256", - "checksumValue": "ef7d1994f533c9e7343d6c19f31064fc8ebbcbcaa144be3812b4f43052a05f4c" + "checksumValue": "22920a86c83f32300b11463635b71f11137a917975af297725e55525027d4e50" } ], - "downloadLocation": "https://github.com/libexpat/libexpat/releases/download/R_2_8_2/expat-2.8.2.tar.gz", + "downloadLocation": "https://github.com/libexpat/libexpat/releases/download/R_2_8_3/expat-2.8.3.tar.gz", "externalRefs": [ { "referenceCategory": "SECURITY", - "referenceLocator": "cpe:2.3:a:libexpat_project:libexpat:2.8.2:*:*:*:*:*:*:*", + "referenceLocator": "cpe:2.3:a:libexpat_project:libexpat:2.8.3:*:*:*:*:*:*:*", "referenceType": "cpe23Type" } ], @@ -1059,7 +1059,7 @@ "name": "expat", "originator": "Organization: Expat development team", "primaryPackagePurpose": "SOURCE", - "versionInfo": "2.8.2" + "versionInfo": "2.8.3" }, { "SPDXID": "SPDXRef-PACKAGE-hacl-star", diff --git a/Modules/expat/ascii.h b/Modules/expat/ascii.h index 1f594d2e54b4d2..1d9cf70bf695da 100644 --- a/Modules/expat/ascii.h +++ b/Modules/expat/ascii.h @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #define ASCII_A 0x41 diff --git a/Modules/expat/asciitab.h b/Modules/expat/asciitab.h index af766fb24785ea..43af0876ccd3f8 100644 --- a/Modules/expat/asciitab.h +++ b/Modules/expat/asciitab.h @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* 0x00 */ BT_NONXML, BT_NONXML, BT_NONXML, BT_NONXML, diff --git a/Modules/expat/expat.h b/Modules/expat/expat.h index c493c70441c418..dbebd985a652ac 100644 --- a/Modules/expat/expat.h +++ b/Modules/expat/expat.h @@ -40,6 +40,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef Expat_INCLUDED @@ -1094,7 +1096,7 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled); */ # define XML_MAJOR_VERSION 2 # define XML_MINOR_VERSION 8 -# define XML_MICRO_VERSION 2 +# define XML_MICRO_VERSION 3 # ifdef __cplusplus } diff --git a/Modules/expat/expat_external.h b/Modules/expat/expat_external.h index cc945c424e471f..6cc3f19ed7dbc8 100644 --- a/Modules/expat/expat_external.h +++ b/Modules/expat/expat_external.h @@ -36,6 +36,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef Expat_External_INCLUDED diff --git a/Modules/expat/fallthrough.h b/Modules/expat/fallthrough.h index 707dbdd44bfe53..0152d1bdc5de8f 100644 --- a/Modules/expat/fallthrough.h +++ b/Modules/expat/fallthrough.h @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef FALLTHROUGH_H diff --git a/Modules/expat/iasciitab.h b/Modules/expat/iasciitab.h index 5d8646f2a318b8..1de8d519c8b7ba 100644 --- a/Modules/expat/iasciitab.h +++ b/Modules/expat/iasciitab.h @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* Like asciitab.h, except that 0xD has code BT_S rather than BT_CR */ diff --git a/Modules/expat/internal.h b/Modules/expat/internal.h index 420d4217a569b1..7e67d2e378c524 100644 --- a/Modules/expat/internal.h +++ b/Modules/expat/internal.h @@ -53,6 +53,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(__GNUC__) && defined(__i386__) && ! defined(__MINGW32__) @@ -123,20 +125,11 @@ # define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u" # endif #else +# include // PRIdPTR, PRIuPTR # define EXPAT_FMT_LLX(midpart) "%" midpart "llx" # define EXPAT_FMT_ULL(midpart) "%" midpart "llu" -# if ! defined(ULONG_MAX) -# error Compiler did not define ULONG_MAX for us -# elif ULONG_MAX == 18446744073709551615u // 2^64-1 -# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "ld" -# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "lu" -# elif defined(__wasm32__) // 32bit mode Emscripten or WASI SDK -# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "ld" -# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "zu" -# else -# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "d" -# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u" -# endif +# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart PRIdPTR +# define EXPAT_FMT_SIZE_T(midpart) "%" midpart PRIuPTR #endif #ifndef UNUSED_P diff --git a/Modules/expat/latin1tab.h b/Modules/expat/latin1tab.h index b681d278af6569..3793f4f3cc7841 100644 --- a/Modules/expat/latin1tab.h +++ b/Modules/expat/latin1tab.h @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* 0x80 */ BT_OTHER, BT_OTHER, BT_OTHER, BT_OTHER, diff --git a/Modules/expat/memory_sanitizer.h b/Modules/expat/memory_sanitizer.h index a8a8006ccded12..f739b88f304871 100644 --- a/Modules/expat/memory_sanitizer.h +++ b/Modules/expat/memory_sanitizer.h @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(MEMORY_SANITIZER_H) diff --git a/Modules/expat/nametab.h b/Modules/expat/nametab.h index 63485446b96727..2385851562e7dc 100644 --- a/Modules/expat/nametab.h +++ b/Modules/expat/nametab.h @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ static const unsigned namingBitmap[] = { diff --git a/Modules/expat/refresh.sh b/Modules/expat/refresh.sh index 503f562c1862a4..1499e92112fb95 100755 --- a/Modules/expat/refresh.sh +++ b/Modules/expat/refresh.sh @@ -12,9 +12,9 @@ fi # Update this when updating to a new version after verifying that the changes # the update brings in are good. These values are used for verifying the SBOM, too. -expected_libexpat_tag="R_2_8_2" -expected_libexpat_version="2.8.2" -expected_libexpat_sha256="ef7d1994f533c9e7343d6c19f31064fc8ebbcbcaa144be3812b4f43052a05f4c" +expected_libexpat_tag="R_2_8_3" +expected_libexpat_version="2.8.3" +expected_libexpat_sha256="22920a86c83f32300b11463635b71f11137a917975af297725e55525027d4e50" expat_dir="$(realpath "$(dirname -- "${BASH_SOURCE[0]}")")" cd ${expat_dir} diff --git a/Modules/expat/siphash.h b/Modules/expat/siphash.h index be216b4006dc84..ac1fbfaf0bde81 100644 --- a/Modules/expat/siphash.h +++ b/Modules/expat/siphash.h @@ -8,6 +8,8 @@ * * 1. https://www.131002.net/siphash/siphash24.c * 2. https://www.131002.net/siphash/ + * + * SPDX-License-Identifier: CC0-1.0 * -------------------------------------------------------------------------- * HISTORY: * diff --git a/Modules/expat/utf8tab.h b/Modules/expat/utf8tab.h index 88efcf91cc16a6..73732d1527f142 100644 --- a/Modules/expat/utf8tab.h +++ b/Modules/expat/utf8tab.h @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* 0x80 */ BT_TRAIL, BT_TRAIL, BT_TRAIL, BT_TRAIL, diff --git a/Modules/expat/winconfig.h b/Modules/expat/winconfig.h index 05805514ec7fa2..9e7e8bdc22ca36 100644 --- a/Modules/expat/winconfig.h +++ b/Modules/expat/winconfig.h @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef WINCONFIG_H diff --git a/Modules/expat/xcsinc.c b/Modules/expat/xcsinc.c index 3597c2480bc961..675b2844c708d6 100644 --- a/Modules/expat/xcsinc.c +++ b/Modules/expat/xcsinc.c @@ -6,7 +6,7 @@ \___/_/\_\ .__/ \__,_|\__| |_| XML parser - Copyright (c) 2022 Sebastian Pipping + Copyright (c) 2022-2026 Sebastian Pipping Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -27,8 +27,14 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ +#if defined(XML_UNICODE) && defined(XML_UNICODE_WCHAR_T) +# include +#endif + static size_t xcslen(const XML_Char *s) { #ifdef XML_UNICODE diff --git a/Modules/expat/xmlparse.c b/Modules/expat/xmlparse.c index d961ebf227e740..4fa61bca8c1629 100644 --- a/Modules/expat/xmlparse.c +++ b/Modules/expat/xmlparse.c @@ -1,4 +1,4 @@ -/* 5de44e6750c6cc78818f06ed552f522a1241df0299395250e1792cb339389daf (2.8.2+) +/* ee5f82c3ffd57c5224394ba46f348dbce466d34d6c925a527ae46b1cfe6adf1d (2.8.3+) __ __ _ ___\ \/ /_ __ __ _| |_ / _ \\ /| '_ \ / _` | __| @@ -50,6 +50,7 @@ Copyright (c) 2026 Nick Begg Copyright (c) 2026 Kartik Kenchi Copyright (c) 2026 Haris Hussain + Copyright (c) 2026 Evgeny Kotkov Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -70,6 +71,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #define XML_BUILDING_EXPAT 1 @@ -93,10 +96,10 @@ #include #include /* memset(), memcpy() */ #include -#include /* INT_MAX, LLONG_MAX, LONG_MAX, UINT_MAX */ +#include /* INT_MAX, UINT_MAX */ #include /* fprintf */ #include /* getenv */ -#include /* SIZE_MAX, uintptr_t */ +#include /* SIZE_MAX, UINT64_MAX, uint64_t, uintptr_t */ #include /* isnan */ #include @@ -211,12 +214,6 @@ typedef char ICHAR; #endif -#ifdef XML_LARGE_SIZE -# define XML_INDEX_MAX LLONG_MAX -#else -# define XML_INDEX_MAX LONG_MAX -#endif - /* Round up n to be a multiple of sz, where sz is a power of 2. */ #define ROUND_UP(n, sz) (((n) + ((sz) - 1)) & ~((sz) - 1)) @@ -719,7 +716,7 @@ struct XML_ParserStruct { char *m_bufferEnd; // past last character to be parsed const char *m_bufferLim; // allocated end of m_buffer - XML_Index m_parseEndByteIndex; + uint64_t m_parseEndByteIndex; const char *m_parseEndPtr; size_t m_partialTokenBytesBefore; /* used in heuristic to avoid O(n^2) */ XML_Bool m_reparseDeferralEnabled; @@ -2312,7 +2309,7 @@ XML_Parse(XML_Parser parser, const char *s, int len, int isFinal) { int nLeftOver; enum XML_Status result; /* Detect overflow (a+b > MAX <==> b > MAX-a) */ - if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) { + if ((uint64_t)len > UINT64_MAX - parser->m_parseEndByteIndex) { parser->m_errorCode = XML_ERROR_NO_MEMORY; parser->m_eventPtr = parser->m_eventEndPtr = NULL; parser->m_processor = errorProcessor; @@ -2430,7 +2427,7 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) { } // Detect and avoid integer overflow - if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) { + if ((uint64_t)len > UINT64_MAX - parser->m_parseEndByteIndex) { parser->m_errorCode = XML_ERROR_NO_MEMORY; parser->m_eventPtr = parser->m_eventEndPtr = NULL; parser->m_processor = errorProcessor; @@ -2692,9 +2689,15 @@ XML_Index XMLCALL XML_GetCurrentByteIndex(XML_Parser parser) { if (parser == NULL) return -1; - if (parser->m_eventPtr) + if (parser->m_eventPtr) { + // NOTE: XML_Index is known to wrap around for >2 GiB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. return (XML_Index)(parser->m_parseEndByteIndex - (parser->m_parseEndPtr - parser->m_eventPtr)); + } return -1; } @@ -2736,7 +2739,12 @@ XML_GetCurrentLineNumber(XML_Parser parser) { parser->m_eventPtr, &parser->m_position); parser->m_positionPtr = parser->m_eventPtr; } - return parser->m_position.lineNumber + 1; + // NOTE: XML_Size is known to wrap around for >2 4iB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. + return (XML_Size)(parser->m_position.lineNumber + 1); } XML_Size XMLCALL @@ -2748,7 +2756,12 @@ XML_GetCurrentColumnNumber(XML_Parser parser) { parser->m_eventPtr, &parser->m_position); parser->m_positionPtr = parser->m_eventPtr; } - return parser->m_position.columnNumber; + // NOTE: XML_Size is known to wrap around for >2 4iB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. + return (XML_Size)parser->m_position.columnNumber; } void XMLCALL @@ -3905,14 +3918,22 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr, if (! attId) return XML_ERROR_NO_MEMORY; #ifdef XML_ATTR_INFO + // NOTE: XML_Index is known to wrap around for >2 GiB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. currAttInfo->nameStart - = parser->m_parseEndByteIndex - (parser->m_parseEndPtr - currAtt->name); + = (XML_Index)(parser->m_parseEndByteIndex + - (parser->m_parseEndPtr - currAtt->name)); currAttInfo->nameEnd = currAttInfo->nameStart + XmlNameLength(enc, currAtt->name); - currAttInfo->valueStart = parser->m_parseEndByteIndex - - (parser->m_parseEndPtr - currAtt->valuePtr); - currAttInfo->valueEnd = parser->m_parseEndByteIndex - - (parser->m_parseEndPtr - currAtt->valueEnd); + currAttInfo->valueStart + = (XML_Index)(parser->m_parseEndByteIndex + - (parser->m_parseEndPtr - currAtt->valuePtr)); + currAttInfo->valueEnd + = (XML_Index)(parser->m_parseEndByteIndex + - (parser->m_parseEndPtr - currAtt->valueEnd)); #endif /* Detect duplicate attributes by their QNames. This does not work when namespace processing is turned on and different prefixes for the same @@ -6554,11 +6575,12 @@ storeAttributeValue(XML_Parser parser, const ENCODING *enc, XML_Bool isCdata, // Check if entity is complete, if not, mark down how much of it is // processed. A XML_SUSPENDED check here is not required as // appendAttributeValue will never suspend the parser. - if (textEnd != nextInEntity) { + if (nextInEntity < textEnd) { entity->processed = (int)(nextInEntity - (const char *)entity->textPtr); continue; } + assert(nextInEntity == textEnd); // Entity is complete. We cannot close it here since we need to first // process its possible inner entities (which are added to the @@ -8192,7 +8214,7 @@ poolGrow(STRING_POOL *pool) { pool->freeBlocks = tem; memcpy(pool->blocks->s, pool->start, (pool->end - pool->start) * sizeof(XML_Char)); - pool->ptr = pool->blocks->s + (pool->ptr - pool->start); + pool->ptr = pool->blocks->s + EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start); pool->start = pool->blocks->s; pool->end = pool->start + pool->blocks->size; return XML_TRUE; @@ -8205,7 +8227,8 @@ poolGrow(STRING_POOL *pool) { /* NOTE: Needs to be calculated prior to calling `realloc` to avoid dangling pointers: */ - const ptrdiff_t offsetInsideBlock = pool->ptr - pool->start; + const ptrdiff_t offsetInsideBlock + = EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start); if (blockSize < 0) { /* This condition traps a situation where either more than @@ -8268,8 +8291,9 @@ poolGrow(STRING_POOL *pool) { tem->next = pool->blocks; pool->blocks = tem; if (pool->ptr != pool->start) - memcpy(tem->s, pool->start, (pool->ptr - pool->start) * sizeof(XML_Char)); - pool->ptr = tem->s + (pool->ptr - pool->start); + memcpy(tem->s, pool->start, + EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start) * sizeof(XML_Char)); + pool->ptr = tem->s + EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start); pool->start = tem->s; pool->end = tem->s + blockSize; } diff --git a/Modules/expat/xmlrole.c b/Modules/expat/xmlrole.c index d56bee82dd2d13..8f6bedda71652d 100644 --- a/Modules/expat/xmlrole.c +++ b/Modules/expat/xmlrole.c @@ -37,6 +37,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff --git a/Modules/expat/xmlrole.h b/Modules/expat/xmlrole.h index 9d0d4ff11b7f98..903a6951f434e2 100644 --- a/Modules/expat/xmlrole.h +++ b/Modules/expat/xmlrole.h @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef XmlRole_INCLUDED diff --git a/Modules/expat/xmltok.c b/Modules/expat/xmltok.c index 387c6e44a25f80..d66af6045f07ac 100644 --- a/Modules/expat/xmltok.c +++ b/Modules/expat/xmltok.c @@ -12,7 +12,7 @@ Copyright (c) 2002 Greg Stein Copyright (c) 2002-2016 Karl Waclawek Copyright (c) 2005-2009 Steven Solie - Copyright (c) 2016-2024 Sebastian Pipping + Copyright (c) 2016-2026 Sebastian Pipping Copyright (c) 2016 Pascal Cuoq Copyright (c) 2016 Don Lewis Copyright (c) 2017 Rhodri James @@ -26,6 +26,7 @@ Copyright (c) 2023 Hanno Böck Copyright (c) 2025 Alfonso Gregory Copyright (c) 2026 Nick Begg + Copyright (c) 2026 Kartik Kenchi Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -46,6 +47,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" @@ -705,9 +708,10 @@ unicode_byte_type(char hi, char lo) { enum XML_Convert_Result res = XML_CONVERT_COMPLETED; \ UNUSED_P(enc); \ fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1); /* shrink to even */ \ - /* Avoid copying first half only of surrogate */ \ + /* Avoid copying the first half (2 bytes) of surrogate pairs (4 bytes) */ \ if (fromLim - *fromP > ((toLim - *toP) << 1) \ - && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) { \ + && /* are the last two bytes a high surrogate (0xD800-0xDBFF)? */ \ + (GET_HI(fromLim - 2) & 0xFC) == 0xD8) { \ fromLim -= 2; \ res = XML_CONVERT_INPUT_INCOMPLETE; \ } \ @@ -1177,6 +1181,13 @@ doParseXmlDecl(const ENCODING *(*encodingFinder)(const ENCODING *, const char *, *versionPtr = val; if (versionEndPtr) *versionEndPtr = ptr; + /* The version number must not be empty; VersionNum requires at least + one character. The encoding and standalone pseudo-attributes below + already reject an empty value, so keep version consistent. */ + if (val == ptr - enc->minBytesPerChar) { + *badPtr = val; + return 0; + } if (! parsePseudoAttribute(enc, ptr, end, &name, &nameEnd, &val, &ptr)) { *badPtr = ptr; return 0; diff --git a/Modules/expat/xmltok.h b/Modules/expat/xmltok.h index 79a9fb76871f10..bd868b87a407d6 100644 --- a/Modules/expat/xmltok.h +++ b/Modules/expat/xmltok.h @@ -10,7 +10,7 @@ Copyright (c) 2000 Clark Cooper Copyright (c) 2002 Fred L. Drake, Jr. Copyright (c) 2002-2005 Karl Waclawek - Copyright (c) 2016-2024 Sebastian Pipping + Copyright (c) 2016-2026 Sebastian Pipping Copyright (c) 2017 Rhodri James Licensed under the MIT license: @@ -32,11 +32,15 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef XmlTok_INCLUDED # define XmlTok_INCLUDED 1 +# include // uint64_t + # ifdef __cplusplus extern "C" { # endif @@ -145,8 +149,8 @@ extern "C" { typedef struct position { /* first line and first column are 0 not 1 */ - XML_Size lineNumber; - XML_Size columnNumber; + uint64_t lineNumber; + uint64_t columnNumber; } POSITION; typedef struct { diff --git a/Modules/expat/xmltok_impl.c b/Modules/expat/xmltok_impl.c index eae11bdd968aee..1d8e457d9de544 100644 --- a/Modules/expat/xmltok_impl.c +++ b/Modules/expat/xmltok_impl.c @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef XML_TOK_IMPL_C diff --git a/Modules/expat/xmltok_impl.h b/Modules/expat/xmltok_impl.h index 3469c4ae138c95..13a08899da3b1a 100644 --- a/Modules/expat/xmltok_impl.h +++ b/Modules/expat/xmltok_impl.h @@ -29,6 +29,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ enum { diff --git a/Modules/expat/xmltok_ns.c b/Modules/expat/xmltok_ns.c index 810ca2c6d0485e..40a02a0308b563 100644 --- a/Modules/expat/xmltok_ns.c +++ b/Modules/expat/xmltok_ns.c @@ -33,6 +33,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef XML_TOK_NS_C