On Fri Jul 17, 2026 at 8:04 AM CEST, Deepak Rathore via lists.openembedded.org wrote: > From: Deepak Rathore <[email protected]> > > These patches apply the upstream fixes shown in [1] and [2], as > referenced by [3]. > > Upstream pull request mentioned in [4] contains both the storeAtts fix > and the related xcsdup overflow hardening so adding both source patches > explicit, even though the published advisory description names storeAtts > specifically. > > [1] > https://github.com/libexpat/libexpat/commit/12dc6d8d3d65f79471a94d8565f6bf1cf245f648 > [2] > https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15 > [3] https://nvd.nist.gov/vuln/detail/CVE-2026-56403 > [4] https://github.com/libexpat/libexpat/pull/1232 > > Signed-off-by: Deepak Rathore <[email protected]> > --- > .../expat/expat/CVE-2026-56403_p1.patch | 81 +++++++++++++++++++ > .../expat/expat/CVE-2026-56403_p2.patch | 52 ++++++++++++ > meta/recipes-core/expat/expat_2.6.4.bb | 2 + > 3 files changed, 135 insertions(+) > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch > > [...] > diff --git a/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch > b/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch > new file mode 100644 > index 0000000000..b578cb60cc > --- /dev/null > +++ b/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch > @@ -0,0 +1,52 @@ > +From 2855ce68a1ce9732267c06734427930364ab66c1 Mon Sep 17 00:00:00 2001 > +From: Sebastian Pipping <[email protected]> > +Date: Fri, 22 May 2026 00:43:52 +0200 > +Subject: [PATCH 02/17] xmlwf: Protect function `xcsdup` from signed integer > + overflow > + > +CVE: CVE-2026-56403 > +Upstream-Status: Backport > [https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15] > + > +Backport Changes: > +- Add stdint.h and convert count and numBytes to size_t because > + Scarthgap 2.6.4 lacks these upstream prerequisites. > + > +(cherry picked from commit 147c8f36d6277d5c6011c098370a8362aed47b15) > +Signed-off-by: Deepak Rathore <[email protected]> > +--- > + expat/xmlwf/xmlwf.c | 10 ++++++++-- > + 1 file changed, 8 insertions(+), 2 deletions(-) > + > +diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c > +index fd4fc3f8..7bbdb303 100644 > +--- a/expat/xmlwf/xmlwf.c > ++++ b/expat/xmlwf/xmlwf.c > +@@ -45,6 +45,7 @@ > + > + #include <assert.h> > + #include <stdio.h> > ++#include <stdint.h>
Hello, Same question as the wrynose reviews: https://lore.kernel.org/all/[email protected]/T/#m9932c3cd0b7d0659653d92b0a3ae69577fb780c8 Since I'm trying to merge the fix from Peter: [scarthgap][PATCH] expat: patch CVE-2026-41080 - Peter Marko https://lore.kernel.org/all/[email protected]/ ... the new stdint.h include might not be necessary. Can you follow-up on this series when that merges? Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241291): https://lists.openembedded.org/g/openembedded-core/message/241291 Mute This Topic: https://lists.openembedded.org/mt/120311079/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
