Hi Yoann, I have rebased all the expat patches on top of the latest wrynose merge commit and refreshed all the patches and removed not needed backport changes.
Please see the v2 of this series as below: 1. https://lists.openembedded.org/g/openembedded-core/message/241377 2. https://lists.openembedded.org/g/openembedded-core/message/241378 3. https://lists.openembedded.org/g/openembedded-core/message/241379 4. https://lists.openembedded.org/g/openembedded-core/message/241380 5. https://lists.openembedded.org/g/openembedded-core/message/241381 6. https://lists.openembedded.org/g/openembedded-core/message/241383 7. https://lists.openembedded.org/g/openembedded-core/message/241382 8. https://lists.openembedded.org/g/openembedded-core/message/241384 9. https://lists.openembedded.org/g/openembedded-core/message/241385 10. https://lists.openembedded.org/g/openembedded-core/message/241386 11. https://lists.openembedded.org/g/openembedded-core/message/241387 Thanks for your review. Regards, Deepak ________________________________ From: [email protected] <[email protected]> on behalf of Yoann Congal via lists.openembedded.org <[email protected]> Sent: Friday, July 17, 2026 8:53 PM To: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) <[email protected]>; [email protected] <[email protected]> Subject: Re: [OE-core][wrynose][PATCH 01/10] expat: fix CVE-2026-56403 On Fri Jul 10, 2026 at 3:08 PM CEST, Deepak Rathore via lists.openembedded.org wrote: > From: Deepak Rathore <[email protected]> > > These patches apply the upstream fixes shown in [1] and [2], as > referenced by [3]. > > [1] > https://github.com/libexpat/libexpat/commit/12dc6d8d3d65f79471a94d8565f6bf1cf245f648 > [2] > https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15 > [3] https://nvd.nist.gov/vuln/detail/CVE-2026-56403 > > Signed-off-by: Deepak Rathore <[email protected]> > > [...] > diff --git a/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch > b/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch > new file mode 100644 > index 0000000000..a17e3a8b3a > --- /dev/null > +++ b/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch > @@ -0,0 +1,52 @@ > +From e8100827a4f68c70d8cadf446bb82bec7cbebbac Mon Sep 17 00:00:00 2001 > +From: Sebastian Pipping <[email protected]> > +Date: Fri, 22 May 2026 00:43:52 +0200 > +Subject: [PATCH] xmlwf: Protect function `xcsdup` from signed integer > overflow > + > +CVE: CVE-2026-56403 > +Upstream-Status: Backport > [https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15] > + > +Backport Changes: > +- Include stdint.h explicitly because Expat 2.7.5 does not expose SIZE_MAX > + to xmlwf.c. > + > +(cherry picked from commit 147c8f36d6277d5c6011c098370a8362aed47b15) > +Signed-off-by: Deepak Rathore <[email protected]> > +--- > + expat/xmlwf/xmlwf.c | 8 +++++++- > + 1 file changed, 7 insertions(+), 1 deletion(-) > + > +diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c > +index 2d0c4f8e..934473ce 100644 > +--- a/expat/xmlwf/xmlwf.c > ++++ b/expat/xmlwf/xmlwf.c > +@@ -46,6 +46,7 @@ > + > + #include <assert.h> > + #include <stdio.h> > ++#include <stdint.h> Hello, I *think* you don't need this backport change anymore since: https://git.openembedded.org/openembedded-core/commit/?h=wrynose&id=21042df15008ce90b76958d74200298d09d71254 (added stdint.h into expat.h) This may also apply to meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch in a later patch of this series. Can you check and send a v2 of the whole fixed series? Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241389): https://lists.openembedded.org/g/openembedded-core/message/241389 Mute This Topic: https://lists.openembedded.org/mt/120206239/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
