summaryrefslogtreecommitdiffstats
path: root/lib/libexpat
AgeCommit message (Collapse)AuthorFilesLines
2020-12-29Update libexpat to 2.2.10. Relevant are only bug fixes #390 #395bluhm10-116/+253
#398 #404 #405 and other changes #354 #355 #412. OK deraadt@
2019-09-25Update libexpat to 2.2.8. CVE-2019-15903 has been fixed earlierbluhm34-13419/+12080
in our tree. Relevant is only bug fix #240. Most of the upstream diff is automated source format change. OK deraadt@
2019-09-10Fix heap overflow in libexpat 2.2.7 triggered by XML_GetCurrentLineNumberbluhm1-7/+13
(or XML_GetCurrentColumnNumber), and deny internal entities closing the doctype; CVE-2019-15903 fixed in commit c20b758c332d9a13afbbb276d30db1d183a85d43 OK tb@
2019-06-29Update libexpat to 2.2.7. Relevant for OpenBSD is only the fix forbluhm9-29/+56
CVE-2018-20843, a potential denial-of-service in libexpat due to high RAM and CPU usage. OK deraadt@
2018-08-22Update libexpat to 2.2.6. Relevant for OpenBSD isbluhm9-317/+448
- Avoid doing arithmetic with NULL pointers in XML_GetBuffer - Fix 2.2.5 regression with suspend-resume while parsing a document like '<root/>' - Address compiler warnings - Fix miscellaneous typos
2017-11-02Update libexpat to 2.2.5. Changes for OpenBSD include a few bugbluhm18-2011/+2428
fixes, no library bump needed. OK deraadt@
2017-08-23Update libexpat to 2.2.4. Fix copying partial UTF-8 characters.bluhm32-155/+979
OK deraadt@
2017-08-04Update libexpat to 2.2.3. Only few changes affect OpenBSD.bluhm14-628/+9386
OK deraadt@
2017-07-28Gcc3 does not have -fvisibility feature, so skip -fvisibility=hiddenaoyama1-2/+7
flag when compiling with gcc3. ok espie@
2017-07-19Update libexpat to 2.2.2. Fixes NULL parser dereference.bluhm8-36/+162
no objections deraadt@
2017-07-06Add ULL suffix to 64 bit constants. This avoids compiler warningsbluhm2-6/+5
on i386 and allows to compile the C++ test. Upstream dropped the ULL in an insufficient attempt to make the siphash code C89 compatible. Their fix will be more complicated. No binary change.
2017-07-06Compile libexpat with -fvisibility=hidden. This restricts thebluhm3-9/+3
exported symbols to the indended API. We do not need a Symbols.map anymore. Major library bump is necessary as some internal functions vanish from the ABI. Discussed upstream with Sebastian Pipping; ports bulk build ajacoutot@; OK deraadt@
2017-06-30Add test suite source files for expat 2.2.1.bluhm12-0/+4557
2017-06-30AmigaOS and pre-X Mac OS support has been dropped in upstreambluhm2-82/+0
libexpat. Remove obsolete header files, missed in previous commit.
2017-06-30Update libexpat to version 2.2.1 which has some security fixes.bluhm19-453/+1340
- CVE-2017-9233 CVE-2016-9063 CVE-2016-5300 CVE-2016-4472 CVE-2016-0718 CVE-2015-2716 CVE-2015-1283 CVE-2012-6702 CVE-2012-0876 have been addressed. Not all of them affect OpenBSD as we had fixes before. - Upstream uses arc4random_buf(3) now. Delete all code for other entropy sources to make sure to compile the correct one. Our library already used arc4random(3) before. - The overflow fixes in rev 1.11 and 1.12 of lib/xmlparse.c have been commited upstream in a different way. Use the upstream code to make maintenance easier. - Although it should be ABI compatible, there is a new global symbol align_limit_to_full_utf8_characters. As it is in lib/internal.h, add a Symbols.map to restrict the export. Do not bump the shared library version. - Use the internal expat's siphash.h. ports build ajacoutot@; move ahead deraadt@
2016-09-14Generate pkg-config files at build time like everything else. Thisnatano1-2/+3
avoids permission problems due to the build and install stages being run by different users. ok deraadt jasper
2016-09-04only regen pkg-config files when required; ok jaspernatano1-2/+4
2016-07-29Fix regression introduced by patch to CVE-2016-0718: Tag names were cut off in some cases.rpointel1-1/+1
2016-05-31fix CVE-2016-0718.rpointel4-75/+146
2016-05-13re-add the check we have in revision 1.12.rpointel1-6/+6
ok jca@ (thanks).
2016-05-09update libexpat to 2.1.1.rpointel7-23/+47
ok deraadt@ (thanks to sebastian[@]pipping[.]org for information).
2016-03-20" the the " -> " the ", or in a couple of cases replace the superfluouskrw1-1/+1
"the" with the obviously intended word. Started with a "the the" spotted by Mihal Mazurek.
2015-08-26More overflow checks in XML_GetBuffer(), adapted from FreeBSD securitymiod1-1/+5
advisory FreeBSD-SA-15:20. Most of them were already fixed by niallo@'s work, which unfortunately got removed in r1.10 /-: With help from doug@
2015-08-26Put back local changes (revisions 1.2 to 1.4), which unfortunately got lost inmiod1-2/+12
the last upgrade. ok deraadt@
2015-05-23define BYTEORDER so the endian tests will workjsg1-1/+10
ok deraadt@ miod@
2013-08-13Switch time_t, ino_t, clock_t, and struct kevent's ident and dataguenther1-1/+1
members to 64bit types. Assign new syscall numbers for (almost all) the syscalls that involve the affected types, including anything with time_t, timeval, itimerval, timespec, rusage, dirent, stat, or kevent arguments. Add a d_off member to struct dirent and replace getdirentries() with getdents(), thus immensely simplifying and accelerating telldir/seekdir. Build perl with -DBIG_TIME. Bump the major on every single base library: the compat bits included here are only good enough to make the transition; the T32 compat option will be burned as soon as we've reached the new world are are happy with the snapshots for all architectures. DANGER: ABI incompatibility. Updating to this kernel requires extra work or you won't be able to login: install a snapshot instead. Much assistance in fixing userland issues from deraadt@ and tedu@ and build assistance from todd@ and otto@
2012-08-02remove leftover NOLINT, WANTLINT, LINTFLAGS, LOBJ vars and lint targets.okan1-2/+1
ok guenther@
2012-07-07unbreak, pointed out by theojasper1-2/+1
2012-07-07actually, make this identical to what upstream expat ships nowadays by addingjasper1-2/+2
a URL field and removing the empty Requires.
2012-07-07add expat.pcjasper2-1/+82
based on a diff by brad ok sthen@
2012-04-01update libexpat to 2.1.0.rpointel7-81/+302
use arc4random instead of rand/srand in generate_hash_secret_salt, spotted by nicm@ and deraadt@. ok nicm@ deraadt@.
2010-06-26sync libexpat with upstream. mostly formating cleanup, no binary change.eric5-85/+86
ok deraadt nicm
2010-05-13merge fixes from upstream (up to rev 1.167)eric1-12/+17
notably fix a regression in parsing DTD parameter entities. ok miod@ nicm@
2009-12-27Security fix for CVE-2009-3560, which could allow attackers to causejasper1-1/+0
a DoS using a specially crafted XML document with malformed UTF-8 sequences. Patch taken from upstream CVS.
2008-06-14slightly more robust fix in not relying on utf-8 sequences being wellpvalchev1-4/+1
formed after discussion w/ upstream
2008-06-12fix parser crash w/ invalid UTF-8 char sequences (all apps that use expatpvalchev1-0/+3
for XML parsing are affected) reported & fixed in upstream cvs
2007-10-19prettyderaadt1-1/+2
2007-10-19do not install them silentlyderaadt1-3/+3
2007-10-18synch expat major number with xenocara, and then some.espie1-1/+1
activate it in the build.
2007-08-30Update to expat 2.0.1. ok deraadt@matthieu15-186/+228
2006-05-06Update to 2.0.0; keep our local changesalek21-822/+2321
ok espie@, djm@
2005-11-24use WANTLINT= (on all architectures)deraadt1-1/+2
2005-11-09- simplify integer overflow checks.niallo1-3/+2
ok otto@
2005-11-06- update comments about integer overflows to reflect reality.niallo1-3/+2
2005-11-06- fix a couple of integer overflows; the only code change so far resulting fromniallo1-0/+8
my audit at v2k5. ok espie@
2005-09-12Do not use __attribute__(regparm) on !x86 !amd64 platforms; ok espie@miod1-1/+1
2005-04-18people who import gnu fdl should stay away from the tree.jolan2-724/+0
2004-09-22OpenBSD tag.espie1-0/+1
2004-09-22OpenBSD infrastructure to compile simply, and install include files.espie3-0/+22
2004-09-22from port:espie1-21/+24
fix expat.h (from expat CVS) breakage reported by naddy@: http://sourceforge.net/tracker/index.php?func=detail&aid=676844&group_id=10127&atid=110127
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.