diff options
| author | Philip Paeps <philip@FreeBSD.org> | 2026-08-10 23:25:51 +0000 |
|---|---|---|
| committer | Philip Paeps <philip@FreeBSD.org> | 2026-08-10 23:25:51 +0000 |
| commit | ef5aa86648f5120e7badb14ea8a6cb2a312fc56b (patch) | |
| tree | bba3307cee124db2f4620b3cfb17139dd7495068 | |
| parent | 28bb687ea813d17f5dc8370ba4bdd11a397a749c (diff) | |
Vendor import of expat 2.8.3vendor/expat/2.8.3
86 files changed, 450 insertions, 77 deletions
@@ -6,29 +6,82 @@ |_| XML parser !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -!! <blink>Expat is UNDERSTAFFED and WITHOUT FUNDING.</blink> !! -!! ~~~~~~~~~~~~ !! -!! The following topics need *additional skilled C developers* to progress !! -!! in a timely manner or at all (loosely ordered by descending priority): !! -!! _______________________ !! -!! - teaming up on fixing the UNFIXED SECURITY ISSUES listed at: !! -!! """"""""""""""""""""""" !! -!! https://github.com/libexpat/libexpat/issues/1160 !! +!! <blink>Expat has UNFIXED SECURITY ISSUES!</blink> !! +!! Please see https://github.com/libexpat/libexpat/issues/1160 for details. !! !! !! -!! - teaming up on researching and fixing future security reports and !! -!! ClusterFuzz findings with few-days-max response times in communication !! -!! in order to (1) have a sound fix ready before the end of a 90 days !! -!! grace period and (2) in a sustainable manner, !! -!! !! -!! - implementing and auto-testing XML 1.0r5 support !! -!! (needs discussion before pull requests), !! -!! !! -!! For details, please reach out via e-mail to sebastian@pipping.org so we !! -!! can schedule a voice call on the topic, in English or German. !! -!! !! -!! THANK YOU! Sebastian Pipping -- Berlin, 2026-03-17 !! +!! Starting 2026-08-01, for up to six months my work maintaining libexpat !! +!! will be funded by the City of Munich as part of their !! +!! Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html) !! +!! — thank you! !! +!! Sebastian Pipping -- Berlin, 2026-08-03 !! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +Release 2.8.3 Mon August 10 2026 + Security fixes: + #1296 CVE-2026-72522 -- Fix an out-of-bounds read and the resulting + infinite loop caused by treating low surrogates (Unicode) + the same as high surrogates in functions *_toUtf16. + Needs Expat compiled with 16bit character support + (e.g. with Firefox and/or on Windows) to be affected. + Upstream CVSS 3.1 vector: + AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) + (Note the "AV:N" for network/remote, the "AV:L" in NVD by + Mitre is mistaken.) + Original bug report from Mozilla at: + https://bugzilla.mozilla.org/show_bug.cgi?id=2053153 + + Bug fixes: + #1297 #1300 lib: Fix support for 2+ GiB documents (regression from 2.8.2) + #1286 lib: Reject empty version in the XML declaration + #1305 #1306 lib: Fix printf format for AIX + + Other changes: + #1309 CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX + #1295 CMake|Windows: Add a 64bit MinGW toolchain file + #1287 #1289 CMake|Windows: Start invoking MSVC with /source-charset:utf-8 + #1289 CMake|Windows: Start requiring MSVC 2015 Update 2 or later + #1300 Document the current wrap-around issues with functions + - XML_GetCurrentByteIndex + - XML_GetCurrentColumnNumber + - XML_GetCurrentLineNumber + - XML_GetAttributeInfo + explicitly. + #1303 Address Clang Static Analyzer 22 warning + `core.NullPointerArithm` + #1313 #1314 Version info bumped from 13:2:12 (libexpat*.so.1.12.2) + to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/ + for what these numbers do + + Infrastructure: + #1311 CI: Limit workflow runtime and package installation runtime + #1310 CI: Pin Cppcheck version for a robust CI + #1310 CI: Migrate Cppcheck CI from macOS to Linux + #1312 CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten + and WASI SDK + #1304 CI: Activate AddressSanitizer for MSVC Windows CI + #1308 CI: Introduce zizmor static analysis for GitHub Actions + #1308 CI: Start using `persist-credentials: false` with Git checkout + #1219 CI: Add a 7 day cooldown to Dependabot for GitHub Actions + #1302 #1303 CI: Bump Clang from 21 to 22 + #1293 #1294 Update project status for 2026-08 + #1301 #1307 Add SPDX license identifiers to the source code + + Special thanks to: + Evgeny Kotkov + Henri Sivonen + Kartik Kenchi + Matthew Fernandez + Matthew Wozniczka + Stan Ulbrych + Tuukka Pasanen + William Woodruff + and + Anthropic + City of Munich Open Source Sabbatical + Mozilla Security Team + Subversion + zizmor static analysis + Release 2.8.2 Thu June 25 2026 Security fixes: #1246 CVE-2026-50219 -- Disallow calls to functions @@ -124,6 +177,10 @@ Release 2.8.1 Sun May 10 2026 through moderately sized crafted XML input (CWE-407). Please note that a layer of compression around XML can significantly reduce the minimum attack payload size. + Upstream CVSS 3.1 vector: + AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) + (Note the "AV:N" for network/remote and the "AC:L" + for low complexity; the NVD entry from Mitre is mistaken.) Other changes: #1209 #1213 Drop more casts related to `void *` that C99 does not need diff --git a/Makefile.am b/Makefile.am index 72f2fca59d6f..09b88f315165 100644 --- a/Makefile.am +++ b/Makefile.am @@ -75,7 +75,8 @@ _EXTRA_DIST_CMAKE = \ cmake/autotools/expat-noconfig__macos.cmake.in \ cmake/autotools/expat-noconfig__windows.cmake.in \ cmake/autotools/expat-package-init.cmake \ - cmake/mingw-toolchain.cmake \ + cmake/mingw-toolchain-win32.cmake \ + cmake/mingw-toolchain-win64.cmake \ \ CMakeLists.txt \ CMake.README \ diff --git a/Makefile.in b/Makefile.in index aa41b152525d..0f9a441aa882 100644 --- a/Makefile.in +++ b/Makefile.in @@ -481,7 +481,8 @@ _EXTRA_DIST_CMAKE = \ cmake/autotools/expat-noconfig__macos.cmake.in \ cmake/autotools/expat-noconfig__windows.cmake.in \ cmake/autotools/expat-package-init.cmake \ - cmake/mingw-toolchain.cmake \ + cmake/mingw-toolchain-win32.cmake \ + cmake/mingw-toolchain-win64.cmake \ \ CMakeLists.txt \ CMake.README \ diff --git a/README.md b/README.md index 5ad5e1e85afa..3e75af77e500 100644 --- a/README.md +++ b/README.md @@ -6,12 +6,18 @@ > [!CAUTION] > -> Expat is **understaffed** and without funding. -> There is a [call for help with details](https://github.com/libexpat/libexpat/blob/master/expat/Changes) -> at the top of the `Changes` file. +> Expat has **unfixed security issues**! +> Please see https://github.com/libexpat/libexpat/issues/1160 for details. + +> [!NOTE] +> +> Starting 2026-08-01, for up to six months my work maintaining libexpat +> will be funded by the [City of Munich](https://en.wikipedia.org/wiki/Munich) +> as part of their [Open Source Sabbatical](https://opensource.muenchen.de/software/libexpat.html#open-source-sabbatical). +> Thank you! :heart: :pray: -# Expat, Release 2.8.2 +# Expat, Release 2.8.3 This is Expat, a C99 library for parsing [XML 1.0 Fourth Edition](https://www.w3.org/TR/2006/REC-xml-20060816/), started by diff --git a/configure.ac b/configure.ac index f14c0308e1c4..ce33dd5698c8 100644 --- a/configure.ac +++ b/configure.ac @@ -90,7 +90,7 @@ dnl If the API changes incompatibly set LIBAGE back to 0 dnl LIBCURRENT=13 # sync -LIBREVISION=2 # with +LIBREVISION=3 # with LIBAGE=12 # CMakeLists.txt! AC_CONFIG_HEADERS([expat_config.h]) diff --git a/doc/reference.html b/doc/reference.html index 5c4b1c76ca78..022a2a0c043c 100644 --- a/doc/reference.html +++ b/doc/reference.html @@ -53,7 +53,7 @@ <body> <div> <h1> - The Expat XML Parser <small>Release 2.8.2</small> + The Expat XML Parser <small>Release 2.8.3</small> </h1> </div> @@ -2917,6 +2917,13 @@ XML_GetCurrentByteIndex(XML_Parser p); <code><a href="#XML_GetCurrentColumnNumber">XML_GetCurrentColumnNumber</a></code>. </div> + <p> + <strong>Note:</strong> Type <code>XML_Index</code> is known to wrap around on + 32bit platforms and 64bit Windows unless Expat has been compiled with + (non-default and uncommon) macro <code><a href= + "#XML_LARGE_SIZE">XML_LARGE_SIZE</a></code>. + </p> + <h4 id="XML_GetCurrentLineNumber"> XML_GetCurrentLineNumber </h4> @@ -2930,6 +2937,13 @@ XML_GetCurrentLineNumber(XML_Parser p); <code>1</code>. </div> + <p> + <strong>Note:</strong> Type <code>XML_Size</code> is known to wrap around on + 32bit platforms and 64bit Windows unless Expat has been compiled with + (non-default and uncommon) macro <code><a href= + "#XML_LARGE_SIZE">XML_LARGE_SIZE</a></code>. + </p> + <h4 id="XML_GetCurrentColumnNumber"> XML_GetCurrentColumnNumber </h4> @@ -2943,6 +2957,13 @@ XML_GetCurrentColumnNumber(XML_Parser p); position. The first column is reported as <code>0</code>. </div> + <p> + <strong>Note:</strong> Type <code>XML_Size</code> is known to wrap around on + 32bit platforms and 64bit Windows unless Expat has been compiled with + (non-default and uncommon) macro <code><a href= + "#XML_LARGE_SIZE">XML_LARGE_SIZE</a></code>. + </p> + <h4 id="XML_GetCurrentByteCount"> XML_GetCurrentByteCount </h4> @@ -3405,6 +3426,13 @@ typedef struct { <code>XML_GetSpecifiedAttributeCount(parser) / 2</code>. </div> + <p> + <strong>Note:</strong> Type <code>XML_Index</code> is known to wrap around on + 32bit platforms and 64bit Windows unless Expat has been compiled with + (non-default and uncommon) macro <code><a href= + "#XML_LARGE_SIZE">XML_LARGE_SIZE</a></code>. + </p> + <h4 id="XML_SetEncoding"> XML_SetEncoding </h4> diff --git a/doc/xmlwf.1 b/doc/xmlwf.1 index 3de559ec1bb3..639760bc6be4 100644 --- a/doc/xmlwf.1 +++ b/doc/xmlwf.1 @@ -5,7 +5,7 @@ \\$2 \(la\\$1\(ra\\$3 .. .if \n(.g .mso www.tmac -.TH XMLWF 1 "June 25, 2026" "" "" +.TH XMLWF 1 "August 10, 2026" "" "" .SH NAME xmlwf \- Determines if an XML document is well-formed .SH SYNOPSIS diff --git a/doc/xmlwf.xml b/doc/xmlwf.xml index 7e57cf1346b9..b1b23bee1f6f 100644 --- a/doc/xmlwf.xml +++ b/doc/xmlwf.xml @@ -21,7 +21,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [ <!ENTITY dhfirstname "<firstname>Scott</firstname>"> <!ENTITY dhsurname "<surname>Bronson</surname>"> - <!ENTITY dhdate "<date>June 25, 2026</date>"> + <!ENTITY dhdate "<date>August 10, 2026</date>"> <!-- Please adjust this^^ date whenever cutting a new release. --> <!ENTITY dhsection "<manvolnum>1</manvolnum>"> <!ENTITY dhemail "<email>bronson@rinspin.com</email>"> diff --git a/examples/element_declarations.c b/examples/element_declarations.c index d864cf70a2f7..ea790f4932b4 100644 --- a/examples/element_declarations.c +++ b/examples/element_declarations.c @@ -37,6 +37,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include <stdbool.h> diff --git a/examples/elements.c b/examples/elements.c index e5fb850d501b..ef7baeae5646 100644 --- a/examples/elements.c +++ b/examples/elements.c @@ -37,6 +37,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include <stdio.h> diff --git a/examples/outline.c b/examples/outline.c index d2df914fedb8..3168fab612cc 100644 --- a/examples/outline.c +++ b/examples/outline.c @@ -34,6 +34,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include <stdio.h> diff --git a/lib/ascii.h b/lib/ascii.h index 1f594d2e54b4..1d9cf70bf695 100644 --- a/lib/ascii.h +++ b/lib/ascii.h @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #define ASCII_A 0x41 diff --git a/lib/asciitab.h b/lib/asciitab.h index af766fb24785..43af0876ccd3 100644 --- a/lib/asciitab.h +++ b/lib/asciitab.h @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* 0x00 */ BT_NONXML, BT_NONXML, BT_NONXML, BT_NONXML, diff --git a/lib/expat.h b/lib/expat.h index c493c70441c4..dbebd985a652 100644 --- a/lib/expat.h +++ b/lib/expat.h @@ -40,6 +40,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef Expat_INCLUDED @@ -1094,7 +1096,7 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled); */ # define XML_MAJOR_VERSION 2 # define XML_MINOR_VERSION 8 -# define XML_MICRO_VERSION 2 +# define XML_MICRO_VERSION 3 # ifdef __cplusplus } diff --git a/lib/expat_external.h b/lib/expat_external.h index 7f5c4c3aae4d..4cd1f3a49c35 100644 --- a/lib/expat_external.h +++ b/lib/expat_external.h @@ -36,6 +36,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef Expat_External_INCLUDED diff --git a/lib/fallthrough.h b/lib/fallthrough.h index 707dbdd44bfe..0152d1bdc5de 100644 --- a/lib/fallthrough.h +++ b/lib/fallthrough.h @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef FALLTHROUGH_H diff --git a/lib/iasciitab.h b/lib/iasciitab.h index 5d8646f2a318..1de8d519c8b7 100644 --- a/lib/iasciitab.h +++ b/lib/iasciitab.h @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* Like asciitab.h, except that 0xD has code BT_S rather than BT_CR */ diff --git a/lib/internal.h b/lib/internal.h index 420d4217a569..7e67d2e378c5 100644 --- a/lib/internal.h +++ b/lib/internal.h @@ -53,6 +53,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(__GNUC__) && defined(__i386__) && ! defined(__MINGW32__) @@ -123,20 +125,11 @@ # define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u" # endif #else +# include <inttypes.h> // PRIdPTR, PRIuPTR # define EXPAT_FMT_LLX(midpart) "%" midpart "llx" # define EXPAT_FMT_ULL(midpart) "%" midpart "llu" -# if ! defined(ULONG_MAX) -# error Compiler did not define ULONG_MAX for us -# elif ULONG_MAX == 18446744073709551615u // 2^64-1 -# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "ld" -# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "lu" -# elif defined(__wasm32__) // 32bit mode Emscripten or WASI SDK -# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "ld" -# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "zu" -# else -# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "d" -# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u" -# endif +# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart PRIdPTR +# define EXPAT_FMT_SIZE_T(midpart) "%" midpart PRIuPTR #endif #ifndef UNUSED_P diff --git a/lib/latin1tab.h b/lib/latin1tab.h index b681d278af65..3793f4f3cc78 100644 --- a/lib/latin1tab.h +++ b/lib/latin1tab.h @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* 0x80 */ BT_OTHER, BT_OTHER, BT_OTHER, BT_OTHER, diff --git a/lib/memory_sanitizer.h b/lib/memory_sanitizer.h index a8a8006ccded..f739b88f3048 100644 --- a/lib/memory_sanitizer.h +++ b/lib/memory_sanitizer.h @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(MEMORY_SANITIZER_H) diff --git a/lib/nametab.h b/lib/nametab.h index 63485446b967..2385851562e7 100644 --- a/lib/nametab.h +++ b/lib/nametab.h @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ static const unsigned namingBitmap[] = { diff --git a/lib/random_arc4random.c b/lib/random_arc4random.c index 243fbbc82fda..5405fef2d0ca 100644 --- a/lib/random_arc4random.c +++ b/lib/random_arc4random.c @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "random_arc4random.h" diff --git a/lib/random_arc4random.h b/lib/random_arc4random.h index 54fbd4c4d38e..c935e97b0023 100644 --- a/lib/random_arc4random.h +++ b/lib/random_arc4random.h @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(RANDOM_ACR4RANDOM_H) diff --git a/lib/random_arc4random_buf.c b/lib/random_arc4random_buf.c index 5212b9f192ce..359710339804 100644 --- a/lib/random_arc4random_buf.c +++ b/lib/random_arc4random_buf.c @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "random_arc4random_buf.h" diff --git a/lib/random_arc4random_buf.h b/lib/random_arc4random_buf.h index 51f7a31f2859..1b4620ec0404 100644 --- a/lib/random_arc4random_buf.h +++ b/lib/random_arc4random_buf.h @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(RANDOM_ACR4RANDOM_BUF_H) diff --git a/lib/random_dev_urandom.c b/lib/random_dev_urandom.c index acae6ba4b047..9353fbbdf9db 100644 --- a/lib/random_dev_urandom.c +++ b/lib/random_dev_urandom.c @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "random_dev_urandom.h" diff --git a/lib/random_dev_urandom.h b/lib/random_dev_urandom.h index d9cf767bff08..0b4774d1cce3 100644 --- a/lib/random_dev_urandom.h +++ b/lib/random_dev_urandom.h @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(RANDOM_DEV_URANDOM_H) diff --git a/lib/random_getentropy.c b/lib/random_getentropy.c index 5cea2d8838b9..d258df6a7678 100644 --- a/lib/random_getentropy.c +++ b/lib/random_getentropy.c @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "random_getentropy.h" diff --git a/lib/random_getentropy.h b/lib/random_getentropy.h index a00b16bfb33d..123e75070254 100644 --- a/lib/random_getentropy.h +++ b/lib/random_getentropy.h @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(RANDOM_GETENTROPY_H) diff --git a/lib/random_getrandom.c b/lib/random_getrandom.c index 72e2cc7093be..79ae670c7f32 100644 --- a/lib/random_getrandom.c +++ b/lib/random_getrandom.c @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" // for HAVE_GETRANDOM, HAVE_SYSCALL_GETRANDOM diff --git a/lib/random_getrandom.h b/lib/random_getrandom.h index ed4d829cd0d6..423b97cad9f8 100644 --- a/lib/random_getrandom.h +++ b/lib/random_getrandom.h @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(RANDOM_GETRANDOM_H) diff --git a/lib/random_rand_s.c b/lib/random_rand_s.c index 46156563c91c..4001ce6cf182 100644 --- a/lib/random_rand_s.c +++ b/lib/random_rand_s.c @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "random_rand_s.h" diff --git a/lib/random_rand_s.h b/lib/random_rand_s.h index 2b487d62a7c5..461fc6086963 100644 --- a/lib/random_rand_s.h +++ b/lib/random_rand_s.h @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(RANDOM_RAND_S_H) diff --git a/lib/siphash.h b/lib/siphash.h index be216b4006dc..ac1fbfaf0bde 100644 --- a/lib/siphash.h +++ b/lib/siphash.h @@ -8,6 +8,8 @@ * * 1. https://www.131002.net/siphash/siphash24.c * 2. https://www.131002.net/siphash/ + * + * SPDX-License-Identifier: CC0-1.0 * -------------------------------------------------------------------------- * HISTORY: * diff --git a/lib/utf8tab.h b/lib/utf8tab.h index 88efcf91cc16..73732d1527f1 100644 --- a/lib/utf8tab.h +++ b/lib/utf8tab.h @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* 0x80 */ BT_TRAIL, BT_TRAIL, BT_TRAIL, BT_TRAIL, diff --git a/lib/xcsinc.c b/lib/xcsinc.c index 3597c2480bc9..675b2844c708 100644 --- a/lib/xcsinc.c +++ b/lib/xcsinc.c @@ -6,7 +6,7 @@ \___/_/\_\ .__/ \__,_|\__| |_| XML parser - Copyright (c) 2022 Sebastian Pipping <sebastian@pipping.org> + Copyright (c) 2022-2026 Sebastian Pipping <sebastian@pipping.org> Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -27,8 +27,14 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ +#if defined(XML_UNICODE) && defined(XML_UNICODE_WCHAR_T) +# include <wchar.h> +#endif + static size_t xcslen(const XML_Char *s) { #ifdef XML_UNICODE diff --git a/lib/xmlparse.c b/lib/xmlparse.c index 60f6cc700548..ac79b9ce7a3b 100644 --- a/lib/xmlparse.c +++ b/lib/xmlparse.c @@ -1,4 +1,4 @@ -/* 5de44e6750c6cc78818f06ed552f522a1241df0299395250e1792cb339389daf (2.8.2+) +/* ee5f82c3ffd57c5224394ba46f348dbce466d34d6c925a527ae46b1cfe6adf1d (2.8.3+) __ __ _ ___\ \/ /_ __ __ _| |_ / _ \\ /| '_ \ / _` | __| @@ -50,6 +50,7 @@ Copyright (c) 2026 Nick Begg <nick@stunttruck.net> Copyright (c) 2026 Kartik Kenchi <netliomax25@gmail.com> Copyright (c) 2026 Haris Hussain <hextheshadow0x@gmail.com> + Copyright (c) 2026 Evgeny Kotkov <kotkov@apache.org> Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -70,6 +71,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #define XML_BUILDING_EXPAT 1 @@ -93,10 +96,10 @@ #include <stddef.h> #include <string.h> /* memset(), memcpy() */ #include <assert.h> -#include <limits.h> /* INT_MAX, LLONG_MAX, LONG_MAX, UINT_MAX */ +#include <limits.h> /* INT_MAX, UINT_MAX */ #include <stdio.h> /* fprintf */ #include <stdlib.h> /* getenv */ -#include <stdint.h> /* SIZE_MAX, uintptr_t */ +#include <stdint.h> /* SIZE_MAX, UINT64_MAX, uint64_t, uintptr_t */ #include <math.h> /* isnan */ #include <errno.h> @@ -211,12 +214,6 @@ typedef char ICHAR; #endif -#ifdef XML_LARGE_SIZE -# define XML_INDEX_MAX LLONG_MAX -#else -# define XML_INDEX_MAX LONG_MAX -#endif - /* Round up n to be a multiple of sz, where sz is a power of 2. */ #define ROUND_UP(n, sz) (((n) + ((sz) - 1)) & ~((sz) - 1)) @@ -719,7 +716,7 @@ struct XML_ParserStruct { char *m_bufferEnd; // past last character to be parsed const char *m_bufferLim; // allocated end of m_buffer - XML_Index m_parseEndByteIndex; + uint64_t m_parseEndByteIndex; const char *m_parseEndPtr; size_t m_partialTokenBytesBefore; /* used in heuristic to avoid O(n^2) */ XML_Bool m_reparseDeferralEnabled; @@ -2312,7 +2309,7 @@ XML_Parse(XML_Parser parser, const char *s, int len, int isFinal) { int nLeftOver; enum XML_Status result; /* Detect overflow (a+b > MAX <==> b > MAX-a) */ - if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) { + if ((uint64_t)len > UINT64_MAX - parser->m_parseEndByteIndex) { parser->m_errorCode = XML_ERROR_NO_MEMORY; parser->m_eventPtr = parser->m_eventEndPtr = NULL; parser->m_processor = errorProcessor; @@ -2430,7 +2427,7 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) { } // Detect and avoid integer overflow - if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) { + if ((uint64_t)len > UINT64_MAX - parser->m_parseEndByteIndex) { parser->m_errorCode = XML_ERROR_NO_MEMORY; parser->m_eventPtr = parser->m_eventEndPtr = NULL; parser->m_processor = errorProcessor; @@ -2692,9 +2689,15 @@ XML_Index XMLCALL XML_GetCurrentByteIndex(XML_Parser parser) { if (parser == NULL) return -1; - if (parser->m_eventPtr) + if (parser->m_eventPtr) { + // NOTE: XML_Index is known to wrap around for >2 GiB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. return (XML_Index)(parser->m_parseEndByteIndex - (parser->m_parseEndPtr - parser->m_eventPtr)); + } return -1; } @@ -2736,7 +2739,12 @@ XML_GetCurrentLineNumber(XML_Parser parser) { parser->m_eventPtr, &parser->m_position); parser->m_positionPtr = parser->m_eventPtr; } - return parser->m_position.lineNumber + 1; + // NOTE: XML_Size is known to wrap around for >2 4iB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. + return (XML_Size)(parser->m_position.lineNumber + 1); } XML_Size XMLCALL @@ -2748,7 +2756,12 @@ XML_GetCurrentColumnNumber(XML_Parser parser) { parser->m_eventPtr, &parser->m_position); parser->m_positionPtr = parser->m_eventPtr; } - return parser->m_position.columnNumber; + // NOTE: XML_Size is known to wrap around for >2 4iB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. + return (XML_Size)parser->m_position.columnNumber; } void XMLCALL @@ -3905,14 +3918,22 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr, if (! attId) return XML_ERROR_NO_MEMORY; #ifdef XML_ATTR_INFO + // NOTE: XML_Index is known to wrap around for >2 GiB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. currAttInfo->nameStart - = parser->m_parseEndByteIndex - (parser->m_parseEndPtr - currAtt->name); + = (XML_Index)(parser->m_parseEndByteIndex + - (parser->m_parseEndPtr - currAtt->name)); currAttInfo->nameEnd = currAttInfo->nameStart + XmlNameLength(enc, currAtt->name); - currAttInfo->valueStart = parser->m_parseEndByteIndex - - (parser->m_parseEndPtr - currAtt->valuePtr); - currAttInfo->valueEnd = parser->m_parseEndByteIndex - - (parser->m_parseEndPtr - currAtt->valueEnd); + currAttInfo->valueStart + = (XML_Index)(parser->m_parseEndByteIndex + - (parser->m_parseEndPtr - currAtt->valuePtr)); + currAttInfo->valueEnd + = (XML_Index)(parser->m_parseEndByteIndex + - (parser->m_parseEndPtr - currAtt->valueEnd)); #endif /* Detect duplicate attributes by their QNames. This does not work when namespace processing is turned on and different prefixes for the same @@ -6554,11 +6575,12 @@ storeAttributeValue(XML_Parser parser, const ENCODING *enc, XML_Bool isCdata, // Check if entity is complete, if not, mark down how much of it is // processed. A XML_SUSPENDED check here is not required as // appendAttributeValue will never suspend the parser. - if (textEnd != nextInEntity) { + if (nextInEntity < textEnd) { entity->processed = (int)(nextInEntity - (const char *)entity->textPtr); continue; } + assert(nextInEntity == textEnd); // Entity is complete. We cannot close it here since we need to first // process its possible inner entities (which are added to the @@ -8192,7 +8214,7 @@ poolGrow(STRING_POOL *pool) { pool->freeBlocks = tem; memcpy(pool->blocks->s, pool->start, (pool->end - pool->start) * sizeof(XML_Char)); - pool->ptr = pool->blocks->s + (pool->ptr - pool->start); + pool->ptr = pool->blocks->s + EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start); pool->start = pool->blocks->s; pool->end = pool->start + pool->blocks->size; return XML_TRUE; @@ -8205,7 +8227,8 @@ poolGrow(STRING_POOL *pool) { /* NOTE: Needs to be calculated prior to calling `realloc` to avoid dangling pointers: */ - const ptrdiff_t offsetInsideBlock = pool->ptr - pool->start; + const ptrdiff_t offsetInsideBlock + = EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start); if (blockSize < 0) { /* This condition traps a situation where either more than @@ -8268,8 +8291,9 @@ poolGrow(STRING_POOL *pool) { tem->next = pool->blocks; pool->blocks = tem; if (pool->ptr != pool->start) - memcpy(tem->s, pool->start, (pool->ptr - pool->start) * sizeof(XML_Char)); - pool->ptr = tem->s + (pool->ptr - pool->start); + memcpy(tem->s, pool->start, + EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start) * sizeof(XML_Char)); + pool->ptr = tem->s + EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start); pool->start = tem->s; pool->end = tem->s + blockSize; } diff --git a/lib/xmlrole.c b/lib/xmlrole.c index d56bee82dd2d..8f6bedda7165 100644 --- a/lib/xmlrole.c +++ b/lib/xmlrole.c @@ -37,6 +37,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff --git a/lib/xmlrole.h b/lib/xmlrole.h index 9d0d4ff11b7f..903a6951f434 100644 --- a/lib/xmlrole.h +++ b/lib/xmlrole.h @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef XmlRole_INCLUDED diff --git a/lib/xmltok.c b/lib/xmltok.c index 387c6e44a25f..d66af6045f07 100644 --- a/lib/xmltok.c +++ b/lib/xmltok.c @@ -12,7 +12,7 @@ Copyright (c) 2002 Greg Stein <gstein@users.sourceforge.net> Copyright (c) 2002-2016 Karl Waclawek <karl@waclawek.net> Copyright (c) 2005-2009 Steven Solie <steven@solie.ca> - Copyright (c) 2016-2024 Sebastian Pipping <sebastian@pipping.org> + Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org> Copyright (c) 2016 Pascal Cuoq <cuoq@trust-in-soft.com> Copyright (c) 2016 Don Lewis <truckman@apache.org> Copyright (c) 2017 Rhodri James <rhodri@wildebeest.org.uk> @@ -26,6 +26,7 @@ Copyright (c) 2023 Hanno Böck <hanno@gentoo.org> Copyright (c) 2025 Alfonso Gregory <gfunni234@gmail.com> Copyright (c) 2026 Nick Begg <nick@stunttruck.net> + Copyright (c) 2026 Kartik Kenchi <netliomax25@gmail.com> Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -46,6 +47,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" @@ -705,9 +708,10 @@ unicode_byte_type(char hi, char lo) { enum XML_Convert_Result res = XML_CONVERT_COMPLETED; \ UNUSED_P(enc); \ fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1); /* shrink to even */ \ - /* Avoid copying first half only of surrogate */ \ + /* Avoid copying the first half (2 bytes) of surrogate pairs (4 bytes) */ \ if (fromLim - *fromP > ((toLim - *toP) << 1) \ - && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) { \ + && /* are the last two bytes a high surrogate (0xD800-0xDBFF)? */ \ + (GET_HI(fromLim - 2) & 0xFC) == 0xD8) { \ fromLim -= 2; \ res = XML_CONVERT_INPUT_INCOMPLETE; \ } \ @@ -1177,6 +1181,13 @@ doParseXmlDecl(const ENCODING *(*encodingFinder)(const ENCODING *, const char *, *versionPtr = val; if (versionEndPtr) *versionEndPtr = ptr; + /* The version number must not be empty; VersionNum requires at least + one character. The encoding and standalone pseudo-attributes below + already reject an empty value, so keep version consistent. */ + if (val == ptr - enc->minBytesPerChar) { + *badPtr = val; + return 0; + } if (! parsePseudoAttribute(enc, ptr, end, &name, &nameEnd, &val, &ptr)) { *badPtr = ptr; return 0; diff --git a/lib/xmltok.h b/lib/xmltok.h index 79a9fb76871f..bd868b87a407 100644 --- a/lib/xmltok.h +++ b/lib/xmltok.h @@ -10,7 +10,7 @@ Copyright (c) 2000 Clark Cooper <coopercc@users.sourceforge.net> Copyright (c) 2002 Fred L. Drake, Jr. <fdrake@users.sourceforge.net> Copyright (c) 2002-2005 Karl Waclawek <karl@waclawek.net> - Copyright (c) 2016-2024 Sebastian Pipping <sebastian@pipping.org> + Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org> Copyright (c) 2017 Rhodri James <rhodri@wildebeest.org.uk> Licensed under the MIT license: @@ -32,11 +32,15 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef XmlTok_INCLUDED # define XmlTok_INCLUDED 1 +# include <stdint.h> // uint64_t + # ifdef __cplusplus extern "C" { # endif @@ -145,8 +149,8 @@ extern "C" { typedef struct position { /* first line and first column are 0 not 1 */ - XML_Size lineNumber; - XML_Size columnNumber; + uint64_t lineNumber; + uint64_t columnNumber; } POSITION; typedef struct { diff --git a/lib/xmltok_impl.c b/lib/xmltok_impl.c index eae11bdd968a..1d8e457d9de5 100644 --- a/lib/xmltok_impl.c +++ b/lib/xmltok_impl.c @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef XML_TOK_IMPL_C diff --git a/lib/xmltok_impl.h b/lib/xmltok_impl.h index 3469c4ae138c..13a08899da3b 100644 --- a/lib/xmltok_impl.h +++ b/lib/xmltok_impl.h @@ -29,6 +29,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ enum { diff --git a/lib/xmltok_ns.c b/lib/xmltok_ns.c index 810ca2c6d048..40a02a0308b5 100644 --- a/lib/xmltok_ns.c +++ b/lib/xmltok_ns.c @@ -33,6 +33,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef XML_TOK_NS_C diff --git a/tests/acc_tests.c b/tests/acc_tests.c index 2e078e6adff5..5e38dee0f5e2 100644 --- a/tests/acc_tests.c +++ b/tests/acc_tests.c @@ -39,6 +39,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff --git a/tests/acc_tests.h b/tests/acc_tests.h index bbb93f37ed20..6fc0dcac9d98 100644 --- a/tests/acc_tests.h +++ b/tests/acc_tests.h @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff --git a/tests/alloc_tests.c b/tests/alloc_tests.c index d97bb277e1e8..c7939708e061 100644 --- a/tests/alloc_tests.c +++ b/tests/alloc_tests.c @@ -41,6 +41,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) diff --git a/tests/alloc_tests.h b/tests/alloc_tests.h index 1eae130be78f..6dcc7b4cf513 100644 --- a/tests/alloc_tests.h +++ b/tests/alloc_tests.h @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff --git a/tests/basic_tests.c b/tests/basic_tests.c index d4dd9adce1fd..308adf6cbce0 100644 --- a/tests/basic_tests.c +++ b/tests/basic_tests.c @@ -22,6 +22,7 @@ Copyright (c) 2024-2026 Berkay Eren Ürün <berkay.ueruen@siemens.com> Copyright (c) 2026 Francesco Bertolaccini Copyright (c) 2026 Matthew Fernandez <matthew.fernandez@gmail.com> + Copyright (c) 2026 Kartik Kenchi <netliomax25@gmail.com> Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -42,6 +43,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) @@ -51,7 +54,7 @@ #include "expat_config.h" #include <assert.h> - +#include <limits.h> // ULONG_MAX #include <stdbool.h> #include <stdio.h> #include <string.h> @@ -67,6 +70,21 @@ #include "siphash.h" #include "basic_tests.h" +#define EXPAT_TESTS_ASAN 1 + +#if defined(__has_feature) +# if ! __has_feature(address_sanitizer) +# undef EXPAT_TESTS_ASAN +# define EXPAT_TESTS_ASAN 0 +# endif +#endif + +#if ULONG_MAX == 18446744073709551615u // 2^64-1 +# define EXPAT_TESTS_64BIT 1 +#else +# define EXPAT_TESTS_64BIT 0 +#endif + static void basic_setup(void) { g_parser = XML_ParserCreate(NULL); @@ -971,6 +989,14 @@ START_TEST(test_xmldecl_missing_value) { } END_TEST +START_TEST(test_xmldecl_empty_version) { + expect_failure("<?xml version=''?>\n" + "<doc/>", + XML_ERROR_XML_DECL, + "Failed to report empty version in XML declaration"); +} +END_TEST + /* Regression test for SF bug #584832. */ START_TEST(test_unknown_encoding_internal_entity) { const char *text = "<?xml version='1.0' encoding='unsupported-encoding'?>\n" @@ -3429,12 +3455,16 @@ START_TEST(test_buffer_can_grow_to_max) { if (s != XML_STATUS_OK) xml_failure(parser); +// Avoid running into "AddressSanitizer: out of memory" on 32bit Windows +#if ! defined(_WIN32) || EXPAT_TESTS_ASAN == 0 || EXPAT_TESTS_64BIT == 1 // XML_CONTEXT_BYTES of the prefix may remain in the buffer; // subtracting the whole prefix is easiest, and close enough. assert_true(XML_GetBuffer(parser, maxbuf - prefix_len) != NULL); // The limit should be consistent; no prefix should allow us to // reach above the max buffer size. assert_true(XML_GetBuffer(parser, maxbuf + 1) == NULL); +#endif + XML_ParserFree(parser); } } @@ -6647,6 +6677,7 @@ make_basic_test_case(Suite *s) { tcase_add_test(tc_basic, test_xmldecl_invalid); tcase_add_test(tc_basic, test_xmldecl_missing_attr); tcase_add_test(tc_basic, test_xmldecl_missing_value); + tcase_add_test(tc_basic, test_xmldecl_empty_version); tcase_add_test__if_xml_ge(tc_basic, test_unknown_encoding_internal_entity); tcase_add_test(tc_basic, test_unrecognised_encoding_internal_entity); tcase_add_test__ifdef_xml_dtd(tc_basic, test_ext_entity_set_encoding); diff --git a/tests/basic_tests.h b/tests/basic_tests.h index 4c16562ca0fd..e8a8488773ed 100644 --- a/tests/basic_tests.h +++ b/tests/basic_tests.h @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff --git a/tests/chardata.c b/tests/chardata.c index ef50a714856d..a36d58c24f36 100644 --- a/tests/chardata.c +++ b/tests/chardata.c @@ -33,6 +33,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) diff --git a/tests/chardata.h b/tests/chardata.h index ccb631f64b22..51b18afe3ffe 100644 --- a/tests/chardata.h +++ b/tests/chardata.h @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff --git a/tests/common.c b/tests/common.c index 3c4a3661a8bc..e2980cbcadbd 100644 --- a/tests/common.c +++ b/tests/common.c @@ -40,6 +40,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff --git a/tests/common.h b/tests/common.h index 2d1a5f207a09..cf1635de0592 100644 --- a/tests/common.h +++ b/tests/common.h @@ -39,6 +39,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff --git a/tests/dummy.c b/tests/dummy.c index 4ab57edd2cf2..57ef8b1ae589 100644 --- a/tests/dummy.c +++ b/tests/dummy.c @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat.h" diff --git a/tests/dummy.h b/tests/dummy.h index 3d7ec63ed336..9a75b6fe9244 100644 --- a/tests/dummy.h +++ b/tests/dummy.h @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff --git a/tests/handlers.c b/tests/handlers.c index bdc0e148a23b..7fc4b7e50cd6 100644 --- a/tests/handlers.c +++ b/tests/handlers.c @@ -42,6 +42,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) diff --git a/tests/handlers.h b/tests/handlers.h index 54e084cdb920..02c170d226d2 100644 --- a/tests/handlers.h +++ b/tests/handlers.h @@ -41,6 +41,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff --git a/tests/memcheck.c b/tests/memcheck.c index 2f43347e1717..b670b322c012 100644 --- a/tests/memcheck.c +++ b/tests/memcheck.c @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include <stdio.h> diff --git a/tests/memcheck.h b/tests/memcheck.h index 4c0cb7281b91..7255aba14796 100644 --- a/tests/memcheck.h +++ b/tests/memcheck.h @@ -29,6 +29,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff --git a/tests/minicheck.c b/tests/minicheck.c index d452864e00fc..7ded6172c4af 100644 --- a/tests/minicheck.c +++ b/tests/minicheck.c @@ -37,6 +37,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) diff --git a/tests/minicheck.h b/tests/minicheck.h index 140eaaa5c105..d80c8603c637 100644 --- a/tests/minicheck.h +++ b/tests/minicheck.h @@ -37,6 +37,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff --git a/tests/misc_tests.c b/tests/misc_tests.c index fb85c1acec28..82b4b54b15bf 100644 --- a/tests/misc_tests.c +++ b/tests/misc_tests.c @@ -22,6 +22,7 @@ Copyright (c) 2025 Berkay Eren Ürün <berkay.ueruen@siemens.com> Copyright (c) 2026 Matthew Fernandez <matthew.fernandez@gmail.com> Copyright (c) 2026 Kartik Kenchi <netliomax25@gmail.com> + Copyright (c) 2026 Evgeny Kotkov <kotkov@apache.org> Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -42,6 +43,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) @@ -214,7 +217,7 @@ START_TEST(test_misc_version) { if (! versions_equal(&read_version, &parsed_version)) fail("Version mismatch"); - if (xcstrcmp(version_text, XCS("expat_2.8.2")) + if (xcstrcmp(version_text, XCS("expat_2.8.3")) != 0) /* needs bump on releases */ fail("XML_*_VERSION in expat.h out of sync?\n"); } @@ -836,6 +839,70 @@ START_TEST(test_misc_resume_parser_forbidden_from_handler) { } END_TEST +// General attack payload idea by Jason Kratzer of Mozilla +START_TEST(test_misc_low_surrogate_mozilla_bug_2053153) { + const char doc_before[] = "<\0!\0D\0O\0C\0T\0Y\0P\0E\0 \0d\0 \0[\0\n\0" + " \0 \0<\0!\0E\0N\0T\0I\0T\0Y\0 \0e\0 \0'\0"; + const char doc_after[] = "'\0>\0\n\0]\0>\0\n\0" + "<\0r\0 \0a\0=\0'\0&\0e\0;\0'\0/\0>\0\n\0"; + + for (size_t i = 1021; i <= 1025; i++) { + set_subtest("[%d]", (int)i); + + XML_Parser parser = XML_ParserCreate(NULL); + + assert_true(_XML_Parse_SINGLE_BYTES(parser, doc_before, + (int)sizeof(doc_before) - 1, + /*isFinal=*/XML_FALSE)); + + for (size_t j = 0; j < i; j++) { + assert_true( + _XML_Parse_SINGLE_BYTES(parser, "a\\0", 2, /*isFinal=*/XML_FALSE)); + } + + // Thinking Python, this is: + // ''.join([f'\\x{e:02x}' for e in '😀'.encode('UTF-16-LE')]) + assert_true(_XML_Parse_SINGLE_BYTES(parser, "\x3d\xd8\x00\xde", 4, + /*isFinal=*/XML_FALSE)); + + assert_true(_XML_Parse_SINGLE_BYTES( + parser, doc_after, (int)sizeof(doc_after) - 1, /*isFinal=*/XML_TRUE)); + + XML_ParserFree(parser); + } +} +END_TEST + +START_TEST(test_misc_input_2gb) { + XML_Parser parser; + const char *const doc = "<?xml version='1.0'?><doc/>"; + unsigned long long offset = 0; + char buf[4096]; + + if (g_chunkSize != 0) { + return; // this test is slow, and doesn't use _XML_Parse_SINGLE_BYTES(). + } + + memset(buf, ' ', sizeof(buf)); + + parser = XML_ParserCreate(NULL); + + assert_true(XML_Parse(parser, doc, (int)strlen(doc), XML_FALSE) + == XML_STATUS_OK); + offset += strlen(doc); + + while (offset < 2ULL * 1024 * 1024 * 1024) { + assert_true(XML_Parse(parser, buf, sizeof(buf), XML_FALSE) + == XML_STATUS_OK); + offset += sizeof(buf); + } + + assert_true(XML_Parse(parser, NULL, 0, XML_TRUE) == XML_STATUS_OK); + + XML_ParserFree(parser); +} +END_TEST + void make_miscellaneous_test_case(Suite *s) { TCase *tc_misc = tcase_create("miscellaneous tests"); @@ -869,4 +936,6 @@ make_miscellaneous_test_case(Suite *s) { tcase_add_test(tc_misc, test_misc_no_infinite_loop_issue_1161); tcase_add_test(tc_misc, test_misc_calls_forbidden_from_handlers); tcase_add_test(tc_misc, test_misc_resume_parser_forbidden_from_handler); + tcase_add_test(tc_misc, test_misc_input_2gb); + tcase_add_test(tc_misc, test_misc_low_surrogate_mozilla_bug_2053153); } diff --git a/tests/misc_tests.h b/tests/misc_tests.h index 3d9c4b8a4065..4cff492e4c90 100644 --- a/tests/misc_tests.h +++ b/tests/misc_tests.h @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff --git a/tests/ns_tests.c b/tests/ns_tests.c index 411e1d3c974a..e130e6b66731 100644 --- a/tests/ns_tests.c +++ b/tests/ns_tests.c @@ -39,6 +39,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff --git a/tests/ns_tests.h b/tests/ns_tests.h index acb0db786a40..72d13532e61e 100644 --- a/tests/ns_tests.h +++ b/tests/ns_tests.h @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff --git a/tests/nsalloc_tests.c b/tests/nsalloc_tests.c index 830bd1953b73..b8c361ae25df 100644 --- a/tests/nsalloc_tests.c +++ b/tests/nsalloc_tests.c @@ -39,6 +39,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) diff --git a/tests/nsalloc_tests.h b/tests/nsalloc_tests.h index 026a2a21a950..59ec6c559847 100644 --- a/tests/nsalloc_tests.h +++ b/tests/nsalloc_tests.h @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff --git a/tests/runtests.c b/tests/runtests.c index ecb1c36be584..51fd131e99f9 100644 --- a/tests/runtests.c +++ b/tests/runtests.c @@ -40,6 +40,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff --git a/tests/structdata.c b/tests/structdata.c index babdba054933..b39c6cfb779b 100644 --- a/tests/structdata.c +++ b/tests/structdata.c @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) diff --git a/tests/structdata.h b/tests/structdata.h index 09881b175f75..2fb9fca714c1 100644 --- a/tests/structdata.h +++ b/tests/structdata.h @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff --git a/xmlwf/codepage.c b/xmlwf/codepage.c index 8e0b5d199cdd..65e0404398cc 100644 --- a/xmlwf/codepage.c +++ b/xmlwf/codepage.c @@ -32,6 +32,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "codepage.h" diff --git a/xmlwf/codepage.h b/xmlwf/codepage.h index 75ddbce4a456..7ebf1e5536be 100644 --- a/xmlwf/codepage.h +++ b/xmlwf/codepage.h @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ int codepageMap(int cp, int *map); diff --git a/xmlwf/ct.c b/xmlwf/ct.c index d4c0e7a0a95d..2526c719e90d 100644 --- a/xmlwf/ct.c +++ b/xmlwf/ct.c @@ -29,6 +29,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #define CHARSET_MAX 41 diff --git a/xmlwf/filemap.h b/xmlwf/filemap.h index b4dc9432424f..a3940b40a065 100644 --- a/xmlwf/filemap.h +++ b/xmlwf/filemap.h @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include <limits.h> /* INT_MAX */ diff --git a/xmlwf/readfilemap.c b/xmlwf/readfilemap.c index d8e7fce42ead..78086a5402b2 100644 --- a/xmlwf/readfilemap.c +++ b/xmlwf/readfilemap.c @@ -35,6 +35,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include <sys/types.h> diff --git a/xmlwf/unixfilemap.c b/xmlwf/unixfilemap.c index 155313fdad38..5ebffe35ba05 100644 --- a/xmlwf/unixfilemap.c +++ b/xmlwf/unixfilemap.c @@ -33,6 +33,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include <sys/types.h> diff --git a/xmlwf/win32filemap.c b/xmlwf/win32filemap.c index a0ed75beb92d..59ff2cfb7d46 100644 --- a/xmlwf/win32filemap.c +++ b/xmlwf/win32filemap.c @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #define STRICT 1 diff --git a/xmlwf/xmlfile.c b/xmlwf/xmlfile.c index 21a7073b2943..0b5f5d67298c 100644 --- a/xmlwf/xmlfile.c +++ b/xmlwf/xmlfile.c @@ -39,6 +39,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff --git a/xmlwf/xmlfile.h b/xmlwf/xmlfile.h index 579201ccf498..c4c8c82cd5cb 100644 --- a/xmlwf/xmlfile.h +++ b/xmlwf/xmlfile.h @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #define XML_MAP_FILE 01 diff --git a/xmlwf/xmlmime.c b/xmlwf/xmlmime.c index 883e293dac4f..2c08eea012db 100644 --- a/xmlwf/xmlmime.c +++ b/xmlwf/xmlmime.c @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include <string.h> diff --git a/xmlwf/xmlmime.h b/xmlwf/xmlmime.h index 591a8847760c..87665bf6cd9d 100644 --- a/xmlwf/xmlmime.h +++ b/xmlwf/xmlmime.h @@ -29,6 +29,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff --git a/xmlwf/xmltchar.h b/xmlwf/xmltchar.h index 30283d086dde..448119d84fc0 100644 --- a/xmlwf/xmltchar.h +++ b/xmlwf/xmltchar.h @@ -29,6 +29,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* Ensures compile-time constants are consistent */ diff --git a/xmlwf/xmlwf.c b/xmlwf/xmlwf.c index 0374fe6685d7..57beef1f75c6 100644 --- a/xmlwf/xmlwf.c +++ b/xmlwf/xmlwf.c @@ -43,6 +43,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff --git a/xmlwf/xmlwf_helpgen.py b/xmlwf/xmlwf_helpgen.py index 18df46dd65c8..d80020550273 100755 --- a/xmlwf/xmlwf_helpgen.py +++ b/xmlwf/xmlwf_helpgen.py @@ -28,6 +28,8 @@ # DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR # OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE # USE OR OTHER DEALINGS IN THE SOFTWARE. +# +# SPDX-License-Identifier: MIT import argparse from textwrap import dedent diff --git a/xmlwf/xmlwf_helpgen.sh b/xmlwf/xmlwf_helpgen.sh index 864e47086d15..ac3c33ea00b5 100755 --- a/xmlwf/xmlwf_helpgen.sh +++ b/xmlwf/xmlwf_helpgen.sh @@ -27,6 +27,8 @@ # DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR # OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE # USE OR OTHER DEALINGS IN THE SOFTWARE. +# +# SPDX-License-Identifier: MIT ./xmlwf/xmlwf_helpgen.py | sed \ -e 's,usage: ,usage:,' \ |