From df3d394e9e17e61dbe01584978ab4085183afdd0 Mon Sep 17 00:00:00 2001 From: rajc6h6 Date: Tue, 10 Mar 2026 14:02:24 +0530 Subject: [PATCH] expat: Fix CVE-2022-25235 - missing UTF-8 encoding validation in xmltok_impl.c - Added IS_INVALID_CHAR guard in CHECK_NAME_CASE macro - Added IS_INVALID_CHAR guard in CHECK_NMSTRT_CASE macro - Added IS_INVALID_CHAR guard in prologTok LEAD_CASE block Backport of upstream libexpat fix from v2.4.5 (PR #562). Closes #290 --- contrib/sdk/sources/expat/lib/xmltok_impl.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/contrib/sdk/sources/expat/lib/xmltok_impl.c b/contrib/sdk/sources/expat/lib/xmltok_impl.c index 9c2895b87..18acdbac1 100644 --- a/contrib/sdk/sources/expat/lib/xmltok_impl.c +++ b/contrib/sdk/sources/expat/lib/xmltok_impl.c @@ -34,7 +34,7 @@ case BT_LEAD ## n: \ if (end - ptr < n) \ return XML_TOK_PARTIAL_CHAR; \ - if (!IS_NAME_CHAR(enc, ptr, n)) { \ + if (IS_INVALID_CHAR(enc, ptr, n) || !IS_NAME_CHAR(enc, ptr, n)) { \ *nextTokPtr = ptr; \ return XML_TOK_INVALID; \ } \ @@ -62,7 +62,7 @@ case BT_LEAD ## n: \ if (end - ptr < n) \ return XML_TOK_PARTIAL_CHAR; \ - if (!IS_NMSTRT_CHAR(enc, ptr, n)) { \ + if (IS_INVALID_CHAR(enc, ptr, n) || !IS_NMSTRT_CHAR(enc, ptr, n)) { \ *nextTokPtr = ptr; \ return XML_TOK_INVALID; \ } \ @@ -1097,6 +1097,10 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end, case BT_LEAD ## n: \ if (end - ptr < n) \ return XML_TOK_PARTIAL_CHAR; \ + if (IS_INVALID_CHAR(enc, ptr, n)) { \ + *nextTokPtr = ptr; \ + return XML_TOK_INVALID; \ + } \ if (IS_NMSTRT_CHAR(enc, ptr, n)) { \ ptr += n; \ tok = XML_TOK_NAME; \ -- 2.54.0