git: 94fd9b50590d - stable/15 - contrib/expat: import expat 2.9.0
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sat, 10 Oct 2026 06:45:14 UTC
The branch stable/15 has been updated by philip:
URL: https://cgit.FreeBSD.org/src/commit/?id=94fd9b50590d114164755e7e6909334fe69c4e98
commit 94fd9b50590d114164755e7e6909334fe69c4e98
Author: Philip Paeps <philip@FreeBSD.org>
AuthorDate: 2026-10-06 07:05:31 +0000
Commit: Philip Paeps <philip@FreeBSD.org>
CommitDate: 2026-10-10 02:43:40 +0000
contrib/expat: import expat 2.9.0
Changes: https://github.com/libexpat/libexpat/blob/R_2_9_0/expat/Changes
Security: CVE-2026-102633
Security: CVE-2026-77214
(cherry picked from commit 22c3edb31297a79ec3c7bf8f906be2df11b472d2)
---
contrib/expat/Changes | 128 ++++-
contrib/expat/Makefile.in | 3 -
contrib/expat/README.md | 2 +-
contrib/expat/configure.ac | 27 +-
contrib/expat/doc/Makefile.in | 3 -
contrib/expat/doc/reference.html | 754 +++++++++++++++++++++---
contrib/expat/doc/xmlwf.1 | 2 +-
contrib/expat/doc/xmlwf.xml | 2 +-
contrib/expat/examples/Makefile.in | 3 -
contrib/expat/examples/element_declarations.c | 14 +-
contrib/expat/examples/elements.c | 14 +-
contrib/expat/examples/outline.c | 14 +-
contrib/expat/expat_config.h.in | 4 -
contrib/expat/fuzz/xml_parse_fuzzer.c | 2 +-
contrib/expat/fuzz/xml_parsebuffer_fuzzer.c | 2 +-
contrib/expat/lib/Makefile.am | 3 +-
contrib/expat/lib/Makefile.in | 43 +-
contrib/expat/lib/expat.h | 99 +++-
contrib/expat/lib/expat_external.h | 3 +
contrib/expat/lib/internal.h | 12 +-
contrib/expat/lib/libexpat.map.in | 17 +-
contrib/expat/lib/xcs.c | 90 +++
contrib/expat/lib/{xcsinc.c => xcs.h} | 36 +-
contrib/expat/lib/xmlparse.c | 549 +++++++++++++-----
contrib/expat/lib/xmltok.c | 280 ++-------
contrib/expat/lib/xmltok_impl.c | 2 +-
contrib/expat/tests/Makefile.am | 6 +-
contrib/expat/tests/Makefile.in | 23 +-
contrib/expat/tests/acc_tests.c | 37 ++
contrib/expat/tests/alloc_tests.c | 59 ++
contrib/expat/tests/basic_tests.c | 170 ++++--
contrib/expat/tests/benchmark/Makefile.in | 3 -
contrib/expat/tests/benchmark/benchmark.c | 19 +-
contrib/expat/tests/chardata.c | 4 +-
contrib/expat/tests/common.c | 11 +-
contrib/expat/tests/common.h | 6 -
contrib/expat/tests/handlers.c | 115 ++--
contrib/expat/tests/misc_tests.c | 114 +++-
contrib/expat/tests/props_tests.c | 790 ++++++++++++++++++++++++++
contrib/expat/tests/props_tests.h | 41 ++
contrib/expat/tests/runtests.c | 20 +-
contrib/expat/tests/structdata.c | 11 +-
contrib/expat/tests/xcs_tests.c | 86 +++
contrib/expat/tests/xcs_tests.h | 41 ++
contrib/expat/xmlwf/Makefile.am | 3 +-
contrib/expat/xmlwf/Makefile.in | 46 +-
contrib/expat/xmlwf/xmlfile.c | 9 +-
contrib/expat/xmlwf/xmlfile.h | 8 +-
contrib/expat/xmlwf/xmlwf.c | 31 +-
lib/libexpat/Makefile | 2 +-
lib/libexpat/expat_config.h | 6 +-
lib/libexpat/libbsdxml.3 | 4 +-
52 files changed, 2945 insertions(+), 828 deletions(-)
diff --git a/contrib/expat/Changes b/contrib/expat/Changes
index bf94e9db5616..91513379bb49 100644
--- a/contrib/expat/Changes
+++ b/contrib/expat/Changes
@@ -5,21 +5,108 @@
\___/_/\_\ .__/ \__,_|\__|
|_| XML parser
-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
-!! <blink>Expat has UNFIXED SECURITY ISSUES!</blink> !!
-!! Please see https://github.com/libexpat/libexpat/issues/1160 for details. !!
-!! !!
-!! Starting 2026-08-01, for up to six months my work maintaining libexpat !!
-!! will be funded by the City of Munich as part of their !!
-!! Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html) !!
-!! — thank you! !!
-!! !!
-!! If your business relies on Expat beyond January 2027, please consider !!
-!! funding the maintenance of Expat to ensure its health and security for !!
-!! you and others. Thank you! !!
-!! !!
-!! Sebastian Pipping -- Berlin, 2026-09-22 !!
-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+///////////////////////////////////////////////////////////////////////////////
+// <blink>Expat has UNFIXED SECURITY ISSUES!</blink> //
+// Please see https://github.com/libexpat/libexpat/issues/1160 for details. //
+// //
+// Starting 2026-08-01, for up to six months my work maintaining libexpat //
+// will be funded by the City of Munich as part of their //
+// Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html) //
+// — thank you! //
+// //
+// If your business relies on Expat beyond January 2027, please consider //
+// funding the maintenance of Expat to ensure its health and security for //
+// you and others. Thank you! //
+// //
+// Sebastian Pipping -- Berlin, 2026-09-22 //
+///////////////////////////////////////////////////////////////////////////////
+
+Release 2.9.0 Mon October 5 2026
+ Security fixes:
+ #1392 CVE-2026-102633 -- Integer overflow in function
+ expat_realloc on 32bit platforms
+ #1393 CVE-2026-77214 -- Validate parameter `len` against available
+ buffer capacity in XML_ParseBuffer
+
+ Bug fixes:
+ #1387 lib: Handle OOM when copying encodingName in XML_ParserReset
+
+ New features:
+ #1327 lib: Introduce new "Properties API" to get and set
+ scalar properties for a single parser instance.
+ There are six new functions:
+ - XML_GetPropertyBool
+ - XML_GetPropertyDouble
+ - XML_GetPropertyUInt64
+ - XML_SetPropertyBool
+ - XML_SetPropertyDouble
+ - XML_SetPropertyUInt64
+ And two new enums:
+ - XML_Prop_Error
+ - XML_Parser_Property
+ #1323 lib: Introduce five new 64bit location API functions:
+ - XML_GetCurrentByteCount64
+ - XML_GetCurrentByteIndex64
+ - XML_GetCurrentColumnNumber64
+ - XML_GetCurrentLineNumber64
+ - XML_GetInputContext64
+ These five functions closely mirror their predecessors
+ but are not prone to 32bit integer wrap-around.
+
+ Other changes:
+ #1391 docs: Document the scope of function XML_GetErrorCode
+ #1395 docs: Document length expectations for XML_ParseBuffer
+ #1394 lib: Call unknown encoding release before parser teardown
+ #1370 #1373 lib: Drop (disabled-by-default) attribute info feature
+ These things are now gone:
+ - Public function XML_GetAttributeInfo
+ - Public struct XML_AttrInfo
+ - Macro XML_ATTR_INFO
+ These things are now causing build errors:
+ - Configure option --enable-xml-attr-info
+ - CMake option -DEXPAT_ATTR_INFO=ON
+ #1379 #1382 lib: Drop (disabled-by-default) minimum size feature
+ These things are now gone:
+ - Macro XML_MIN_SIZE
+ These things are now causing build errors:
+ - Configuring with -DXML_MIN_SIZE for CPPFLAGS/CFLAGS
+ - CMake option -DEXPAT_MIN_SIZE=ON
+ #1323 #1411 lib: Deprecate macro XML_LARGE_SIZE (use the new 64bit
+ location API functions instead please)
+ #1323 lib: Deprecate five location API functions that are cursed
+ with integer wrap-around:
+ - XML_GetCurrentByteCount
+ - XML_GetCurrentByteIndex
+ - XML_GetCurrentColumnNumber
+ - XML_GetCurrentLineNumber
+ - XML_GetInputContext
+ #1399 lib: Guard against out-of-handler use of XML_DefaultCurrent
+ #1400 lib: Use size_t for bytesAllocated and peakBytesAllocated
+ #1401 #1402 ..
+ #1404 #1405 lib|xmlwf|tests: Unify use of xcslen, xcscmp and xcsncmp
+ #1406 xmlwf: Add missing `#include "expat.h"`
+ #1389 #1396 Version info bumped from 13:5:12 (libexpat*.so.1.12.5)
+ to 14:0:13 (libexpat*.so.1.13.0); see https://verbump.de/
+ for what these numbers do
+
+ Infrastructure:
+ #1386 CI: Bump MinGW Clang from 23.1.1 to 23.1.2
+ #1410 CI: Bump Fil-C from 0.685 to 0.686
+ #1388 CI: Adapt to breaking changes regarding windows-11-arm image
+ #1403 CI: Limit package cache download runtime
+
+ Special thanks to:
+ Bénédikt Tran
+ Berkay Eren Ürün
+ Fabian Wahle (Hap Security)
+ Filippo Tedeschi
+ Junki Lee
+ Matthew Fernandez
+ Scott Moore
+ Wade Sparks III
+ and
+ City of Munich Open Source Sabbatical
+ VulnCheck
Release 2.8.5 Tue September 22 2026
Security fixes:
@@ -33,17 +120,6 @@ Release 2.8.5 Tue September 22 2026
Upstream CVSS 3.1 vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS score: 9.8)
-///////////////////////////////////////////////////////////////////////////////
-// The next release will drop two (disabled-by-default) features: //
-// //
-// - ATTR_INFO (-DXML_ATTR_INFO, -DEXPAT_ATTR_INFO, --enable-xml-attr-info, //
-// function XML_GetAttributeInfo, struct XML_AttrInfo) //
-// - MIN_SIZE (-DXML_MIN_SIZE, -DEXPAT_MIN_SIZE) //
-// //
-// If you need them in 2026 and beyond, please share your scenario at //
-// GitHub issues #1370 (for ATTR_INFO) and/or #1379 (for MIN_SIZE). Thanks! //
-///////////////////////////////////////////////////////////////////////////////
-
Bug fixes:
#1346 lib: Fix OOM-related memory leak on a failed overflow check
#1371 lib: Fix memory alignment for architectures with 128bit
diff --git a/contrib/expat/Makefile.in b/contrib/expat/Makefile.in
index c0a0eefc47ac..999ed2b231dc 100644
--- a/contrib/expat/Makefile.in
+++ b/contrib/expat/Makefile.in
@@ -345,12 +345,10 @@ ECHO_T = @ECHO_T@
EGREP = @EGREP@
ETAGS = @ETAGS@
EXEEXT = @EXEEXT@
-EXPAT_ATTR_INFO = @EXPAT_ATTR_INFO@
EXPAT_CHAR_TYPE = @EXPAT_CHAR_TYPE@
EXPAT_CONTEXT_BYTES = @EXPAT_CONTEXT_BYTES@
EXPAT_DTD = @EXPAT_DTD@
EXPAT_LARGE_SIZE = @EXPAT_LARGE_SIZE@
-EXPAT_MIN_SIZE = @EXPAT_MIN_SIZE@
EXPAT_NS = @EXPAT_NS@
FGREP = @FGREP@
FILECMD = @FILECMD@
@@ -405,7 +403,6 @@ SO_PATCH = @SO_PATCH@
STRIP = @STRIP@
VERSION = @VERSION@
VSCRIPT_LDFLAGS = @VSCRIPT_LDFLAGS@
-_EXPAT_COMMENT_ATTR_INFO = @_EXPAT_COMMENT_ATTR_INFO@
_EXPAT_COMMENT_DTD_OR_GE = @_EXPAT_COMMENT_DTD_OR_GE@
abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
diff --git a/contrib/expat/README.md b/contrib/expat/README.md
index 36e46a90fd23..1951645e8285 100644
--- a/contrib/expat/README.md
+++ b/contrib/expat/README.md
@@ -17,7 +17,7 @@
> Thank you! :heart: :pray:
-# Expat, Release 2.8.5
+# Expat, Release 2.9.0
This is Expat, a C99 library for parsing
[XML 1.0 Fourth Edition](https://www.w3.org/TR/2006/REC-xml-20060816/), started by
diff --git a/contrib/expat/configure.ac b/contrib/expat/configure.ac
index e8562dbc5fc1..6d80021cf0a9 100644
--- a/contrib/expat/configure.ac
+++ b/contrib/expat/configure.ac
@@ -103,9 +103,9 @@ dnl
dnl If the API changes incompatibly set LIBAGE back to 0
dnl
-LIBCURRENT=13 # sync
-LIBREVISION=5 # with
-LIBAGE=12 # CMakeLists.txt!
+LIBCURRENT=14 # sync
+LIBREVISION=0 # with
+LIBAGE=13 # CMakeLists.txt!
AC_CONFIG_HEADERS([expat_config.h])
AH_TOP([#ifndef EXPAT_CONFIG_H
@@ -226,9 +226,11 @@ AM_CONDITIONAL([MINGW], [test x${EXPATCFG_ON_MINGW} = xyes])
dnl Note: Prefix "_INTERNAL_" here means exclusive use inside of file configure.ac
AM_CONDITIONAL([UNICODE], [echo -- "${CPPFLAGS}${CFLAGS}" | ${FGREP} XML_UNICODE >/dev/null])
AM_CONDITIONAL([_INTERNAL_UNICODE_WCHAR_T], [echo -- "${CPPFLAGS}${CFLAGS}" | ${FGREP} XML_UNICODE_WCHAR_T >/dev/null])
-AM_CONDITIONAL([_INTERNAL_MIN_SIZE], [echo -- "${CPPFLAGS}${CFLAGS}" | ${FGREP} XML_MIN_SIZE >/dev/null])
AM_CONDITIONAL([_INTERNAL_LARGE_SIZE], [echo -- "${CPPFLAGS}${CFLAGS}" | ${FGREP} XML_LARGE_SIZE >/dev/null])
+AS_IF([echo -- "${CPPFLAGS}${CFLAGS}" | ${FGREP} XML_MIN_SIZE >/dev/null],
+ [AC_MSG_ERROR([Feature XML_MIN_SIZE has been removed. Please open a GitHub issue if you need it back.])])
+
LT_LIB_M
AC_ARG_WITH([arc4random],
@@ -428,13 +430,11 @@ AS_IF([test "x${with_dev_urandom}" = "xyes"],
AC_ARG_ENABLE([xml-attr-info],
- [AS_HELP_STRING([--enable-xml-attr-info],
- [Enable retrieving the byte offsets for attribute names and values @<:@default=no@:>@])],
+ [],
[],
[enable_xml_attr_info=no])
AS_IF([test "x${enable_xml_attr_info}" = "xyes"],
- [AC_DEFINE([XML_ATTR_INFO], 1,
- [Define to allow retrieving the byte offsets for attribute names and values.])])
+ [AC_MSG_ERROR([Feature --enable-xml-attr-info has been removed. Please open a GitHub issue if you need it back.])])
AC_ARG_ENABLE([xml-context],
AS_HELP_STRING([--enable-xml-context @<:@COUNT@:>@],
@@ -495,21 +495,12 @@ dnl Configure CMake file templates
dnl NOTE: The *_TRUE variables read here are Automake conditionals
dnl that are either set to "" when enabled or to "#" when disabled
dnl (because they are used to dynamically comment out certain things)
-AS_IF([test "x${enable_xml_attr_info}" = xyes],
- [EXPAT_ATTR_INFO=ON
- _EXPAT_COMMENT_ATTR_INFO=" "],
- [EXPAT_ATTR_INFO=OFF
- _EXPAT_COMMENT_ATTR_INFO="#"])
-AC_SUBST([_EXPAT_COMMENT_ATTR_INFO])
EXPAT_DTD=ON
_EXPAT_COMMENT_DTD_OR_GE=" "
AC_SUBST([_EXPAT_COMMENT_DTD_OR_GE])
AS_IF([test "x${_INTERNAL_LARGE_SIZE_TRUE}" = x],
[EXPAT_LARGE_SIZE=ON],
[EXPAT_LARGE_SIZE=OFF])
-AS_IF([test "x${_INTERNAL_MIN_SIZE_TRUE}" = x],
- [EXPAT_MIN_SIZE=ON],
- [EXPAT_MIN_SIZE=OFF])
EXPAT_NS=ON
AS_IF([test "x${enable_xml_context}" != xno],
[EXPAT_CONTEXT_BYTES=${enable_xml_context}],
@@ -525,10 +516,8 @@ LIBDIR_BASENAME="$(basename "${libdir}")"
SO_MAJOR="$(expr "${LIBCURRENT}" - "${LIBAGE}")"
SO_MINOR="${LIBAGE}"
SO_PATCH="${LIBREVISION}"
-AC_SUBST([EXPAT_ATTR_INFO])
AC_SUBST([EXPAT_DTD])
AC_SUBST([EXPAT_LARGE_SIZE])
-AC_SUBST([EXPAT_MIN_SIZE])
AC_SUBST([EXPAT_NS])
AC_SUBST([EXPAT_CONTEXT_BYTES])
AC_SUBST([EXPAT_CHAR_TYPE])
diff --git a/contrib/expat/doc/Makefile.in b/contrib/expat/doc/Makefile.in
index 52a18ffb673f..afe0b8d5c814 100644
--- a/contrib/expat/doc/Makefile.in
+++ b/contrib/expat/doc/Makefile.in
@@ -234,12 +234,10 @@ ECHO_T = @ECHO_T@
EGREP = @EGREP@
ETAGS = @ETAGS@
EXEEXT = @EXEEXT@
-EXPAT_ATTR_INFO = @EXPAT_ATTR_INFO@
EXPAT_CHAR_TYPE = @EXPAT_CHAR_TYPE@
EXPAT_CONTEXT_BYTES = @EXPAT_CONTEXT_BYTES@
EXPAT_DTD = @EXPAT_DTD@
EXPAT_LARGE_SIZE = @EXPAT_LARGE_SIZE@
-EXPAT_MIN_SIZE = @EXPAT_MIN_SIZE@
EXPAT_NS = @EXPAT_NS@
FGREP = @FGREP@
FILECMD = @FILECMD@
@@ -294,7 +292,6 @@ SO_PATCH = @SO_PATCH@
STRIP = @STRIP@
VERSION = @VERSION@
VSCRIPT_LDFLAGS = @VSCRIPT_LDFLAGS@
-_EXPAT_COMMENT_ATTR_INFO = @_EXPAT_COMMENT_ATTR_INFO@
_EXPAT_COMMENT_DTD_OR_GE = @_EXPAT_COMMENT_DTD_OR_GE@
abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
diff --git a/contrib/expat/doc/reference.html b/contrib/expat/doc/reference.html
index 5bd9150ea78a..2f892fd20b82 100644
--- a/contrib/expat/doc/reference.html
+++ b/contrib/expat/doc/reference.html
@@ -53,7 +53,7 @@
<body>
<div>
<h1>
- The Expat XML Parser <small>Release 2.8.5</small>
+ The Expat XML Parser <small>Release 2.9.0</small>
</h1>
</div>
@@ -309,22 +309,76 @@
<li>
<a href="#XML_GetCurrentByteIndex">XML_GetCurrentByteIndex</a>
+ (deprecated)
+ </li>
+
+ <li>
+ <a href="#XML_GetCurrentByteIndex64">XML_GetCurrentByteIndex64</a>
</li>
<li>
<a href="#XML_GetCurrentLineNumber">XML_GetCurrentLineNumber</a>
+ (deprecated)
+ </li>
+
+ <li>
+ <a href="#XML_GetCurrentLineNumber64">XML_GetCurrentLineNumber64</a>
</li>
<li>
<a href="#XML_GetCurrentColumnNumber">XML_GetCurrentColumnNumber</a>
+ (deprecated)
+ </li>
+
+ <li>
+ <a href=
+ "#XML_GetCurrentColumnNumber64">XML_GetCurrentColumnNumber64</a>
</li>
<li>
<a href="#XML_GetCurrentByteCount">XML_GetCurrentByteCount</a>
+ (deprecated)
+ </li>
+
+ <li>
+ <a href="#XML_GetCurrentByteCount64">XML_GetCurrentByteCount64</a>
</li>
<li>
- <a href="#XML_GetInputContext">XML_GetInputContext</a>
+ <a href="#XML_GetInputContext">XML_GetInputContext</a> (deprecated)
+ </li>
+
+ <li>
+ <a href="#XML_GetInputContext64">XML_GetInputContext64</a>
+ </li>
+ </ul>
+ </li>
+
+ <li>
+ <a href="#properties">Properties / Security Tuning</a>
+ <ul>
+ <li>
+ <a href="#XML_GetPropertyBool">XML_GetPropertyBool</a>
+ </li>
+
+ <li>
+ <a href="#XML_GetPropertyDouble">XML_GetPropertyDouble</a>
+ </li>
+
+ <li>
+ <a href="#XML_GetPropertyUInt64">XML_GetPropertyUInt64</a>
+ </li>
+
+ <li>
+ <a href="#XML_SetPropertyBool">XML_SetPropertyBool</a>
+ </li>
+
+ <li>
+ <a href="#XML_SetPropertyDouble">XML_SetPropertyDouble</a>
+ </li>
+
+ <li>
+ <a href="#XML_SetPropertyUInt64">XML_SetPropertyUInt64</a>
</li>
</ul>
</li>
@@ -391,10 +445,6 @@
<a href="#XML_GetIdAttributeIndex">XML_GetIdAttributeIndex</a>
</li>
- <li>
- <a href="#XML_GetAttributeInfo">XML_GetAttributeInfo</a>
- </li>
-
<li>
<a href="#XML_SetEncoding">XML_SetEncoding</a>
</li>
@@ -751,19 +801,59 @@ make install
</dd>
<dt>
- <a id="XML_LARGE_SIZE" name="XML_LARGE_SIZE">XML_LARGE_SIZE</a>
+ <a id="XML_LARGE_SIZE" name="XML_LARGE_SIZE">XML_LARGE_SIZE</a> (deprecated)
</dt>
<dd>
- If defined, causes the <code>XML_Size</code> and <code>XML_Index</code> integer
- types to be at least 64 bits in size. This is intended to support processing of
- very large input streams, where the return values of <code><a href=
- "#XML_GetCurrentByteIndex">XML_GetCurrentByteIndex</a></code>, <code><a href=
- "#XML_GetCurrentLineNumber">XML_GetCurrentLineNumber</a></code> and
- <code><a href=
- "#XML_GetCurrentColumnNumber">XML_GetCurrentColumnNumber</a></code> could
- overflow. It may not be supported by all compilers, and is turned off by
- default.
+ <p>
+ If defined, causes the <code>XML_Size</code> and <code>XML_Index</code>
+ integer types to be at least 64 bits in size. This is intended to support
+ processing of very large input streams, where the return values of
+ <code><a href="#XML_GetCurrentByteIndex">XML_GetCurrentByteIndex</a></code>,
+ <code><a href="#XML_GetCurrentLineNumber">XML_GetCurrentLineNumber</a></code>
+ and <code><a href=
+ "#XML_GetCurrentColumnNumber">XML_GetCurrentColumnNumber</a></code> could
+ overflow. It may not be supported by all compilers, and is turned off by
+ default.
+ </p>
+
+ <p>
+ Starting with Expat 2.9.0, there are 64bit versions of these functions, so
+ that relying on (non-default and uncommon) macro <code>XML_LARGE_SIZE</code>
+ is no longer needed. These functions are:
+ </p>
+
+ <ul>
+ <li>
+ <code><a href=
+ "#XML_GetCurrentByteIndex64">XML_GetCurrentByteIndex64</a></code>
+ </li>
+
+ <li>
+ <code><a href=
+ "#XML_GetCurrentColumnNumber64">XML_GetCurrentColumnNumber64</a></code>
+ </li>
+
+ <li>
+ <code><a href=
+ "#XML_GetCurrentLineNumber64">XML_GetCurrentLineNumber64</a></code>
+ </li>
+ </ul>
+
+ <p>
+ And there are two more that <code>XML_LARGE_SIZE</code> was not covering:
+ </p>
+
+ <ul>
+ <li>
+ <code><a href=
+ "#XML_GetCurrentByteCount64">XML_GetCurrentByteCount64</a></code>
+ </li>
+
+ <li>
+ <code><a href="#XML_GetInputContext64">XML_GetInputContext64</a></code>
+ </li>
+ </ul>
</dd>
<dt>
@@ -790,16 +880,6 @@ make install
the code that calls it; this is required to get all the right MSVC magic
annotations correct. This is ignored on other platforms.
</dd>
-
- <dt>
- <a id="XML_ATTR_INFO" name="XML_ATTR_INFO">XML_ATTR_INFO</a>
- </dt>
-
- <dd>
- If defined, makes the additional function <code><a href=
- "#XML_GetAttributeInfo">XML_GetAttributeInfo</a></code> available for reporting
- attribute byte offsets.
- </dd>
</dl>
<hr />
@@ -1707,6 +1787,17 @@ XML_ParseBuffer(XML_Parser p,
application can avoid double copying of the input.
</p>
+ <p>
+ <strong>Note:</strong> It is the responsibility of the application code to pass
+ a value for <code>len</code> that does not exceed the length of the remaining
+ unparsed XML content that was previously copied into the buffer obtained from
+ <code><a href="#XML_GetBuffer">XML_GetBuffer</a></code>. The documentation of
+ <code><a href="#XML_GetBuffer">XML_GetBuffer</a></code> below has an <a href=
+ "#XML_GetBuffer">example of typical use</a> of functions <code><a href=
+ "#XML_GetBuffer">XML_GetBuffer</a></code> and <code><a href=
+ "#XML_ParseBuffer">XML_ParseBuffer</a></code> in tandem.
+ </p>
+
<p>
Negative values for <code>len</code> are rejected since Expat 2.6.3.
</p>
@@ -2889,7 +2980,40 @@ enum XML_Error XMLCALL
XML_GetErrorCode(XML_Parser p);
</pre>
<div class="fcndef">
- Return what type of error has occurred.
+ <p>
+ Return what type of error has occurred inside the main Expat parsing machinery.
+ </p>
+
+ <p>
+ Only the following functions record the type of error for retrivial via
+ <code>XML_GetErrorCode</code>:
+ </p>
+
+ <ul>
+ <li>
+ <code><a href="#XML_GetBuffer">XML_GetBuffer</a></code>
+ </li>
+
+ <li>
+ <code><a href="#XML_Parse">XML_Parse</a></code>
+ </li>
+
+ <li>
+ <code><a href="#XML_ParseBuffer">XML_ParseBuffer</a></code>
+ </li>
+
+ <li>
+ <code><a href="#XML_ParserReset">XML_ParserReset</a></code>
+ </li>
+
+ <li>
+ <code><a href="#XML_ResumeParser">XML_ResumeParser</a></code>
+ </li>
+
+ <li>
+ <code><a href="#XML_StopParser">XML_StopParser</a></code>
+ </li>
+ </ul>
</div>
<h4 id="XML_ErrorString">
@@ -2907,13 +3031,18 @@ XML_ErrorString(enum XML_Error code);
</div>
<h4 id="XML_GetCurrentByteIndex">
- XML_GetCurrentByteIndex
+ XML_GetCurrentByteIndex (deprecated)
</h4>
<pre class="fcndec">
XML_Index XMLCALL
XML_GetCurrentByteIndex(XML_Parser p);
</pre>
+ <p>
+ <b>Note:</b> This function is deprecated, please use function <code><a href=
+ "#XML_GetCurrentByteIndex64">XML_GetCurrentByteIndex64</a></code>, instead.
+ </p>
+
<div class="fcndef">
Return the byte offset of the position. This always corresponds to the values
returned by <code><a href=
@@ -2928,14 +3057,36 @@ XML_GetCurrentByteIndex(XML_Parser p);
"#XML_LARGE_SIZE">XML_LARGE_SIZE</a></code>.
</p>
+ <h4 id="XML_GetCurrentByteIndex64">
+ XML_GetCurrentByteIndex64
+ </h4>
+
+ <pre class="fcndec">
+/* Added in Expat 2.9.0. */
+int64_t XMLCALL
+XML_GetCurrentByteIndex64(XML_Parser p);
+</pre>
+ <div class="fcndef">
+ Return the byte offset of the position. This always corresponds to the values
+ returned by <code><a href=
+ "#XML_GetCurrentLineNumber64">XML_GetCurrentLineNumber64</a></code> and
+ <code><a href=
+ "#XML_GetCurrentColumnNumber64">XML_GetCurrentColumnNumber64</a></code>.
+ </div>
+
<h4 id="XML_GetCurrentLineNumber">
- XML_GetCurrentLineNumber
+ XML_GetCurrentLineNumber (deprecated)
</h4>
<pre class="fcndec">
XML_Size XMLCALL
XML_GetCurrentLineNumber(XML_Parser p);
</pre>
+ <p>
+ <b>Note:</b> This function is deprecated, please use function <code><a href=
+ "#XML_GetCurrentLineNumber64">XML_GetCurrentLineNumber64</a></code>, instead.
+ </p>
+
<div class="fcndef">
Return the line number of the position. The first line is reported as
<code>1</code>.
@@ -2948,14 +3099,33 @@ XML_GetCurrentLineNumber(XML_Parser p);
"#XML_LARGE_SIZE">XML_LARGE_SIZE</a></code>.
</p>
+ <h4 id="XML_GetCurrentLineNumber64">
+ XML_GetCurrentLineNumber64
+ </h4>
+
+ <pre class="fcndec">
+/* Added in Expat 2.9.0. */
+uint64_t XMLCALL
+XML_GetCurrentLineNumber64(XML_Parser p);
+</pre>
+ <div class="fcndef">
+ Return the line number of the position. The first line is reported as
+ <code>1</code>.
+ </div>
+
<h4 id="XML_GetCurrentColumnNumber">
- XML_GetCurrentColumnNumber
+ XML_GetCurrentColumnNumber (deprecated)
</h4>
<pre class="fcndec">
XML_Size XMLCALL
XML_GetCurrentColumnNumber(XML_Parser p);
</pre>
+ <p>
+ <b>Note:</b> This function is deprecated, please use function <code><a href=
+ "#XML_GetCurrentColumnNumber64">XML_GetCurrentColumnNumber64</a></code>, instead.
+ </p>
+
<div class="fcndef">
Return the <em>offset</em>, from the beginning of the current line, of the
position. The first column is reported as <code>0</code>.
@@ -2968,13 +3138,53 @@ XML_GetCurrentColumnNumber(XML_Parser p);
"#XML_LARGE_SIZE">XML_LARGE_SIZE</a></code>.
</p>
+ <h4 id="XML_GetCurrentColumnNumber64">
+ XML_GetCurrentColumnNumber64
+ </h4>
+
+ <pre class="fcndec">
+/* Added in Expat 2.9.0. */
+uint64_t XMLCALL
+XML_GetCurrentColumnNumber64(XML_Parser p);
+</pre>
+ <div class="fcndef">
+ Return the <em>offset</em>, from the beginning of the current line, of the
+ position. The first column is reported as <code>0</code>.
+ </div>
+
<h4 id="XML_GetCurrentByteCount">
- XML_GetCurrentByteCount
+ XML_GetCurrentByteCount (deprecated)
</h4>
<pre class="fcndec">
int XMLCALL
XML_GetCurrentByteCount(XML_Parser p);
+</pre>
+ <p>
+ <b>Note:</b> This function is deprecated, please use function <code><a href=
+ "#XML_GetCurrentByteCount64">XML_GetCurrentByteCount64</a></code>, instead.
+ </p>
+
+ <div class="fcndef">
+ Return the number of bytes in the current event. Returns <code>0</code> if the
+ event is inside a reference to an internal entity and for the end-tag event for
+ empty element tags (the later can be used to distinguish empty-element tags from
+ empty elements using separate start and end tags).
+ </div>
+
+ <p>
+ <strong>Note:</strong> Type <code>int</code> is known to wrap around (on both
+ 32bit platforms and 64bit platforms).
+ </p>
+
+ <h4 id="XML_GetCurrentByteCount64">
+ XML_GetCurrentByteCount64
+ </h4>
+
+ <pre class="fcndec">
+/* Added in Expat 2.9.0. */
+uint64_t XMLCALL
+XML_GetCurrentByteCount64(XML_Parser p);
</pre>
<div class="fcndef">
Return the number of bytes in the current event. Returns <code>0</code> if the
@@ -2984,7 +3194,7 @@ XML_GetCurrentByteCount(XML_Parser p);
</div>
<h4 id="XML_GetInputContext">
- XML_GetInputContext
+ XML_GetInputContext (deprecated)
</h4>
<pre class="fcndec">
@@ -2992,6 +3202,53 @@ const char * XMLCALL
XML_GetInputContext(XML_Parser p,
int *offset,
int *size);
+</pre>
+ <p>
+ <b>Note:</b> This function is deprecated, please use function <code><a href=
+ "#XML_GetInputContext64">XML_GetInputContext64</a></code>, instead.
+ </p>
+
+ <div class="fcndef">
+ <p>
+ Returns the parser's input buffer, sets the integer pointed at by
+ <code>offset</code> to the offset within this buffer of the current parse
+ position, and set the integer pointed at by <code>size</code> to the size of
+ the returned buffer.
+ </p>
+
+ <p>
+ This should only be called from within a handler during an active parse and the
+ returned buffer should only be referred to from within the handler that made
+ the call. This input buffer contains the untranslated bytes of the input.
+ </p>
+
+ <p>
+ Only a limited amount of context is kept, so if the event triggering a call
+ spans over a very large amount of input, the actual parse position may be
+ before the beginning of the buffer.
+ </p>
+
+ <p>
+ If <code>XML_CONTEXT_BYTES</code> is zero, this will always return
+ <code>NULL</code>.
+ </p>
+
+ <p>
+ <strong>Note:</strong> Type <code>int</code> is known to wrap around (on both
+ 32bit platforms and 64bit platforms).
+ </p>
+ </div>
+
+ <h4 id="XML_GetInputContext64">
+ XML_GetInputContext64
+ </h4>
+
+ <pre class="fcndec">
+/* Added in Expat 2.9.0. */
+const char * XMLCALL
+XML_GetInputContext64(XML_Parser p,
+ int64_t *offset,
+ zint64_t *size);
</pre>
<div class="fcndef">
<p>
@@ -3019,11 +3276,390 @@ XML_GetInputContext(XML_Parser p,
</p>
</div>
+ <h3>
+ <a id="properties" name="properties">Properties / Security Tuning</a>
+ </h3>
+
+ <p>
+ Expat 2.9.0 introduced a new Properties API. Think of properties as the control
+ knobs of a parser. The key motivations behind its introduction are:
+ </p>
+
+ <ul>
+ <li>to allow Expat to add more properties — both security-related and non-
+ security ones — in the future (without need to also add new related getter and
+ setter functions for each of them as was the case in the past),
+ </li>
+
+ <li>to allow users to read (not just to set) the current values, and
+ </li>
+
+ <li>to allow users to distinuish the different sources of error beyond a mere
+ "did not work".
+ </li>
+ </ul>
+
+ <p>
+ There is one setter function and one getter function — a pair — per supported
+ data type:
+ </p>
+
+ <ul>
+ <li>For <code>XML_Bool</code>:
+ <ul>
+ <li>
+ <code><a href="#XML_GetPropertyBool">XML_GetPropertyBool</a></code>
+ </li>
+
+ <li>
+ <code><a href="#XML_SetPropertyBool">XML_SetPropertyBool</a></code>
+ </li>
+ </ul>
+ </li>
+
+ <li>For <code>double</code>:
+ <ul>
+ <li>
+ <code><a href="#XML_GetPropertyDouble">XML_GetPropertyDouble</a></code>
+ </li>
+
+ <li>
+ <code><a href="#XML_SetPropertyDouble">XML_SetPropertyDouble</a></code>
+ </li>
+ </ul>
+ </li>
+
+ <li>For <code>uint64_t</code>:
+ <ul>
+ <li>
+ <code><a href="#XML_GetPropertyUInt64">XML_GetPropertyUInt64</a></code>
+ </li>
+
+ <li>
+ <code><a href="#XML_SetPropertyUInt64">XML_SetPropertyUInt64</a></code>
+ </li>
+ </ul>
+ </li>
+ </ul>
+
+ <p>
+ They all share these two key enums:
+ </p>
+
+ <h4 id="XML_Parser_Property">
+ XML_Parser_Property
+ </h4>
+
+ <pre>
+/* Added in Expat 2.9.0. */
+enum XML_Parser_Property {
+# if XML_GE == 1
+ XML_PROP_ALLOC_TRACKER_ACTIVATION_THRESHOLD = 1, // of type `uint64_t`
+ XML_PROP_ALLOC_TRACKER_MAXIMUM_AMPLIFICATION = 2, // of type `double`
+ XML_PROP_BILLION_LAUGHS_ACTIVATION_THRESHOLD = 3, // of type `uint64_t`
+ XML_PROP_BILLION_LAUGHS_MAXIMUM_AMPLIFICATION = 4, // of type `double`
+# endif
+ XML_PROP_REPARSE_DEFERRAL_ENABLED = 5, // of type `XML_Bool`
+ /* more properties upcoming here */
+};</pre>
+ <h4 id="XML_Prop_Error">
+ XML_Prop_Error
+ </h4>
+
+ <pre>
+/* Added in 2.9.0. */
+enum XML_Prop_Error {
+ XML_PROP_ERROR_NONE = 0, // i.e. success
+
+ XML_PROP_ERROR_INVALID_KEY = 1, // i.e. the property is not known at all
+ XML_PROP_ERROR_INVALID_TYPE = 2, // i.e. the property is known but expects a
+ // different type (so a different
+ // getter/setter would need to be called)
+ XML_PROP_ERROR_INVALID_VALUE = 3, // i.e. the value is invalid (with a setter
+ // function) or a NULL-pointer (with a
+ // getter function)
+
+ XML_PROP_ERROR_PARSER_NULL = 4, // i.e. the parser argument is NULL
+ XML_PROP_ERROR_PARSER_NOT_ROOT = 5, // i.e. the parser is not a root parser
+ // but a subparser (and a root parser is
+ // needed)
+
+ /* potentially more error codes upcoming here */
+};</pre>
+ <p>
+ Let us look at these functions in more detail:
+ </p>
+
+ <h4 id="XML_GetPropertyBool">
+ XML_GetPropertyBool
+ </h4>
+
+ <pre class="fcndec">
+/* Added in Expat 2.9.0. */
+enum XML_Prop_Error
+XML_GetPropertyBool(XML_Parser parser, enum XML_Parser_Property property,
+ XML_Bool *value);
+</pre>
+ <div class="fcndef">
+ <p>
+ Writes the current value of boolean property <code>property</code> of parser
+ <code>parser</code> to output variable <code>value</code>. Supported properties
+ are:
+ </p>
+
+ <ul>
+ <li>
+ <code>XML_PROP_REPARSE_DEFERRAL_ENABLED</code> — whether <a href=
+ "#XML_SetReparseDeferralEnabled">reparse deferral</a> is active or not
+ </li>
+ </ul>
+
+ <p>
+ Both parameters <code>parser</code> and <code>value</code> must be
+ non-<code>NULL</code>. On success <code>XML_PROP_ERROR_NONE</code> is returned;
+ on error one of the other variants of <a href=
+ "#XML_Prop_Error">XML_Prop_Error</a> is returned.
+ </p>
+
+ <p>
+ <strong>Note:</strong> There may be more error codes introduced into <a href=
+ "#XML_Prop_Error">XML_Prop_Error</a> in the future, so user code must be robust
+ towards error codes from the future at runtime that were not known at compile
+ time.
+ </p>
+ </div>
+
+ <h4 id="XML_GetPropertyDouble">
+ XML_GetPropertyDouble
+ </h4>
+
+ <pre class="fcndec">
+/* Added in Expat 2.9.0. */
+enum XML_Prop_Error
+XML_GetPropertyDouble(XML_Parser parser, enum XML_Parser_Property property,
+ double *value);
*** 5122 LINES SKIPPED ***