f5f54d
%global unversion 2_2_5
f5f54d
f5f54d
Summary: An XML parser library
f5f54d
Name: expat
f5f54d
Version: %(echo %{unversion} | sed 's/_/./g')
2f0e98
Release: 11%{?dist}
f5f54d
Source: https://github.com/libexpat/libexpat/archive/R_%{unversion}.tar.gz#/expat-%{version}.tar.gz
f5f54d
URL: https://libexpat.github.io/
f5f54d
License: MIT
f5f54d
BuildRequires: autoconf, libtool, xmlto, gcc-c++
f5f54d
Patch0: expat-2.2.5-doc2man.patch
721c48
Patch1: expat-2.2.5-CVE-2018-20843.patch
721c48
Patch2: expat-2.2.5-CVE-2019-15903.patch
fa9cc6
Patch3:	expat-2.2.5-Detect-and-prevent-integer-overflow-in-XML_GetBuffer.patch
fa9cc6
Patch4:	expat-2.2.5-Detect-and-prevent-troublesome-left-shifts.patch
fa9cc6
Patch5:	expat-2.2.5-Prevent-integer-overflow-on-m_groupSize-in-function.patch
fa9cc6
Patch6:	expat-2.2.5-Prevent-more-integer-overflows.patch
589ceb
Patch7: expat-2.2.5-Protect-against-malicious-namespace-declarations.patch
589ceb
Patch8: expat-2.2.5-Add-missing-validation-of-encoding.patch
589ceb
Patch9: expat-2.2.5-Prevent-integer-overflow-in-storeRawNames.patch
589ceb
Patch10: expat-2.2.5-Prevent-integer-overflow-in-copyString.patch
589ceb
Patch11: expat-2.2.5-Prevent-stack-exhaustion-in-build_model.patch
2f0e98
Patch12: expat-2.2.5-Ensure-raw-tagnames-are-safe-exiting-internalEntityParser.patch
2f0e98
Patch13: expat-2.2.5-CVE-2022-43680.patch
f5f54d
f5f54d
%description
f5f54d
This is expat, the C library for parsing XML, written by James Clark. Expat
f5f54d
is a stream oriented XML parser. This means that you register handlers with
f5f54d
the parser prior to starting the parse. These handlers are called when the
f5f54d
parser discovers the associated structures in the document being parsed. A
f5f54d
start tag is an example of the kind of structures for which you may
f5f54d
register handlers.
f5f54d
f5f54d
%package devel
f5f54d
Summary: Libraries and header files to develop applications using expat
f5f54d
Requires: expat%{?_isa} = %{version}-%{release}
f5f54d
f5f54d
%description devel
f5f54d
The expat-devel package contains the libraries, include files and documentation
f5f54d
to develop XML applications with expat.
f5f54d
f5f54d
%package static
f5f54d
Summary: expat XML parser static library
f5f54d
Requires: expat-devel%{?_isa} = %{version}-%{release}
f5f54d
f5f54d
%description static
f5f54d
The expat-static package contains the static version of the expat library.
f5f54d
Install it if you need to link statically with expat.
f5f54d
f5f54d
%prep
f5f54d
%setup -q -n libexpat-R_%{unversion}/expat
f5f54d
%patch0 -p2 -b .doc2man
721c48
%patch1 -p2 -b .cve20843
721c48
%patch2 -p2 -b .cve15903
fa9cc6
%patch3 -p1 -b .CVE-2022-23852
fa9cc6
%patch4 -p1 -b .CVE-2021-45960
fa9cc6
%patch5 -p1 -b .CVE-2021-46143
fa9cc6
%patch6 -p1 -b .CVE-2022-22822-CVE-2022-22827
589ceb
%patch7 -p1 -b .CVE-2022-25236
589ceb
%patch8 -p1 -b .CVE-2022-25235
589ceb
%patch9 -p1 -b .CVE-2022-25315
589ceb
%patch10 -p1 -b .CVE-2022-25314
589ceb
%patch11 -p1 -b .CVE-2022-25313
2f0e98
%patch12 -p1 -b .CVE-2022-40674
2f0e98
%patch13 -p1 -b .CVE-2022-43680
721c48
f5f54d
sed -i 's/install-data-hook/do-nothing-please/' lib/Makefile.am
f5f54d
./buildconf.sh
f5f54d
f5f54d
%build
f5f54d
export CFLAGS="$RPM_OPT_FLAGS -fPIC"
f5f54d
export DOCBOOK_TO_MAN="xmlto man --skip-validation"
f5f54d
%configure
f5f54d
make %{?_smp_mflags}
f5f54d
f5f54d
%install
f5f54d
make install DESTDIR=$RPM_BUILD_ROOT
f5f54d
f5f54d
rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
f5f54d
f5f54d
%check
f5f54d
make check
f5f54d
f5f54d
%ldconfig_scriptlets
f5f54d
f5f54d
%files
f5f54d
%{!?_licensedir:%global license %%doc}
f5f54d
%doc AUTHORS Changes
f5f54d
%license COPYING
f5f54d
%{_bindir}/*
f5f54d
%{_libdir}/lib*.so.*
f5f54d
%{_mandir}/*/*
f5f54d
f5f54d
%files devel
f5f54d
%doc doc/reference.html doc/*.png doc/*.css examples/*.c
f5f54d
%{_libdir}/lib*.so
f5f54d
%{_libdir}/pkgconfig/*.pc
f5f54d
%{_includedir}/*.h
f5f54d
f5f54d
%files static
f5f54d
%{_libdir}/lib*.a
f5f54d
f5f54d
%changelog
2f0e98
* Mon Nov 14 2022 Tomas Korbar <tkorbar@redhat.com> - 2.2.5-11
2f0e98
- CVE-2022-43680 expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate
2f0e98
- Resolves: CVE-2022-43680
2f0e98
2f0e98
* Fri Sep 30 2022 Tomas Korbar <tkorbar@redhat.com> - 2.2.5-10
2f0e98
- Ensure raw tagnames are safe exiting internalEntityParser
2f0e98
- Resolves: CVE-2022-40674
2f0e98
589ceb
* Fri May 06 2022 Tomas Korbar <tkorbar@redhat.com> - 2.2.5-9
589ceb
- Fix multiple CVEs
589ceb
- Resolves: CVE-2022-25314
589ceb
- Resolves: CVE-2022-25313
589ceb
589ceb
* Mon Mar 14 2022 Tomas Korbar <tkorbar@redhat.com> - 2.2.5-8
589ceb
- Improve patch for CVE-2022-25236
589ceb
- Related: CVE-2022-25236
589ceb
589ceb
* Fri Mar 04 2022 Tomas Korbar <tkorbar@redhat.com> - 2.2.5-7
589ceb
- Fix patch for CVE-2022-25235
589ceb
- Resolves: CVE-2022-25235
589ceb
589ceb
* Thu Mar 03 2022 Tomas Korbar <tkorbar@redhat.com> - 2.2.5-6
589ceb
- Fix multiple CVEs
589ceb
- CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
589ceb
- CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
589ceb
- CVE-2022-25315 expat: integer overflow in storeRawNames()
589ceb
- Resolves: CVE-2022-25236
589ceb
- Resolves: CVE-2022-25235
589ceb
- Resolves: CVE-2022-25315
589ceb
fa9cc6
* Fri Feb 14 2022 Tomas Korbar <tkorbar@redhat.com> -  2.2.5-5
fa9cc6
- Fix multiple CVEs
fa9cc6
- CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
fa9cc6
- CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
fa9cc6
- CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
fa9cc6
- CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
fa9cc6
- CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
fa9cc6
- CVE-2022-22825 Integer overflow in lookup in xmlparse.c
fa9cc6
- CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
fa9cc6
- CVE-2022-22823 Integer overflow in build_model in xmlparse.c
fa9cc6
- CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
fa9cc6
- Resolves: CVE-2022-23852
fa9cc6
- Resolves: CVE-2021-45960
fa9cc6
- Resolves: CVE-2021-46143
fa9cc6
- Resolves: CVE-2022-22827
fa9cc6
- Resolves: CVE-2022-22826
fa9cc6
- Resolves: CVE-2022-22825
fa9cc6
- Resolves: CVE-2022-22824
fa9cc6
- Resolves: CVE-2022-22823
fa9cc6
- Resolves: CVE-2022-22822
fa9cc6
721c48
* Fri Apr 24 2020 Joe Orton <jorton@redhat.com> - 2.2.5-4
721c48
- add security fixes for CVE-2018-20843, CVE-2019-15903
721c48
f5f54d
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.5-3
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
f5f54d
f5f54d
* Sat Feb 03 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2.2.5-2
f5f54d
- Switch to %%ldconfig_scriptlets
f5f54d
f5f54d
* Thu Nov  2 2017 Joe Orton <jorton@redhat.com> - 2.2.5-1
f5f54d
- update to 2.2.5 (#1508667)
f5f54d
f5f54d
* Mon Aug 21 2017 Joe Orton <jorton@redhat.com> - 2.2.4-1
f5f54d
- update to 2.2.4 (#1483359)
f5f54d
f5f54d
* Fri Aug  4 2017 Joe Orton <jorton@redhat.com> - 2.2.3-1
f5f54d
- fix tests with unsigned char (upstream PR 109)
f5f54d
- update to 2.2.3 (#1473266)
f5f54d
f5f54d
* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.2-4
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
f5f54d
f5f54d
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.2-3
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
f5f54d
f5f54d
* Fri Jul 14 2017 Joe Orton <jorton@redhat.com> - 2.2.2-2
f5f54d
- update to 2.2.2 (#1470891)
f5f54d
f5f54d
* Fri Jul  7 2017 Joe Orton <jorton@redhat.com> - 2.2.1-2
f5f54d
- trim unnecessary doc, examples content
f5f54d
f5f54d
* Mon Jun 19 2017 Joe Orton <jorton@redhat.com> - 2.2.1-1
f5f54d
- update to 2.2.1 (#1462474)
f5f54d
f5f54d
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.0-2
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
f5f54d
f5f54d
* Tue Jun 21 2016 Joe Orton <jorton@redhat.com> - 2.2.0-1
f5f54d
- update to 2.2.0 (#1247348)
f5f54d
f5f54d
* Thu Jun 16 2016 Joe Orton <jorton@redhat.com> - 2.1.1-2
f5f54d
- add security fixes for CVE-2016-0718, CVE-2012-6702, CVE-2016-5300,
f5f54d
  CVE-2016-4472
f5f54d
f5f54d
* Mon Apr 18 2016 David Tardon <dtardon@redhat.com> - 2.1.1-1
f5f54d
- new upstream release
f5f54d
f5f54d
* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-13
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
f5f54d
f5f54d
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.0-12
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
f5f54d
f5f54d
* Sat Feb 21 2015 Till Maas <opensource@till.name> - 2.1.0-11
f5f54d
- Rebuilt for Fedora 23 Change
f5f54d
  https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
f5f54d
f5f54d
* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.0-10
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
f5f54d
f5f54d
* Sat Jul 12 2014 Tom Callaway <spot@fedoraproject.org> - 2.1.0-9
f5f54d
- fix license handling
f5f54d
f5f54d
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.0-8
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
f5f54d
f5f54d
* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.0-7
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
f5f54d
f5f54d
* Mon Jun 17 2013 Joe Orton <jorton@redhat.com> - 2.1.0-6
f5f54d
- fix "xmlwf -h" output (#948534)
f5f54d
f5f54d
* Wed Feb 13 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.0-5
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
f5f54d
f5f54d
* Thu Jul 19 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.0-4
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
f5f54d
f5f54d
* Fri Apr 13 2012 Joe Orton <jorton@redhat.com> - 2.1.0-3
f5f54d
- add -static subpackage (#722647)
f5f54d
f5f54d
* Fri Mar 30 2012 Joe Orton <jorton@redhat.com> - 2.1.0-1
f5f54d
- ship .pc file, move library back to libdir (#808399)
f5f54d
f5f54d
* Mon Mar 26 2012 Joe Orton <jorton@redhat.com> - 2.1.0-1
f5f54d
- update to 2.1.0 (#806602)
f5f54d
f5f54d
* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.0.1-12
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
f5f54d
f5f54d
* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.0.1-11
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
f5f54d
f5f54d
* Mon Feb  8 2010 Joe Orton <jorton@redhat.com> - 2.0.1-10
f5f54d
- revised fix for CVE-2009-3560 regression (#544996)
f5f54d
f5f54d
* Sun Jan 31 2010 Joe Orton <jorton@redhat.com> - 2.0.1-9
f5f54d
- drop static libraries (#556046)
f5f54d
- add fix for regression in CVE-2009-3560 patch (#544996)
f5f54d
f5f54d
* Tue Dec  1 2009 Joe Orton <jorton@redhat.com> - 2.0.1-8
f5f54d
- add security fix for CVE-2009-3560 (#533174)
f5f54d
- add security fix for CVE-2009-3720 (#531697)
f5f54d
- run the test suite
f5f54d
f5f54d
* Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.0.1-7
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
f5f54d
f5f54d
* Tue Feb 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.0.1-6
f5f54d
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
f5f54d
f5f54d
* Tue Feb 19 2008 Fedora Release Engineering <rel-eng@fedoraproject.org> - 2.0.1-5
f5f54d
- Autorebuild for GCC 4.3
f5f54d
f5f54d
* Wed Jan 23 2008 Joe Orton <jorton@redhat.com> 2.0.1-4
f5f54d
- chmod 644 even more documentation (#429806)
f5f54d
f5f54d
* Tue Jan  8 2008 Joe Orton <jorton@redhat.com> 2.0.1-3
f5f54d
- chmod 644 the documentation (#427950)
f5f54d
f5f54d
* Wed Aug 22 2007 Joe Orton <jorton@redhat.com> 2.0.1-2
f5f54d
- rebuild
f5f54d
f5f54d
* Wed Aug  8 2007 Joe Orton <jorton@redhat.com> 2.0.1-1
f5f54d
- update to 2.0.1
f5f54d
- fix the License tag
f5f54d
- drop the .la file
f5f54d
f5f54d
* Sun Feb  4 2007 Joe Orton <jorton@redhat.com> 1.95.8-10
f5f54d
- remove trailing dot in Summary (#225742)
f5f54d
- use preferred BuildRoot per packaging guidelines (#225742)
f5f54d
f5f54d
* Tue Jan 30 2007 Joe Orton <jorton@redhat.com> 1.95.8-9
f5f54d
- regenerate configure/libtool correctly (#199361)
f5f54d
- strip DSP files from examples (#186889)
f5f54d
- fix expat.h compilation with g++ -pedantic (#190244)
f5f54d
f5f54d
* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 1.95.8-8.2.1
f5f54d
- rebuild
f5f54d
f5f54d
* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 1.95.8-8.2
f5f54d
- bump again for double-long bug on ppc(64)
f5f54d
f5f54d
* Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - 1.95.8-8.1
f5f54d
- rebuilt for new gcc4.1 snapshot and glibc changes
f5f54d
f5f54d
* Tue Jan 31 2006 Joe Orton <jorton@redhat.com> 1.95.8-8
f5f54d
- restore .la file for apr-util
f5f54d
f5f54d
* Mon Jan 30 2006 Joe Orton <jorton@redhat.com> 1.95.8-7
f5f54d
- move library to /lib (#178743)
f5f54d
- omit .la file (#170031)
f5f54d
f5f54d
* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
f5f54d
- rebuilt
f5f54d
f5f54d
* Tue Mar  8 2005 Joe Orton <jorton@redhat.com> 1.95.8-6
f5f54d
- rebuild
f5f54d
f5f54d
* Thu Nov 25 2004 Ivana Varekova <varekova@redhat.com> 1.95.8
f5f54d
- update to 1.95.8
f5f54d
f5f54d
* Wed Jun 16 2004 Jeff Johnson <jbj@jbj.org> 1.95.7-4
f5f54d
- add -fPIC (#125586).
f5f54d
f5f54d
* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
f5f54d
- rebuilt
f5f54d
f5f54d
* Fri Jun 11 2004 Jeff Johnson <jbj@jbj.org> 1.95.7-2
f5f54d
- fix: malloc failure from dbus test suite (#124747).
f5f54d
f5f54d
* Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com>
f5f54d
- rebuilt
f5f54d
f5f54d
* Sun Feb 22 2004 Joe Orton <jorton@redhat.com> 1.95.7-1
f5f54d
- update to 1.95.7, include COPYING file in main package
f5f54d
f5f54d
* Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
f5f54d
- rebuilt
f5f54d
f5f54d
* Wed Sep 17 2003 Matt Wilson <msw@redhat.com> 1.95.5-6
f5f54d
- rebuild again for #91211
f5f54d
f5f54d
* Tue Sep 16 2003 Matt Wilson <msw@redhat.com> 1.95.5-5
f5f54d
- rebuild to fix gzip'ed file md5sums (#91211)
f5f54d
f5f54d
* Tue Jun 17 2003 Jeff Johnson <jbj@redhat.com> 1.95.5-4
f5f54d
- rebuilt because of crt breakage on ppc64.
f5f54d
f5f54d
* Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>
f5f54d
- rebuilt
f5f54d
f5f54d
* Wed Jan 22 2003 Tim Powers <timp@redhat.com>
f5f54d
- rebuilt
f5f54d
f5f54d
* Mon Nov 11 2002 Jeff Johnson <jbj@redhat.com> 1.95.5-1
f5f54d
- update to 1.95.5.
f5f54d
f5f54d
* Mon Aug 19 2002 Trond Eivind Glomsrød <teg@redhat.com> 1,95.4-1
f5f54d
- 1.95.4. 1.95.3 was withdrawn by the expat developers.
f5f54d
f5f54d
* Fri Jun 21 2002 Tim Powers <timp@redhat.com>
f5f54d
- automated rebuild
f5f54d
f5f54d
* Thu Jun  6 2002 Trond Eivind Glomsrød <teg@redhat.com> 1,95.3-1
f5f54d
- 1.95.3
f5f54d
f5f54d
* Thu May 23 2002 Tim Powers <timp@redhat.com>
f5f54d
- automated rebuild
f5f54d
f5f54d
* Fri Mar 22 2002 Trond Eivind Glomsrød <teg@redhat.com>
f5f54d
- Change a prereq in -devel on main package to a req
f5f54d
- License from MIT/X11 to BSD
f5f54d
f5f54d
* Mon Mar 11 2002 Trond Eivind Glomsrød <teg@redhat.com>
f5f54d
- 1.95.2
f5f54d
f5f54d
* Sun Jun 24 2001 Elliot Lee <sopwith@redhat.com>
f5f54d
- Bump release + rebuild.
f5f54d
f5f54d
* Tue Oct 24 2000 Jeff Johnson <jbj@redhat.com>
f5f54d
- update to 1.95.1
f5f54d
f5f54d
* Sun Oct  8 2000 Jeff Johnson <jbj@redhat.com>
f5f54d
- Create.