dd5dd7
%global unversion 2_2_5
dd5dd7
dd5dd7
Summary: An XML parser library
dd5dd7
Name: expat
dd5dd7
Version: %(echo %{unversion} | sed 's/_/./g')
ed4ea5
Release: 11%{?dist}
dd5dd7
Source: https://github.com/libexpat/libexpat/archive/R_%{unversion}.tar.gz#/expat-%{version}.tar.gz
dd5dd7
URL: https://libexpat.github.io/
dd5dd7
License: MIT
dd5dd7
BuildRequires: autoconf, libtool, xmlto, gcc-c++
dd5dd7
Patch0: expat-2.2.5-doc2man.patch
dd5dd7
Patch1: expat-2.2.5-CVE-2018-20843.patch
dd5dd7
Patch2: expat-2.2.5-CVE-2019-15903.patch
83eb0d
Patch3:	expat-2.2.5-Detect-and-prevent-integer-overflow-in-XML_GetBuffer.patch
83eb0d
Patch4:	expat-2.2.5-Detect-and-prevent-troublesome-left-shifts.patch
83eb0d
Patch5:	expat-2.2.5-Prevent-integer-overflow-on-m_groupSize-in-function.patch
83eb0d
Patch6:	expat-2.2.5-Prevent-more-integer-overflows.patch
afa004
Patch7: expat-2.2.5-Protect-against-malicious-namespace-declarations.patch
afa004
Patch8: expat-2.2.5-Add-missing-validation-of-encoding.patch
afa004
Patch9: expat-2.2.5-Prevent-integer-overflow-in-storeRawNames.patch
55f270
Patch10: expat-2.2.5-Prevent-integer-overflow-in-copyString.patch
55f270
Patch11: expat-2.2.5-Prevent-stack-exhaustion-in-build_model.patch
27c44f
Patch12: expat-2.2.5-Ensure-raw-tagnames-are-safe-exiting-internalEntityParser.patch
8fe6e1
Patch13: expat-2.2.5-CVE-2022-43680.patch
dd5dd7
dd5dd7
%description
dd5dd7
This is expat, the C library for parsing XML, written by James Clark. Expat
dd5dd7
is a stream oriented XML parser. This means that you register handlers with
dd5dd7
the parser prior to starting the parse. These handlers are called when the
dd5dd7
parser discovers the associated structures in the document being parsed. A
dd5dd7
start tag is an example of the kind of structures for which you may
dd5dd7
register handlers.
dd5dd7
dd5dd7
%package devel
dd5dd7
Summary: Libraries and header files to develop applications using expat
dd5dd7
Requires: expat%{?_isa} = %{version}-%{release}
dd5dd7
dd5dd7
%description devel
dd5dd7
The expat-devel package contains the libraries, include files and documentation
dd5dd7
to develop XML applications with expat.
dd5dd7
dd5dd7
%package static
dd5dd7
Summary: expat XML parser static library
dd5dd7
Requires: expat-devel%{?_isa} = %{version}-%{release}
dd5dd7
dd5dd7
%description static
dd5dd7
The expat-static package contains the static version of the expat library.
dd5dd7
Install it if you need to link statically with expat.
dd5dd7
dd5dd7
%prep
dd5dd7
%setup -q -n libexpat-R_%{unversion}/expat
dd5dd7
%patch0 -p2 -b .doc2man
dd5dd7
%patch1 -p2 -b .cve20843
dd5dd7
%patch2 -p2 -b .cve15903
83eb0d
%patch3 -p1 -b .CVE-2022-23852
83eb0d
%patch4 -p1 -b .CVE-2021-45960
83eb0d
%patch5 -p1 -b .CVE-2021-46143
83eb0d
%patch6 -p1 -b .CVE-2022-22822-CVE-2022-22827
afa004
%patch7 -p1 -b .CVE-2022-25236
afa004
%patch8 -p1 -b .CVE-2022-25235
afa004
%patch9 -p1 -b .CVE-2022-25315
55f270
%patch10 -p1 -b .CVE-2022-25314
55f270
%patch11 -p1 -b .CVE-2022-25313
27c44f
%patch12 -p1 -b .CVE-2022-40674
8fe6e1
%patch13 -p1 -b .CVE-2022-43680
dd5dd7
dd5dd7
sed -i 's/install-data-hook/do-nothing-please/' lib/Makefile.am
dd5dd7
./buildconf.sh
dd5dd7
dd5dd7
%build
dd5dd7
export CFLAGS="$RPM_OPT_FLAGS -fPIC"
dd5dd7
export DOCBOOK_TO_MAN="xmlto man --skip-validation"
dd5dd7
%configure
dd5dd7
make %{?_smp_mflags}
dd5dd7
dd5dd7
%install
dd5dd7
make install DESTDIR=$RPM_BUILD_ROOT
dd5dd7
dd5dd7
rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
dd5dd7
dd5dd7
%check
dd5dd7
make check
dd5dd7
dd5dd7
%ldconfig_scriptlets
dd5dd7
dd5dd7
%files
dd5dd7
%{!?_licensedir:%global license %%doc}
dd5dd7
%doc AUTHORS Changes
dd5dd7
%license COPYING
dd5dd7
%{_bindir}/*
dd5dd7
%{_libdir}/lib*.so.*
dd5dd7
%{_mandir}/*/*
dd5dd7
dd5dd7
%files devel
dd5dd7
%doc doc/reference.html doc/*.png doc/*.css examples/*.c
dd5dd7
%{_libdir}/lib*.so
dd5dd7
%{_libdir}/pkgconfig/*.pc
dd5dd7
%{_includedir}/*.h
dd5dd7
dd5dd7
%files static
dd5dd7
%{_libdir}/lib*.a
dd5dd7
dd5dd7
%changelog
ed4ea5
* Mon Nov 14 2022 Tomas Korbar <tkorbar@redhat.com> - 2.2.5-11
8fe6e1
- CVE-2022-43680 expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate
8fe6e1
- Resolves: CVE-2022-43680
8fe6e1
27c44f
* Fri Sep 30 2022 Tomas Korbar <tkorbar@redhat.com> - 2.2.5-10
27c44f
- Ensure raw tagnames are safe exiting internalEntityParser
27c44f
- Resolves: CVE-2022-40674
27c44f
55f270
* Fri May 06 2022 Tomas Korbar <tkorbar@redhat.com> - 2.2.5-9
55f270
- Fix multiple CVEs
55f270
- Resolves: CVE-2022-25314
55f270
- Resolves: CVE-2022-25313
55f270
afa004
* Mon Mar 14 2022 Tomas Korbar <tkorbar@redhat.com> - 2.2.5-8
afa004
- Improve patch for CVE-2022-25236
afa004
- Related: CVE-2022-25236
afa004
afa004
* Fri Mar 04 2022 Tomas Korbar <tkorbar@redhat.com> - 2.2.5-7
afa004
- Fix patch for CVE-2022-25235
afa004
- Resolves: CVE-2022-25235
afa004
afa004
* Thu Mar 03 2022 Tomas Korbar <tkorbar@redhat.com> - 2.2.5-6
afa004
- Fix multiple CVEs
afa004
- CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
afa004
- CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
afa004
- CVE-2022-25315 expat: integer overflow in storeRawNames()
afa004
- Resolves: CVE-2022-25236
afa004
- Resolves: CVE-2022-25235
afa004
- Resolves: CVE-2022-25315
afa004
83eb0d
* Fri Feb 14 2022 Tomas Korbar <tkorbar@redhat.com> -  2.2.5-5
83eb0d
- Fix multiple CVEs
83eb0d
- CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
83eb0d
- CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
83eb0d
- CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
83eb0d
- CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
83eb0d
- CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
83eb0d
- CVE-2022-22825 Integer overflow in lookup in xmlparse.c
83eb0d
- CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
83eb0d
- CVE-2022-22823 Integer overflow in build_model in xmlparse.c
83eb0d
- CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
83eb0d
- Resolves: CVE-2022-23852
83eb0d
- Resolves: CVE-2021-45960
83eb0d
- Resolves: CVE-2021-46143
83eb0d
- Resolves: CVE-2022-22827
83eb0d
- Resolves: CVE-2022-22826
83eb0d
- Resolves: CVE-2022-22825
83eb0d
- Resolves: CVE-2022-22824
83eb0d
- Resolves: CVE-2022-22823
83eb0d
- Resolves: CVE-2022-22822
83eb0d
dd5dd7
* Fri Apr 24 2020 Joe Orton <jorton@redhat.com> - 2.2.5-4
dd5dd7
- add security fixes for CVE-2018-20843, CVE-2019-15903
dd5dd7
dd5dd7
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.5-3
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
dd5dd7
dd5dd7
* Sat Feb 03 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2.2.5-2
dd5dd7
- Switch to %%ldconfig_scriptlets
dd5dd7
dd5dd7
* Thu Nov  2 2017 Joe Orton <jorton@redhat.com> - 2.2.5-1
dd5dd7
- update to 2.2.5 (#1508667)
dd5dd7
dd5dd7
* Mon Aug 21 2017 Joe Orton <jorton@redhat.com> - 2.2.4-1
dd5dd7
- update to 2.2.4 (#1483359)
dd5dd7
dd5dd7
* Fri Aug  4 2017 Joe Orton <jorton@redhat.com> - 2.2.3-1
dd5dd7
- fix tests with unsigned char (upstream PR 109)
dd5dd7
- update to 2.2.3 (#1473266)
dd5dd7
dd5dd7
* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.2-4
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
dd5dd7
dd5dd7
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.2-3
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
dd5dd7
dd5dd7
* Fri Jul 14 2017 Joe Orton <jorton@redhat.com> - 2.2.2-2
dd5dd7
- update to 2.2.2 (#1470891)
dd5dd7
dd5dd7
* Fri Jul  7 2017 Joe Orton <jorton@redhat.com> - 2.2.1-2
dd5dd7
- trim unnecessary doc, examples content
dd5dd7
dd5dd7
* Mon Jun 19 2017 Joe Orton <jorton@redhat.com> - 2.2.1-1
dd5dd7
- update to 2.2.1 (#1462474)
dd5dd7
dd5dd7
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.0-2
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
dd5dd7
dd5dd7
* Tue Jun 21 2016 Joe Orton <jorton@redhat.com> - 2.2.0-1
dd5dd7
- update to 2.2.0 (#1247348)
dd5dd7
dd5dd7
* Thu Jun 16 2016 Joe Orton <jorton@redhat.com> - 2.1.1-2
dd5dd7
- add security fixes for CVE-2016-0718, CVE-2012-6702, CVE-2016-5300,
dd5dd7
  CVE-2016-4472
dd5dd7
dd5dd7
* Mon Apr 18 2016 David Tardon <dtardon@redhat.com> - 2.1.1-1
dd5dd7
- new upstream release
dd5dd7
dd5dd7
* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-13
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
dd5dd7
dd5dd7
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.0-12
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
dd5dd7
dd5dd7
* Sat Feb 21 2015 Till Maas <opensource@till.name> - 2.1.0-11
dd5dd7
- Rebuilt for Fedora 23 Change
dd5dd7
  https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
dd5dd7
dd5dd7
* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.0-10
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
dd5dd7
dd5dd7
* Sat Jul 12 2014 Tom Callaway <spot@fedoraproject.org> - 2.1.0-9
dd5dd7
- fix license handling
dd5dd7
dd5dd7
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.0-8
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
dd5dd7
dd5dd7
* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.0-7
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
dd5dd7
dd5dd7
* Mon Jun 17 2013 Joe Orton <jorton@redhat.com> - 2.1.0-6
dd5dd7
- fix "xmlwf -h" output (#948534)
dd5dd7
dd5dd7
* Wed Feb 13 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.0-5
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
dd5dd7
dd5dd7
* Thu Jul 19 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.0-4
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
dd5dd7
dd5dd7
* Fri Apr 13 2012 Joe Orton <jorton@redhat.com> - 2.1.0-3
dd5dd7
- add -static subpackage (#722647)
dd5dd7
dd5dd7
* Fri Mar 30 2012 Joe Orton <jorton@redhat.com> - 2.1.0-1
dd5dd7
- ship .pc file, move library back to libdir (#808399)
dd5dd7
dd5dd7
* Mon Mar 26 2012 Joe Orton <jorton@redhat.com> - 2.1.0-1
dd5dd7
- update to 2.1.0 (#806602)
dd5dd7
dd5dd7
* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.0.1-12
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
dd5dd7
dd5dd7
* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.0.1-11
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
dd5dd7
dd5dd7
* Mon Feb  8 2010 Joe Orton <jorton@redhat.com> - 2.0.1-10
dd5dd7
- revised fix for CVE-2009-3560 regression (#544996)
dd5dd7
dd5dd7
* Sun Jan 31 2010 Joe Orton <jorton@redhat.com> - 2.0.1-9
dd5dd7
- drop static libraries (#556046)
dd5dd7
- add fix for regression in CVE-2009-3560 patch (#544996)
dd5dd7
dd5dd7
* Tue Dec  1 2009 Joe Orton <jorton@redhat.com> - 2.0.1-8
dd5dd7
- add security fix for CVE-2009-3560 (#533174)
dd5dd7
- add security fix for CVE-2009-3720 (#531697)
dd5dd7
- run the test suite
dd5dd7
dd5dd7
* Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.0.1-7
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
dd5dd7
dd5dd7
* Tue Feb 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.0.1-6
dd5dd7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
dd5dd7
dd5dd7
* Tue Feb 19 2008 Fedora Release Engineering <rel-eng@fedoraproject.org> - 2.0.1-5
dd5dd7
- Autorebuild for GCC 4.3
dd5dd7
dd5dd7
* Wed Jan 23 2008 Joe Orton <jorton@redhat.com> 2.0.1-4
dd5dd7
- chmod 644 even more documentation (#429806)
dd5dd7
dd5dd7
* Tue Jan  8 2008 Joe Orton <jorton@redhat.com> 2.0.1-3
dd5dd7
- chmod 644 the documentation (#427950)
dd5dd7
dd5dd7
* Wed Aug 22 2007 Joe Orton <jorton@redhat.com> 2.0.1-2
dd5dd7
- rebuild
dd5dd7
dd5dd7
* Wed Aug  8 2007 Joe Orton <jorton@redhat.com> 2.0.1-1
dd5dd7
- update to 2.0.1
dd5dd7
- fix the License tag
dd5dd7
- drop the .la file
dd5dd7
dd5dd7
* Sun Feb  4 2007 Joe Orton <jorton@redhat.com> 1.95.8-10
dd5dd7
- remove trailing dot in Summary (#225742)
dd5dd7
- use preferred BuildRoot per packaging guidelines (#225742)
dd5dd7
dd5dd7
* Tue Jan 30 2007 Joe Orton <jorton@redhat.com> 1.95.8-9
dd5dd7
- regenerate configure/libtool correctly (#199361)
dd5dd7
- strip DSP files from examples (#186889)
dd5dd7
- fix expat.h compilation with g++ -pedantic (#190244)
dd5dd7
dd5dd7
* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 1.95.8-8.2.1
dd5dd7
- rebuild
dd5dd7
dd5dd7
* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 1.95.8-8.2
dd5dd7
- bump again for double-long bug on ppc(64)
dd5dd7
dd5dd7
* Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - 1.95.8-8.1
dd5dd7
- rebuilt for new gcc4.1 snapshot and glibc changes
dd5dd7
dd5dd7
* Tue Jan 31 2006 Joe Orton <jorton@redhat.com> 1.95.8-8
dd5dd7
- restore .la file for apr-util
dd5dd7
dd5dd7
* Mon Jan 30 2006 Joe Orton <jorton@redhat.com> 1.95.8-7
dd5dd7
- move library to /lib (#178743)
dd5dd7
- omit .la file (#170031)
dd5dd7
dd5dd7
* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
dd5dd7
- rebuilt
dd5dd7
dd5dd7
* Tue Mar  8 2005 Joe Orton <jorton@redhat.com> 1.95.8-6
dd5dd7
- rebuild
dd5dd7
dd5dd7
* Thu Nov 25 2004 Ivana Varekova <varekova@redhat.com> 1.95.8
dd5dd7
- update to 1.95.8
dd5dd7
dd5dd7
* Wed Jun 16 2004 Jeff Johnson <jbj@jbj.org> 1.95.7-4
dd5dd7
- add -fPIC (#125586).
dd5dd7
dd5dd7
* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
dd5dd7
- rebuilt
dd5dd7
dd5dd7
* Fri Jun 11 2004 Jeff Johnson <jbj@jbj.org> 1.95.7-2
dd5dd7
- fix: malloc failure from dbus test suite (#124747).
dd5dd7
dd5dd7
* Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com>
dd5dd7
- rebuilt
dd5dd7
dd5dd7
* Sun Feb 22 2004 Joe Orton <jorton@redhat.com> 1.95.7-1
dd5dd7
- update to 1.95.7, include COPYING file in main package
dd5dd7
dd5dd7
* Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
dd5dd7
- rebuilt
dd5dd7
dd5dd7
* Wed Sep 17 2003 Matt Wilson <msw@redhat.com> 1.95.5-6
dd5dd7
- rebuild again for #91211
dd5dd7
dd5dd7
* Tue Sep 16 2003 Matt Wilson <msw@redhat.com> 1.95.5-5
dd5dd7
- rebuild to fix gzip'ed file md5sums (#91211)
dd5dd7
dd5dd7
* Tue Jun 17 2003 Jeff Johnson <jbj@redhat.com> 1.95.5-4
dd5dd7
- rebuilt because of crt breakage on ppc64.
dd5dd7
dd5dd7
* Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>
dd5dd7
- rebuilt
dd5dd7
dd5dd7
* Wed Jan 22 2003 Tim Powers <timp@redhat.com>
dd5dd7
- rebuilt
dd5dd7
dd5dd7
* Mon Nov 11 2002 Jeff Johnson <jbj@redhat.com> 1.95.5-1
dd5dd7
- update to 1.95.5.
dd5dd7
dd5dd7
* Mon Aug 19 2002 Trond Eivind Glomsrød <teg@redhat.com> 1,95.4-1
dd5dd7
- 1.95.4. 1.95.3 was withdrawn by the expat developers.
dd5dd7
dd5dd7
* Fri Jun 21 2002 Tim Powers <timp@redhat.com>
dd5dd7
- automated rebuild
dd5dd7
dd5dd7
* Thu Jun  6 2002 Trond Eivind Glomsrød <teg@redhat.com> 1,95.3-1
dd5dd7
- 1.95.3
dd5dd7
dd5dd7
* Thu May 23 2002 Tim Powers <timp@redhat.com>
dd5dd7
- automated rebuild
dd5dd7
dd5dd7
* Fri Mar 22 2002 Trond Eivind Glomsrød <teg@redhat.com>
dd5dd7
- Change a prereq in -devel on main package to a req
dd5dd7
- License from MIT/X11 to BSD
dd5dd7
dd5dd7
* Mon Mar 11 2002 Trond Eivind Glomsrød <teg@redhat.com>
dd5dd7
- 1.95.2
dd5dd7
dd5dd7
* Sun Jun 24 2001 Elliot Lee <sopwith@redhat.com>
dd5dd7
- Bump release + rebuild.
dd5dd7
dd5dd7
* Tue Oct 24 2000 Jeff Johnson <jbj@redhat.com>
dd5dd7
- update to 1.95.1
dd5dd7
dd5dd7
* Sun Oct  8 2000 Jeff Johnson <jbj@redhat.com>
dd5dd7
- Create.