225ef2
diff -up thunderbird-91.7.0/parser/expat/lib/xmltok.c.expat-CVE-2022-25235 thunderbird-91.7.0/parser/expat/lib/xmltok.c
225ef2
--- thunderbird-91.7.0/parser/expat/lib/xmltok.c.expat-CVE-2022-25235	2022-03-02 17:57:38.364361168 +0100
225ef2
+++ thunderbird-91.7.0/parser/expat/lib/xmltok.c	2022-03-02 17:58:22.235512399 +0100
225ef2
@@ -65,13 +65,6 @@
225ef2
                       + ((((byte)[2]) >> 5) & 1)] \
225ef2
          & (1u << (((byte)[2]) & 0x1F)))
225ef2
 
225ef2
-#define UTF8_GET_NAMING(pages, p, n) \
225ef2
-  ((n) == 2 \
225ef2
-  ? UTF8_GET_NAMING2(pages, (const unsigned char *)(p)) \
225ef2
-  : ((n) == 3 \
225ef2
-     ? UTF8_GET_NAMING3(pages, (const unsigned char *)(p)) \
225ef2
-     : 0))
225ef2
-
225ef2
 /* Detection of invalid UTF-8 sequences is based on Table 3.1B
225ef2
    of Unicode 3.2: http://www.unicode.org/unicode/reports/tr28/
225ef2
    with the additional restriction of not allowing the Unicode
225ef2
diff -up thunderbird-91.7.0/parser/expat/lib/xmltok_impl.c.expat-CVE-2022-25235 thunderbird-91.7.0/parser/expat/lib/xmltok_impl.c
225ef2
--- thunderbird-91.7.0/parser/expat/lib/xmltok_impl.c.expat-CVE-2022-25235	2022-03-02 17:57:38.365361172 +0100
225ef2
+++ thunderbird-91.7.0/parser/expat/lib/xmltok_impl.c	2022-03-02 18:04:51.240853247 +0100
225ef2
@@ -34,7 +34,7 @@
225ef2
    case BT_LEAD ## n: \
225ef2
      if (end - ptr < n) \
225ef2
        return XML_TOK_PARTIAL_CHAR; \
225ef2
-     if (!IS_NAME_CHAR(enc, ptr, n)) { \
225ef2
+     if (IS_INVALID_CHAR(enc, ptr, n) || ! IS_NAME_CHAR(enc, ptr, n)) { \
225ef2
        *nextTokPtr = ptr; \
225ef2
        return XML_TOK_INVALID; \
225ef2
      } \
225ef2
@@ -62,7 +62,7 @@
225ef2
    case BT_LEAD ## n: \
225ef2
      if (end - ptr < n) \
225ef2
        return XML_TOK_PARTIAL_CHAR; \
225ef2
-     if (!IS_NMSTRT_CHAR(enc, ptr, n)) { \
225ef2
+     if (IS_INVALID_CHAR(enc, ptr, n) || ! IS_NMSTRT_CHAR(enc, ptr, n)) { \
225ef2
        *nextTokPtr = ptr; \
225ef2
        return XML_TOK_INVALID; \
225ef2
      } \
225ef2
@@ -1090,6 +1090,10 @@ PREFIX(prologTok)(const ENCODING *enc, c
225ef2
   case BT_LEAD ## n: \
225ef2
     if (end - ptr < n) \
225ef2
       return XML_TOK_PARTIAL_CHAR; \
225ef2
+    if (IS_INVALID_CHAR(enc, ptr, n)) {                                        \
225ef2
+      *nextTokPtr = ptr;                                                       \
225ef2
+      return XML_TOK_INVALID;                                                  \
225ef2
+    }                                                                          \
225ef2
     if (IS_NMSTRT_CHAR(enc, ptr, n)) { \
225ef2
       ptr += n; \
225ef2
       tok = XML_TOK_NAME; \