XML Parser Toolkit
Expat is an XML 1.0 parser written in C. It aims to be fully
conformant. It is currently not a validating XML processor. The current
production version of expat can be downloaded from
ftp://ftp.jclark.com/pub/xml/expat.zip. The directory xmltok contains a
low-level library for tokenizing XML. The interface is documented in
xmltok/xmltok.h. The directory xmlparse contains an XML parser library
that is built on top of the xmltok library. The interface is documented
in xmlparse/xmlparse.h. The directory sample contains a simple example
program using this interface. The file sample/build.bat is a batch
file to build the example using Visual C++. The directory xmlwf
contains the xmlwf application, which uses the xmlparse library. The
arguments to xmlwf are one or more files to check for well-formedness.
An option -d dir can be specified. For each well-formed input file, the
corresponding canonical XML is written to dir/f, where f is the
filename (without any path) of the input file. A -x option causes
references to external general entities to be processed. A -s option
makes documents that are not stand-alone cause an error (a document is
considered stand-alone if it is intrinsically stand-alone because it
has no external subset and no references to parameter entities in the
internal subset or it is declared as stand-alone in the XML
declaration).
- Developed at devel:libraries:c_c++
- Sources inherited from project openSUSE:Factory
-
6
derived packages
- Download package
-
Checkout Package
osc -A https://api.opensuse.org checkout openSUSE:Factory:zSystems/expat && cd $_ - Create Badge
Source Files
| Filename | Size | Changed |
|---|---|---|
| baselibs.conf | 0000000179 179 Bytes | |
| expat-2.4.6.tar.xz | 0000452468 442 KB | |
| expat-2.4.6.tar.xz.asc | 0000000833 833 Bytes | |
| expat.changes | 0000041123 40.2 KB | |
| expat.spec | 0000003490 3.41 KB | |
| expatfaq.html | 0000003117 3.04 KB |
Revision 66 (latest revision is 79)
Dominique Leuenberger (dimstar_suse)
accepted
request 956337
from
Pedro Monreal Gonzalez (pmonrealgonzalez)
(revision 66)
- update to 2.4.6 (bsc#1196168, CVE-2022-25313):
* Bug fixes:
- Fix a regression introduced by the fix for CVE-2022-25313
in release 2.4.5 that affects applications that (1)
call function XML_SetElementDeclHandler and (2) are
parsing XML that contains nested element declarations
(e.g. "<!ELEMENT junk ((bar|foo|xyz+), zebra*)>").
- Version info bumped from 9:5:8 to 9:6:8;
see https://verbump.de/ for what these numbers do.
- update to 2.4.5 (bsc#1196171, bsc#1196169, bsc#1196168,
bsc#1196026, bsc#1196025):
* Security fixes:
- CVE-2022-25235 -- Passing malformed 2- and 3-byte UTF-8
sequences (e.g. from start tag names) to the XML
processing application on top of Expat can cause
arbitrary damage (e.g. code execution) depending
on how invalid UTF-8 is handled inside the XML
processor; validation was not their job but Expat's.
Exploits with code execution are known to exist.
- CVE-2022-25236 -- Passing (one or more) namespace separator
characters in "xmlns[:prefix]" attribute values
made Expat send malformed tag names to the XML
processor on top of Expat which can cause
arbitrary damage (e.g. code execution) depending
on such unexpectable cases are handled inside the XML
processor; validation was not their job but Expat's.
Exploits with code execution are known to exist.
- CVE-2022-25313 -- Fix stack exhaustion in doctype parsing
that could be triggered by e.g. a 2 megabytes
Comments 0