Bundled expat 2.6.4 (xlsxreader) is missing upstream security fixes
維護者通常 4 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
Start by inspecting the depends/libexpat submodule revision and how xlsxreader uses xlsxio to pass sheet XML to expat; the issue identifies both entry points. Check the bundled expat version in the Linux release and compare it with the upstream fixes listed here. Done means updating the dependency to expat 2.9.0 or later and confirming the bundled xlsxreader uses that version.
由索引模型根據 Issue 內容生成。
描述
Hi,
depends/libexpat points to DFHack/libexpat e3ea446, whose upstream base is libexpat 2691aff (expat 2.6.4, November 2024). The 53.16-r3 Linux release ships this code in hack/plugins/xlsxreader.plug.so, which reports "expat_2.6.4". The submodule on develop is the same.
xlsxreader opens .xlsx files through xlsxio, which feeds the sheet XML to expat with XML_ParseBuffer, so expat parses whatever spreadsheet a user loads, for example a quickfort blueprint downloaded from elsewhere.
expat releases since 2.6.4 fix issues that a crafted document can reach on this path, including:
- CVE-2024-8176, stack overflow from chaining many entities (fixed in 2.7.0)
- CVE-2025-59375, large memory allocations from a small document (2.7.2)
- CVE-2026-41080, too little salt entropy in the hash flooding protection (2.8.0)
- CVE-2026-45186, quadratic time in attribute name collision checks (2.8.1)
- CVE-2026-66046, quadratic time in attribute CDATA lookups (2.8.4)
- CVE-2026-93990, malformed UTF-16 accepted (2.8.5)
Later releases also add integer overflow checks for very large inputs. Updating depends/libexpat to expat 2.9.0 or later would pick all of these up. They are already public, and I have not tried to trigger any of them in DFHack.
- 主要語言
- C++
- 星號
- 2.1k
- 分支
- 509
- 平均合併
- 3 天 17 小時
- 30 天內合併 PR
- 13
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
DFHack/dfhack 的其他 Issue
-
難度 2/5 1-3 小時 新手友好度 78/100
維護者通常 4 天內回覆
-
難度 2/5 1-3 小時 新手友好度 66/100
維護者通常 4 天內回覆
-
難度 3/5 1-2 天 新手友好度 57/100
維護者通常 4 天內回覆
-
難度 5/5 一週以上 新手友好度 35/100
維護者通常 4 天內回覆
-
難度 5/5 一週以上 新手友好度 25/100
維護者通常 4 天內回覆
相似的 Issue
-
難度 1/5 1 小時以內 新手友好度 88/100
ROCm/FastFlowLM#887 ·
維護者通常 1 天內回覆
-
paraview 6.2.0 uses Abseil 20260526 symbols but does not pin libabseil (undefined symbol with libabseil 20260817)可能已有人在做 @jschueller 今天認領。 未關閉
難度 2/5 1-3 小時 新手友好度 64/100
-
bug medium priority openmp tokenizer wrong result
難度 2/5 1-3 小時 新手友好度 82/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 92/100
apache/casbin-cpp#277 ·
-
難度 2/5 1-3 小時 新手友好度 68/100
iamaisim/ProjectAirSim#241 ·
維護者通常 1 天內回覆