chore(deps): update bundled expat 2.8.1 -> 2.8.2 (13 CVEs) (#5396)

* chore(deps): update bundled expat 2.8.1 -> 2.8.2 (13 CVEs)

Security fixes from upstream (Expat 2.8.2), all CVE-2026:

Integer overflows (9):
- CVE-2026-56403, CVE-2026-56404, CVE-2026-56405, CVE-2026-56406,
  CVE-2026-56407, CVE-2026-56408, CVE-2026-56409, CVE-2026-56410,
  CVE-2026-56411

Missing control flow integrity checks (3):
- CVE-2026-50219, CVE-2026-56131, CVE-2026-56412

Out-of-bounds write (1):
- CVE-2026-56132

The integer overflows land in xmlparse.c; the control-flow-integrity
and bounds checks touch xmlparse.c, xmltok.c and xmltok_impl.c.

Other upstream changes carried in:
- New helper sources added to the bundle: fallthrough.h,
  memory_sanitizer.h and xcsinc.c (the latter is #included from the
  char-type variants, not a standalone translation unit).
- errno-propagation and siphash.h cleanups; minor random_*.c churn.
- Library VERSION/SOVERSION moved from 1.12.1 to 1.12.2
  (LIBCURRENT 13 / LIBREVISION 2 / LIBAGE 12).

Bundled-build adjustments:
- dependencies/expat/CMakeLists.txt tracks upstream's reworked
  lib/CMakeLists.txt; Poco's portable expat_config.h is preserved
  (the update did not overwrite it).
- dependencies/README.md dependency table: 2.8.1 -> 2.8.2.

Ref: https://blog.hartwork.org/posts/expat-2-8-2-released/

Verified: XML-testrunner -all passes (138 tests) on Windows x64
(MSVC 19.44, VS 2022) in a minimal cmake build (POCO_MINIMAL_BUILD +
ENABLE_XML + ENABLE_TESTS).

* fix(XML): abort parse via XML_StopParser instead of throwing through Expat callbacks

A C++ exception unwinding through Expat 2.8.2 leaves the parser marked
in-handler, turning XML_ParserFree() into a silent no-op (memory leak). #5395

* fix(XML): harden ParserEngine handler exception capture

Never drop a captured exception if XML_StopParser() failed; capture
exceptions from the unknown-encoding handler; test throwing handlers.

Co-authored-by: Matej Kenda <matejken@gmail.com>

* chore(codeql): derive throwing test handler from DefaultHandler

Removes raw-array parameters flagged by cpp/array-in-interface.

---------

Co-authored-by: Matej Kenda <matejken@gmail.com>

Author: beatabaranowska

XML/src/ParserEngine.cpp

@@ -7,7 +7,7 @@
 //
 // Definition of the ParseEngine class.
 //
-// Copyright (c) 2004-2006, Applied Informatics Software Engineering GmbH.
+// Copyright (c) 2004-2026, Applied Informatics Software Engineering GmbH.
 // and Contributors.
 //
 // SPDX-License-Identifier:	BSL-1.0
@@ -23,6 +23,7 @@
 #include "Poco/SAX/Locator.h"
 #include "Poco/TextEncoding.h"
 #include <expat.h>
+#include <exception>
 #include <map>
 #include <vector>
 
@@ -220,6 +221,33 @@ class XML_API ParserEngine: public Locator
 		/// Throws an XMLException with a message corresponding
 		/// to the given Expat error code.
 
+	void checkError(XML_Parser parser);
+		/// Called after a failed XML_Parse()/XML_ParseBuffer() call.
+		/// If a C++ exception thrown from within a handler has been
+		/// captured by abortParse(), rethrows it (and clears it);
+		/// otherwise translates the parser's current Expat error code
+		/// into an exception via handleError().
+
+	void abortParse(XML_Parser parser, std::exception_ptr ex);
+		/// Called from an Expat callback when invoking application code
+		/// (a SAX/DTD/lexical handler or entity resolver) throws a C++
+		/// exception. Expat is a C library and does not support C++
+		/// exceptions unwinding through its call stack -- doing so skips
+		/// Expat's internal handler-call-depth bookkeeping and leaves the
+		/// parser (and everything it owns) permanently leaked, since Expat
+		/// then refuses to free a parser it believes is still inside a
+		/// handler call.
+		///
+		/// Instead, the exception is captured here and the parser is
+		/// stopped gracefully via XML_StopParser(), which Expat fully
+		/// supports from within a handler. Once XML_Parse() returns,
+		/// checkError() rethrows the captured exception.
+
+	XML_Parser currentParser() const;
+		/// Returns the Expat parser instance (the main parser, or the
+		/// external entity sub-parser currently being parsed) that is
+		/// active for the top-most entry of the context stack.
+
 	void parseExternal(XML_Parser extParser, InputSource* pInputSource);
 		/// Parse an XML document from the given InputSource.
 
@@ -290,6 +318,8 @@ class XML_API ParserEngine: public Locator
 	LexicalHandler* _pLexicalHandler;
 	ErrorHandler*   _pErrorHandler;
 
+	std::exception_ptr _exception;
+
 	float _maximumAmplificationFactor;
 	Poco::UInt64 _activationThresholdBytes;
 

XML/src/ParserEngine.h

@@ -14,12 +14,14 @@
 #include "Poco/SAX/SAXParser.h"
 #include "Poco/SAX/InputSource.h"
 #include "Poco/SAX/EntityResolver.h"
+#include "Poco/SAX/DefaultHandler.h"
 #include "Poco/SAX/SAXException.h"
 #include "Poco/SAX/WhitespaceFilter.h"
 #include "Poco/XML/XMLWriter.h"
 #include "Poco/Latin9Encoding.h"
 #include "Poco/FileStream.h"
 #include <sstream>
+#include <stdexcept>
 
 
 using Poco::XML::SAXParser;
@@ -28,8 +30,11 @@ using Poco::XML::XMLReader;
 using Poco::XML::InputSource;
 using Poco::XML::EntityResolver;
 using Poco::XML::XMLString;
+using Poco::XML::XMLException;
 using Poco::XML::SAXParseException;
 using Poco::XML::WhitespaceFilter;
+using Poco::XML::DefaultHandler;
+using Poco::XML::Attributes;
 
 
 class TestEntityResolver: public EntityResolver
@@ -62,6 +67,32 @@ class TestEntityResolver: public EntityResolver
 };
 
 
+class ThrowingHandler: public DefaultHandler
+{
+public:
+	enum Kind
+	{
+		THROW_STD,
+		THROW_XML
+	};
+
+	ThrowingHandler(Kind kind): _kind(kind)
+	{
+	}
+
+	void startElement(const XMLString& uri, const XMLString& localName, const XMLString& qname, const Attributes& attrList)
+	{
+		if (_kind == THROW_STD)
+			throw std::runtime_error("handler failure");
+		else
+			throw XMLException("handler failure");
+	}
+
+private:
+	Kind _kind;
+};
+
+
 SAXParserTest::SAXParserTest(const std::string& name): CppUnit::TestCase(name)
 {
 }
@@ -313,6 +344,38 @@ void SAXParserTest::testParsePartialReads()
 }
 
 
+void SAXParserTest::testContentHandlerThrows()
+{
+	SAXParser parser;
+
+	ThrowingHandler stdHandler(ThrowingHandler::THROW_STD);
+	parser.setContentHandler(&stdHandler);
+	try
+	{
+		parser.parseString("<root/>");
+		fail("must throw");
+	}
+	catch (const std::runtime_error& exc)
+	{
+		assertTrue (std::string(exc.what()) == "handler failure");
+	}
+
+	ThrowingHandler xmlHandler(ThrowingHandler::THROW_XML);
+	parser.setContentHandler(&xmlHandler);
+	try
+	{
+		parser.parseString("<root/>");
+		fail("must throw");
+	}
+	catch (const SAXParseException&)
+	{
+	}
+
+	parser.setContentHandler(nullptr);
+	parser.parseString(SIMPLE1);
+}
+
+
 void SAXParserTest::setUp()
 {
 }
@@ -378,6 +441,7 @@ CppUnit::Test* SAXParserTest::suite()
 	CppUnit_addTest(pSuite, SAXParserTest, testCharacters);
 	CppUnit_addTest(pSuite, SAXParserTest, testParseMemory);
 	CppUnit_addTest(pSuite, SAXParserTest, testParsePartialReads);
+	CppUnit_addTest(pSuite, SAXParserTest, testContentHandlerThrows);
 
 	return pSuite;
 }

XML/testsuite/src/SAXParserTest.cpp

@@ -48,6 +48,7 @@ class SAXParserTest: public CppUnit::TestCase
 	void testParseMemory();
 	void testCharacters();
 	void testParsePartialReads();
+	void testContentHandlerThrows();
 
 	void setUp();
 	void tearDown();

XML/testsuite/src/SAXParserTest.h

@@ -14,7 +14,7 @@ are replaced with system-installed versions via `find_package()` or `-l` flags.
 | [zlib](zlib/) | 1.3.2 | Zlib | Foundation (compression/decompression streams) | Yes | https://github.com/madler/zlib |
 | [pcre2](pcre2/) | 10.47 | BSD-3-Clause | Foundation (regular expressions) | Yes | https://github.com/PCRE2Project/pcre2 |
 | [utf8proc](utf8proc/) | 2.11.3 | MIT | Foundation (Unicode normalization) | Yes | https://github.com/JuliaStrings/utf8proc |
-| [expat](expat/) | 2.8.1 | MIT | XML (SAX/DOM parser) | Yes | https://github.com/libexpat/libexpat |
+| [expat](expat/) | 2.8.2 | MIT | XML (SAX/DOM parser) | Yes | https://github.com/libexpat/libexpat |
 | [sqlite3](sqlite3/) | 3.53.1 | Public Domain | Data/SQLite (embedded database) | Yes | https://www.sqlite.org |
 | [png](png/) | 1.6.58 | libpng License | PDF (PNG image support) | Yes | https://github.com/pnggroup/libpng |
 | [v8_double_conversion](v8_double_conversion/) | 3.4.0 | BSD-3-Clause | Foundation (float-to-string conversion) | No | https://github.com/google/double-conversion |

dependencies/README.md

@@ -1,6 +1,6 @@
 # Expat XML parser library
-# Version: 2.8.1
-# Source: https://github.com/libexpat/libexpat/releases/tag/R_2_8_1
+# Version: 2.8.2
+# Source: https://github.com/libexpat/libexpat/releases/tag/R_2_8_2
 
 if(POCO_UNBUNDLED)
 	if (ENABLE_XML)
@@ -11,8 +11,14 @@ else()
 	# Core sources -- exclude the per-entropy-source random_*.c files;
 	# those are added conditionally below to mirror the upstream
 	# CMakeLists gating (see expat-2.8.1/CMakeLists.txt).
+	# Also exclude xcsinc.c: unlike xmltok_impl.c/xmltok_ns.c (which guard
+	# themselves with #ifdef XML_TOK_IMPL_C/XML_TOK_NS_C and compile to an
+	# empty translation unit standalone), xcsinc.c has no include guard and
+	# is only meant to be #include-d from xmlparse.c; compiling it as its
+	# own translation unit fails since XML_Char is undefined.
 	file(GLOB SRCS_G "src/*.c")
 	list(FILTER SRCS_G EXCLUDE REGEX "/random_.*\\.c$")
+	list(FILTER SRCS_G EXCLUDE REGEX "/xcsinc\\.c$")
 	POCO_SOURCES(SRCS expat ${SRCS_G})
 
 	# Headers

dependencies/expat/CMakeLists.txt

@@ -1094,7 +1094,7 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled);
 */
 #  define XML_MAJOR_VERSION 2
 #  define XML_MINOR_VERSION 8
-#  define XML_MICRO_VERSION 1
+#  define XML_MICRO_VERSION 2
 
 #  ifdef __cplusplus
 }

dependencies/expat/src/expat.h

@@ -0,0 +1,49 @@
+/*
+                            __  __            _
+                         ___\ \/ /_ __   __ _| |_
+                        / _ \\  /| '_ \ / _` | __|
+                       |  __//  \| |_) | (_| | |_
+                        \___/_/\_\ .__/ \__,_|\__|
+                                 |_| XML parser
+
+   Copyright (c) 2026 Nick Begg <nick@stunttruck.net>
+   Licensed under the MIT license:
+
+   Permission is  hereby granted,  free of charge,  to any  person obtaining
+   a  copy  of  this  software   and  associated  documentation  files  (the
+   "Software"),  to  deal in  the  Software  without restriction,  including
+   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
+   distribute, sublicense, and/or sell copies of the Software, and to permit
+   persons  to whom  the Software  is  furnished to  do so,  subject to  the
+   following conditions:
+
+   The above copyright  notice and this permission notice  shall be included
+   in all copies or substantial portions of the Software.
+
+   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
+   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
+   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+   USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+#ifndef FALLTHROUGH_H
+#  define FALLTHROUGH_H 1
+
+// Explicit fallthrough in switch case to avoid warnings
+// with compiler flag -Wimplicit-fallthrough.
+
+#  define EXPAT_FALLTHROUGH                                                    \
+    do {                                                                       \
+    } while (0)
+
+#  if defined(__has_attribute)
+#    if __has_attribute(fallthrough)
+#      undef EXPAT_FALLTHROUGH
+#      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
+#    endif
+#  endif
+
+#endif // FALLTHROUGH_H

dependencies/expat/src/fallthrough.h

@@ -0,0 +1,51 @@
+/*
+                            __  __            _
+                         ___\ \/ /_ __   __ _| |_
+                        / _ \\  /| '_ \ / _` | __|
+                       |  __//  \| |_) | (_| | |_
+                        \___/_/\_\ .__/ \__,_|\__|
+                                 |_| XML parser
+
+   Copyright (c) 2026 Matthew Fernandez <matthew.fernandez@gmail.com>
+   Licensed under the MIT license:
+
+   Permission is  hereby granted,  free of charge,  to any  person obtaining
+   a  copy  of  this  software   and  associated  documentation  files  (the
+   "Software"),  to  deal in  the  Software  without restriction,  including
+   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
+   distribute, sublicense, and/or sell copies of the Software, and to permit
+   persons  to whom  the Software  is  furnished to  do so,  subject to  the
+   following conditions:
+
+   The above copyright  notice and this permission notice  shall be included
+   in all copies or substantial portions of the Software.
+
+   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
+   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
+   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+   USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+#if ! defined(MEMORY_SANITIZER_H)
+#  define MEMORY_SANITIZER_H 1
+
+#  if defined(__has_feature)
+#    if __has_feature(memory_sanitizer)
+#      include <sanitizer/msan_interface.h>
+
+// inform Memory Sanitizer that [base, base + extent) is now initialized
+#      define MSAN_UNPOISON(base, extent) __msan_unpoison((base), (extent))
+
+#    endif
+#  endif
+
+#  if ! defined(MSAN_UNPOISON)
+#    define MSAN_UNPOISON(base, extent)                                        \
+      do {                                                                     \
+      } while (0)
+#  endif
+
+#endif // ! defined(MEMORY_SANITIZER_H)

dependencies/expat/src/memory_sanitizer.h

@@ -7,6 +7,7 @@
                                  |_| XML parser
 
    Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2026 Matthew Fernandez <matthew.fernandez@gmail.com>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -35,9 +36,12 @@
 #  define _DEFAULT_SOURCE 1 /* for glibc */
 #endif
 
+#include "memory_sanitizer.h"
 #include <stdlib.h> // for arc4random_buf
 
 void
 writeRandomBytes_arc4random_buf(void *target, size_t count) {
   arc4random_buf(target, count);
+  // MSan does not understand `arc4random_buf`, so explain its effects
+  MSAN_UNPOISON(target, count);
 }