You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@openoffice.apache.org by ar...@apache.org on 2023/02/08 22:35:42 UTC

[openoffice] branch AOO42X updated: Update to expat-2.5.0 (#169)

This is an automated email from the ASF dual-hosted git repository.

ardovm pushed a commit to branch AOO42X
in repository https://gitbox.apache.org/repos/asf/openoffice.git


The following commit(s) were added to refs/heads/AOO42X by this push:
     new e5d7a0ebcc Update to expat-2.5.0 (#169)
e5d7a0ebcc is described below

commit e5d7a0ebcca71e849f3fb3b2f86d001c3e39136b
Author: Arrigo Marchiori <ar...@yahoo.it>
AuthorDate: Wed Feb 8 23:03:00 2023 +0100

    Update to expat-2.5.0 (#169)
    
    Update to expat-2.5.0
    
    Patched into version 2.5.0-aoo.
    
    (cherry picked from commit b6c96fbc33bcb02cbd67f2d110ed776004ec6a4c)
---
 main/expat/expat-2.5.0.patch | 815 +++++++++++++++++++++++++++++++++++++++++++
 main/expat/makefile.mk       |   4 +-
 main/expat/prj/d.lst         |   4 +-
 main/external_deps.lst       |   6 +-
 4 files changed, 822 insertions(+), 7 deletions(-)

diff --git a/main/expat/expat-2.5.0.patch b/main/expat/expat-2.5.0.patch
new file mode 100644
index 0000000000..f1e57ab91f
--- /dev/null
+++ b/main/expat/expat-2.5.0.patch
@@ -0,0 +1,815 @@
+diff -ru misc/expat-2.5.0/lib/makefile.mk misc/build/expat-2.5.0/lib/makefile.mk
+--- misc/expat-2.5.0/lib/makefile.mk	2023-02-06 23:22:07.391327553 +0100
++++ misc/build/expat-2.5.0/lib/makefile.mk	2023-02-06 23:22:40.584115842 +0100
+@@ -1,1 +1,79 @@
+-dummy
++#**************************************************************
++#  
++#  Licensed to the Apache Software Foundation (ASF) under one
++#  or more contributor license agreements.  See the NOTICE file
++#  distributed with this work for additional information
++#  regarding copyright ownership.  The ASF licenses this file
++#  to you under the Apache License, Version 2.0 (the
++#  "License"); you may not use this file except in compliance
++#  with the License.  You may obtain a copy of the License at
++#  
++#    http://www.apache.org/licenses/LICENSE-2.0
++#  
++#  Unless required by applicable law or agreed to in writing,
++#  software distributed under the License is distributed on an
++#  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
++#  KIND, either express or implied.  See the License for the
++#  specific language governing permissions and limitations
++#  under the License.
++#  
++#**************************************************************
++PRJ=..$/..$/..$/..$/..
++
++PRJNAME=expat
++TARGET=expat
++LIBTARGET=NO
++EXTERNAL_WARNINGS_NOT_ERRORS=TRUE
++
++# --- Settings -----------------------------------------------------
++.INCLUDE :  settings.mk
++# --- Files --------------------------------------------------------
++
++CFLAGS+=-I..
++
++.IF "$(OS)"=="WNT"
++CDEFS+=-DWIN32
++.ELSE
++CDEFS+=-DHAVE_EXPAT_CONFIG_H
++.ENDIF
++
++.IF "$(OS)"=="MACOSX" && "$(SYSBASE)"!=""
++CDEFS+=-DHAVE_MEMMOVE -DHAVE_BCOPY
++.ENDIF # "$(OS)"=="MACOSX"
++
++SECOND_BUILD=UNICODE
++UNICODE_SLOFILES=$(SLO)$/xmlparse.obj
++UNICODECDEFS+=-DXML_UNICODE
++
++LIB1ARCHIV=$(LB)$/libascii_$(TARGET)_xmlparse.a
++LIB1TARGET=$(SLB)$/ascii_$(TARGET)_xmlparse.lib
++LIB1OBJFILES=$(SLO)$/xmlparse.obj
++
++LIB2ARCHIV=$(LB)$/lib$(TARGET)_xmlparse.a
++LIB2TARGET=$(SLB)$/$(TARGET)_xmlparse.lib
++LIB2OBJFILES =$(REAL_UNICODE_SLOFILES)
++
++LIB3ARCHIV=$(LB)$/lib$(TARGET)_xmltok.a
++LIB3TARGET=$(SLB)$/$(TARGET)_xmltok.lib
++LIB3OBJFILES=$(SLO)$/xmlrole.obj $(SLO)$/xmltok.obj
++
++.IF "$(BUILD_X64)"!=""
++# ---------------- X64 stuff special ---------------------
++#  use UNICODE only because shell/shlxthandler
++#  doesn't link against ascii_expat_xmlparse
++#---------------------------------------------------------
++SLOFILES_X64=$(SLO_X64)$/xmlparse.obj \
++             $(SLO_X64)$/xmlrole.obj \
++             $(SLO_X64)$/xmltok.obj
++CDEFS_X64+=-DXML_UNICODE -DWIN32
++CFLAGS_X64+=-I..
++LIB1TARGET_X64=$(SLB_X64)$/$(TARGET)_xmlparse.lib
++LIB1OBJFILES_X64=$(SLO_X64)$/xmlparse.obj
++LIB2TARGET_X64=$(SLB_X64)$/$(TARGET)_xmltok.lib
++LIB2OBJFILES_X64=$(SLO_X64)$/xmlrole.obj $(SLO_X64)$/xmltok.obj
++.ENDIF # "$(BUILD_X64)"!=""
++
++# --- Targets ------------------------------------------------------
++.INCLUDE :  set_wntx64.mk
++.INCLUDE :	target.mk
++.INCLUDE :  tg_wntx64.mk
+diff -ru misc/expat-2.5.0/Changes misc/build/expat-2.5.0/Changes
+--- misc/expat-2.5.0/Changes	2022-10-25 17:09:08.000000000 +0200
++++ misc/build/expat-2.5.0/Changes	2023-02-06 23:22:40.572115558 +0100
+@@ -2,6 +2,9 @@
+       https://github.com/libexpat/libexpat/labels/help%20wanted
+       If you can help, please get in touch.  Thanks!
+ 
++Release 2.5.0-aoo Sat February 04 2023
++        Adapted to AOO sources.
++
+ Release 2.5.0 Tue October 25 2022
+         Security fixes:
+   #616 #649 #650  CVE-2022-43680 -- Fix heap use-after-free after overeager
+diff -ru misc/expat-2.5.0/expat_config.h misc/build/expat-2.5.0/expat_config.h
+--- misc/expat-2.5.0/expat_config.h	2022-10-25 17:34:58.000000000 +0200
++++ misc/build/expat-2.5.0/expat_config.h	2023-02-06 23:22:40.604116318 +0100
+@@ -14,7 +14,7 @@
+ /* #undef HAVE_ARC4RANDOM */
+ 
+ /* Define to 1 if you have the `arc4random_buf' function. */
+-#define HAVE_ARC4RANDOM_BUF 1
++/* #undef HAVE_ARC4RANDOM_BUF */
+ 
+ /* Define to 1 if you have the <dlfcn.h> header file. */
+ #define HAVE_DLFCN_H 1
+@@ -74,13 +74,13 @@
+ #define PACKAGE "expat"
+ 
+ /* Define to the address where bug reports for this package should be sent. */
+-#define PACKAGE_BUGREPORT "expat-bugs@libexpat.org"
++#define PACKAGE_BUGREPORT "dev@openoffice.apache.org"
+ 
+ /* Define to the full name of this package. */
+ #define PACKAGE_NAME "expat"
+ 
+ /* Define to the full name and version of this package. */
+-#define PACKAGE_STRING "expat 2.5.0"
++#define PACKAGE_STRING "expat 2.5.0-aoo"
+ 
+ /* Define to the one symbol short name of this package. */
+ #define PACKAGE_TARNAME "expat"
+@@ -89,7 +89,7 @@
+ #define PACKAGE_URL ""
+ 
+ /* Define to the version of this package. */
+-#define PACKAGE_VERSION "2.5.0"
++#define PACKAGE_VERSION "2.5.0-aoo"
+ 
+ /* Define to 1 if all of the C90 standard headers exist (not just the ones
+    required in a freestanding environment). This macro is provided for
+@@ -97,7 +97,7 @@
+ #define STDC_HEADERS 1
+ 
+ /* Version number of package */
+-#define VERSION "2.5.0"
++#define VERSION "2.5.0-aoo"
+ 
+ /* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
+    significant byte first (like Motorola and SPARC, unlike Intel). */
+@@ -119,8 +119,10 @@
+    point. */
+ #define XML_CONTEXT_BYTES 1024
+ 
++#if ! defined(_WIN32)
+ /* Define to include code reading entropy from `/dev/urandom'. */
+ #define XML_DEV_URANDOM 1
++#endif
+ 
+ /* Define to make parameter entity parsing functionality available. */
+ #define XML_DTD 1
+@@ -128,6 +130,11 @@
+ /* Define to make XML Namespaces functionality available. */
+ #define XML_NS 1
+ 
++/* Define to __FUNCTION__ or "" if `__func__' does not conform to ANSI C. */
++#ifdef _MSC_VER
++#  define __func__ __FUNCTION__
++#endif
++
+ /* Define to empty if `const' does not conform to ANSI C. */
+ /* #undef const */
+ 
+diff -ru misc/expat-2.5.0/lib/siphash.h misc/build/expat-2.5.0/lib/siphash.h
+--- misc/expat-2.5.0/lib/siphash.h	2022-10-23 17:16:56.000000000 +0200
++++ misc/build/expat-2.5.0/lib/siphash.h	2023-02-06 23:22:40.588115938 +0100
+@@ -99,7 +99,15 @@
+ #define SIPHASH_H
+ 
+ #include <stddef.h> /* size_t */
+-#include <stdint.h> /* uint64_t uint32_t uint8_t */
++#if defined(_WIN32) && defined(_MSC_VER) && (_MSC_VER < 1600)
++/* For vs2003/7.1 up to vs2008/9.0; _MSC_VER 1600 is vs2010/10.0 */
++typedef unsigned __int8 uint8_t;
++typedef unsigned __int32 uint32_t;
++typedef unsigned __int64 uint64_t;
++#else
++#  include <stdint.h> /* uint64_t uint32_t uint8_t */
++#endif
++
+ 
+ /*
+  * Workaround to not require a C++11 compiler for using ULL suffix
+diff -ru misc/expat-2.5.0/lib/winconfig.h misc/build/expat-2.5.0/lib/winconfig.h
+--- misc/expat-2.5.0/lib/winconfig.h	2022-10-24 18:32:55.000000000 +0200
++++ misc/build/expat-2.5.0/lib/winconfig.h	2023-02-06 23:22:40.584115842 +0100
+@@ -42,4 +42,11 @@
+ #include <memory.h>
+ #include <string.h>
+ 
++#  define XML_NS 1
++#  define XML_DTD 1
++#  define XML_CONTEXT_BYTES 1024
++
++/* we will assume all Windows platforms are little endian */
++#  define BYTEORDER 1234
++
+ #endif /* ndef WINCONFIG_H */
+diff -ru misc/expat-2.5.0/lib/xmlparse.c misc/build/expat-2.5.0/lib/xmlparse.c
+--- misc/expat-2.5.0/lib/xmlparse.c	2022-10-25 17:09:08.000000000 +0200
++++ misc/build/expat-2.5.0/lib/xmlparse.c	2023-02-06 23:22:40.584115842 +0100
+@@ -60,8 +60,6 @@
+ 
+ #define XML_BUILDING_EXPAT 1
+ 
+-#include <expat_config.h>
+-
+ #if ! defined(_GNU_SOURCE)
+ #  define _GNU_SOURCE 1 /* syscall prototype */
+ #endif
+@@ -79,9 +77,19 @@
+ #include <limits.h> /* UINT_MAX */
+ #include <stdio.h>  /* fprintf */
+ #include <stdlib.h> /* getenv, rand_s */
+-#include <stdint.h> /* uintptr_t */
+ #include <math.h>   /* isnan */
+ 
++#if defined(_WIN32) && defined(_MSC_VER) && (_MSC_VER < 1600)
++/* vs2008/9.0 and earlier lack stdint.h; _MSC_VER 1600 is vs2010/10.0 */
++#  if defined(_WIN64)
++typedef unsigned __int64 uintptr_t;
++#  else
++typedef unsigned __int32 uintptr_t;
++#  endif
++#else
++#  include <stdint.h> /* uintptr_t */
++#endif
++
+ #ifdef _WIN32
+ #  define getpid GetCurrentProcessId
+ #else
+@@ -94,7 +102,13 @@
+ 
+ #ifdef _WIN32
+ #  include "winconfig.h"
++#include <float.h>
++#ifndef isnan
++#define isnan _isnan
+ #endif
++#else
++#  include <expat_config.h>
++#endif /* ndef _WIN32 */
+ 
+ #include "ascii.h"
+ #include "expat.h"
+@@ -720,7 +734,9 @@
+ 
+ XML_Parser XMLCALL
+ XML_ParserCreateNS(const XML_Char *encodingName, XML_Char nsSep) {
+-  XML_Char tmp[2] = {nsSep, 0};
++  XML_Char tmp[2];
++  tmp[0] = nsSep;
++  tmp[1] = 0;
+   return XML_ParserCreate_MM(encodingName, NULL, tmp);
+ }
+ 
+@@ -1354,7 +1370,9 @@
+      would be otherwise.
+   */
+   if (parser->m_ns) {
+-    XML_Char tmp[2] = {parser->m_namespaceSeparator, 0};
++    XML_Char tmp[2];
++    tmp[0] = parser->m_namespaceSeparator;
++    tmp[1] = 0;
+     parser = parserCreate(encodingName, &parser->m_mem, tmp, newDtd);
+   } else {
+     parser = parserCreate(encodingName, &parser->m_mem, NULL, newDtd);
+@@ -3469,6 +3487,8 @@
+   i = 0;
+   if (nPrefixes) {
+     int j; /* hash table index */
++    unsigned int nsAttsSize;
++    unsigned char oldNsAttsPower;
+     unsigned long version = parser->m_nsAttsVersion;
+ 
+     /* Detect and prevent invalid shift */
+@@ -3476,8 +3496,8 @@
+       return XML_ERROR_NO_MEMORY;
+     }
+ 
+-    unsigned int nsAttsSize = 1u << parser->m_nsAttsPower;
+-    unsigned char oldNsAttsPower = parser->m_nsAttsPower;
++    nsAttsSize = 1u << parser->m_nsAttsPower;
++    oldNsAttsPower = parser->m_nsAttsPower;
+     /* size of hash table must be at least 2 * (# of prefixed attributes) */
+     if ((nPrefixes << 1)
+         >> parser->m_nsAttsPower) { /* true for m_nsAttsPower = 0 */
+@@ -3922,6 +3942,7 @@
+   if (parser->m_freeBindingList) {
+     b = parser->m_freeBindingList;
+     if (len > b->uriAlloc) {
++      XML_Char *temp = NULL;
+       /* Detect and prevent integer overflow */
+       if (len > INT_MAX - EXPAND_SPARE) {
+         return XML_ERROR_NO_MEMORY;
+@@ -3937,7 +3958,7 @@
+       }
+ #endif
+ 
+-      XML_Char *temp = (XML_Char *)REALLOC(
++      temp = (XML_Char *)REALLOC(
+           parser, b->uri, sizeof(XML_Char) * (len + EXPAND_SPARE));
+       if (temp == NULL)
+         return XML_ERROR_NO_MEMORY;
+@@ -4638,11 +4659,6 @@
+          ASCII_I, ASCII_O, ASCII_N, ASCII_LPAREN, '\0'};
+   static const XML_Char enumValueSep[] = {ASCII_PIPE, '\0'};
+   static const XML_Char enumValueStart[] = {ASCII_LPAREN, '\0'};
+-
+-#ifndef XML_DTD
+-  UNUSED_P(account);
+-#endif
+-
+   /* save one level of indirection */
+   DTD *const dtd = parser->m_dtd;
+ 
+@@ -4650,6 +4666,10 @@
+   const char **eventEndPP;
+   enum XML_Content_Quant quant;
+ 
++#ifndef XML_DTD
++  UNUSED_P(account);
++#endif
++
+   if (enc == parser->m_encoding) {
+     eventPP = &parser->m_eventPtr;
+     eventEndPP = &parser->m_eventEndPtr;
+@@ -5290,12 +5310,13 @@
+       if (parser->m_prologState.level >= parser->m_groupSize) {
+         if (parser->m_groupSize) {
+           {
++	    char *new_connector = NULL;
+             /* Detect and prevent integer overflow */
+             if (parser->m_groupSize > (unsigned int)(-1) / 2u) {
+               return XML_ERROR_NO_MEMORY;
+             }
+ 
+-            char *const new_connector = (char *)REALLOC(
++            new_connector = (char *)REALLOC(
+                 parser, parser->m_groupConnector, parser->m_groupSize *= 2);
+             if (new_connector == NULL) {
+               parser->m_groupSize /= 2;
+@@ -5309,13 +5330,14 @@
+              * The preprocessor guard addresses the "always false" warning
+              * from -Wtype-limits on platforms where
+              * sizeof(unsigned int) < sizeof(size_t), e.g. on x86_64. */
++	    int *new_scaff_index = NULL;
+ #if UINT_MAX >= SIZE_MAX
+             if (parser->m_groupSize > (size_t)(-1) / sizeof(int)) {
+               return XML_ERROR_NO_MEMORY;
+             }
+ #endif
+ 
+-            int *const new_scaff_index = (int *)REALLOC(
++            new_scaff_index = (int *)REALLOC(
+                 parser, dtd->scaffIndex, parser->m_groupSize * sizeof(int));
+             if (new_scaff_index == NULL)
+               return XML_ERROR_NO_MEMORY;
+@@ -6404,13 +6426,14 @@
+       }
+     } else {
+       DEFAULT_ATTRIBUTE *temp;
++      int count;
+ 
+       /* Detect and prevent integer overflow */
+       if (type->allocDefaultAtts > INT_MAX / 2) {
+         return 0;
+       }
+ 
+-      int count = type->allocDefaultAtts * 2;
++      count = type->allocDefaultAtts * 2;
+ 
+       /* Detect and prevent integer overflow.
+        * The preprocessor guard addresses the "always false" warning
+@@ -7072,22 +7095,26 @@
+     /* check for overflow (table is half full) */
+     if (table->used >> (table->power - 1)) {
+       unsigned char newPower = table->power + 1;
++      size_t newSize;
++      unsigned long newMask;
++      size_t tsize;
++      NAMED **newV = NULL;
+ 
+       /* Detect and prevent invalid shift */
+       if (newPower >= sizeof(unsigned long) * 8 /* bits per byte */) {
+         return NULL;
+       }
+ 
+-      size_t newSize = (size_t)1 << newPower;
+-      unsigned long newMask = (unsigned long)newSize - 1;
++      newSize = (size_t)1 << newPower;
++      newMask = (unsigned long)newSize - 1;
+ 
+       /* Detect and prevent integer overflow */
+       if (newSize > (size_t)(-1) / sizeof(NAMED *)) {
+         return NULL;
+       }
+ 
+-      size_t tsize = newSize * sizeof(NAMED *);
+-      NAMED **newV = table->mem->malloc_fcn(tsize);
++      tsize = newSize * sizeof(NAMED *);
++      newV = table->mem->malloc_fcn(tsize);
+       if (! newV)
+         return NULL;
+       memset(newV, 0, tsize);
+@@ -7489,6 +7516,10 @@
+   DTD *const dtd = parser->m_dtd; /* save one level of indirection */
+   XML_Content *ret;
+   XML_Char *str; /* the current string writing location */
++  size_t allocsize;
++  XML_Content *dest = NULL;
++  XML_Content *destLimit = NULL;
++  XML_Content *jobDest = NULL;
+ 
+   /* Detect and prevent integer overflow.
+    * The preprocessor guard addresses the "always false" warning
+@@ -7507,7 +7538,7 @@
+     return NULL;
+   }
+ 
+-  const size_t allocsize = (dtd->scaffCount * sizeof(XML_Content)
++  allocsize = (dtd->scaffCount * sizeof(XML_Content)
+                             + (dtd->contentStringLen * sizeof(XML_Char)));
+ 
+   ret = (XML_Content *)MALLOC(parser, allocsize);
+@@ -7563,9 +7594,9 @@
+    *
+    * - The algorithm repeats until all target array indices have been processed.
+    */
+-  XML_Content *dest = ret; /* tree node writing location, moves upwards */
+-  XML_Content *const destLimit = &ret[dtd->scaffCount];
+-  XML_Content *jobDest = ret; /* next free writing location in target array */
++  dest = ret; /* tree node writing location, moves upwards */
++  destLimit = &ret[dtd->scaffCount];
++  jobDest = ret; /* next free writing location in target array */
+   str = (XML_Char *)&ret[dtd->scaffCount];
+ 
+   /* Add the starting job, the root node (index 0) of the source tree  */
+@@ -7670,13 +7701,14 @@
+ static void
+ accountingReportStats(XML_Parser originParser, const char *epilog) {
+   const XML_Parser rootParser = getRootParserOf(originParser, NULL);
++  float amplificationFactor;
+   assert(! rootParser->m_parentParser);
+ 
+   if (rootParser->m_accounting.debugLevel < 1) {
+     return;
+   }
+ 
+-  const float amplificationFactor
++  amplificationFactor
+       = accountingGetCurrentAmplification(rootParser);
+   fprintf(stderr,
+           "expat: Accounting(%p): Direct " EXPAT_FMT_ULL(
+@@ -7696,6 +7728,10 @@
+                      unsigned int levelsAwayFromRootParser, const char *before,
+                      const char *after, ptrdiff_t bytesMore, int source_line,
+                      enum XML_Account account) {
++  const char ellipis[] = "[..]";
++  const size_t ellipsisLength = sizeof(ellipis) /* because compile-time */ - 1;
++  const unsigned int contextLength = 10;
++  const char *walker = NULL;
+   assert(! rootParser->m_parentParser);
+ 
+   fprintf(stderr,
+@@ -7703,12 +7739,8 @@
+           bytesMore, (account == XML_ACCOUNT_DIRECT) ? "DIR" : "EXP",
+           levelsAwayFromRootParser, source_line, 10, "");
+ 
+-  const char ellipis[] = "[..]";
+-  const size_t ellipsisLength = sizeof(ellipis) /* because compile-time */ - 1;
+-  const unsigned int contextLength = 10;
+-
+   /* Note: Performance is of no concern here */
+-  const char *walker = before;
++  walker = before;
+   if ((rootParser->m_accounting.debugLevel >= 3)
+       || (after - before)
+              <= (ptrdiff_t)(contextLength + ellipsisLength + contextLength)) {
+@@ -7732,6 +7764,14 @@
+ accountingDiffTolerated(XML_Parser originParser, int tok, const char *before,
+                         const char *after, int source_line,
+                         enum XML_Account account) {
++  unsigned int levelsAwayFromRootParser;
++  XML_Parser rootParser;
++  int isDirect;
++  ptrdiff_t bytesMore;
++  XmlBigCount *additionTarget = NULL;
++  XmlBigCount countBytesOutput;
++  float amplificationFactor;
++  XML_Bool tolerated;
+   /* Note: We need to check the token type *first* to be sure that
+    *       we can even access variable <after>, safely.
+    *       E.g. for XML_TOK_NONE <after> may hold an invalid pointer. */
+@@ -7746,16 +7786,15 @@
+   if (account == XML_ACCOUNT_NONE)
+     return XML_TRUE; /* because these bytes have been accounted for, already */
+ 
+-  unsigned int levelsAwayFromRootParser;
+-  const XML_Parser rootParser
++  rootParser
+       = getRootParserOf(originParser, &levelsAwayFromRootParser);
+   assert(! rootParser->m_parentParser);
+ 
+-  const int isDirect
++  isDirect
+       = (account == XML_ACCOUNT_DIRECT) && (originParser == rootParser);
+-  const ptrdiff_t bytesMore = after - before;
++  bytesMore = after - before;
+ 
+-  XmlBigCount *const additionTarget
++  additionTarget
+       = isDirect ? &rootParser->m_accounting.countBytesDirect
+                  : &rootParser->m_accounting.countBytesIndirect;
+ 
+@@ -7764,12 +7803,12 @@
+     return XML_FALSE;
+   *additionTarget += bytesMore;
+ 
+-  const XmlBigCount countBytesOutput
++  countBytesOutput
+       = rootParser->m_accounting.countBytesDirect
+         + rootParser->m_accounting.countBytesIndirect;
+-  const float amplificationFactor
++  amplificationFactor
+       = accountingGetCurrentAmplification(rootParser);
+-  const XML_Bool tolerated
++  tolerated
+       = (countBytesOutput < rootParser->m_accounting.activationThresholdBytes)
+         || (amplificationFactor
+             <= rootParser->m_accounting.maximumAmplificationFactor);
+@@ -7800,14 +7839,15 @@
+ static void
+ entityTrackingReportStats(XML_Parser rootParser, ENTITY *entity,
+                           const char *action, int sourceLine) {
++  const char *entityName;
+   assert(! rootParser->m_parentParser);
+   if (rootParser->m_entity_stats.debugLevel < 1)
+     return;
+ 
+ #  if defined(XML_UNICODE)
+-  const char *const entityName = "[..]";
++  entityName = "[..]";
+ #  else
+-  const char *const entityName = entity->name;
++  entityName = entity->name;
+ #  endif
+ 
+   fprintf(
+@@ -8387,14 +8427,17 @@
+ static unsigned long
+ getDebugLevel(const char *variableName, unsigned long defaultDebugLevel) {
+   const char *const valueOrNull = getenv(variableName);
++  const char *value = NULL;
++  char *afterValue = NULL;
++  unsigned long debugLevel;
+   if (valueOrNull == NULL) {
+     return defaultDebugLevel;
+   }
+-  const char *const value = valueOrNull;
++  value = valueOrNull;
+ 
+   errno = 0;
+-  char *afterValue = (char *)value;
+-  unsigned long debugLevel = strtoul(value, &afterValue, 10);
++  afterValue = (char *)value;
++  debugLevel = strtoul(value, &afterValue, 10);
+   if ((errno != 0) || (afterValue[0] != '\0')) {
+     errno = 0;
+     return defaultDebugLevel;
+diff -ru misc/expat-2.5.0/lib/xmltok.c misc/build/expat-2.5.0/lib/xmltok.c
+--- misc/expat-2.5.0/lib/xmltok.c	2022-10-24 18:32:55.000000000 +0200
++++ misc/build/expat-2.5.0/lib/xmltok.c	2023-02-06 23:22:40.588115938 +0100
+@@ -44,14 +44,22 @@
+    USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+ 
+-#include <expat_config.h>
+-
+ #include <stddef.h>
+ #include <string.h> /* memcpy */
+-#include <stdbool.h>
++
++#if defined(_MSC_VER) && (_MSC_VER <= 1700)
++/* for vs2012/11.0/1700 and earlier Visual Studio compilers */
++#  define bool int
++#  define false 0
++#  define true 1
++#else
++#  include <stdbool.h>
++#endif
+ 
+ #ifdef _WIN32
+ #  include "winconfig.h"
++#else
++#  include <expat_config.h>
+ #endif
+ 
+ #include "expat_external.h"
+diff -ru misc/expat-2.5.0/tests/runtests.c misc/build/expat-2.5.0/tests/runtests.c
+--- misc/expat-2.5.0/tests/runtests.c	2022-10-25 17:09:08.000000000 +0200
++++ misc/build/expat-2.5.0/tests/runtests.c	2023-02-06 23:22:40.592116032 +0100
+@@ -40,7 +40,15 @@
+    USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+ 
+-#include <expat_config.h>
++#ifdef _WIN32
++#  include "winconfig.h"
++#include <float.h>
++#ifndef isnan
++#define isnan _isnan
++#endif
++#else
++#  include <expat_config.h>
++#endif /* ndef _WIN32 */
+ 
+ #if defined(NDEBUG)
+ #  undef NDEBUG /* because test suite relies on assert(...) at the moment */
+@@ -53,11 +61,28 @@
+ #include <stddef.h> /* ptrdiff_t */
+ #include <ctype.h>
+ #include <limits.h>
+-#include <stdint.h> /* intptr_t uint64_t */
++
++#if defined(_WIN32) && defined(_MSC_VER) && (_MSC_VER < 1600)
++/* vs2008/9.0 and earlier lack stdint.h; _MSC_VER 1600 is vs2010/10.0 */
++#  if defined(_WIN64)
++typedef unsigned __int64 uintptr_t;
++#  else
++typedef unsigned __int32 uintptr_t;
++#  endif
++#else
++#  include <stdint.h> /* uintptr_t */
++#endif
+ 
+ #if ! defined(__cplusplus)
++#if defined(_MSC_VER) && (_MSC_VER <= 1700)
++/* for vs2012/11.0/1700 and earlier Visual Studio compilers */
++#  define bool int
++#  define false 0
++#  define true 1
++#else
+ #  include <stdbool.h>
+ #endif
++#endif
+ 
+ #include "expat.h"
+ #include "chardata.h"
+@@ -2666,8 +2691,8 @@
+ static void XMLCALL
+ element_decl_check_model(void *userData, const XML_Char *name,
+                          XML_Content *model) {
+-  UNUSED_P(userData);
+   uint32_t errorFlags = 0;
++  UNUSED_P(userData);
+ 
+   /* Expected model array structure is this:
+    * [0] (type 6, quant 0)
+@@ -3926,10 +3951,9 @@
+ #if defined(XML_CONTEXT_BYTES)
+ START_TEST(test_get_buffer_3_overflow) {
+   XML_Parser parser = XML_ParserCreate(NULL);
+-  assert(parser != NULL);
+-
+-  const char *const text = "\n";
++  const char *text = "\n";
+   const int expectedKeepValue = (int)strlen(text);
++  assert(parser != NULL);
+ 
+   // After this call, variable "keep" in XML_GetBuffer will
+   // have value expectedKeepValue
+@@ -4992,8 +5016,8 @@
+ 
+ static void XMLCALL
+ suspending_comment_handler(void *userData, const XML_Char *data) {
+-  UNUSED_P(data);
+   XML_Parser parser = (XML_Parser)userData;
++  UNUSED_P(data);
+   XML_StopParser(parser, XML_TRUE);
+ }
+ 
+@@ -6210,13 +6234,16 @@
+     for (; j < sizeof(atNameStart) / sizeof(atNameStart[0]); j++) {
+       const bool expectedSuccess
+           = atNameStart[j] ? cases[i].goodNameStart : cases[i].goodName;
++      XML_Parser parser;
++      enum XML_Status status;
++      bool success;
+       sprintf(doc, "<%s%s><!--", atNameStart[j] ? "" : "a", cases[i].tagName);
+-      XML_Parser parser = XML_ParserCreate(NULL);
++      parser = XML_ParserCreate(NULL);
+ 
+-      const enum XML_Status status
++      status
+           = XML_Parse(parser, doc, (int)strlen(doc), /*isFinal=*/XML_FALSE);
+ 
+-      bool success = true;
++      success = true;
+       if ((status == XML_STATUS_OK) != expectedSuccess) {
+         success = false;
+       }
+@@ -6812,13 +6839,14 @@
+   CharData storage;
+   XML_Parser parser = XML_ParserCreate(NULL);
+   ParserPlusStorage parserPlusStorage = {parser, &storage};
+-
++  enum XML_Status status;
++  
+   CharData_Init(&storage);
+   XML_SetParamEntityParsing(parser, XML_PARAM_ENTITY_PARSING_ALWAYS);
+   XML_SetCommentHandler(parser, accumulate_and_suspend_comment_handler);
+   XML_SetUserData(parser, &parserPlusStorage);
+ 
+-  enum XML_Status status = XML_Parse(parser, text, (int)strlen(text), XML_TRUE);
++  status = XML_Parse(parser, text, (int)strlen(text), XML_TRUE);
+   while (status == XML_STATUS_SUSPENDED) {
+     status = XML_ResumeParser(parser);
+   }
+@@ -10214,6 +10242,8 @@
+                                                  const XML_Char *base,
+                                                  const XML_Char *systemId,
+                                                  const XML_Char *publicId) {
++  const XML_Char *encodingName = XCS("UTF-8"); // needs something non-NULL
++  XML_Parser ext_parser;
+   UNUSED_P(base);
+   UNUSED_P(systemId);
+   UNUSED_P(publicId);
+@@ -10226,8 +10256,7 @@
+   // &(parser->m_mem));" in function parserInit.
+   allocation_count = 3;
+ 
+-  const XML_Char *const encodingName = XCS("UTF-8"); // needs something non-NULL
+-  const XML_Parser ext_parser
++  ext_parser
+       = XML_ExternalEntityParserCreate(parser, context, encodingName);
+   if (ext_parser != NULL)
+     fail(
+@@ -11718,14 +11747,17 @@
+                                        const XML_Char *base,
+                                        const XML_Char *systemId,
+                                        const XML_Char *publicId) {
+-  UNUSED_P(context);
+-  UNUSED_P(base);
+-  UNUSED_P(publicId);
+-
+   const struct AccountingTestCase *const testCase
+       = (const struct AccountingTestCase *)XML_GetUserData(parser);
+ 
+   const char *externalText = NULL;
++  XML_Parser entParser;
++  XmlParseFunction xmlParseFunction;
++  enum XML_Status status;
++  UNUSED_P(context);
++  UNUSED_P(base);
++  UNUSED_P(publicId);
++
+   if (xcstrcmp(systemId, XCS("first.ent")) == 0) {
+     externalText = testCase->firstExternalText;
+   } else if (xcstrcmp(systemId, XCS("second.ent")) == 0) {
+@@ -11735,13 +11767,13 @@
+   }
+   assert(externalText);
+ 
+-  XML_Parser entParser = XML_ExternalEntityParserCreate(parser, context, 0);
++  entParser = XML_ExternalEntityParserCreate(parser, context, 0);
+   assert(entParser);
+ 
+-  const XmlParseFunction xmlParseFunction
++  xmlParseFunction
+       = testCase->singleBytesWanted ? _XML_Parse_SINGLE_BYTES : XML_Parse;
+ 
+-  const enum XML_Status status = xmlParseFunction(
++  status = xmlParseFunction(
+       entParser, externalText, (int)strlen(externalText), XML_TRUE);
+ 
+   XML_ParserFree(entParser);
+@@ -11951,6 +11983,10 @@
+             + cases[u].expectedCountBytesIndirectExtra;
+ 
+       XML_Parser parser = XML_ParserCreate(NULL);
++      XmlParseFunction xmlParseFunction;
++      enum XML_Status status;
++      unsigned long long actualCountBytesDirect;
++      unsigned long long actualCountBytesIndirect;
+       XML_SetParamEntityParsing(parser, XML_PARAM_ENTITY_PARSING_ALWAYS);
+       if (cases[u].firstExternalText) {
+         XML_SetExternalEntityRefHandler(parser,
+@@ -11959,19 +11995,19 @@
+         cases[u].singleBytesWanted = singleBytesWanted;
+       }
+ 
+-      const XmlParseFunction xmlParseFunction
++      xmlParseFunction
+           = singleBytesWanted ? _XML_Parse_SINGLE_BYTES : XML_Parse;
+ 
+-      enum XML_Status status
++      status
+           = xmlParseFunction(parser, cases[u].primaryText,
+                              (int)strlen(cases[u].primaryText), XML_TRUE);
+       if (status != XML_STATUS_OK) {
+         _xml_failure(parser, __FILE__, __LINE__);
+       }
+ 
+-      const unsigned long long actualCountBytesDirect
++      actualCountBytesDirect
+           = testingAccountingGetCountBytesDirect(parser);
+-      const unsigned long long actualCountBytesIndirect
++      actualCountBytesIndirect
+           = testingAccountingGetCountBytesIndirect(parser);
+ 
+       XML_ParserFree(parser);
diff --git a/main/expat/makefile.mk b/main/expat/makefile.mk
index 20fd92b444..4dd51f8ac5 100644
--- a/main/expat/makefile.mk
+++ b/main/expat/makefile.mk
@@ -38,8 +38,8 @@ all:
 
 # --- Files --------------------------------------------------------
 
-TARFILE_NAME=expat-2.2.10
-TARFILE_MD5=9d60de01cc0126dfd11121b04838e154
+TARFILE_NAME=expat-2.5.0
+TARFILE_MD5=5e9974d422dc4b157f300568ad28ebf6
 ADDITIONAL_FILES=lib$/makefile.mk
 PATCH_FILES=$(TARFILE_NAME).patch
 
diff --git a/main/expat/prj/d.lst b/main/expat/prj/d.lst
index 010fdf1e1b..2b59c1d9d5 100644
--- a/main/expat/prj/d.lst
+++ b/main/expat/prj/d.lst
@@ -1,7 +1,7 @@
 mkdir: %_DEST%\inc%_EXT%\external\expat
 mkdir: %_DEST%\lib%_EXT%\x64
-..\%__SRC%\misc\build\expat-2.2.10\lib\expat.h %_DEST%\inc%_EXT%\external\expat.h
-..\%__SRC%\misc\build\expat-2.2.10\lib\expat_external.h %_DEST%\inc%_EXT%\external\expat_external.h
+..\%__SRC%\misc\build\expat-2.5.0\lib\expat.h %_DEST%\inc%_EXT%\external\expat.h
+..\%__SRC%\misc\build\expat-2.5.0\lib\expat_external.h %_DEST%\inc%_EXT%\external\expat_external.h
 ..\%__SRC%\slb\expat_xmltok.lib %_DEST%\lib%_EXT%\expat_xmltok.lib
 ..\%__SRC%\slb\expat_xmlparse.lib %_DEST%\lib%_EXT%\expat_xmlparse.lib
 ..\%__SRC%\slb\ascii_expat_xmlparse.lib %_DEST%\lib%_EXT%\ascii_expat_xmlparse.lib
diff --git a/main/external_deps.lst b/main/external_deps.lst
index d2f2da3639..5041642119 100644
--- a/main/external_deps.lst
+++ b/main/external_deps.lst
@@ -217,9 +217,9 @@ if (SYSTEM_VIGRA != YES)
     URL2 = $(OOO_EXTRAS)$(MD5)-$(name)
 
 if (SYSTEM_EXPAT != YES)
-    MD5 = 9d60de01cc0126dfd11121b04838e154
-    name = expat-2.2.10.tar.bz2
-    URL1 = https://sourceforge.net/projects/expat/files/expat/2.2.10/$(name)
+    MD5 = 5e9974d422dc4b157f300568ad28ebf6
+    name = expat-2.5.0.tar.bz2
+    URL1 = https://sourceforge.net/projects/expat/files/expat/2.5.0/$(name)
     URL2 = $(OOO_EXTRAS)$(MD5)-$(name)
 
 if (SYSTEM_CURL != YES)