CVE-2023-52426 (C, published 2024-02-04T20:15Z)
Description: value: libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-776 \u2014 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Repository: https://github.com/libexpat/libexpat
Files changed:
expat/CMakeLists.txt
expat/lib/expat.h
expat/lib/internal.h
expat/lib/libexpat.def.cmake
expat/lib/xmlparse.c
expat/xmlwf/xmlwf.c
Commit message: lib|xmlwf|cmake: Extend scope of billion laughs attack protection

.. from "defined(XML_DTD)" to "defined(XML_DTD) || XML_GE==1".


Vulnerable code:
        _expat_def_file_toggle(EXPAT_DTD _EXPAT_COMMENT_DTD)
#ifdef XML_DTD
/* Added in Expat 2.4.0. */
/* Added in Expat 2.4.0. */
#if defined(XML_DTD)
@_EXPAT_COMMENT_DTD@ XML_SetBillionLaughsAttackProtectionActivationThreshold @69
@_EXPAT_COMMENT_DTD@ XML_SetBillionLaughsAttackProtectionMaximumAmplification @70
#ifdef XML_DTD
#endif /* XML_DTD */
#ifdef XML_DTD
#endif /* XML_DTD */
#ifdef XML_DTD
#ifdef XML_DTD
#ifdef XML_DTD
    /* Added in Expat 2.4.0. */
#ifdef XML_DTD
#endif /* XML_DTD */
#ifdef XML_DTD
#endif /* XML_DTD */
#ifdef XML_DTD
#ifdef XML_DTD
#endif /* XML_DTD */
#ifdef XML_DTD
#  ifdef XML_DTD
#ifdef XML_DTD
#  ifdef XML_DTD
#ifdef XML_DTD
    case XML_ROLE_TEXT_DECL:      // bytes accounted in processXmlDecl
#ifdef XML_DTD
#ifdef XML_DTD
#ifdef XML_DTD
#endif /* XML_DTD */
#ifdef XML_DTD
#ifdef XML_DTD
#ifdef XML_DTD
#endif /* XML_DTD */
#ifdef XML_DTD
#ifdef XML_DTD
#ifdef XML_DTD
#ifdef XML_DTD
#endif /* XML_DTD */
#ifndef XML_DTD
      ftprintf(stderr, T("Warning: Given amplification limit ignored") T(
                           ", xmlwf has been compiled without DTD support.\n"));
#ifndef XML_DTD
      ftprintf(stderr, T("Warning: Given attack threshold ignored") T(
                           ", xmlwf has been compiled without DTD support.\n"));
#ifdef XML_DTD
#ifdef XML_DTD

Fixed code:
        if(EXPAT_DTD OR EXPAT_GE)
            set(_EXPAT_DTD_OR_GE TRUE)
        else()
            set(_EXPAT_DTD_OR_GE FALSE)
        endif()

        _expat_def_file_toggle(_EXPAT_DTD_OR_GE _EXPAT_COMMENT_DTD_OR_GE)
#if defined(XML_DTD) || XML_GE == 1
/* Added in Expat 2.4.0 for XML_DTD defined and
 * added in Expat 2.6.0 for XML_GE == 1. */
/* Added in Expat 2.4.0 for XML_DTD defined and
 * added in Expat 2.6.0 for XML_GE == 1. */
#if defined(XML_DTD) || XML_GE == 1
@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetBillionLaughsAttackProtectionActivationThreshold @69
@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetBillionLaughsAttackProtectionMaximumAmplification @70
#if defined(XML_DTD) || XML_GE == 1
#endif /* defined(XML_DTD) || XML_GE == 1 */
#if defined(XML_DTD) || XML_GE == 1
#endif /* defined(XML_DTD) || XML_GE == 1 */
#if defined(XML_DTD) || XML_GE == 1
#if defined(XML_DTD) || XML_GE == 1
#if defined(XML_DTD) || XML_GE == 1
    /* Added in Expat 2.4.0 for XML_DTD defined and
     * added in Expat 2.6.0 for XML_GE == 1. */
#if defined(XML_DTD) || XML_GE == 1
#endif /* defined(XML_DTD) || XML_GE == 1 */
#if defined(XML_DTD) || XML_GE == 1
#endif /* defined(XML_DTD) || XML_GE == 1 */
#if defined(XML_DTD) || XML_GE == 1
#if defined(XML_DTD) || XML_GE == 1
#endif /* defined(XML_DTD) || XML_GE == 1 */
#if defined(XML_DTD) || XML_GE == 1
#  if defined(XML_DTD) || XML_GE == 1
#if defined(XML_DTD) || XML_GE == 1
#  if defined(XML_DTD) || XML_GE == 1
#if defined(XML_DTD) || XML_GE == 1
#  ifdef XML_DTD
    case XML_ROLE_TEXT_DECL: // bytes accounted in processXmlDecl
#  endif
#if defined(XML_DTD) || XML_GE == 1
#if defined(XML_DTD) || XML_GE == 1
#if defined(XML_DTD) || XML_GE == 1
#endif /* defined(XML_DTD) || XML_GE == 1 */
#if defined(XML_DTD) || XML_GE == 1
#if defined(XML_DTD) || XML_GE == 1
#if defined(XML_DTD) || XML_GE == 1
#endif /* defined(XML_DTD) || XML_GE == 1 */
#if defined(XML_DTD) || XML_GE == 1
#if defined(XML_DTD) || XML_GE == 1
#if defined(XML_DTD) || XML_GE == 1
#if defined(XML_DTD) || XML_GE == 1
#endif /* defined(XML_DTD) || XML_GE == 1 */
#if ! defined(XML_DTD) && XML_GE == 0
      ftprintf(stderr,
               T("Warning: Given amplification limit ignored")
                   T(", xmlwf has been compiled without DTD/GE support.\n"));
#if ! defined(XML_DTD) && XML_GE == 0
      ftprintf(stderr,
               T("Warning: Given attack threshold ignored")
                   T(", xmlwf has been compiled without DTD/GE support.\n"));
#if defined(XML_DTD) || XML_GE == 1
#if defined(XML_DTD) || XML_GE == 1