From 03b02ba4f3b88b4d71ca563fad184811206a01c8 Mon Sep 17 00:00:00 2001
From: MSVSphere Packaging Team <packager@msvsphere-os.ru>
Date: Tue, 31 Oct 2023 03:02:23 +0300
Subject: [PATCH 01/10] import firefox-115.4.0-1.el9_2

---
 .firefox.metadata                       |   4 +-
 .gitignore                              |   4 +-
 SOURCES/CVE-2023-44488-libvpx.patch     | 127 ++++++++++++++++++++++++
 SOURCES/firefox-redhat-default-prefs.js |   4 +-
 SPECS/firefox.spec                      |  37 +++++--
 5 files changed, 159 insertions(+), 17 deletions(-)
 create mode 100644 SOURCES/CVE-2023-44488-libvpx.patch

diff --git a/.firefox.metadata b/.firefox.metadata
index 3ebe432..2fcf433 100644
--- a/.firefox.metadata
+++ b/.firefox.metadata
@@ -1,6 +1,6 @@
 b963b16f6879c5dbe6e33a3a3da058b494453922 SOURCES/cbindgen-vendor.tar.xz
-6a421b655b8310153e13f3ba323f091e1735feaf SOURCES/firefox-115.3.1esr.processed-source.tar.xz
-fea6ac1599da96cac5fcdd931c353feb8d6c14a0 SOURCES/firefox-langpacks-115.3.1esr-20230929.tar.xz
+c9051c7d9ac83384e3c049090861cbe449595e23 SOURCES/firefox-115.4.0esr.processed-source.tar.xz
+0a64220feb8757a00f38d37c6aba3180d2c265dd SOURCES/firefox-langpacks-115.4.0esr-20231017.tar.xz
 2d8a6b2b30d5496735f49ffe8c8a7ede3a78a5ca SOURCES/mochitest-python.tar.gz
 d744f92e874688cc4b5376477dfdd639a97a6cd4 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 9555ba179bc1398fbacfa2896e45f3808d94ecd2 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/.gitignore b/.gitignore
index 37fe7c2..be27f70 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,6 @@
 SOURCES/cbindgen-vendor.tar.xz
-SOURCES/firefox-115.3.1esr.processed-source.tar.xz
-SOURCES/firefox-langpacks-115.3.1esr-20230929.tar.xz
+SOURCES/firefox-115.4.0esr.processed-source.tar.xz
+SOURCES/firefox-langpacks-115.4.0esr-20231017.tar.xz
 SOURCES/mochitest-python.tar.gz
 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/SOURCES/CVE-2023-44488-libvpx.patch b/SOURCES/CVE-2023-44488-libvpx.patch
new file mode 100644
index 0000000..79e5235
--- /dev/null
+++ b/SOURCES/CVE-2023-44488-libvpx.patch
@@ -0,0 +1,127 @@
+From 263682c9a29395055f3b3afe2d97be1828a6223f Mon Sep 17 00:00:00 2001
+From: Jerome Jiang <jianj@google.com>
+Date: Thu, 30 Jun 2022 13:48:56 -0400
+Subject: [PATCH] Fix bug with smaller width bigger size
+
+Fixed previous patch that clusterfuzz failed on.
+
+Bug: webm:1642
+Change-Id: If0e08e72abd2e042efe4dcfac21e4cc51afdfdb9
+---
+ test/resize_test.cc          | 11 +++--------
+ vp9/common/vp9_alloccommon.c | 13 ++++++-------
+ vp9/encoder/vp9_encoder.c    | 27 +++++++++++++++++++++++++--
+ 3 files changed, 34 insertions(+), 17 deletions(-)
+
+diff --git a/test/resize_test.cc b/test/resize_test.cc
+index fd1c2a92de6..20ad2229b46 100644
+--- a/test/resize_test.cc
++++ b/test/resize_test.cc
+@@ -102,11 +102,8 @@ void ScaleForFrameNumber(unsigned int frame, unsigned int initial_w,
+     if (frame < 30) {
+       return;
+     }
+-    if (frame < 100) {
+-      *w = initial_w * 7 / 10;
+-      *h = initial_h * 16 / 10;
+-      return;
+-    }
++    *w = initial_w * 7 / 10;
++    *h = initial_h * 16 / 10;
+     return;
+   }
+   if (frame < 10) {
+@@ -559,9 +556,7 @@ TEST_P(ResizeRealtimeTest, TestExternalResizeWorks) {
+   }
+ }
+ 
+-// TODO(https://crbug.com/webm/1642): This causes a segfault in
+-// init_encode_frame_mb_context().
+-TEST_P(ResizeRealtimeTest, DISABLED_TestExternalResizeSmallerWidthBiggerSize) {
++TEST_P(ResizeRealtimeTest, TestExternalResizeSmallerWidthBiggerSize) {
+   ResizingVideoSource video;
+   video.flag_codec_ = true;
+   video.smaller_width_larger_size_ = true;
+diff --git a/vp9/common/vp9_alloccommon.c b/vp9/common/vp9_alloccommon.c
+index e53883f621d..9e73e40ea09 100644
+--- a/vp9/common/vp9_alloccommon.c
++++ b/vp9/common/vp9_alloccommon.c
+@@ -135,13 +135,6 @@ int vp9_alloc_context_buffers(VP9_COMMON *cm, int width, int height) {
+     cm->free_mi(cm);
+     if (cm->alloc_mi(cm, new_mi_size)) goto fail;
+   }
+-
+-  if (cm->seg_map_alloc_size < cm->mi_rows * cm->mi_cols) {
+-    // Create the segmentation map structure and set to 0.
+-    free_seg_map(cm);
+-    if (alloc_seg_map(cm, cm->mi_rows * cm->mi_cols)) goto fail;
+-  }
+-
+   if (cm->above_context_alloc_cols < cm->mi_cols) {
+     vpx_free(cm->above_context);
+     cm->above_context = (ENTROPY_CONTEXT *)vpx_calloc(
+@@ -156,6 +149,12 @@ int vp9_alloc_context_buffers(VP9_COMMON *cm, int width, int height) {
+     cm->above_context_alloc_cols = cm->mi_cols;
+   }
+ 
++  if (cm->seg_map_alloc_size < cm->mi_rows * cm->mi_cols) {
++    // Create the segmentation map structure and set to 0.
++    free_seg_map(cm);
++    if (alloc_seg_map(cm, cm->mi_rows * cm->mi_cols)) goto fail;
++  }
++
+   if (vp9_alloc_loop_filter(cm)) goto fail;
+ 
+   return 0;
+diff --git a/vp9/encoder/vp9_encoder.c b/vp9/encoder/vp9_encoder.c
+index 69a4e3c314f..e3ba294c32f 100644
+--- a/vp9/encoder/vp9_encoder.c
++++ b/vp9/encoder/vp9_encoder.c
+@@ -2047,6 +2047,17 @@ static void alloc_copy_partition_data(VP9_COMP *cpi) {
+   }
+ }
+ 
++static void free_copy_partition_data(VP9_COMP *cpi) {
++  vpx_free(cpi->prev_partition);
++  cpi->prev_partition = NULL;
++  vpx_free(cpi->prev_segment_id);
++  cpi->prev_segment_id = NULL;
++  vpx_free(cpi->prev_variance_low);
++  cpi->prev_variance_low = NULL;
++  vpx_free(cpi->copied_frame_cnt);
++  cpi->copied_frame_cnt = NULL;
++}
++
+ void vp9_change_config(struct VP9_COMP *cpi, const VP9EncoderConfig *oxcf) {
+   VP9_COMMON *const cm = &cpi->common;
+   RATE_CONTROL *const rc = &cpi->rc;
+@@ -2126,6 +2137,8 @@ void vp9_change_config(struct VP9_COMP *cpi, const VP9EncoderConfig *oxcf) {
+     new_mi_size = cm->mi_stride * calc_mi_size(cm->mi_rows);
+     if (cm->mi_alloc_size < new_mi_size) {
+       vp9_free_context_buffers(cm);
++      vp9_free_pc_tree(&cpi->td);
++      vpx_free(cpi->mbmi_ext_base);
+       alloc_compressor_data(cpi);
+       realloc_segmentation_maps(cpi);
+       cpi->initial_width = cpi->initial_height = 0;
+@@ -2144,8 +2157,18 @@ void vp9_change_config(struct VP9_COMP *cpi, const VP9EncoderConfig *oxcf) {
+     update_frame_size(cpi);
+ 
+   if (last_w != cpi->oxcf.width || last_h != cpi->oxcf.height) {
+-    memset(cpi->consec_zero_mv, 0,
+-           cm->mi_rows * cm->mi_cols * sizeof(*cpi->consec_zero_mv));
++    vpx_free(cpi->consec_zero_mv);
++    CHECK_MEM_ERROR(
++        &cm->error, cpi->consec_zero_mv,
++        vpx_calloc(cm->mi_rows * cm->mi_cols, sizeof(*cpi->consec_zero_mv)));
++
++    vpx_free(cpi->skin_map);
++    CHECK_MEM_ERROR(
++        &cm->error, cpi->skin_map,
++        vpx_calloc(cm->mi_rows * cm->mi_cols, sizeof(cpi->skin_map[0])));
++
++    free_copy_partition_data(cpi);
++    alloc_copy_partition_data(cpi);
+     if (cpi->oxcf.aq_mode == CYCLIC_REFRESH_AQ)
+       vp9_cyclic_refresh_reset_resize(cpi);
+     rc->rc_1_frame = 0;
diff --git a/SOURCES/firefox-redhat-default-prefs.js b/SOURCES/firefox-redhat-default-prefs.js
index f130247..cdb98dd 100644
--- a/SOURCES/firefox-redhat-default-prefs.js
+++ b/SOURCES/firefox-redhat-default-prefs.js
@@ -14,8 +14,8 @@ pref("browser.shell.checkDefaultBrowser",   false);
 pref("network.manage-offline-status",       true);
 pref("extensions.shownSelectionUI",         true);
 pref("ui.SpellCheckerUnderlineStyle",       1);
-pref("startup.homepage_override_url",       "https://www.redhat.com");
-pref("startup.homepage_welcome_url",        "https://www.redhat.com");
+pref("startup.homepage_override_url",       "%HOMEPAGE%");
+pref("startup.homepage_welcome_url",        "%HOMEPAGE%");
 pref("browser.startup.homepage",            "data:text/plain,browser.startup.homepage=file:///%PREFIX%/share/doc/HTML/index.html");
 pref("media.gmp-gmpopenh264.autoupdate",true);
 pref("media.gmp-gmpopenh264.enabled",false);
diff --git a/SPECS/firefox.spec b/SPECS/firefox.spec
index 5a73a9e..9bf0628 100644
--- a/SPECS/firefox.spec
+++ b/SPECS/firefox.spec
@@ -1,3 +1,4 @@
+%define homepage %(grep '^HOME_URL\s*=' /etc/os-release | sed 's/^HOME_URL\s*=//;s/^\s*"//;s/"\s*$//')
 %global disable_toolsets  0
 
 # Produce debug (non-optimized) package build. Suitable for debugging only
@@ -131,7 +132,7 @@ end}
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        115.3.1
+Version:        115.4.0
 Release:        1%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
@@ -157,7 +158,7 @@ ExcludeArch:    aarch64 s390 ppc
 # Link to original tarball: https://archive.mozilla.org/pub/firefox/releases/%%{version}%%{?pre_version}/source/firefox-%%{version}%%{?pre_version}.source.tar.xz
 Source0:        firefox-%{version}%{?pre_version}%{?buildnum}.processed-source.tar.xz
 %if %{with langpacks}
-Source1:        firefox-langpacks-%{version}%{?pre_version}-20230929.tar.xz
+Source1:        firefox-langpacks-%{version}%{?pre_version}-20231017.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
@@ -229,6 +230,9 @@ Patch155:       rhbz-1354671.patch
 # GENDIFF_DIFF_ARGS=-U0 gendiff firefox-xxxx .firefox-tests-reftest
 Patch201:       firefox-tests-xpcshell-freeze.patch
 
+# ---- Security patches ----
+Patch301:       CVE-2023-44488-libvpx.patch
+
 # BUILD REQURES/REQUIRES
 %if %{?system_nss} && !0%{?bundle_nss}
 BuildRequires:  pkgconfig(nspr) >= %{nspr_version}
@@ -973,15 +977,15 @@ to run Firefox explicitly on X11.
 %prep
 echo "Build environment"
 echo "--------------------------------------------"
-echo "dist                  %{?dist}"
-echo "RHEL 8 minor version: %{?rhel_minor_version}"
-echo "bundle_nss            %{?bundle_nss}"
-echo "system_nss            %{?system_nss}"
-echo "use_rust_ts           %{?use_rust_ts}"
-echo "use_dts               %{?use_dts}"
-echo "use_nodejs_scl        %{?use_nodejs_scl}"
-echo "use_llvm_ts           %{?use_llvm_ts}"
-echo "use_python3_scl       %{?use_python3_scl}"
+echo "dist                %{?dist}"
+echo "RHEL minor version: %{?rhel_minor_version}"
+echo "bundle_nss          %{?bundle_nss}"
+echo "system_nss          %{?system_nss}"
+echo "use_rust_ts         %{?use_rust_ts}"
+echo "use_dts             %{?use_dts}"
+echo "use_nodejs_scl      %{?use_nodejs_scl}"
+echo "use_llvm_ts         %{?use_llvm_ts}"
+echo "use_python3_scl     %{?use_python3_scl}"
 echo "--------------------------------------------"
 %setup -q -n %{name}-%{version}
 
@@ -1034,6 +1038,11 @@ echo "--------------------------------------------"
 # ---- Test patches ----
 %patch -P201 -p1 -b .firefox-tests-xpcshell-freeze
 
+# ---- Security patches ----
+cd media/libvpx/libvpx
+%patch -P301 -p1 -b .CVE-2023-44488-libvpx
+cd -
+
 %{__rm} -f .mozconfig
 %{__cp} %{SOURCE10} .mozconfig
 %{__cp} %{SOURCE24} mozilla-api-key
@@ -1544,6 +1553,7 @@ ln -s %{mozappdir}/defaults/preferences $RPM_BUILD_ROOT/%{mozappdir}/browser/def
 # Default preferences
 %{__cp} %{SOURCE12} %{buildroot}%{mozappdir}/defaults/preferences/all-redhat.js
 sed -i -e 's|%PREFIX%|%{_prefix}|' %{buildroot}%{mozappdir}/defaults/preferences/all-redhat.js
+sed -i -e 's|%HOMEPAGE%|%{homepage}|' %{buildroot}%{mozappdir}/defaults/preferences/all-redhat.js
 # Enable modern crypto for the key export on the RHEL9 only (rhbz#1764205)
 %if 0%{?rhel} == 9
   echo 'pref("security.pki.use_modern_crypto_with_pkcs12", true);' >> %{buildroot}%{mozappdir}/defaults/preferences/all-redhat.js
@@ -1717,6 +1727,11 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #---------------------------------------------------------------------
 
 %changelog
+* Tue Oct 17 2023 Eike Rathke <erack@redhat.com> - 115.4.0-1
+- Update to 115.4.0 build1
+- Add fix for CVE-2023-44488
+- Set homepage from os-release HOME_URL
+
 * Fri Sep 29 2023 Eike Rathke <erack@redhat.com> - 115.3.1-1
 - Update to 115.3.1
 

From c19c96d6743f132558be05a62ee96b2f46b44bb6 Mon Sep 17 00:00:00 2001
From: MSVSphere Packaging Team <packager@msvsphere-os.ru>
Date: Tue, 28 Nov 2023 03:03:20 +0300
Subject: [PATCH 02/10] import firefox-115.5.0-1.el9_3

---
 .firefox.metadata  |  4 ++--
 .gitignore         |  4 ++--
 SPECS/firefox.spec | 27 +++++++++++++++++++++------
 3 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/.firefox.metadata b/.firefox.metadata
index 2fcf433..e5440fe 100644
--- a/.firefox.metadata
+++ b/.firefox.metadata
@@ -1,6 +1,6 @@
 b963b16f6879c5dbe6e33a3a3da058b494453922 SOURCES/cbindgen-vendor.tar.xz
-c9051c7d9ac83384e3c049090861cbe449595e23 SOURCES/firefox-115.4.0esr.processed-source.tar.xz
-0a64220feb8757a00f38d37c6aba3180d2c265dd SOURCES/firefox-langpacks-115.4.0esr-20231017.tar.xz
+f19b5467588701056ebbecc4e4e1e12a07be06f5 SOURCES/firefox-115.5.0esr.processed-source.tar.xz
+04fd448a519fc232595fdff573e38c7d5daa1d05 SOURCES/firefox-langpacks-115.5.0esr-20231114.tar.xz
 2d8a6b2b30d5496735f49ffe8c8a7ede3a78a5ca SOURCES/mochitest-python.tar.gz
 d744f92e874688cc4b5376477dfdd639a97a6cd4 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 9555ba179bc1398fbacfa2896e45f3808d94ecd2 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/.gitignore b/.gitignore
index be27f70..96e2494 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,6 @@
 SOURCES/cbindgen-vendor.tar.xz
-SOURCES/firefox-115.4.0esr.processed-source.tar.xz
-SOURCES/firefox-langpacks-115.4.0esr-20231017.tar.xz
+SOURCES/firefox-115.5.0esr.processed-source.tar.xz
+SOURCES/firefox-langpacks-115.5.0esr-20231114.tar.xz
 SOURCES/mochitest-python.tar.gz
 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/SPECS/firefox.spec b/SPECS/firefox.spec
index 9bf0628..6f347df 100644
--- a/SPECS/firefox.spec
+++ b/SPECS/firefox.spec
@@ -24,7 +24,7 @@ function dist_to_rhel_minor(str, start)
   end
   match = string.match(str, ".el8")
   if match then
-     return 9
+     return 10
   end
   match = string.match(str, ".module%+el9.%d+")
   if match then
@@ -36,7 +36,7 @@ function dist_to_rhel_minor(str, start)
   end
   match = string.match(str, ".el9")
   if match then
-     return 3
+     return 4
   end
   return -1
 end}
@@ -132,7 +132,7 @@ end}
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        115.4.0
+Version:        115.5.0
 Release:        1%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
@@ -141,10 +141,15 @@ License:        MPLv1.1 or GPLv2+ or LGPLv2+
 ExcludeArch:    %{ix86}
 %endif
 %if 0%{?rhel} == 8
+  # Started to ship on aarch64 in RHEL 8.2, on s390x in RHEL 8.3
   %if %{rhel_minor_version} == 1
-ExcludeArch:    %{ix86} aarch64 s390x
+ExcludeArch:    %{ix86} s390x aarch64
   %else
+    %if %{rhel_minor_version} == 2
+ExcludeArch:    %{ix86} s390x
+    %else
 ExcludeArch:    %{ix86}
+    %endif
   %endif
 %endif
 %if 0%{?rhel} == 7
@@ -158,7 +163,7 @@ ExcludeArch:    aarch64 s390 ppc
 # Link to original tarball: https://archive.mozilla.org/pub/firefox/releases/%%{version}%%{?pre_version}/source/firefox-%%{version}%%{?pre_version}.source.tar.xz
 Source0:        firefox-%{version}%{?pre_version}%{?buildnum}.processed-source.tar.xz
 %if %{with langpacks}
-Source1:        firefox-langpacks-%{version}%{?pre_version}-20231017.tar.xz
+Source1:        firefox-langpacks-%{version}%{?pre_version}-20231114.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
@@ -1116,6 +1121,13 @@ echo "ac_add_options --with-mozilla-api-keyfile=`pwd`/mozilla-api-key" >> .mozco
 echo "ac_add_options --with-google-location-service-api-keyfile=`pwd`/google-loc-api-key" >> .mozconfig
 echo "ac_add_options --with-google-safebrowsing-api-keyfile=`pwd`/google-api-key" >> .mozconfig
 
+# May result in empty --with-libclang-path= in earlier versions.
+# So far this is needed only for c8s.
+%if 0%{?rhel} == 8 && %{rhel_minor_version} >= 10
+# Clang 17 upstream's detection fails, tell it where to look.
+echo "ac_add_options --with-libclang-path=`llvm-config --libdir`" >> .mozconfig
+%endif
+
 echo 'export NODEJS="%{_buildrootdir}/bin/node-stdout-nonblocking-wrapper"' >> .mozconfig
 
 # Remove executable bit to make brp-mangle-shebangs happy.
@@ -1727,6 +1739,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #---------------------------------------------------------------------
 
 %changelog
+* Tue Nov 14 2023 Eike Rathke <erack@redhat.com> - 115.5.0-1
+- Update to 115.5.0 build1
+
 * Tue Oct 17 2023 Eike Rathke <erack@redhat.com> - 115.4.0-1
 - Update to 115.4.0 build1
 - Add fix for CVE-2023-44488
@@ -1759,7 +1774,7 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 * Tue Apr 04 2023 Eike Rathke <erack@redhat.com> - 102.10.0-1
 - Update to 102.10.0 build1
 
-* Wed Mar 15 2023 MSVSphere Packaging Team <packager@msvsphere.ru> - 102.3.0-6
+* Wed Mar 15 2023 MSVSphere Packaging Team <packager@msvsphere.ru> - 102.9.0-4
 - Rebuilt for MSVSphere 9.1.
 
 * Fri Mar 10 2023 Eike Rathke <erack@redhat.com> - 102.9.0-4

From ca2b6c5ba5c6a6a73af1f50b2e3b50bbcfe8e903 Mon Sep 17 00:00:00 2001
From: MSVSphere Packaging Team <packager@msvsphere-os.ru>
Date: Wed, 3 Jan 2024 03:32:14 +0300
Subject: [PATCH 03/10] import firefox-115.6.0-1.el9_3

---
 .firefox.metadata  |  4 ++--
 .gitignore         |  4 ++--
 SPECS/firefox.spec | 13 ++++++++-----
 3 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/.firefox.metadata b/.firefox.metadata
index e5440fe..804a9c5 100644
--- a/.firefox.metadata
+++ b/.firefox.metadata
@@ -1,6 +1,6 @@
 b963b16f6879c5dbe6e33a3a3da058b494453922 SOURCES/cbindgen-vendor.tar.xz
-f19b5467588701056ebbecc4e4e1e12a07be06f5 SOURCES/firefox-115.5.0esr.processed-source.tar.xz
-04fd448a519fc232595fdff573e38c7d5daa1d05 SOURCES/firefox-langpacks-115.5.0esr-20231114.tar.xz
+3f01e727d6f69c743a7fac6ccee8c2feb5c883ff SOURCES/firefox-115.6.0esr.processed-source.tar.xz
+76e4af93eb2372f845f59693b080717beb33d793 SOURCES/firefox-langpacks-115.6.0esr-20231212.tar.xz
 2d8a6b2b30d5496735f49ffe8c8a7ede3a78a5ca SOURCES/mochitest-python.tar.gz
 d744f92e874688cc4b5376477dfdd639a97a6cd4 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 9555ba179bc1398fbacfa2896e45f3808d94ecd2 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/.gitignore b/.gitignore
index 96e2494..320e9ea 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,6 @@
 SOURCES/cbindgen-vendor.tar.xz
-SOURCES/firefox-115.5.0esr.processed-source.tar.xz
-SOURCES/firefox-langpacks-115.5.0esr-20231114.tar.xz
+SOURCES/firefox-115.6.0esr.processed-source.tar.xz
+SOURCES/firefox-langpacks-115.6.0esr-20231212.tar.xz
 SOURCES/mochitest-python.tar.gz
 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/SPECS/firefox.spec b/SPECS/firefox.spec
index 6f347df..1021595 100644
--- a/SPECS/firefox.spec
+++ b/SPECS/firefox.spec
@@ -132,7 +132,7 @@ end}
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        115.5.0
+Version:        115.6.0
 Release:        1%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
@@ -163,7 +163,7 @@ ExcludeArch:    aarch64 s390 ppc
 # Link to original tarball: https://archive.mozilla.org/pub/firefox/releases/%%{version}%%{?pre_version}/source/firefox-%%{version}%%{?pre_version}.source.tar.xz
 Source0:        firefox-%{version}%{?pre_version}%{?buildnum}.processed-source.tar.xz
 %if %{with langpacks}
-Source1:        firefox-langpacks-%{version}%{?pre_version}-20231114.tar.xz
+Source1:        firefox-langpacks-%{version}%{?pre_version}-20231212.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
@@ -310,7 +310,7 @@ BuildRequires:  rust >= %{rust_version}
 
 %if 0%{?rhel} == 9
 BuildRequires:  cargo
-BuildRequires:  clang clang-libs llvm
+BuildRequires:  clang clang-libs llvm llvm-devel
 BuildRequires:  gcc
 BuildRequires:  gcc-c++
 BuildRequires:  python3-devel
@@ -1122,8 +1122,8 @@ echo "ac_add_options --with-google-location-service-api-keyfile=`pwd`/google-loc
 echo "ac_add_options --with-google-safebrowsing-api-keyfile=`pwd`/google-api-key" >> .mozconfig
 
 # May result in empty --with-libclang-path= in earlier versions.
-# So far this is needed only for c8s.
-%if 0%{?rhel} == 8 && %{rhel_minor_version} >= 10
+# So far this is needed only for c8s/c9s.
+%if (0%{?rhel} == 8 && %{rhel_minor_version} >= 10) || (0%{?rhel} == 9 && %{rhel_minor_version} >= 4)
 # Clang 17 upstream's detection fails, tell it where to look.
 echo "ac_add_options --with-libclang-path=`llvm-config --libdir`" >> .mozconfig
 %endif
@@ -1739,6 +1739,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #---------------------------------------------------------------------
 
 %changelog
+* Tue Dec 12 2023 Eike Rathke <erack@redhat.com> - 115.6.0-1
+- Update to 115.6.0 build1
+
 * Tue Nov 14 2023 Eike Rathke <erack@redhat.com> - 115.5.0-1
 - Update to 115.5.0 build1
 

From 149acc57ace11c7c9bfe623ed2512008965968b9 Mon Sep 17 00:00:00 2001
From: MSVSphere Packaging Team <packager@msvsphere-os.ru>
Date: Wed, 31 Jan 2024 03:32:10 +0300
Subject: [PATCH 04/10] import firefox-115.7.0-1.el9_3

---
 .firefox.metadata  |  4 ++--
 .gitignore         |  4 ++--
 SPECS/firefox.spec | 28 ++++++++++++++++------------
 3 files changed, 20 insertions(+), 16 deletions(-)

diff --git a/.firefox.metadata b/.firefox.metadata
index 804a9c5..611f5d9 100644
--- a/.firefox.metadata
+++ b/.firefox.metadata
@@ -1,6 +1,6 @@
 b963b16f6879c5dbe6e33a3a3da058b494453922 SOURCES/cbindgen-vendor.tar.xz
-3f01e727d6f69c743a7fac6ccee8c2feb5c883ff SOURCES/firefox-115.6.0esr.processed-source.tar.xz
-76e4af93eb2372f845f59693b080717beb33d793 SOURCES/firefox-langpacks-115.6.0esr-20231212.tar.xz
+31fb51ff4e90d942af418dfb96679686e11c2f65 SOURCES/firefox-115.7.0esr.processed-source.tar.xz
+4d0d4a0699b692bcd7fa54f36ef1914ca5c4a751 SOURCES/firefox-langpacks-115.7.0esr-20240116.tar.xz
 2d8a6b2b30d5496735f49ffe8c8a7ede3a78a5ca SOURCES/mochitest-python.tar.gz
 d744f92e874688cc4b5376477dfdd639a97a6cd4 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 9555ba179bc1398fbacfa2896e45f3808d94ecd2 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/.gitignore b/.gitignore
index 320e9ea..94a429e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,6 @@
 SOURCES/cbindgen-vendor.tar.xz
-SOURCES/firefox-115.6.0esr.processed-source.tar.xz
-SOURCES/firefox-langpacks-115.6.0esr-20231212.tar.xz
+SOURCES/firefox-115.7.0esr.processed-source.tar.xz
+SOURCES/firefox-langpacks-115.7.0esr-20240116.tar.xz
 SOURCES/mochitest-python.tar.gz
 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/SPECS/firefox.spec b/SPECS/firefox.spec
index 1021595..38ac5c9 100644
--- a/SPECS/firefox.spec
+++ b/SPECS/firefox.spec
@@ -132,7 +132,7 @@ end}
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        115.6.0
+Version:        115.7.0
 Release:        1%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
@@ -163,7 +163,7 @@ ExcludeArch:    aarch64 s390 ppc
 # Link to original tarball: https://archive.mozilla.org/pub/firefox/releases/%%{version}%%{?pre_version}/source/firefox-%%{version}%%{?pre_version}.source.tar.xz
 Source0:        firefox-%{version}%{?pre_version}%{?buildnum}.processed-source.tar.xz
 %if %{with langpacks}
-Source1:        firefox-langpacks-%{version}%{?pre_version}-20231212.tar.xz
+Source1:        firefox-langpacks-%{version}%{?pre_version}-20240116.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
@@ -1631,6 +1631,17 @@ rm -rf %{buildroot}%{mozappdir}/gtk2/
 ln -sf /usr/lib64/libnss3.so %{buildroot}%{_libdir}/libnss3.so
 ln -sf /usr/lib64/pkcs11/p11-kit-client.so %{buildroot}%{_libdir}/libnssckbi.so
 %endif
+
+# clean the created bundled rpms if there are any
+rm -rf %{_srcrpmdir}/libffi*.src.rpm
+find %{_rpmdir} -name "libffi*.rpm" -delete
+rm -rf %{_srcrpmdir}/openssl*.src.rpm
+find %{_rpmdir} -name "openssl*.rpm" -delete
+rm -rf %{_srcrpmdir}/nss*.src.rpm
+find %{_rpmdir} -name "nss*.rpm" -delete
+rm -rf %{_srcrpmdir}/nspr*.src.rpm
+find %{_rpmdir} -name "nspr*.rpm" -delete
+
 #---------------------------------------------------------------------
 
 %check
@@ -1644,16 +1655,6 @@ if [ $1 -eq 0 ]; then
   %{__rm} -rf %{mozappdir}/plugins
 fi
 
-%clean
-rm -rf %{_srcrpmdir}/libffi*.src.rpm
-find %{_rpmdir} -name "libffi*.rpm" -delete
-rm -rf %{_srcrpmdir}/openssl*.src.rpm
-find %{_rpmdir} -name "openssl*.rpm" -delete
-rm -rf %{_srcrpmdir}/nss*.src.rpm
-find %{_rpmdir} -name "nss*.rpm" -delete
-rm -rf %{_srcrpmdir}/nspr*.src.rpm
-find %{_rpmdir} -name "nspr*.rpm" -delete
-
 %post
 update-desktop-database &> /dev/null || :
 touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
@@ -1739,6 +1740,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #---------------------------------------------------------------------
 
 %changelog
+* Tue Jan 16 2024 Eike Rathke <erack@redhat.com> - 115.7.0-1
+- Update to 115.7.0 build1
+
 * Tue Dec 12 2023 Eike Rathke <erack@redhat.com> - 115.6.0-1
 - Update to 115.6.0 build1
 

From c76bdb2f62f24f91aae08dfdc231f99dda000613 Mon Sep 17 00:00:00 2001
From: MSVSphere Packaging Team <packager@msvsphere-os.ru>
Date: Fri, 23 Feb 2024 03:32:35 +0300
Subject: [PATCH 05/10] import firefox-115.8.0-1.el9_3

---
 .firefox.metadata                                |  4 ++--
 .gitignore                                       |  4 ++--
 SOURCES/build-rhel7-lower-node-min-version.patch | 12 ++++++------
 SPECS/firefox.spec                               |  7 +++++--
 4 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/.firefox.metadata b/.firefox.metadata
index 611f5d9..9b26fa5 100644
--- a/.firefox.metadata
+++ b/.firefox.metadata
@@ -1,6 +1,6 @@
 b963b16f6879c5dbe6e33a3a3da058b494453922 SOURCES/cbindgen-vendor.tar.xz
-31fb51ff4e90d942af418dfb96679686e11c2f65 SOURCES/firefox-115.7.0esr.processed-source.tar.xz
-4d0d4a0699b692bcd7fa54f36ef1914ca5c4a751 SOURCES/firefox-langpacks-115.7.0esr-20240116.tar.xz
+9319b0b809919b3a2848167200ebd9844fff4b07 SOURCES/firefox-115.8.0esr.processed-source.tar.xz
+ebdc56046476e31cca6a0e864565527eb156b715 SOURCES/firefox-langpacks-115.8.0esr-20240213.tar.xz
 2d8a6b2b30d5496735f49ffe8c8a7ede3a78a5ca SOURCES/mochitest-python.tar.gz
 d744f92e874688cc4b5376477dfdd639a97a6cd4 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 9555ba179bc1398fbacfa2896e45f3808d94ecd2 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/.gitignore b/.gitignore
index 94a429e..d6935dd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,6 @@
 SOURCES/cbindgen-vendor.tar.xz
-SOURCES/firefox-115.7.0esr.processed-source.tar.xz
-SOURCES/firefox-langpacks-115.7.0esr-20240116.tar.xz
+SOURCES/firefox-115.8.0esr.processed-source.tar.xz
+SOURCES/firefox-langpacks-115.8.0esr-20240213.tar.xz
 SOURCES/mochitest-python.tar.gz
 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/SOURCES/build-rhel7-lower-node-min-version.patch b/SOURCES/build-rhel7-lower-node-min-version.patch
index 2bb39c8..398cbc3 100644
--- a/SOURCES/build-rhel7-lower-node-min-version.patch
+++ b/SOURCES/build-rhel7-lower-node-min-version.patch
@@ -1,11 +1,11 @@
---- firefox-102.4.0/python/mozbuild/mozbuild/nodeutil.py.lower-node-min-version	2022-10-10 17:55:56.000000000 +0200
-+++ firefox-102.4.0/python/mozbuild/mozbuild/nodeutil.py	2022-10-17 14:57:47.476182627 +0200
+--- firefox-115.8.0/python/mozbuild/mozbuild/nodeutil.py.lower-node-min-version	2024-02-12 21:53:56.000000000 +0200
++++ firefox-115.8.0/python/mozbuild/mozbuild/nodeutil.py	2024-02-14 16:48:12.476182627 +0200
 @@ -13,7 +13,7 @@ from mozboot.util import get_tools_dir
- from mozfile import which
+ from packaging.version import Version
  from six import PY3
  
--NODE_MIN_VERSION = StrictVersion("12.22.12")
-+NODE_MIN_VERSION = StrictVersion("10.24.0")
- NPM_MIN_VERSION = StrictVersion("6.14.16")
+-NODE_MIN_VERSION = Version("12.22.12")
++NODE_MIN_VERSION = Version("10.24.0")
+ NPM_MIN_VERSION = Version("6.14.16")
  
  
diff --git a/SPECS/firefox.spec b/SPECS/firefox.spec
index 38ac5c9..3d0f324 100644
--- a/SPECS/firefox.spec
+++ b/SPECS/firefox.spec
@@ -132,7 +132,7 @@ end}
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        115.7.0
+Version:        115.8.0
 Release:        1%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
@@ -163,7 +163,7 @@ ExcludeArch:    aarch64 s390 ppc
 # Link to original tarball: https://archive.mozilla.org/pub/firefox/releases/%%{version}%%{?pre_version}/source/firefox-%%{version}%%{?pre_version}.source.tar.xz
 Source0:        firefox-%{version}%{?pre_version}%{?buildnum}.processed-source.tar.xz
 %if %{with langpacks}
-Source1:        firefox-langpacks-%{version}%{?pre_version}-20240116.tar.xz
+Source1:        firefox-langpacks-%{version}%{?pre_version}-20240213.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
@@ -1740,6 +1740,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #---------------------------------------------------------------------
 
 %changelog
+* Tue Feb 13 2024 Eike Rathke <erack@redhat.com> - 115.8.0-1
+- Update to 115.8.0 build1
+
 * Tue Jan 16 2024 Eike Rathke <erack@redhat.com> - 115.7.0-1
 - Update to 115.7.0 build1
 

From 7ee55adb857049c5fea6943fb134bd5cd79494d4 Mon Sep 17 00:00:00 2001
From: MSVSphere Packaging Team <packager@msvsphere-os.ru>
Date: Tue, 26 Mar 2024 03:32:10 +0300
Subject: [PATCH 06/10] import firefox-115.9.1-1.el9_3

---
 .firefox.metadata                  |   4 +-
 .gitignore                         |   4 +-
 SOURCES/expat-CVE-2023-52425.patch | 375 +++++++++++++++++++++++++++++
 SPECS/firefox.spec                 |  18 +-
 4 files changed, 394 insertions(+), 7 deletions(-)
 create mode 100644 SOURCES/expat-CVE-2023-52425.patch

diff --git a/.firefox.metadata b/.firefox.metadata
index 9b26fa5..7b99b5a 100644
--- a/.firefox.metadata
+++ b/.firefox.metadata
@@ -1,6 +1,6 @@
 b963b16f6879c5dbe6e33a3a3da058b494453922 SOURCES/cbindgen-vendor.tar.xz
-9319b0b809919b3a2848167200ebd9844fff4b07 SOURCES/firefox-115.8.0esr.processed-source.tar.xz
-ebdc56046476e31cca6a0e864565527eb156b715 SOURCES/firefox-langpacks-115.8.0esr-20240213.tar.xz
+b28310d67624787206243d4c9eff8496ecb4c9df SOURCES/firefox-115.9.1esr.processed-source.tar.xz
+a69c4cf421b2b0e84142b7a5e47ae382ba9e975b SOURCES/firefox-langpacks-115.9.1esr-20240322.tar.xz
 2d8a6b2b30d5496735f49ffe8c8a7ede3a78a5ca SOURCES/mochitest-python.tar.gz
 d744f92e874688cc4b5376477dfdd639a97a6cd4 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 9555ba179bc1398fbacfa2896e45f3808d94ecd2 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/.gitignore b/.gitignore
index d6935dd..fcc34b3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,6 @@
 SOURCES/cbindgen-vendor.tar.xz
-SOURCES/firefox-115.8.0esr.processed-source.tar.xz
-SOURCES/firefox-langpacks-115.8.0esr-20240213.tar.xz
+SOURCES/firefox-115.9.1esr.processed-source.tar.xz
+SOURCES/firefox-langpacks-115.9.1esr-20240322.tar.xz
 SOURCES/mochitest-python.tar.gz
 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/SOURCES/expat-CVE-2023-52425.patch b/SOURCES/expat-CVE-2023-52425.patch
new file mode 100644
index 0000000..bdd06ca
--- /dev/null
+++ b/SOURCES/expat-CVE-2023-52425.patch
@@ -0,0 +1,375 @@
+# erAck: backport of expat CVE-2023-52425 DoS fix
+# https://github.com/libexpat/libexpat/commit/34b598c5f594b015c513c73f06e7ced3323edbf1
+#
+--- firefox-115.9.0/parser/expat/lib/expat.h.expat-CVE-2023-52425	2024-03-11 20:36:11.000000000 +0100
++++ firefox-115.9.0/parser/expat/lib/expat.h	2024-03-13 20:46:45.648505015 +0100
+@@ -1045,6 +1045,10 @@ XMLPARSEAPI(const XML_Feature *)
+ XML_GetFeatureList(void);
+ 
+ 
++/* Added in Expat 2.6.0. */
++XMLPARSEAPI(XML_Bool)
++XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled);
++
+ /* Expat follows the semantic versioning convention.
+    See http://semver.org.
+ */
+--- firefox-115.9.0/parser/expat/lib/internal.h.expat-CVE-2023-52425	2024-03-11 20:36:11.000000000 +0100
++++ firefox-115.9.0/parser/expat/lib/internal.h	2024-03-14 00:14:39.334319725 +0100
+@@ -80,6 +80,7 @@
+ # endif
+ #endif
+ 
++#include "expat.h" // so we can use type XML_Parser below
+ 
+ #ifdef __cplusplus
+ extern "C" {
+@@ -90,6 +91,9 @@ void
+ align_limit_to_full_utf8_characters(const char * from, const char ** fromLimRef);
+ 
+ 
++extern XML_Bool g_reparseDeferralEnabledDefault; // written ONLY in runtests.c
++extern unsigned int g_parseAttempts;             // used for testing only
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- firefox-115.9.0/parser/expat/lib/xmlparse.c.expat-CVE-2023-52425	2024-03-11 20:36:11.000000000 +0100
++++ firefox-115.9.0/parser/expat/lib/xmlparse.c	2024-03-13 22:55:14.844756009 +0100
+@@ -6,6 +6,7 @@
+ 
+ #define _GNU_SOURCE                     /* syscall prototype */
+ 
++#include <stdbool.h>
+ #include <stddef.h>
+ #include <string.h>                     /* memset(), memcpy() */
+ #include <assert.h>
+@@ -89,6 +90,9 @@ typedef char ICHAR;
+ /* Round up n to be a multiple of sz, where sz is a power of 2. */
+ #define ROUND_UP(n, sz) (((n) + ((sz) - 1)) & ~((sz) - 1))
+ 
++/* Do safe (NULL-aware) pointer arithmetic */
++#define EXPAT_SAFE_PTR_DIFF(p, q) (((p) && (q)) ? ((p) - (q)) : 0)
++
+ /* Handle the case where memmove() doesn't exist. */
+ #ifndef HAVE_MEMMOVE
+ #ifdef HAVE_BCOPY
+@@ -98,6 +102,8 @@ typedef char ICHAR;
+ #endif /* HAVE_BCOPY */
+ #endif /* HAVE_MEMMOVE */
+ 
++#define EXPAT_MIN(a, b) (((a) < (b)) ? (a) : (b))
++
+ #include "internal.h"
+ #include "xmltok.h"
+ #include "xmlrole.h"
+@@ -476,6 +482,9 @@ parserInit(XML_Parser parser, const XML_
+    ? 0 \
+    : ((*((pool)->ptr)++ = c), 1))
+ 
++XML_Bool g_reparseDeferralEnabledDefault = XML_TRUE; // write ONLY in runtests.c
++unsigned int g_parseAttempts = 0;                    // used for testing only
++
+ struct XML_ParserStruct {
+   /* The first member must be userData so that the XML_GetUserData
+      macro works. */
+@@ -491,6 +500,9 @@ struct XML_ParserStruct {
+   const char *m_bufferLim;
+   XML_Index m_parseEndByteIndex;
+   const char *m_parseEndPtr;
++  size_t m_partialTokenBytesBefore; /* used in heuristic to avoid O(n^2) */
++  XML_Bool m_reparseDeferralEnabled;
++  int m_lastBufferRequestSize;
+   XML_Char *m_dataBuf;
+   XML_Char *m_dataBufEnd;
+   XML_StartElementHandler m_startElementHandler;
+@@ -647,6 +659,9 @@ struct XML_ParserStruct {
+ #define bufferEnd (parser->m_bufferEnd)
+ #define parseEndByteIndex (parser->m_parseEndByteIndex)
+ #define parseEndPtr (parser->m_parseEndPtr)
++#define partialTokenBytesBefore (parser->m_partialTokenBytesBefore)
++#define reparseDeferralEnabled (parser->m_reparseDeferralEnabled)
++#define lastBufferRequestSize (parser->m_lastBufferRequestSize)
+ #define bufferLim (parser->m_bufferLim)
+ #define dataBuf (parser->m_dataBuf)
+ #define dataBufEnd (parser->m_dataBufEnd)
+@@ -887,6 +902,47 @@ get_hash_secret_salt(XML_Parser parser)
+   return parser->m_hash_secret_salt;
+ }
+ 
++static enum XML_Error
++callProcessor(XML_Parser parser, const char *start, const char *end,
++              const char **endPtr) {
++  const size_t have_now = EXPAT_SAFE_PTR_DIFF(end, start);
++
++  if (parser->m_reparseDeferralEnabled
++      && ! parser->m_parsingStatus.finalBuffer) {
++    // Heuristic: don't try to parse a partial token again until the amount of
++    // available data has increased significantly.
++    const size_t had_before = parser->m_partialTokenBytesBefore;
++    // ...but *do* try anyway if we're close to causing a reallocation.
++    size_t available_buffer
++        = EXPAT_SAFE_PTR_DIFF(parser->m_bufferPtr, parser->m_buffer);
++#if XML_CONTEXT_BYTES > 0
++    available_buffer -= EXPAT_MIN(available_buffer, XML_CONTEXT_BYTES);
++#endif
++    available_buffer
++        += EXPAT_SAFE_PTR_DIFF(parser->m_bufferLim, parser->m_bufferEnd);
++    // m_lastBufferRequestSize is never assigned a value < 0, so the cast is ok
++    const bool enough
++        = (have_now >= 2 * had_before)
++          || ((size_t)parser->m_lastBufferRequestSize > available_buffer);
++
++    if (! enough) {
++      *endPtr = start; // callers may expect this to be set
++      return XML_ERROR_NONE;
++    }
++  }
++  g_parseAttempts += 1;
++  const enum XML_Error ret = parser->m_processor(parser, start, end, endPtr);
++  if (ret == XML_ERROR_NONE) {
++    // if we consumed nothing, remember what we had on this parse attempt.
++    if (*endPtr == start) {
++      parser->m_partialTokenBytesBefore = have_now;
++    } else {
++      parser->m_partialTokenBytesBefore = 0;
++    }
++  }
++  return ret;
++}
++
+ static XML_Bool  /* only valid for root parser */
+ startParsing(XML_Parser parser)
+ {
+@@ -1075,6 +1131,9 @@ parserInit(XML_Parser parser, const XML_
+   bufferEnd = buffer;
+   parseEndByteIndex = 0;
+   parseEndPtr = NULL;
++  partialTokenBytesBefore = 0;
++  reparseDeferralEnabled = g_reparseDeferralEnabledDefault;
++  lastBufferRequestSize = 0;
+   declElementType = NULL;
+   declAttributeId = NULL;
+   declEntity = NULL;
+@@ -1232,6 +1291,7 @@ XML_ExternalEntityParserCreate(XML_Parse
+      to worry which hash secrets each table has.
+   */
+   unsigned long oldhash_secret_salt;
++  XML_Bool oldReparseDeferralEnabled;
+ 
+   /* Validate the oldParser parameter before we pull everything out of it */
+   if (oldParser == NULL)
+@@ -1276,6 +1336,7 @@ XML_ExternalEntityParserCreate(XML_Parse
+      to worry which hash secrets each table has.
+   */
+   oldhash_secret_salt = hash_secret_salt;
++  oldReparseDeferralEnabled = reparseDeferralEnabled;
+ 
+ #ifdef XML_DTD
+   if (!context)
+@@ -1330,6 +1391,7 @@ XML_ExternalEntityParserCreate(XML_Parse
+   defaultExpandInternalEntities = oldDefaultExpandInternalEntities;
+   ns_triplets = oldns_triplets;
+   hash_secret_salt = oldhash_secret_salt;
++  reparseDeferralEnabled = oldReparseDeferralEnabled;
+   parentParser = oldParser;
+ #ifdef XML_DTD
+   paramEntityParsing = oldParamEntityParsing;
+@@ -1850,39 +1912,8 @@ XML_Parse(XML_Parser parser, const char
+     ps_parsing = XML_PARSING;
+   }
+ 
+-  if (len == 0) {
+-    ps_finalBuffer = (XML_Bool)isFinal;
+-    if (!isFinal)
+-      return XML_STATUS_OK;
+-    positionPtr = bufferPtr;
+-    parseEndPtr = bufferEnd;
+-
+-    /* If data are left over from last buffer, and we now know that these
+-       data are the final chunk of input, then we have to check them again
+-       to detect errors based on that fact.
+-    */
+-    errorCode = processor(parser, bufferPtr, parseEndPtr, &bufferPtr);
+-
+-    if (errorCode == XML_ERROR_NONE) {
+-      switch (ps_parsing) {
+-      case XML_SUSPENDED:
+-        XmlUpdatePosition(encoding, positionPtr, bufferPtr, &position);
+-        positionPtr = bufferPtr;
+-        return XML_STATUS_SUSPENDED;
+-      case XML_INITIALIZED:
+-      case XML_PARSING:
+-        ps_parsing = XML_FINISHED;
+-        /* fall through */
+-      default:
+-        return XML_STATUS_OK;
+-      }
+-    }
+-    eventEndPtr = eventPtr;
+-    processor = errorProcessor;
+-    return XML_STATUS_ERROR;
+-  }
+ #ifndef XML_CONTEXT_BYTES
+-  else if (bufferPtr == bufferEnd) {
++  if (bufferPtr == bufferEnd) {
+     const char *end;
+     int nLeftOver;
+     enum XML_Status result;
+@@ -1899,11 +1930,14 @@ XML_Parse(XML_Parser parser, const char
+        processor = errorProcessor;
+        return XML_STATUS_ERROR;
+     }
++    // though this isn't a buffer request, we assume that `len` is the app's
++    // preferred buffer fill size, and therefore save it here.
++    lastBufferRequestSize = len;
+     parseEndByteIndex += len;
+     positionPtr = s;
+     ps_finalBuffer = (XML_Bool)isFinal;
+ 
+-    errorCode = processor(parser, s, parseEndPtr = s + len, &end);
++    errorCode = callProcessor(parser, s, parseEndPtr = s + len, &end);
+ 
+     if (errorCode != XML_ERROR_NONE) {
+       eventEndPtr = eventPtr;
+@@ -1930,6 +1964,8 @@ XML_Parse(XML_Parser parser, const char
+     XmlUpdatePosition(encoding, positionPtr, end, &position);
+     nLeftOver = s + len - end;
+     if (nLeftOver) {
++#if 0
++// erAck: replace with XML_GetBuffer() below.
+       if (buffer == NULL || nLeftOver > bufferLim - buffer) {
+         /* avoid _signed_ integer overflow */
+         char *temp = NULL;
+@@ -1939,6 +1975,28 @@ XML_Parse(XML_Parser parser, const char
+                 ? (char *)MALLOC(bytesToAllocate)
+                 : (char *)REALLOC(buffer, bytesToAllocate));
+         }
++#endif
++#if 1
++// erAck: the original patch context had a call to XML_GetBuffer() instead:
++      // Back up and restore the parsing status to avoid XML_ERROR_SUSPENDED
++      // (and XML_ERROR_FINISHED) from XML_GetBuffer.
++      const enum XML_Parsing originalStatus = ps_parsing;
++      ps_parsing = XML_PARSING;
++      void *const temp = XML_GetBuffer(parser, nLeftOver);
++      ps_parsing = originalStatus;
++#endif
++      // GetBuffer may have overwritten this, but we want to remember what the
++      // app requested, not how many bytes were left over after parsing.
++      lastBufferRequestSize = len;
++#if 1
++      if (temp == NULL) {
++        // NOTE: parser->m_errorCode has already been set by XML_GetBuffer().
++        eventPtr = eventEndPtr = NULL;
++        processor = errorProcessor;
++        return XML_STATUS_ERROR;
++      }
++#endif
++#if 0
+         if (temp == NULL) {
+           errorCode = XML_ERROR_NO_MEMORY;
+           eventPtr = eventEndPtr = NULL;
+@@ -1948,6 +2006,7 @@ XML_Parse(XML_Parser parser, const char
+         buffer = temp;
+         bufferLim = buffer + bytesToAllocate;
+       }
++#endif
+       memcpy(buffer, end, nLeftOver);
+     }
+     bufferPtr = buffer;
+@@ -1959,15 +2018,14 @@ XML_Parse(XML_Parser parser, const char
+     return result;
+   }
+ #endif  /* not defined XML_CONTEXT_BYTES */
+-  else {
+-    void *buff = XML_GetBuffer(parser, len);
+-    if (buff == NULL)
+-      return XML_STATUS_ERROR;
+-    else {
+-      memcpy(buff, s, len);
+-      return XML_ParseBuffer(parser, len, isFinal);
+-    }
++  void *buff = XML_GetBuffer(parser, len);
++  if (buff == NULL)
++    return XML_STATUS_ERROR;
++  if (len > 0) {
++    assert(s != NULL); // make sure s==NULL && len!=0 was rejected above
++    memcpy(buff, s, len);
+   }
++  return XML_ParseBuffer(parser, len, isFinal);
+ }
+ 
+ enum XML_Status XMLCALL
+@@ -2001,7 +2059,7 @@ XML_ParseBuffer(XML_Parser parser, int l
+   parseEndByteIndex += len;
+   ps_finalBuffer = (XML_Bool)isFinal;
+ 
+-  errorCode = processor(parser, start, parseEndPtr, &bufferPtr);
++  errorCode = callProcessor(parser, start, parseEndPtr, &bufferPtr);
+ 
+   if (errorCode != XML_ERROR_NONE) {
+     eventEndPtr = eventPtr;
+@@ -2047,7 +2105,11 @@ XML_GetBuffer(XML_Parser parser, int len
+   default: ;
+   }
+ 
+-  if (len > bufferLim - bufferEnd) {
++  // whether or not the request succeeds, `len` seems to be the app's preferred
++  // buffer fill size; remember it.
++  lastBufferRequestSize = len;
++  if (len > EXPAT_SAFE_PTR_DIFF(bufferLim, bufferEnd)
++      || buffer == NULL) {
+ #ifdef XML_CONTEXT_BYTES
+     int keep;
+ #endif  /* defined XML_CONTEXT_BYTES */
+@@ -2063,7 +2125,9 @@ XML_GetBuffer(XML_Parser parser, int len
+       keep = XML_CONTEXT_BYTES;
+     neededSize += keep;
+ #endif  /* defined XML_CONTEXT_BYTES */
+-    if (neededSize  <= bufferLim - buffer) {
++    if (buffer && bufferPtr
++        && neededSize
++               <= EXPAT_SAFE_PTR_DIFF(bufferLim, buffer)) {
+ #ifdef XML_CONTEXT_BYTES
+       if (keep < bufferPtr - buffer) {
+         int offset = (int)(bufferPtr - buffer) - keep;
+@@ -2072,8 +2136,11 @@ XML_GetBuffer(XML_Parser parser, int len
+         bufferPtr -= offset;
+       }
+ #else
+-      memmove(buffer, bufferPtr, bufferEnd - bufferPtr);
+-      bufferEnd = buffer + (bufferEnd - bufferPtr);
++      memmove(buffer, bufferPtr,
++              EXPAT_SAFE_PTR_DIFF(bufferEnd, bufferPtr));
++      bufferEnd
++          = buffer
++            + EXPAT_SAFE_PTR_DIFF(bufferEnd, bufferPtr);
+       bufferPtr = buffer;
+ #endif  /* not defined XML_CONTEXT_BYTES */
+     }
+@@ -2171,7 +2238,7 @@ XML_ResumeParser(XML_Parser parser)
+   }
+   ps_parsing = XML_PARSING;
+ 
+-  errorCode = processor(parser, bufferPtr, parseEndPtr, &bufferPtr);
++  errorCode = callProcessor(parser, bufferPtr, parseEndPtr, &bufferPtr);
+ 
+   if (errorCode != XML_ERROR_NONE) {
+     eventEndPtr = eventPtr;
+@@ -2481,6 +2548,15 @@ MOZ_XML_ProcessingEntityValue(XML_Parser
+ }
+ /* END MOZILLA CHANGE */
+ 
++XML_Bool XMLCALL
++XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled) {
++  if (parser != NULL && (enabled == XML_TRUE || enabled == XML_FALSE)) {
++    parser->m_reparseDeferralEnabled = enabled;
++    return XML_TRUE;
++  }
++  return XML_FALSE;
++}
++
+ /* Initially tag->rawName always points into the parse buffer;
+    for those TAG instances opened while the current parse buffer was
+    processed, and not yet closed, we need to store tag->rawName in a more
diff --git a/SPECS/firefox.spec b/SPECS/firefox.spec
index 3d0f324..d92a5ba 100644
--- a/SPECS/firefox.spec
+++ b/SPECS/firefox.spec
@@ -122,7 +122,7 @@ end}
 # If set to .b2 or .b3 ... the processed source file needs to be renamed before upload, e.g.
 # firefox-102.8.0esr.b2.processed-source.tar.xz
 # When unset use processed source file name as is.
-##global buildnum             .b2
+##global buildnum .b2
 
 %bcond_without langpacks
 
@@ -132,7 +132,7 @@ end}
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        115.8.0
+Version:        115.9.1
 Release:        1%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
@@ -163,7 +163,7 @@ ExcludeArch:    aarch64 s390 ppc
 # Link to original tarball: https://archive.mozilla.org/pub/firefox/releases/%%{version}%%{?pre_version}/source/firefox-%%{version}%%{?pre_version}.source.tar.xz
 Source0:        firefox-%{version}%{?pre_version}%{?buildnum}.processed-source.tar.xz
 %if %{with langpacks}
-Source1:        firefox-langpacks-%{version}%{?pre_version}-20240213.tar.xz
+Source1:        firefox-langpacks-%{version}%{?pre_version}-20240322.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
@@ -237,6 +237,7 @@ Patch201:       firefox-tests-xpcshell-freeze.patch
 
 # ---- Security patches ----
 Patch301:       CVE-2023-44488-libvpx.patch
+Patch302:       expat-CVE-2023-52425.patch
 
 # BUILD REQURES/REQUIRES
 %if %{?system_nss} && !0%{?bundle_nss}
@@ -1047,6 +1048,7 @@ echo "--------------------------------------------"
 cd media/libvpx/libvpx
 %patch -P301 -p1 -b .CVE-2023-44488-libvpx
 cd -
+%patch -P302 -p1 -b .expat-CVE-2023-52425
 
 %{__rm} -f .mozconfig
 %{__cp} %{SOURCE10} .mozconfig
@@ -1740,6 +1742,16 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #---------------------------------------------------------------------
 
 %changelog
+* Fri Mar 22 2024 Eike Rathke <erack@redhat.com> - 115.9.1-1
+- Update to 115.9.1
+
+* Fri Mar 15 2024 Eike Rathke <erack@redhat.com> - 115.9.0-2
+- Update to 115.9.0 build2
+
+* Tue Mar 12 2024 Eike Rathke <erack@redhat.com> - 115.9.0-1
+- Update to 115.9.0 build1
+- Fix expat CVE-2023-52425
+
 * Tue Feb 13 2024 Eike Rathke <erack@redhat.com> - 115.8.0-1
 - Update to 115.8.0 build1
 

From 61c9c559cea45661e1ead9290948b171c123183a Mon Sep 17 00:00:00 2001
From: MSVSphere Packaging Team <packager@msvsphere-os.ru>
Date: Fri, 12 Apr 2024 03:33:05 +0300
Subject: [PATCH 07/10] import firefox-115.9.1-2.el9_3

---
 SOURCES/expat-CVE-2023-52425.patch | 375 -----------------------------
 SPECS/firefox.spec                 |   7 +-
 2 files changed, 4 insertions(+), 378 deletions(-)
 delete mode 100644 SOURCES/expat-CVE-2023-52425.patch

diff --git a/SOURCES/expat-CVE-2023-52425.patch b/SOURCES/expat-CVE-2023-52425.patch
deleted file mode 100644
index bdd06ca..0000000
--- a/SOURCES/expat-CVE-2023-52425.patch
+++ /dev/null
@@ -1,375 +0,0 @@
-# erAck: backport of expat CVE-2023-52425 DoS fix
-# https://github.com/libexpat/libexpat/commit/34b598c5f594b015c513c73f06e7ced3323edbf1
-#
---- firefox-115.9.0/parser/expat/lib/expat.h.expat-CVE-2023-52425	2024-03-11 20:36:11.000000000 +0100
-+++ firefox-115.9.0/parser/expat/lib/expat.h	2024-03-13 20:46:45.648505015 +0100
-@@ -1045,6 +1045,10 @@ XMLPARSEAPI(const XML_Feature *)
- XML_GetFeatureList(void);
- 
- 
-+/* Added in Expat 2.6.0. */
-+XMLPARSEAPI(XML_Bool)
-+XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled);
-+
- /* Expat follows the semantic versioning convention.
-    See http://semver.org.
- */
---- firefox-115.9.0/parser/expat/lib/internal.h.expat-CVE-2023-52425	2024-03-11 20:36:11.000000000 +0100
-+++ firefox-115.9.0/parser/expat/lib/internal.h	2024-03-14 00:14:39.334319725 +0100
-@@ -80,6 +80,7 @@
- # endif
- #endif
- 
-+#include "expat.h" // so we can use type XML_Parser below
- 
- #ifdef __cplusplus
- extern "C" {
-@@ -90,6 +91,9 @@ void
- align_limit_to_full_utf8_characters(const char * from, const char ** fromLimRef);
- 
- 
-+extern XML_Bool g_reparseDeferralEnabledDefault; // written ONLY in runtests.c
-+extern unsigned int g_parseAttempts;             // used for testing only
-+
- #ifdef __cplusplus
- }
- #endif
---- firefox-115.9.0/parser/expat/lib/xmlparse.c.expat-CVE-2023-52425	2024-03-11 20:36:11.000000000 +0100
-+++ firefox-115.9.0/parser/expat/lib/xmlparse.c	2024-03-13 22:55:14.844756009 +0100
-@@ -6,6 +6,7 @@
- 
- #define _GNU_SOURCE                     /* syscall prototype */
- 
-+#include <stdbool.h>
- #include <stddef.h>
- #include <string.h>                     /* memset(), memcpy() */
- #include <assert.h>
-@@ -89,6 +90,9 @@ typedef char ICHAR;
- /* Round up n to be a multiple of sz, where sz is a power of 2. */
- #define ROUND_UP(n, sz) (((n) + ((sz) - 1)) & ~((sz) - 1))
- 
-+/* Do safe (NULL-aware) pointer arithmetic */
-+#define EXPAT_SAFE_PTR_DIFF(p, q) (((p) && (q)) ? ((p) - (q)) : 0)
-+
- /* Handle the case where memmove() doesn't exist. */
- #ifndef HAVE_MEMMOVE
- #ifdef HAVE_BCOPY
-@@ -98,6 +102,8 @@ typedef char ICHAR;
- #endif /* HAVE_BCOPY */
- #endif /* HAVE_MEMMOVE */
- 
-+#define EXPAT_MIN(a, b) (((a) < (b)) ? (a) : (b))
-+
- #include "internal.h"
- #include "xmltok.h"
- #include "xmlrole.h"
-@@ -476,6 +482,9 @@ parserInit(XML_Parser parser, const XML_
-    ? 0 \
-    : ((*((pool)->ptr)++ = c), 1))
- 
-+XML_Bool g_reparseDeferralEnabledDefault = XML_TRUE; // write ONLY in runtests.c
-+unsigned int g_parseAttempts = 0;                    // used for testing only
-+
- struct XML_ParserStruct {
-   /* The first member must be userData so that the XML_GetUserData
-      macro works. */
-@@ -491,6 +500,9 @@ struct XML_ParserStruct {
-   const char *m_bufferLim;
-   XML_Index m_parseEndByteIndex;
-   const char *m_parseEndPtr;
-+  size_t m_partialTokenBytesBefore; /* used in heuristic to avoid O(n^2) */
-+  XML_Bool m_reparseDeferralEnabled;
-+  int m_lastBufferRequestSize;
-   XML_Char *m_dataBuf;
-   XML_Char *m_dataBufEnd;
-   XML_StartElementHandler m_startElementHandler;
-@@ -647,6 +659,9 @@ struct XML_ParserStruct {
- #define bufferEnd (parser->m_bufferEnd)
- #define parseEndByteIndex (parser->m_parseEndByteIndex)
- #define parseEndPtr (parser->m_parseEndPtr)
-+#define partialTokenBytesBefore (parser->m_partialTokenBytesBefore)
-+#define reparseDeferralEnabled (parser->m_reparseDeferralEnabled)
-+#define lastBufferRequestSize (parser->m_lastBufferRequestSize)
- #define bufferLim (parser->m_bufferLim)
- #define dataBuf (parser->m_dataBuf)
- #define dataBufEnd (parser->m_dataBufEnd)
-@@ -887,6 +902,47 @@ get_hash_secret_salt(XML_Parser parser)
-   return parser->m_hash_secret_salt;
- }
- 
-+static enum XML_Error
-+callProcessor(XML_Parser parser, const char *start, const char *end,
-+              const char **endPtr) {
-+  const size_t have_now = EXPAT_SAFE_PTR_DIFF(end, start);
-+
-+  if (parser->m_reparseDeferralEnabled
-+      && ! parser->m_parsingStatus.finalBuffer) {
-+    // Heuristic: don't try to parse a partial token again until the amount of
-+    // available data has increased significantly.
-+    const size_t had_before = parser->m_partialTokenBytesBefore;
-+    // ...but *do* try anyway if we're close to causing a reallocation.
-+    size_t available_buffer
-+        = EXPAT_SAFE_PTR_DIFF(parser->m_bufferPtr, parser->m_buffer);
-+#if XML_CONTEXT_BYTES > 0
-+    available_buffer -= EXPAT_MIN(available_buffer, XML_CONTEXT_BYTES);
-+#endif
-+    available_buffer
-+        += EXPAT_SAFE_PTR_DIFF(parser->m_bufferLim, parser->m_bufferEnd);
-+    // m_lastBufferRequestSize is never assigned a value < 0, so the cast is ok
-+    const bool enough
-+        = (have_now >= 2 * had_before)
-+          || ((size_t)parser->m_lastBufferRequestSize > available_buffer);
-+
-+    if (! enough) {
-+      *endPtr = start; // callers may expect this to be set
-+      return XML_ERROR_NONE;
-+    }
-+  }
-+  g_parseAttempts += 1;
-+  const enum XML_Error ret = parser->m_processor(parser, start, end, endPtr);
-+  if (ret == XML_ERROR_NONE) {
-+    // if we consumed nothing, remember what we had on this parse attempt.
-+    if (*endPtr == start) {
-+      parser->m_partialTokenBytesBefore = have_now;
-+    } else {
-+      parser->m_partialTokenBytesBefore = 0;
-+    }
-+  }
-+  return ret;
-+}
-+
- static XML_Bool  /* only valid for root parser */
- startParsing(XML_Parser parser)
- {
-@@ -1075,6 +1131,9 @@ parserInit(XML_Parser parser, const XML_
-   bufferEnd = buffer;
-   parseEndByteIndex = 0;
-   parseEndPtr = NULL;
-+  partialTokenBytesBefore = 0;
-+  reparseDeferralEnabled = g_reparseDeferralEnabledDefault;
-+  lastBufferRequestSize = 0;
-   declElementType = NULL;
-   declAttributeId = NULL;
-   declEntity = NULL;
-@@ -1232,6 +1291,7 @@ XML_ExternalEntityParserCreate(XML_Parse
-      to worry which hash secrets each table has.
-   */
-   unsigned long oldhash_secret_salt;
-+  XML_Bool oldReparseDeferralEnabled;
- 
-   /* Validate the oldParser parameter before we pull everything out of it */
-   if (oldParser == NULL)
-@@ -1276,6 +1336,7 @@ XML_ExternalEntityParserCreate(XML_Parse
-      to worry which hash secrets each table has.
-   */
-   oldhash_secret_salt = hash_secret_salt;
-+  oldReparseDeferralEnabled = reparseDeferralEnabled;
- 
- #ifdef XML_DTD
-   if (!context)
-@@ -1330,6 +1391,7 @@ XML_ExternalEntityParserCreate(XML_Parse
-   defaultExpandInternalEntities = oldDefaultExpandInternalEntities;
-   ns_triplets = oldns_triplets;
-   hash_secret_salt = oldhash_secret_salt;
-+  reparseDeferralEnabled = oldReparseDeferralEnabled;
-   parentParser = oldParser;
- #ifdef XML_DTD
-   paramEntityParsing = oldParamEntityParsing;
-@@ -1850,39 +1912,8 @@ XML_Parse(XML_Parser parser, const char
-     ps_parsing = XML_PARSING;
-   }
- 
--  if (len == 0) {
--    ps_finalBuffer = (XML_Bool)isFinal;
--    if (!isFinal)
--      return XML_STATUS_OK;
--    positionPtr = bufferPtr;
--    parseEndPtr = bufferEnd;
--
--    /* If data are left over from last buffer, and we now know that these
--       data are the final chunk of input, then we have to check them again
--       to detect errors based on that fact.
--    */
--    errorCode = processor(parser, bufferPtr, parseEndPtr, &bufferPtr);
--
--    if (errorCode == XML_ERROR_NONE) {
--      switch (ps_parsing) {
--      case XML_SUSPENDED:
--        XmlUpdatePosition(encoding, positionPtr, bufferPtr, &position);
--        positionPtr = bufferPtr;
--        return XML_STATUS_SUSPENDED;
--      case XML_INITIALIZED:
--      case XML_PARSING:
--        ps_parsing = XML_FINISHED;
--        /* fall through */
--      default:
--        return XML_STATUS_OK;
--      }
--    }
--    eventEndPtr = eventPtr;
--    processor = errorProcessor;
--    return XML_STATUS_ERROR;
--  }
- #ifndef XML_CONTEXT_BYTES
--  else if (bufferPtr == bufferEnd) {
-+  if (bufferPtr == bufferEnd) {
-     const char *end;
-     int nLeftOver;
-     enum XML_Status result;
-@@ -1899,11 +1930,14 @@ XML_Parse(XML_Parser parser, const char
-        processor = errorProcessor;
-        return XML_STATUS_ERROR;
-     }
-+    // though this isn't a buffer request, we assume that `len` is the app's
-+    // preferred buffer fill size, and therefore save it here.
-+    lastBufferRequestSize = len;
-     parseEndByteIndex += len;
-     positionPtr = s;
-     ps_finalBuffer = (XML_Bool)isFinal;
- 
--    errorCode = processor(parser, s, parseEndPtr = s + len, &end);
-+    errorCode = callProcessor(parser, s, parseEndPtr = s + len, &end);
- 
-     if (errorCode != XML_ERROR_NONE) {
-       eventEndPtr = eventPtr;
-@@ -1930,6 +1964,8 @@ XML_Parse(XML_Parser parser, const char
-     XmlUpdatePosition(encoding, positionPtr, end, &position);
-     nLeftOver = s + len - end;
-     if (nLeftOver) {
-+#if 0
-+// erAck: replace with XML_GetBuffer() below.
-       if (buffer == NULL || nLeftOver > bufferLim - buffer) {
-         /* avoid _signed_ integer overflow */
-         char *temp = NULL;
-@@ -1939,6 +1975,28 @@ XML_Parse(XML_Parser parser, const char
-                 ? (char *)MALLOC(bytesToAllocate)
-                 : (char *)REALLOC(buffer, bytesToAllocate));
-         }
-+#endif
-+#if 1
-+// erAck: the original patch context had a call to XML_GetBuffer() instead:
-+      // Back up and restore the parsing status to avoid XML_ERROR_SUSPENDED
-+      // (and XML_ERROR_FINISHED) from XML_GetBuffer.
-+      const enum XML_Parsing originalStatus = ps_parsing;
-+      ps_parsing = XML_PARSING;
-+      void *const temp = XML_GetBuffer(parser, nLeftOver);
-+      ps_parsing = originalStatus;
-+#endif
-+      // GetBuffer may have overwritten this, but we want to remember what the
-+      // app requested, not how many bytes were left over after parsing.
-+      lastBufferRequestSize = len;
-+#if 1
-+      if (temp == NULL) {
-+        // NOTE: parser->m_errorCode has already been set by XML_GetBuffer().
-+        eventPtr = eventEndPtr = NULL;
-+        processor = errorProcessor;
-+        return XML_STATUS_ERROR;
-+      }
-+#endif
-+#if 0
-         if (temp == NULL) {
-           errorCode = XML_ERROR_NO_MEMORY;
-           eventPtr = eventEndPtr = NULL;
-@@ -1948,6 +2006,7 @@ XML_Parse(XML_Parser parser, const char
-         buffer = temp;
-         bufferLim = buffer + bytesToAllocate;
-       }
-+#endif
-       memcpy(buffer, end, nLeftOver);
-     }
-     bufferPtr = buffer;
-@@ -1959,15 +2018,14 @@ XML_Parse(XML_Parser parser, const char
-     return result;
-   }
- #endif  /* not defined XML_CONTEXT_BYTES */
--  else {
--    void *buff = XML_GetBuffer(parser, len);
--    if (buff == NULL)
--      return XML_STATUS_ERROR;
--    else {
--      memcpy(buff, s, len);
--      return XML_ParseBuffer(parser, len, isFinal);
--    }
-+  void *buff = XML_GetBuffer(parser, len);
-+  if (buff == NULL)
-+    return XML_STATUS_ERROR;
-+  if (len > 0) {
-+    assert(s != NULL); // make sure s==NULL && len!=0 was rejected above
-+    memcpy(buff, s, len);
-   }
-+  return XML_ParseBuffer(parser, len, isFinal);
- }
- 
- enum XML_Status XMLCALL
-@@ -2001,7 +2059,7 @@ XML_ParseBuffer(XML_Parser parser, int l
-   parseEndByteIndex += len;
-   ps_finalBuffer = (XML_Bool)isFinal;
- 
--  errorCode = processor(parser, start, parseEndPtr, &bufferPtr);
-+  errorCode = callProcessor(parser, start, parseEndPtr, &bufferPtr);
- 
-   if (errorCode != XML_ERROR_NONE) {
-     eventEndPtr = eventPtr;
-@@ -2047,7 +2105,11 @@ XML_GetBuffer(XML_Parser parser, int len
-   default: ;
-   }
- 
--  if (len > bufferLim - bufferEnd) {
-+  // whether or not the request succeeds, `len` seems to be the app's preferred
-+  // buffer fill size; remember it.
-+  lastBufferRequestSize = len;
-+  if (len > EXPAT_SAFE_PTR_DIFF(bufferLim, bufferEnd)
-+      || buffer == NULL) {
- #ifdef XML_CONTEXT_BYTES
-     int keep;
- #endif  /* defined XML_CONTEXT_BYTES */
-@@ -2063,7 +2125,9 @@ XML_GetBuffer(XML_Parser parser, int len
-       keep = XML_CONTEXT_BYTES;
-     neededSize += keep;
- #endif  /* defined XML_CONTEXT_BYTES */
--    if (neededSize  <= bufferLim - buffer) {
-+    if (buffer && bufferPtr
-+        && neededSize
-+               <= EXPAT_SAFE_PTR_DIFF(bufferLim, buffer)) {
- #ifdef XML_CONTEXT_BYTES
-       if (keep < bufferPtr - buffer) {
-         int offset = (int)(bufferPtr - buffer) - keep;
-@@ -2072,8 +2136,11 @@ XML_GetBuffer(XML_Parser parser, int len
-         bufferPtr -= offset;
-       }
- #else
--      memmove(buffer, bufferPtr, bufferEnd - bufferPtr);
--      bufferEnd = buffer + (bufferEnd - bufferPtr);
-+      memmove(buffer, bufferPtr,
-+              EXPAT_SAFE_PTR_DIFF(bufferEnd, bufferPtr));
-+      bufferEnd
-+          = buffer
-+            + EXPAT_SAFE_PTR_DIFF(bufferEnd, bufferPtr);
-       bufferPtr = buffer;
- #endif  /* not defined XML_CONTEXT_BYTES */
-     }
-@@ -2171,7 +2238,7 @@ XML_ResumeParser(XML_Parser parser)
-   }
-   ps_parsing = XML_PARSING;
- 
--  errorCode = processor(parser, bufferPtr, parseEndPtr, &bufferPtr);
-+  errorCode = callProcessor(parser, bufferPtr, parseEndPtr, &bufferPtr);
- 
-   if (errorCode != XML_ERROR_NONE) {
-     eventEndPtr = eventPtr;
-@@ -2481,6 +2548,15 @@ MOZ_XML_ProcessingEntityValue(XML_Parser
- }
- /* END MOZILLA CHANGE */
- 
-+XML_Bool XMLCALL
-+XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled) {
-+  if (parser != NULL && (enabled == XML_TRUE || enabled == XML_FALSE)) {
-+    parser->m_reparseDeferralEnabled = enabled;
-+    return XML_TRUE;
-+  }
-+  return XML_FALSE;
-+}
-+
- /* Initially tag->rawName always points into the parse buffer;
-    for those TAG instances opened while the current parse buffer was
-    processed, and not yet closed, we need to store tag->rawName in a more
diff --git a/SPECS/firefox.spec b/SPECS/firefox.spec
index d92a5ba..4044dc0 100644
--- a/SPECS/firefox.spec
+++ b/SPECS/firefox.spec
@@ -133,7 +133,7 @@ end}
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
 Version:        115.9.1
-Release:        1%{?dist}
+Release:        2%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
 
@@ -237,7 +237,6 @@ Patch201:       firefox-tests-xpcshell-freeze.patch
 
 # ---- Security patches ----
 Patch301:       CVE-2023-44488-libvpx.patch
-Patch302:       expat-CVE-2023-52425.patch
 
 # BUILD REQURES/REQUIRES
 %if %{?system_nss} && !0%{?bundle_nss}
@@ -1048,7 +1047,6 @@ echo "--------------------------------------------"
 cd media/libvpx/libvpx
 %patch -P301 -p1 -b .CVE-2023-44488-libvpx
 cd -
-%patch -P302 -p1 -b .expat-CVE-2023-52425
 
 %{__rm} -f .mozconfig
 %{__cp} %{SOURCE10} .mozconfig
@@ -1742,6 +1740,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #---------------------------------------------------------------------
 
 %changelog
+* Tue Apr 09 2024 Jan Horak <jhorak@redhat.com> - 115.9.1-2
+- Removed expat CVE fix
+
 * Fri Mar 22 2024 Eike Rathke <erack@redhat.com> - 115.9.1-1
 - Update to 115.9.1
 

From b87edbdede818dbf59b3ed4faeab2ef0353489ad Mon Sep 17 00:00:00 2001
From: MSVSphere Packaging Team <packager@msvsphere-os.ru>
Date: Fri, 19 Apr 2024 03:32:10 +0300
Subject: [PATCH 08/10] import firefox-115.10.0-1.el9_3

---
 .firefox.metadata  | 4 ++--
 .gitignore         | 4 ++--
 SPECS/firefox.spec | 9 ++++++---
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/.firefox.metadata b/.firefox.metadata
index 7b99b5a..69db820 100644
--- a/.firefox.metadata
+++ b/.firefox.metadata
@@ -1,6 +1,6 @@
 b963b16f6879c5dbe6e33a3a3da058b494453922 SOURCES/cbindgen-vendor.tar.xz
-b28310d67624787206243d4c9eff8496ecb4c9df SOURCES/firefox-115.9.1esr.processed-source.tar.xz
-a69c4cf421b2b0e84142b7a5e47ae382ba9e975b SOURCES/firefox-langpacks-115.9.1esr-20240322.tar.xz
+d20eb93d03020aaeaf53cb59ea9febda3420e7c0 SOURCES/firefox-115.10.0esr.processed-source.tar.xz
+26d7084ec0caa9dff114cdb3fab8cae0c46ba4b4 SOURCES/firefox-langpacks-115.10.0esr-20240409.tar.xz
 2d8a6b2b30d5496735f49ffe8c8a7ede3a78a5ca SOURCES/mochitest-python.tar.gz
 d744f92e874688cc4b5376477dfdd639a97a6cd4 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 9555ba179bc1398fbacfa2896e45f3808d94ecd2 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/.gitignore b/.gitignore
index fcc34b3..cb05f46 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,6 @@
 SOURCES/cbindgen-vendor.tar.xz
-SOURCES/firefox-115.9.1esr.processed-source.tar.xz
-SOURCES/firefox-langpacks-115.9.1esr-20240322.tar.xz
+SOURCES/firefox-115.10.0esr.processed-source.tar.xz
+SOURCES/firefox-langpacks-115.10.0esr-20240409.tar.xz
 SOURCES/mochitest-python.tar.gz
 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/SPECS/firefox.spec b/SPECS/firefox.spec
index 4044dc0..73a822f 100644
--- a/SPECS/firefox.spec
+++ b/SPECS/firefox.spec
@@ -132,8 +132,8 @@ end}
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        115.9.1
-Release:        2%{?dist}
+Version:        115.10.0
+Release:        1%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
 
@@ -163,7 +163,7 @@ ExcludeArch:    aarch64 s390 ppc
 # Link to original tarball: https://archive.mozilla.org/pub/firefox/releases/%%{version}%%{?pre_version}/source/firefox-%%{version}%%{?pre_version}.source.tar.xz
 Source0:        firefox-%{version}%{?pre_version}%{?buildnum}.processed-source.tar.xz
 %if %{with langpacks}
-Source1:        firefox-langpacks-%{version}%{?pre_version}-20240322.tar.xz
+Source1:        firefox-langpacks-%{version}%{?pre_version}-20240409.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
@@ -1740,6 +1740,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #---------------------------------------------------------------------
 
 %changelog
+* Tue Apr 09 2024 Eike Rathke <erack@redhat.com> - 115.10.0-1
+- Update to 115.10.0 build1
+
 * Tue Apr 09 2024 Jan Horak <jhorak@redhat.com> - 115.9.1-2
 - Removed expat CVE fix
 

From e0e52179e5fe377a1fa2e0a1ea68e85e53f2f48d Mon Sep 17 00:00:00 2001
From: MSVSphere Packaging Team <packager@msvsphere-os.ru>
Date: Mon, 20 May 2024 20:08:22 +0300
Subject: [PATCH 09/10] import firefox-115.11.0-1.el9_4

---
 .firefox.metadata  | 4 ++--
 .gitignore         | 4 ++--
 SPECS/firefox.spec | 7 +++++--
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/.firefox.metadata b/.firefox.metadata
index 69db820..93095ef 100644
--- a/.firefox.metadata
+++ b/.firefox.metadata
@@ -1,6 +1,6 @@
 b963b16f6879c5dbe6e33a3a3da058b494453922 SOURCES/cbindgen-vendor.tar.xz
-d20eb93d03020aaeaf53cb59ea9febda3420e7c0 SOURCES/firefox-115.10.0esr.processed-source.tar.xz
-26d7084ec0caa9dff114cdb3fab8cae0c46ba4b4 SOURCES/firefox-langpacks-115.10.0esr-20240409.tar.xz
+390c5bc3d9df2baf3e969203e4827e096c4c7f69 SOURCES/firefox-115.11.0esr.processed-source.tar.xz
+11b5c428a7e73076351e2d0e344e513db8186a04 SOURCES/firefox-langpacks-115.11.0esr-20240507.tar.xz
 2d8a6b2b30d5496735f49ffe8c8a7ede3a78a5ca SOURCES/mochitest-python.tar.gz
 d744f92e874688cc4b5376477dfdd639a97a6cd4 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 9555ba179bc1398fbacfa2896e45f3808d94ecd2 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/.gitignore b/.gitignore
index cb05f46..c5050d1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,6 @@
 SOURCES/cbindgen-vendor.tar.xz
-SOURCES/firefox-115.10.0esr.processed-source.tar.xz
-SOURCES/firefox-langpacks-115.10.0esr-20240409.tar.xz
+SOURCES/firefox-115.11.0esr.processed-source.tar.xz
+SOURCES/firefox-langpacks-115.11.0esr-20240507.tar.xz
 SOURCES/mochitest-python.tar.gz
 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/SPECS/firefox.spec b/SPECS/firefox.spec
index 73a822f..4cfac94 100644
--- a/SPECS/firefox.spec
+++ b/SPECS/firefox.spec
@@ -132,7 +132,7 @@ end}
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        115.10.0
+Version:        115.11.0
 Release:        1%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
@@ -163,7 +163,7 @@ ExcludeArch:    aarch64 s390 ppc
 # Link to original tarball: https://archive.mozilla.org/pub/firefox/releases/%%{version}%%{?pre_version}/source/firefox-%%{version}%%{?pre_version}.source.tar.xz
 Source0:        firefox-%{version}%{?pre_version}%{?buildnum}.processed-source.tar.xz
 %if %{with langpacks}
-Source1:        firefox-langpacks-%{version}%{?pre_version}-20240409.tar.xz
+Source1:        firefox-langpacks-%{version}%{?pre_version}-20240507.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
@@ -1740,6 +1740,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #---------------------------------------------------------------------
 
 %changelog
+* Tue May 07 2024 Eike Rathke <erack@redhat.com> - 115.11.0-1
+- Update to 115.11.0 build1
+
 * Tue Apr 09 2024 Eike Rathke <erack@redhat.com> - 115.10.0-1
 - Update to 115.10.0 build1
 

From ea26ae79a49cbb9ce2045b13449ce9628ea284fd Mon Sep 17 00:00:00 2001
From: MSVSphere Packaging Team <packager@msvsphere-os.ru>
Date: Tue, 18 Jun 2024 03:31:11 +0300
Subject: [PATCH 10/10] import firefox-115.12.0-1.el9_4

---
 .firefox.metadata  | 4 ++--
 .gitignore         | 4 ++--
 SPECS/firefox.spec | 9 ++++++---
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/.firefox.metadata b/.firefox.metadata
index 93095ef..887a3db 100644
--- a/.firefox.metadata
+++ b/.firefox.metadata
@@ -1,6 +1,6 @@
 b963b16f6879c5dbe6e33a3a3da058b494453922 SOURCES/cbindgen-vendor.tar.xz
-390c5bc3d9df2baf3e969203e4827e096c4c7f69 SOURCES/firefox-115.11.0esr.processed-source.tar.xz
-11b5c428a7e73076351e2d0e344e513db8186a04 SOURCES/firefox-langpacks-115.11.0esr-20240507.tar.xz
+820717fcb4ec429ccf7f49cf9c10612d27dadc09 SOURCES/firefox-115.12.0esr.processed-source.tar.xz
+3b6cc16c53c37017fbd31ee47c9d2a5f0c84dfda SOURCES/firefox-langpacks-115.12.0esr-20240604.tar.xz
 2d8a6b2b30d5496735f49ffe8c8a7ede3a78a5ca SOURCES/mochitest-python.tar.gz
 d744f92e874688cc4b5376477dfdd639a97a6cd4 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 9555ba179bc1398fbacfa2896e45f3808d94ecd2 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/.gitignore b/.gitignore
index c5050d1..b19fd3a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,6 @@
 SOURCES/cbindgen-vendor.tar.xz
-SOURCES/firefox-115.11.0esr.processed-source.tar.xz
-SOURCES/firefox-langpacks-115.11.0esr-20240507.tar.xz
+SOURCES/firefox-115.12.0esr.processed-source.tar.xz
+SOURCES/firefox-langpacks-115.12.0esr-20240604.tar.xz
 SOURCES/mochitest-python.tar.gz
 SOURCES/nspr-4.35.0-1.el8_1.src.rpm
 SOURCES/nss-3.90.0-3.el8_1.src.rpm
diff --git a/SPECS/firefox.spec b/SPECS/firefox.spec
index 4cfac94..d6faa0a 100644
--- a/SPECS/firefox.spec
+++ b/SPECS/firefox.spec
@@ -36,7 +36,7 @@ function dist_to_rhel_minor(str, start)
   end
   match = string.match(str, ".el9")
   if match then
-     return 4
+     return 5
   end
   return -1
 end}
@@ -132,7 +132,7 @@ end}
 
 Summary:        Mozilla Firefox Web browser
 Name:           firefox
-Version:        115.11.0
+Version:        115.12.0
 Release:        1%{?dist}
 URL:            https://www.mozilla.org/firefox/
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
@@ -163,7 +163,7 @@ ExcludeArch:    aarch64 s390 ppc
 # Link to original tarball: https://archive.mozilla.org/pub/firefox/releases/%%{version}%%{?pre_version}/source/firefox-%%{version}%%{?pre_version}.source.tar.xz
 Source0:        firefox-%{version}%{?pre_version}%{?buildnum}.processed-source.tar.xz
 %if %{with langpacks}
-Source1:        firefox-langpacks-%{version}%{?pre_version}-20240507.tar.xz
+Source1:        firefox-langpacks-%{version}%{?pre_version}-20240604.tar.xz
 %endif
 Source2:        cbindgen-vendor.tar.xz
 Source3:        process-official-tarball
@@ -1740,6 +1740,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 #---------------------------------------------------------------------
 
 %changelog
+* Tue Jun 04 2024 Eike Rathke <erack@redhat.com> - 115.12.0-1
+- Update to 115.12.0 build1
+
 * Tue May 07 2024 Eike Rathke <erack@redhat.com> - 115.11.0-1
 - Update to 115.11.0 build1