Update expat to 2.2.0 to fix CVE vulnerability.

third_party/expat/README.chromium

 Name: Expat XML Parser
 Short Name: expat
 URL: http://sourceforge.net/projects/expat/

[dominicc (has gone to gerrit), 2017/03/23 05:35:27]

Can you point to the git repository you got this from so the hashes make sense?

(Is that https://github.com/libexpat/libexpat)?

-Version: 2.1.0
+Version: 2.2.0
 License: MIT
 License File: files/COPYING
 Security Critical: yes
 
 Description:
   This is Expat XML parser - very lightweight C library for parsing XML.
   Expat is distributed under an MIT license detailed in files/COPYING.
 
   We include it here because libjingle depends on it.
 
 Local Modifications:
   Removed files that Chromium didn't need:
     lib/expat*.dsp
     lib/Makefile.MPW
     amiga/*
     bcb5/*
     conftools/*
     doc/*
     examples/*
+    m4/*
     tests/*
     vms/*
     win32/*
     xmlwf/*
+    aclocal.m4
+    CMake.README
+    CMakeLists.txt
     configure
-    configure.in
+    configure.ac
+    configureChecks.cmake
     Makefile.in
     expat.dsw
-    expat.dsw
+    expat.pc.in
+    expat_config.h.cmake
     expat_config.h.in
+    Makefile.in
   Edited:
     lib/winconfig.h (see winconfig.h.original for unmodified version)
-      * Added check on line 1751 of xmltok_impl.c to patch a

[dominicc (has gone to gerrit), 2017/03/23 05:35:27]

Can you point to where this was fixed upstream?

-        bug with the handling of utf-8 characters that leads to a crash.
-    lib/xmltok_impl.c (see xmltok_imp.c.original for unmodified version)
-      * Prevent a compiler warning when compiling with
-        WIN32_LEAN_AND_MEAN predefined.
     lib/xmlparse.c (see xmlparse.c.original for unmodified version)
-      * Apply https://hg.mozilla.org/releases/mozilla-esr31/rev/2f3e78643f5c

[dominicc (has gone to gerrit), 2017/03/23 05:35:27]

Likewise, was this fixed upstream?

-        to prevent an integer overflow.
+      * Added line 713 of xmlparse.c to suppress compiling error.
+      * Apply expat patch 7ae9c3d3af433cd4defe95234eae7dc8ed15637f
+      * Apply expat patch #539 Fix regression from fix to CVE-2016-0718

[dominicc (has gone to gerrit), 2017/03/23 05:35:27]

This is imprecise; what did you apply exactly? I don't see that label but a
bunch of commits which mention an issue with that number. Just naming a commit
is good.

+      * Apply expat patch 7ae9c3d3af433cd4defe95234eae7dc8ed15637f

[dominicc (has gone to gerrit), 2017/03/23 05:35:27]

Is this a dup of the one a couple of lines up?

+    lib/xmltok.c (see xmltok.c.original for unmodified version)
+      * Apply expat patch #539 Fix regression from fix to CVE-2016-0718
   Added files:
     lib/expat_config.h (a generated config file)