Etapa G: libs C base pcre2 + libxml2 al corpus (223→225)

Track de libs fundacionales (pivote tras gmp). Ambas static-musl, gcc:
- pcre2 10.47 → libpcre2-8.a + libpcre2-posix.a (regex; dep de pcre2-sys, grep-variants)
- libxml2 2.13.9 → libxml2.a (XML/HTML; dep de mucha cola C + crates -sys)

FIX CLAVE de comportamiento del lab (causa de los fallos previos, gmp incluido):
el lab tiene fases configure Y compile SEPARADAS; si configure se deja vacío, la
heurística inyecta su propio ./configure minimal (defaults → python/probe) que
corre ANTES y aborta. Solución: definir [build.phases].configure explícito.
libxml2 con --without-python/lzma/zlib; configure-phase split lo desbloqueó.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

recipes/CVE-2026-6732-test.patch

@@ -0,0 +1,84 @@
+--- a/testparser.c
++++ b/testparser.c
+@@ -11,6 +11,7 @@
+ #include <libxml/xmlreader.h>
+ #include <libxml/xmlwriter.h>
+ #include <libxml/HTMLparser.h>
++#include <libxml/xmlschemas.h>
+ 
+ #include <string.h>
+ 
+@@ -777,6 +778,63 @@
+ }
+ #endif /* WIN32 */
+ 
++#if defined(LIBXML_READER_ENABLED) && defined(LIBXML_SCHEMAS_ENABLED)
++/*
++ * Regression test for CVE-2026-6732: a type confusion in xmlParseReference
++ * crashed a schema-validating xmlTextReader whenever the document expanded
++ * an internal entity. Without the fix this triggers SIGSEGV on the first
++ * read; with the fix the entity expansion is read and the schema correctly
++ * reports the substituted content as invalid against xs:integer.
++ *
++ * Backport of upstream commit 7cea3fd1 adapted for the libxml2 2.13
++ * testparser.c layout (which predates the testReaderSchemaResourceLoader
++ * helper that upstream uses as an anchor on master).
++ */
++static int
++testReaderSchemaEntityExpansion(void) {
++    static const char xsd[] =
++        "<?xml version='1.0'?>\n"
++        "<xs:schema xmlns:xs='http://www.w3.org/2001/XMLSchema'>\n"
++        "  <xs:element name='e' type='xs:integer'/>\n"
++        "</xs:schema>\n";
++    static const char xml[] =
++        "<!DOCTYPE e [<!ENTITY n \"not-an-int\">]>\n"
++        "<e>&n;</e>";
++    xmlSchemaParserCtxtPtr spc;
++    xmlSchemaPtr schema;
++    xmlTextReaderPtr reader;
++    int err = 0;
++    int ret;
++
++    spc = xmlSchemaNewMemParserCtxt(xsd, (int) sizeof(xsd) - 1);
++    schema = xmlSchemaParse(spc);
++    xmlSchemaFreeParserCtxt(spc);
++    if (schema == NULL) {
++        fprintf(stderr, "xmlSchemaParse failed\n");
++        return 1;
++    }
++
++    reader = xmlReaderForMemory(xml, (int) sizeof(xml) - 1, "doc.xml", NULL,
++                                XML_PARSE_NOENT | XML_PARSE_DTDLOAD);
++    xmlTextReaderSetSchema(reader, schema);
++
++    while ((ret = xmlTextReaderRead(reader)) == 1)
++        ;
++    if (ret != 0) {
++        fprintf(stderr, "reader failed on entity-expanded document\n");
++        err = 1;
++    }
++    if (xmlTextReaderIsValid(reader) != 0) {
++        fprintf(stderr, "schema missed invalid entity-expanded text\n");
++        err = 1;
++    }
++
++    xmlFreeTextReader(reader);
++    xmlSchemaFree(schema);
++    return err;
++}
++#endif
++
+ int
+ main(void) {
+     int err = 0;
+@@ -807,6 +865,9 @@
+ #ifdef LIBXML_XINCLUDE_ENABLED
+     err |= testReaderXIncludeError();
+ #endif
++#ifdef LIBXML_SCHEMAS_ENABLED
++    err |= testReaderSchemaEntityExpansion();
++#endif
+ #endif
+ #ifdef LIBXML_WRITER_ENABLED
+     err |= testWriterClose();

recipes/CVE-2026-6732.patch

@@ -0,0 +1,32 @@
+diff --git a/parser.c b/parser.c
+index 6e7621a86b5b9256b7a068f09a7e1650e7264aa5..85bc39b1c2739574ab90fde34a24459e5ef9928f 100644
+--- a/parser.c
++++ b/parser.c
+@@ -7261,10 +7261,10 @@ xmlParseReference(xmlParserCtxt *ctxt) {
+             if ((cur->type == XML_TEXT_NODE) ||
+                 (ctxt->options & XML_PARSE_NOCDATA)) {
+                 if (ctxt->sax->characters != NULL)
+-                    ctxt->sax->characters(ctxt, cur->content, len);
++                    ctxt->sax->characters(ctxt->userData, cur->content, len);
+             } else {
+                 if (ctxt->sax->cdataBlock != NULL)
+-                    ctxt->sax->cdataBlock(ctxt, cur->content, len);
++                    ctxt->sax->cdataBlock(ctxt->userData, cur->content, len);
+             }
+ 
+             cur = cur->next;
+@@ -7284,10 +7284,12 @@ xmlParseReference(xmlParserCtxt *ctxt) {
+                 if ((cur->type == XML_TEXT_NODE) ||
+                     (ctxt->options & XML_PARSE_NOCDATA)) {
+                     if (ctxt->sax->characters != NULL)
+-                        ctxt->sax->characters(ctxt, cur->content, len);
++                        ctxt->sax->characters(ctxt->userData, cur->content,
++                                              len);
+                 } else {
+                     if (ctxt->sax->cdataBlock != NULL)
+-                        ctxt->sax->cdataBlock(ctxt, cur->content, len);
++                        ctxt->sax->cdataBlock(ctxt->userData, cur->content,
++                                              len);
+                 }
+ 
+                 break;

recipes/libxml2.toml

@@ -0,0 +1,34 @@
+# libxml2 2.13.9 — parser XML/HTML (C). Lib FUNDACIONAL: dep de muchísima cola C + crates *-sys.
+# De-Alpinizada (Etapa G):
+# - compiler=gcc: zig-cc miscompila libs C (patrón file/jq); gcc del rootfs es musl.
+# - --disable-shared --enable-static: el lab linkea estático; queremos libxml2.a en /usr/lib.
+# - core sin compresión/bindings: --without-lzma (no hay xz en corpus), --without-zlib,
+#   --without-python (el binding no aplica al userland estático). El parseo XML —el valor— no los pide.
+# - patches CVE de Alpine conservados (seguridad).
+name    = "libxml2"
+version = "2.13.9"
+
+[source]
+tarball = "https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.9.tar.xz"
+sha256  = "a2c9ae7b770da34860050c309f903221c67830c86e4a7e760692b803df95143a"
+patches = ["CVE-2026-6732.patch", "CVE-2026-6732-test.patch"]
+
+[build]
+compiler = "gcc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# configure EXPLÍCITO: si se deja vacío, la heurística del lab inyecta su propio ./configure
+# minimal (defaults → exige python-3.12) que corre antes y aborta. Definirlo lo desactiva.
+[build.phases]
+configure = '''
+./configure \
+	--build=$CBUILD --host=$CHOST \
+	--prefix=/usr \
+	--disable-shared --enable-static \
+	--without-python --without-lzma --without-zlib \
+	--with-legacy
+'''
+compile = 'make'
+install = 'make DESTDIR=/out install'

recipes/pcre2.toml

@@ -0,0 +1,34 @@
+# pcre2 10.47 — biblioteca de regex Perl-compatible (C). Lib FUNDACIONAL: dep de grep-variants,
+# pcre2-sys (crates Rust), y mucha cola C. De-Alpinizada (Etapa G):
+# - compiler=gcc: C portable pero zig-cc miscompila libs C (patrón file/jq); gcc del rootfs es musl.
+# - --disable-shared --enable-static: el lab linkea estático; queremos libpcre2-*.a en /usr/lib.
+# - sin --enable-pcre2test-libedit (libedit no está en corpus, es solo para el test interactivo).
+name    = "pcre2"
+version = "10.47"
+
+[source]
+tarball = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-10.47/pcre2-10.47.tar.bz2"
+sha256  = "47fe8c99461250d42f89e6e8fdaeba9da057855d06eb7fc08d9ca03fd08d7bc7"
+
+[build]
+compiler = "gcc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+compile = '''
+./configure \
+	--build=$CBUILD --host=$CHOST \
+	--prefix=/usr \
+	--disable-shared --enable-static \
+	--enable-pcre2-16 --enable-pcre2-32 \
+	--enable-jit \
+	--enable-pcre2grep-libz \
+	--disable-symvers
+make
+'''
+install = 'make DESTDIR=/out install'
+
+[deps]
+build = ["zlib"]