Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

bpo-45329: Fix freed memory access in pyexpat.c#28649

Merged
serhiy-storchaka merged 5 commits into
python:mainpython/cpython:mainfrom
y-tag:pyexpat-freed-memoryy-tag/cpython:pyexpat-freed-memoryCopy head branch name to clipboard
Oct 2, 2021
Merged

bpo-45329: Fix freed memory access in pyexpat.c#28649
serhiy-storchaka merged 5 commits into
python:mainpython/cpython:mainfrom
y-tag:pyexpat-freed-memoryy-tag/cpython:pyexpat-freed-memoryCopy head branch name to clipboard

Conversation

@y-tag

@y-tag y-tag commented Sep 30, 2021 •
edited by bedevere-bot
Loading

Copy link
Copy Markdown
Contributor

https://bugs.python.org/issue45329

  • xmlparse_clear(self) calls clear_handlers(self, 0)
  • clear_handlers(self, 0) accesses self->itself
  • Therefore xmlparse_clear(self) would be done before XML_ParserFree(self->itself)

https://bugs.python.org/issue45329

@serhiy-storchaka serhiy-storchaka added needs backport to 3.9 needs backport to 3.10 only security fixes type-bug An unexpected behavior, bug, or error labels Oct 1, 2021
@serhiy-storchaka

serhiy-storchaka commented Oct 1, 2021

Copy link
Copy Markdown
Member

LGTM, but please add a NEWS entry. https://blurb-it.herokuapp.com/

serhiy-storchaka
serhiy-storchaka reviewed Oct 1, 2021
View reviewed changes
Comment thread Misc/NEWS.d/next/Core and Builtins/2021-10-01-11-17-45.bpo-45329.vtqRvA.rst Outdated
@y-tag

y-tag commented Oct 1, 2021

Copy link
Copy Markdown
Contributor Author

I found that the segmentation fault occurs with expat 2.2.0 or earlier.
Null check has been added to 2.2.1.
Since the expat included in this repositry has been updated to 2.4.1, the segmentation fault does not occur with it.
Some tests are failed with ./configure --with-system-expat on CentOS 7, which includes expat 2.1.0.

So this patch might be useful on system which uses old expat...

@serhiy-storchaka serhiy-storchaka merged commit 0742abd into python:main Oct 2, 2021
@miss-islington

miss-islington commented Oct 2, 2021

Copy link
Copy Markdown
Contributor

Thanks @y-tag for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 2, 2021
@y-tag @miss-islington
bpo-45329: Fix freed memory access in pyexpat.c (pythonGH-28649)
0e39c63 
(cherry picked from commit 0742abd)

Co-authored-by: TAGAMI Yukihiro <tagami.yukihiro@gmail.com>
@bedevere-bot

bedevere-bot commented Oct 2, 2021

Copy link
Copy Markdown

GH-28692 is a backport of this pull request to the 3.10 branch.

@bedevere-bot bedevere-bot removed the needs backport to 3.10 only security fixes label Oct 2, 2021
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 2, 2021
@y-tag @miss-islington
bpo-45329: Fix freed memory access in pyexpat.c (pythonGH-28649)
0c70829 
(cherry picked from commit 0742abd)

Co-authored-by: TAGAMI Yukihiro <tagami.yukihiro@gmail.com>
@bedevere-bot

bedevere-bot commented Oct 2, 2021

Copy link
Copy Markdown

GH-28693 is a backport of this pull request to the 3.9 branch.

@y-tag y-tag deleted the pyexpat-freed-memory branch October 2, 2021 11:20
miss-islington added a commit that referenced this pull request Oct 2, 2021
@miss-islington @y-tag
bpo-45329: Fix freed memory access in pyexpat.c (GH-28649)
22cf6a2 
(cherry picked from commit 0742abd)

Co-authored-by: TAGAMI Yukihiro <tagami.yukihiro@gmail.com>
@serhiy-storchaka

serhiy-storchaka commented Oct 2, 2021

Copy link
Copy Markdown
Member

Thank you for your contribution TAGAMI-san!

@y-tag

y-tag commented Oct 2, 2021

Copy link
Copy Markdown
Contributor Author

Thank you too! 😃

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@serhiy-storchaka serhiy-storchaka serhiy-storchaka approved these changes

Assignees

No one assigned

Labels

type-bug An unexpected behavior, bug, or error

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@y-tag @serhiy-storchaka @miss-islington @bedevere-bot @the-knights-who-say-ni
Morty Proxy This is a proxified and sanitized view of the page, visit original site.