Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpo-45329: Fix freed memory access in pyexpat.c #28649

Merged
merged 5 commits into from Oct 2, 2021
Merged

bpo-45329: Fix freed memory access in pyexpat.c #28649

merged 5 commits into from Oct 2, 2021

Conversation

@y-tag
Copy link
Contributor

@y-tag y-tag commented Sep 30, 2021 •
edited by bedevere-bot

https://bugs.python.org/issue45329

  • xmlparse_clear(self) calls clear_handlers(self, 0)
  • clear_handlers(self, 0) accesses self->itself
  • Therefore xmlparse_clear(self) would be done before XML_ParserFree(self->itself)

https://bugs.python.org/issue45329
@serhiy-storchaka
Copy link
Member

@serhiy-storchaka serhiy-storchaka commented Oct 1, 2021

LGTM, but please add a NEWS entry. https://blurb-it.herokuapp.com/

@y-tag
Copy link
Contributor Author

@y-tag y-tag commented Oct 1, 2021

I found that the segmentation fault occurs with expat 2.2.0 or earlier.
Null check has been added to 2.2.1.
Since the expat included in this repositry has been updated to 2.4.1, the segmentation fault does not occur with it.
Some tests are failed with ./configure --with-system-expat on CentOS 7, which includes expat 2.1.0.

So this patch might be useful on system which uses old expat...

@serhiy-storchaka serhiy-storchaka merged commit 0742abd into python:main Oct 2, 2021
12 checks passed
@miss-islington
Copy link
Contributor

@miss-islington miss-islington commented Oct 2, 2021

Thanks @y-tag for the PR, and @serhiy-storchaka for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10.
🐍🍒⛏🤖

miss-islington added a commit to miss-islington/cpython that referenced this issue Oct 2, 2021
@y-tag @miss-islington
bpo-45329: Fix freed memory access in pyexpat.c (pythonGH-28649)
0e39c63 
(cherry picked from commit 0742abd)

Co-authored-by: TAGAMI Yukihiro <tagami.yukihiro@gmail.com>
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Oct 2, 2021

GH-28692 is a backport of this pull request to the 3.10 branch.

miss-islington added a commit to miss-islington/cpython that referenced this issue Oct 2, 2021
@y-tag @miss-islington
bpo-45329: Fix freed memory access in pyexpat.c (pythonGH-28649)
0c70829 
(cherry picked from commit 0742abd)

Co-authored-by: TAGAMI Yukihiro <tagami.yukihiro@gmail.com>
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Oct 2, 2021

GH-28693 is a backport of this pull request to the 3.9 branch.

@y-tag y-tag deleted the pyexpat-freed-memory branch Oct 2, 2021
miss-islington added a commit that referenced this issue Oct 2, 2021
@y-tag @miss-islington
bpo-45329: Fix freed memory access in pyexpat.c (GH-28649)
22cf6a2 
(cherry picked from commit 0742abd)

Co-authored-by: TAGAMI Yukihiro <tagami.yukihiro@gmail.com>
@serhiy-storchaka
Copy link
Member

@serhiy-storchaka serhiy-storchaka commented Oct 2, 2021

Thank you for your contribution TAGAMI-san!

@y-tag
Copy link
Contributor Author

@y-tag y-tag commented Oct 2, 2021

Thank you too! 😃

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@serhiy-storchaka serhiy-storchaka

Assignees
No one assigned
Labels
CLA signed type-bugfix
Projects
None yet
Milestone
No milestone
5 participants
@y-tag @serhiy-storchaka @miss-islington @bedevere-bot @the-knights-who-say-ni