GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.10] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234) by hartwork · Pull Request #139532 · python/cpython

Conversation

@hartwork

@hartwork hartwork commented Oct 3, 2025 •
edited by picnixz
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Expose the XML Expat 2.7.2 mitigation APIs to disallow use of disproportional amounts of dynamic memory from within an Expat parser (see CVE-2025-59375 for instance).

The exposed APIs are available on Expat parsers, that is, parsers created by xml.parsers.expat.ParserCreate(), as:

  • parser.SetAllocTrackerActivationThreshold(threshold), and
  • parser.SetAllocTrackerMaximumAmplification(max_factor).

(cherry picked from commits f04bea4 and 68a1778)

CC @picnixz

  • Issue: Expose Expat XML attack protection APIs #90949

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
picnixz and others added 4 commits October 3, 2025 01:42
@picnixz @hartwork
pythongh-90949: add Expat API to prevent XML deadly allocations (CVE-…
de690f1
…2025-59375) (python#139234)

Expose the XML Expat 2.7.2 mitigation APIs to disallow use of
disproportional amounts of dynamic memory from within an Expat
parser (see CVE-2025-59375 for instance).

The exposed APIs are available on Expat parsers, that is,
parsers created by `xml.parsers.expat.ParserCreate()`, as:

- `parser.SetAllocTrackerActivationThreshold(threshold)`, and
- `parser.SetAllocTrackerMaximumAmplification(max_factor)`.

(cherry picked from commit f04bea4)
@picnixz @hartwork
pythongh-90949: amend pythonGH-139234 in prevision of future mitigati…
6ae7665
…on API (python#139366)

Fix some typos left in f04bea4,
and simplify some internal functions to ease maintenance of future
mitigation APIs.

(cherry picked from commit 68a1778)
@hartwork
Workaround lack of _Py_ID in CPython 3.10.x
a6a31cf
@hartwork
Add temporary workaround for issue 139400
98cb5cd
@bedevere-app bedevere-app Bot mentioned this pull request Oct 3, 2025
Expose Expat XML attack protection APIs #90949
Closed
@bedevere-app bedevere-app Bot added awaiting review topic-XML labels Oct 3, 2025
@bedevere-app bedevere-app Bot mentioned this pull request Oct 3, 2025
gh-90949: add Expat API to prevent XML deadly allocations #139234
Merged
picnixz
picnixz reviewed Oct 3, 2025
View reviewed changes
Comment thread Modules/pyexpat.c Resolved

Uh oh!

There was an error while loading. Please reload this page.

@hartwork
Migrate py_id_code into pyexpat_state
d1da6d6
Idea by @picnixz
@hartwork
hartwork requested a review from picnixz October 3, 2025 15:29
picnixz
picnixz approved these changes Oct 3, 2025
View reviewed changes

@picnixz picnixz left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the backport!

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

hartwork reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
Comment thread Modules/pyexpat.c Outdated
#include <stdbool.h>
#include "structmember.h" // PyMemberDef
#include "frameobject.h"
#include <stddef.h> // offsetof()

@picnixz picnixz Oct 3, 2025

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need offsetof?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

@hartwork hartwork Oct 3, 2025

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@picnixz we do!

For one, because it is used in:

static PyMemberDef xmlparse_members[] = {
    {"intern", T_OBJECT, offsetof(xmlparseobject, intern), READONLY, NULL},
    {NULL}
};

For two, because it is added in de690f1, the source of the backport.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

@picnixz picnixz Oct 3, 2025

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hum. Why did add it? I think it was because my IDE complained at some point. Ok then.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

@hartwork hartwork Oct 3, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@picnixz I need to correct me earlier statement: I got the commit wrong, it's actually f04bea4 and you did not add that import there, it was already present in main and 3.14 and 3.13. So the question now seems to be whether we want to add or not add that import in the backports targetting 3.12, 3.11 and 3.10. It's the correct header but then some other header must be already pulling it in or the code would not compile already prior to these backports. I'm good with dropping or keeping that new include — what would you prefer?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

@picnixz picnixz Oct 3, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Try to reduce the diff as much as possible. If it works without the include then let's not add it. I think it would make better sense to remove it from 3.13 and 3.14 actually but I don't know if other files actually have an explicit or an implicit include policy...

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

@hartwork hartwork Oct 3, 2025

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Try to reduce the diff as much as possible. If it works without the include then let's not add it.

@picnixz okay, let me try…

I think it would make better sense to remove it from 3.13 and 3.14 actually but I don't know if other files actually have an explicit or an implicit include policy...

That I would have trouble supporting. Please don't.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

@hartwork hartwork Oct 3, 2025

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@picnixz PS: I found…

Doc/c-api/structures.rst:   (You may need to ``#include <stddef.h>`` for :c:func:`!offsetof`.)

…and also…

Include/structmember.h:#include <stddef.h> /* For offsetof (not always provided by Python.h) */

in 3.12 code and that all of 3.10, 3.11, 3.12 have pyexpat.c include structmember.h but 3.13, 3.14, main do not and so these seem to rightfully contain a dedicated #include <stddef.h> for offsetof.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

@hartwork hartwork Oct 3, 2025

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@picnixz okay, let me try…

Update: dropped from all of 3.10, 3.11, 3.12 backports by now.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Oct 3, 2025
hartwork added 3 commits October 3, 2025 21:58
@hartwork
Revert introduction of stddef.h import
21bdc0d
Idea by @picnixz
@hartwork
Merge remote-tracking branch 'upstream/3.10' into backport-f04bea4-3.10
0049b51
@hartwork
Drop workaround for 139400 as no-longer-needed
8027b28
@picnixz

picnixz commented Oct 7, 2025

Copy link
Copy Markdown
Member

To have a good synchronization, we'll also delay 3.10 to 3.13 backports for their next release cycle (see #139359 (comment)).

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@picnixz picnixz self-assigned this Oct 7, 2025
@ambv ambv added the DO-NOT-MERGE label Oct 8, 2025
@ambv

ambv commented Oct 8, 2025

Copy link
Copy Markdown
Contributor

I set DO-NOT-MERGE to avoid confusion. Unset that when you think we should be releasing this.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@picnixz picnixz removed the DO-NOT-MERGE label Nov 2, 2025
@hartwork
Merge remote-tracking branch 'upstream/3.10' into backport-f04bea4-3.10
7499b90
@hartwork

hartwork commented Nov 5, 2025

Copy link
Copy Markdown
Contributor Author

@pablogsal I believe this is ready to be merged. Do you have a minute?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

picnixz
picnixz approved these changes Nov 8, 2025
View reviewed changes
@picnixz

picnixz commented Nov 8, 2025

Copy link
Copy Markdown
Member

This was this PR I wanted to check manually because we didn't have _Py_ID() access in 3.10

hartwork reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@picnixz picnixz assigned pablogsal Nov 8, 2025
@hartwork

hartwork commented Nov 22, 2025

Copy link
Copy Markdown
Contributor Author

@pablogsal do you have a minute for this? 🙏

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

pablogsal
pablogsal approved these changes Nov 25, 2025
View reviewed changes
@pablogsal
pablogsal merged commit 1173f80 into python:3.10 Nov 25, 2025
5 checks passed

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app bedevere-app Bot removed the awaiting merge label Nov 25, 2025
@pablogsal

pablogsal commented Nov 25, 2025

Copy link
Copy Markdown
Member

Thanks a lot for the backport and thanks for the patience :)

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@briankeane briankeane mentioned this pull request Oct 14, 2026
bugfix: v2.4.1 — fix transcription failing on Macs older than macOS 26.4 playola-radio/quick-interview-editor#110
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@picnixz picnixz picnixz approved these changes
@pablogsal pablogsal pablogsal approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@picnixz picnixz

@pablogsal pablogsal

Labels

topic-XML

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@hartwork @picnixz @ambv @pablogsal
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.