GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | ||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | ||||||||||||||||||
GeezerVison is showing github.com — [3.10] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234) by hartwork · Pull Request #139532 · python/cpython Conversation
|
| #include <stdbool.h> | ||
| #include "structmember.h" // PyMemberDef | ||
| #include "frameobject.h" | ||
| #include <stddef.h> // offsetof() |
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Do we need offsetof?
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Hum. Why did add it? I think it was because my IDE complained at some point. Ok then.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
@picnixz I need to correct me earlier statement: I got the commit wrong, it's actually f04bea4 and you did not add that import there, it was already present in main and 3.14 and 3.13. So the question now seems to be whether we want to add or not add that import in the backports targetting 3.12, 3.11 and 3.10. It's the correct header but then some other header must be already pulling it in or the code would not compile already prior to these backports. I'm good with dropping or keeping that new include — what would you prefer?
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Try to reduce the diff as much as possible. If it works without the include then let's not add it. I think it would make better sense to remove it from 3.13 and 3.14 actually but I don't know if other files actually have an explicit or an implicit include policy...
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Try to reduce the diff as much as possible. If it works without the include then let's not add it.
@picnixz okay, let me try…
I think it would make better sense to remove it from 3.13 and 3.14 actually but I don't know if other files actually have an explicit or an implicit include policy...
That I would have trouble supporting. Please don't.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
@picnixz PS: I found…
Doc/c-api/structures.rst: (You may need to ``#include <stddef.h>`` for :c:func:`!offsetof`.)
…and also…
Include/structmember.h:#include <stddef.h> /* For offsetof (not always provided by Python.h) */
in 3.12 code and that all of 3.10, 3.11, 3.12 have pyexpat.c include structmember.h but 3.13, 3.14, main do not and so these seem to rightfully contain a dedicated #include <stddef.h> for offsetof.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
@picnixz okay, let me try…
Update: dropped from all of 3.10, 3.11, 3.12 backports by now.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
To have a good synchronization, we'll also delay 3.10 to 3.13 backports for their next release cycle (see #139359 (comment)). |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
I set DO-NOT-MERGE to avoid confusion. Unset that when you think we should be releasing this. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
@pablogsal I believe this is ready to be merged. Do you have a minute? |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
This was this PR I wanted to check manually because we didn't have |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
@pablogsal do you have a minute for this? 🙏 |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
|
Thanks a lot for the backport and thanks for the patience :) |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
Successfully merging this pull request may close these issues.
There was an error while loading. Please reload this page.