GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.12] gh-139400: Make sure that parent parsers outlive their subparsers in `pyexpat` (GH-139403) by hartwork · Pull Request #139609 · python/cpython

Conversation

@hartwork

@hartwork hartwork commented Oct 5, 2025 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor
  • Issue: Heap-use-after-free issue in pyexpat related to .ExternalEntityParserCreate #139400

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@hartwork
pythongh-139400: Make sure that parent parsers outlive their subparse…
65730f3 
…rs in `pyexpat` (python#139403)

* Modules/pyexpat.c: Disallow collection of in-use parent parsers.

Within libexpat, a parser created via `XML_ExternalEntityParserCreate`
is relying on its parent parser throughout its entire lifetime.
Prior to this fix, is was possible for the parent parser to be
garbage-collected too early.

(cherry picked from commit 6edb2dd)
@bedevere-app bedevere-app Bot added the awaiting review label Oct 5, 2025
This was referenced Oct 5, 2025
Heap-use-after-free issue in pyexpat related to .ExternalEntityParserCreate #139400
Closed
gh-139400: Make sure that parent parsers outlive their subparsers in pyexpat #139403
Merged
@hartwork hartwork changed the title [3.12] gh-139400: Make sure that parent parsers outlive their subparsers in pyexpat (GH-139403) [3.12] gh-139400: Make sure that parent parsers outlive their subparsers in pyexpat (GH-139403) Oct 5, 2025
picnixz
picnixz approved these changes Oct 5, 2025
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Oct 5, 2025
@hartwork
Move news item from section "Core and Builtins" to section "Security"
5ee7718
encukou
encukou approved these changes Oct 6, 2025
View reviewed changes
@picnixz picnixz assigned pablogsal and Yhg1s and unassigned pablogsal Oct 6, 2025
@picnixz

picnixz commented Oct 6, 2025

Copy link
Copy Markdown
Member

(Sorry for the misassignments; I got lost in my multiple tabs & backport versions :))
hartwork reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@ambv
ambv merged commit dea7e3d into python:3.12 Oct 7, 2025
5 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Oct 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@encukou encukou encukou approved these changes
@picnixz picnixz picnixz approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@Yhg1s Yhg1s

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

6 participants

@hartwork @picnixz @encukou @ambv @Yhg1s @pablogsal
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.