GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.11] gh-139400: Make sure that parent parsers outlive their subparsers in `pyexpat` (GH-139403) by hartwork · Pull Request #139612 · python/cpython

Conversation

@hartwork

@hartwork hartwork commented Oct 5, 2025 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor
  • Issue: Heap-use-after-free issue in pyexpat related to .ExternalEntityParserCreate #139400

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@hartwork
pythongh-139400: Make sure that parent parsers outlive their subparse…
37f71cb 
…rs in `pyexpat` (python#139403)

* Modules/pyexpat.c: Disallow collection of in-use parent parsers.

Within libexpat, a parser created via `XML_ExternalEntityParserCreate`
is relying on its parent parser throughout its entire lifetime.
Prior to this fix, is was possible for the parent parser to be
garbage-collected too early.

(cherry picked from commit 6edb2dd)
@bedevere-app bedevere-app Bot mentioned this pull request Oct 5, 2025
Heap-use-after-free issue in pyexpat related to .ExternalEntityParserCreate #139400
Closed
@bedevere-app bedevere-app Bot added the awaiting review label Oct 5, 2025
@bedevere-app bedevere-app Bot mentioned this pull request Oct 5, 2025
gh-139400: Make sure that parent parsers outlive their subparsers in pyexpat #139403
Merged
@hartwork hartwork changed the title [3.11] gh-139400: Make sure that parent parsers outlive their subparsers in pyexpat (GH-139403) [3.11] gh-139400: Make sure that parent parsers outlive their subparsers in pyexpat (GH-139403) Oct 5, 2025
picnixz
picnixz approved these changes Oct 5, 2025
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Oct 5, 2025
@hartwork
Move news item from section "Core and Builtins" to section "Security"
e8fae80
@picnixz picnixz assigned pablogsal Oct 6, 2025
@pablogsal
pablogsal merged commit 1459d1f into python:3.11 Oct 6, 2025
5 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Oct 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@picnixz picnixz picnixz approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@pablogsal pablogsal

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@hartwork @picnixz @pablogsal
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.