GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.10] gh-139400: Make sure that parent parsers outlive their subparsers in `pyexpat` (GH-139403) by hartwork · Pull Request #139613 · python/cpython

Conversation

@hartwork

@hartwork hartwork commented Oct 5, 2025 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor
  • Issue: Heap-use-after-free issue in pyexpat related to .ExternalEntityParserCreate #139400

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@hartwork
pythongh-139400: Make sure that parent parsers outlive their subparse…
135a66e 
…rs in `pyexpat` (python#139403)

* Modules/pyexpat.c: Disallow collection of in-use parent parsers.

Within libexpat, a parser created via `XML_ExternalEntityParserCreate`
is relying on its parent parser throughout its entire lifetime.
Prior to this fix, is was possible for the parent parser to be
garbage-collected too early.

(cherry picked from commit 6edb2dd)
@bedevere-app bedevere-app Bot mentioned this pull request Oct 5, 2025
Heap-use-after-free issue in pyexpat related to .ExternalEntityParserCreate #139400
Closed
@bedevere-app bedevere-app Bot added the awaiting review label Oct 5, 2025
@bedevere-app bedevere-app Bot mentioned this pull request Oct 5, 2025
gh-139400: Make sure that parent parsers outlive their subparsers in pyexpat #139403
Merged
picnixz
picnixz approved these changes Oct 5, 2025
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Oct 5, 2025
@picnixz picnixz added the 🔨 test-with-refleak-buildbots Test PR w/ refleak buildbots; report in status section label Oct 5, 2025
@bedevere-bot

bedevere-bot commented Oct 5, 2025

Copy link
Copy Markdown

🤖 New build scheduled with the buildbot fleet by @picnixz for commit 135a66e 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F139613%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-refleak-buildbots label again.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the 🔨 test-with-refleak-buildbots Test PR w/ refleak buildbots; report in status section label Oct 5, 2025
@picnixz

picnixz commented Oct 5, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

I'll just run the refleak bots on the 3.10 and 3.13 branches as I think 3.11/3.12/3.13 are similar right (it's just to make sure the change of the GC protocol will not surprise us)
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@hartwork

hartwork commented Oct 5, 2025

Copy link
Copy Markdown
Contributor Author

3.11/3.12/3.13 are similar right

@picnixz about as similar as it gets
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@picnixz

picnixz commented Oct 5, 2025

Copy link
Copy Markdown
Member
  • The Fedora build bot failure is likely due to Temporarily skip test_aead_aes_gcm for buildbots with Linux kernel between 6.16.0 and 6.17.x #139310 that I didn't backport as it's a temporary fix so no need to worry about it.
  • The macOS failure is likely due to SSL issues that we always have.
  • The CentOS failure seems unrelated as it's about test_site.
hartwork reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@hartwork
Move news item to from section "Core and Builtins" to section "Security"
614a4c9
@picnixz picnixz assigned pablogsal Oct 6, 2025
@pablogsal
pablogsal merged commit 8ea678d into python:3.10 Oct 6, 2025
5 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Oct 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@picnixz picnixz picnixz approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@pablogsal pablogsal

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@hartwork @bedevere-bot @picnixz @pablogsal
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.