Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork33.7k
[3.10] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234)#139532
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
…2025-59375) (python#139234)Expose the XML Expat 2.7.2 mitigation APIs to disallow use ofdisproportional amounts of dynamic memory from within an Expatparser (seeCVE-2025-59375 for instance).The exposed APIs are available on Expat parsers, that is,parsers created by `xml.parsers.expat.ParserCreate()`, as:- `parser.SetAllocTrackerActivationThreshold(threshold)`, and- `parser.SetAllocTrackerMaximumAmplification(max_factor)`.(cherry picked from commitf04bea4)
…on API (python#139366)Fix some typos left inf04bea4,and simplify some internal functions to ease maintenance of futuremitigation APIs.(cherry picked from commit68a1778)
Uh oh!
There was an error while loading.Please reload this page.
picnixz left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Thanks for the backport!
Modules/pyexpat.c Outdated
| #include<stdbool.h> | ||
| #include"structmember.h"// PyMemberDef | ||
| #include"frameobject.h" | ||
| #include<stddef.h>// offsetof() |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Do we need offsetof?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Hum. Why did add it? I think it was because my IDE complained at some point. Ok then.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
@picnixz I need to correct me earlier statement: I got the commit wrong, it's actuallyf04bea4 and you didnot add that import there, it was already present inmain and 3.14 and 3.13. So the question now seems to be whether we want to add or not add that import in the backports targetting 3.12, 3.11 and 3.10. It's thecorrect header but then some other header must be already pulling it in or the code would not compile already prior to these backports. I'm good with dropping or keeping that new include — what would you prefer?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Try to reduce the diff as much as possible. If it works without the include then let's not add it. I think it would make better sense toremove it from 3.13 and 3.14 actually but I don't know if other files actually have an explicit or an implicit include policy...
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Try to reduce the diff as much as possible. If it works without the include then let's not add it.
@picnixz okay, let me try…
I think it would make better sense toremove it from 3.13 and 3.14 actually but I don't know if other files actually have an explicit or an implicit include policy...
That I would have trouble supporting. Please don't.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
@picnixz PS: I found…
Doc/c-api/structures.rst: (You may need to ``#include <stddef.h>`` for :c:func:`!offsetof`.)…and also…
Include/structmember.h:#include <stddef.h> /* For offsetof (not always provided by Python.h) */in 3.12 code and that all of 3.10, 3.11, 3.12 havepyexpat.c includestructmember.h but 3.13, 3.14,main do not and so these seem to rightfully contain a dedicated#include <stddef.h> foroffsetof.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
@picnixz okay, let me try…
Update: dropped from all of 3.10, 3.11, 3.12 backports by now.
picnixz commentedOct 7, 2025
To have a good synchronization, we'll also delay 3.10 to 3.13 backports for their next release cycle (see#139359 (comment)). |
ambv commentedOct 8, 2025
I set DO-NOT-MERGE to avoid confusion. Unset that when you think we should be releasing this. |
hartwork commentedNov 5, 2025
@pablogsal I believe this is ready to be merged. Do you have a minute? |
picnixz commentedNov 8, 2025
This was this PR I wanted to check manually because we didn't have |
hartwork commentedNov 22, 2025
@pablogsal do you have a minute for this? 🙏 |
1173f80 intopython:3.10Uh oh!
There was an error while loading.Please reload this page.
pablogsal commentedNov 25, 2025
Thanks a lot for the backport and thanks for the patience :) |
Uh oh!
There was an error while loading.Please reload this page.
Expose the XML Expat 2.7.2 mitigation APIs to disallow use of disproportional amounts of dynamic memory from within an Expat parser (seeCVE-2025-59375 for instance).
The exposed APIs are available on Expat parsers, that is, parsers created by
xml.parsers.expat.ParserCreate(), as:parser.SetAllocTrackerActivationThreshold(threshold), andparser.SetAllocTrackerMaximumAmplification(max_factor).(cherry picked from commitsf04bea4 and68a1778)
CC@picnixz