99 lines
3.5 KiB
Diff
99 lines
3.5 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
|
|
Date: Sun, 15 Mar 2026 21:46:06 +0000
|
|
Subject: 00485: CVE-2026-4224
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Stack overflow parsing XML with deeply nested DTD content models
|
|
|
|
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
|
|
---
|
|
Lib/test/test_pyexpat.py | 18 ++++++++++++++++++
|
|
...6-03-14-17-31-39.gh-issue-145986.ifSSr8.rst | 4 ++++
|
|
Modules/pyexpat.c | 9 ++++++++-
|
|
3 files changed, 30 insertions(+), 1 deletion(-)
|
|
create mode 100644 Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
|
|
|
|
diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py
|
|
index 38f951573f..37d9086f40 100644
|
|
--- a/Lib/test/test_pyexpat.py
|
|
+++ b/Lib/test/test_pyexpat.py
|
|
@@ -675,6 +675,24 @@ def test_change_size_2(self):
|
|
parser.Parse(xml2, True)
|
|
self.assertEqual(self.n, 4)
|
|
|
|
+class ElementDeclHandlerTest(unittest.TestCase):
|
|
+ def test_deeply_nested_content_model(self):
|
|
+ # This should raise a RecursionError and not crash.
|
|
+ # See https://github.com/python/cpython/issues/145986.
|
|
+ N = 500_000
|
|
+ data = (
|
|
+ b'<!DOCTYPE root [\n<!ELEMENT root '
|
|
+ + b'(a, ' * N + b'a' + b')' * N
|
|
+ + b'>\n]>\n<root/>\n'
|
|
+ )
|
|
+
|
|
+ parser = expat.ParserCreate()
|
|
+ parser.ElementDeclHandler = lambda _1, _2: None
|
|
+ with support.infinite_recursion():
|
|
+ with self.assertRaises(RecursionError):
|
|
+ parser.Parse(data)
|
|
+
|
|
+
|
|
class MalformedInputTest(unittest.TestCase):
|
|
def test1(self):
|
|
xml = b"\0\r\n"
|
|
diff --git a/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst b/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
|
|
new file mode 100644
|
|
index 0000000000..79536d1fef
|
|
--- /dev/null
|
|
+++ b/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
|
|
@@ -0,0 +1,4 @@
|
|
+:mod:`xml.parsers.expat`: Fixed a crash caused by unbounded C recursion when
|
|
+converting deeply nested XML content models with
|
|
+:meth:`~xml.parsers.expat.xmlparser.ElementDeclHandler`.
|
|
+This addresses :cve:`2026-4224`.
|
|
diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
|
|
index 79492ca5c4..8673540f35 100644
|
|
--- a/Modules/pyexpat.c
|
|
+++ b/Modules/pyexpat.c
|
|
@@ -3,6 +3,7 @@
|
|
#endif
|
|
|
|
#include "Python.h"
|
|
+#include "pycore_ceval.h" // _Py_EnterRecursiveCall()
|
|
#include "pycore_runtime.h" // _Py_ID()
|
|
#include <ctype.h>
|
|
|
|
@@ -578,6 +579,10 @@ static PyObject *
|
|
conv_content_model(XML_Content * const model,
|
|
PyObject *(*conv_string)(const XML_Char *))
|
|
{
|
|
+ if (_Py_EnterRecursiveCall(" in conv_content_model")) {
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
PyObject *result = NULL;
|
|
PyObject *children = PyTuple_New(model->numchildren);
|
|
int i;
|
|
@@ -589,7 +594,7 @@ conv_content_model(XML_Content * const model,
|
|
conv_string);
|
|
if (child == NULL) {
|
|
Py_XDECREF(children);
|
|
- return NULL;
|
|
+ goto done;
|
|
}
|
|
PyTuple_SET_ITEM(children, i, child);
|
|
}
|
|
@@ -597,6 +602,8 @@ conv_content_model(XML_Content * const model,
|
|
model->type, model->quant,
|
|
conv_string,model->name, children);
|
|
}
|
|
+done:
|
|
+ _Py_LeaveRecursiveCall();
|
|
return result;
|
|
}
|
|
|