Skip to content

gh-119342: Fix a potential denial of service in plistlib #119343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
serhiy-storchaka merged 7 commits into from
Dec 1, 2025
Merged

gh-119342: Fix a potential denial of service in plistlib #119343

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6969658
gh-119342: Fix OOM vulnerability in plistlib
serhiy-storchaka May 21, 2024
efcb8c5
Apply suggestions from code review
serhiy-storchaka May 22, 2024
412032b
Use a named constant.
serhiy-storchaka May 22, 2024
64fc738
Update 2024-05-21-22-11-31.gh-issue-119342.BTFj4Z.rst
serhiy-storchaka Nov 18, 2025
ae1d2bc
Merge branch 'main' into plistlib-oom
serhiy-storchaka Nov 18, 2025
9e18b74
Merge branch 'main' into plistlib-oom
serhiy-storchaka Dec 1, 2025
82093fb
Address review comments.
serhiy-storchaka Dec 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Address review comments.
  • Loading branch information
@serhiy-storchaka
serhiy-storchaka committed Dec 1, 2025
commit 82093fbcca035b47c52f9cb57a1815301cbff6bf
4 changes: 2 additions & 2 deletions Lib/plistlib.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@

# Data larger than this will be read in chunks, to prevent extreme
# overallocation.
_SAFE_BUF_SIZE = 1 << 20
_MIN_READ_BUF_SIZE = 1 << 20

class UID:
def __init__(self, data):
Expand Down Expand Up @@ -512,7 +512,7 @@ def _get_size(self, tokenL):
return tokenL

def _read(self, size):
cursize = min(size, _SAFE_BUF_SIZE)
cursize = min(size, _MIN_READ_BUF_SIZE)
data = self._fp.read(cursize)
while True:
if len(data) != cursize:
Expand Down
7 changes: 3 additions & 4 deletions Misc/NEWS.d/next/Security/2024-05-21-22-11-31.gh-issue-119342.BTFj4Z.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
Fix a potential denial of service in the :mod:`plistlib` module.
Fix a potential memory denial of service in the :mod:`plistlib` module.
When reading a Plist file received from untrusted source, it could cause
an arbitrary amount of memory to be allocated.
In best case this could lead to a :exc:`MemoryError` or other process crash.
In worst case it could lead to swapping which would dramatically slow down the
whole system and make it less responcible.
This could have led to symptoms including a :exc:`MemoryError`, swapping, out
of memory (OOM) killed processes or containers, or even system crashes.
Loading