Skip to content

gh-139400: Make sure that parent parsers outlive their subparsers in pyexpat #139403

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
picnixz merged 22 commits into from
Oct 5, 2025
Merged

gh-139400: Make sure that parent parsers outlive their subparsers in pyexpat #139403

Changes from 1 commit
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
e1c0470
pyexpat.c: Disallow collection of in-use parent parsers
hartwork Sep 28, 2025
3b0afda
Add a regression test for issue 139400
hartwork Sep 28, 2025
8f70991
Add news item for issue 139400
hartwork Sep 28, 2025
a63bd34
Improve test's docstring
hartwork Sep 28, 2025
22417ec
Simplify xmlparseobject_ to xmlparseobject
hartwork Sep 28, 2025
20caacd
Leverage Py_CLEAR
hartwork Sep 28, 2025
f8c58a3
Simplify call to Py_CLEAR
hartwork Sep 28, 2025
f1e3e36
Streamline docsting of ParentParserLifetimeTest
hartwork Sep 28, 2025
1b2937d
pyexpat.c: Adjust whitespace around pointer
hartwork Sep 28, 2025
8c5a4e8
Re-write news item
hartwork Sep 29, 2025
a6f5520
Turn parent into a PyObject pointer
hartwork Sep 30, 2025
4470cea
Add missing parent visit to xmlparse_traverse
hartwork Sep 30, 2025
3759ac7
Re-write comment about mission of "PyObject *parent"
hartwork Sep 30, 2025
30598a9
Add whitespace as requested
hartwork Oct 2, 2025
6d3c424
Add more tests
hartwork Oct 2, 2025
66b77e0
Add comment about Py_CLEAR(self->parent) to xmlparse_clear
hartwork Oct 5, 2025
455787f
Add missing full stops to docstrings
hartwork Oct 5, 2025
a669454
Drop reference to XML_ExternalEntityParserCreate
hartwork Oct 5, 2025
a91ed6b
Make test test_cycle waterproof
hartwork Oct 5, 2025
c056cfe
Full stops and sentences
hartwork Oct 5, 2025
12b8989
Drop test test_cycle
hartwork Oct 5, 2025
0541d6f
Drop now-unused import
hartwork Oct 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
pyexpat.c: Disallow collection of in-use parent parsers 
Within libexpat, a parser created via XML_ExternalEntityParserCreate
is relying on its parent parser throughout its entire lifetime.
Prior to this fix, is was possible for the parent parser
to be garbage-collected by CPython. This fixes related reference
counting, to stop that from happening.
  • Loading branch information
@hartwork
hartwork committed Sep 28, 2025
commit e1c047039b72c4c9002e9eb9c6cf689f4f54a9b2
17 changes: 16 additions & 1 deletion Modules/pyexpat.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,10 +72,11 @@ pyexpat_get_state(PyObject *module)

/* Declarations for objects of type xmlparser */

typedef struct {
typedef struct xmlparseobject_ {
Comment thread
hartwork marked this conversation as resolved.
Outdated
PyObject_HEAD

XML_Parser itself;
struct xmlparseobject_ * parent;
int ordered_attributes; /* Return attributes as a list. */
int specified_attributes; /* Report only specified attributes. */
int in_callback; /* Is a callback active? */
Expand Down Expand Up @@ -1065,6 +1066,11 @@ pyexpat_xmlparser_ExternalEntityParserCreate_impl(xmlparseobject *self,
return NULL;
}

// The new subparser will make use of the parent XML_Parser inside of Expat.
// So we need to take subparsers into account with the reference counting
// of their parent parser.
Py_INCREF(self);

new_parser->buffer_size = self->buffer_size;
new_parser->buffer_used = 0;
new_parser->buffer = NULL;
Expand All @@ -1074,18 +1080,21 @@ pyexpat_xmlparser_ExternalEntityParserCreate_impl(xmlparseobject *self,
new_parser->ns_prefixes = self->ns_prefixes;
new_parser->itself = XML_ExternalEntityParserCreate(self->itself, context,
encoding);
new_parser->parent = self;
new_parser->handlers = 0;
new_parser->intern = Py_XNewRef(self->intern);

if (self->buffer != NULL) {
new_parser->buffer = PyMem_Malloc(new_parser->buffer_size);
if (new_parser->buffer == NULL) {
Py_DECREF(new_parser);
Py_DECREF(self);
return PyErr_NoMemory();
}
}
if (!new_parser->itself) {
Py_DECREF(new_parser);
Py_DECREF(self);
return PyErr_NoMemory();
}

Expand All @@ -1099,6 +1108,7 @@ pyexpat_xmlparser_ExternalEntityParserCreate_impl(xmlparseobject *self,
new_parser->handlers = PyMem_New(PyObject *, i);
if (!new_parser->handlers) {
Py_DECREF(new_parser);
Py_DECREF(self);
return PyErr_NoMemory();
}
clear_handlers(new_parser, 1);
Expand Down Expand Up @@ -1479,6 +1489,7 @@ newxmlparseobject(pyexpat_state *state, const char *encoding,
/* namespace_separator is either NULL or contains one char + \0 */
self->itself = XML_ParserCreate_MM(encoding, &ExpatMemoryHandler,
namespace_separator);
self->parent = NULL;
if (self->itself == NULL) {
PyErr_SetString(PyExc_RuntimeError,
"XML_ParserCreate failed");
Expand Down Expand Up @@ -1538,6 +1549,10 @@ xmlparse_dealloc(PyObject *op)
XML_ParserFree(self->itself);
}
self->itself = NULL;
if (self->parent != NULL) {
Py_DECREF(self->parent);
self->parent = NULL;
Comment thread
hartwork marked this conversation as resolved.
Outdated
}

if (self->handlers != NULL) {
PyMem_Free(self->handlers);
Expand Down