Skip to content

[3.12] gh-111784: Fix two segfaults in the elementtree module (GH-113405) #113446

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
serhiy-storchaka merged 1 commit into from
Dec 24, 2023
Merged

[3.12] gh-111784: Fix two segfaults in the elementtree module (GH-113405) #113446

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions Misc/NEWS.d/next/Library/2023-12-23-13-10-42.gh-issue-111784.Nb4L1j.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
Fix segfaults in the ``_elementtree`` module.
Fix first segfault during deallocation of ``_elementtree.XMLParser`` instances by keeping strong reference
to ``pyexpat`` module in module state for capsule lifetime.
Fix second segfault which happens in the same deallocation process by keeping strong reference
to ``_elementtree`` module in ``XMLParser`` structure for ``_elementtree`` module lifetime.
16 changes: 14 additions & 2 deletions Modules/_elementtree.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,7 @@ typedef struct {
PyTypeObject *TreeBuilder_Type;
PyTypeObject *XMLParser_Type;

PyObject *expat_capsule;
struct PyExpat_CAPI *expat_capi;
} elementtreestate;

Expand Down Expand Up @@ -150,6 +151,7 @@ elementtree_clear(PyObject *m)
Py_CLEAR(st->ElementIter_Type);
Py_CLEAR(st->TreeBuilder_Type);
Py_CLEAR(st->XMLParser_Type);
Py_CLEAR(st->expat_capsule);

st->expat_capi = NULL;
return 0;
Expand All @@ -170,6 +172,7 @@ elementtree_traverse(PyObject *m, visitproc visit, void *arg)
Py_VISIT(st->ElementIter_Type);
Py_VISIT(st->TreeBuilder_Type);
Py_VISIT(st->XMLParser_Type);
Py_VISIT(st->expat_capsule);
return 0;
}

Expand Down Expand Up @@ -3065,6 +3068,7 @@ typedef struct {
PyObject *handle_close;

elementtreestate *state;
PyObject *elementtree_module;
} XMLParserObject;

/* helpers */
Expand Down Expand Up @@ -3611,7 +3615,11 @@ xmlparser_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
self->handle_start = self->handle_data = self->handle_end = NULL;
self->handle_comment = self->handle_pi = self->handle_close = NULL;
self->handle_doctype = NULL;
self->state = get_elementtree_state_by_type(type);
self->elementtree_module = PyType_GetModuleByDef(type, &elementtreemodule);
assert(self->elementtree_module != NULL);
Py_INCREF(self->elementtree_module);
// See gh-111784 for explanation why is reference to module needed here.
self->state = get_elementtree_state(self->elementtree_module);
}
return (PyObject *)self;
}
Expand Down Expand Up @@ -3788,6 +3796,7 @@ xmlparser_gc_clear(XMLParserObject *self)
EXPAT(st, ParserFree)(parser);
}

Py_CLEAR(self->elementtree_module);
Py_CLEAR(self->handle_close);
Py_CLEAR(self->handle_pi);
Py_CLEAR(self->handle_comment);
Expand Down Expand Up @@ -4347,7 +4356,10 @@ module_exec(PyObject *m)
goto error;

/* link against pyexpat */
st->expat_capi = PyCapsule_Import(PyExpat_CAPSULE_NAME, 0);
if (!(st->expat_capsule = _PyImport_GetModuleAttrString("pyexpat", "expat_CAPI")))
goto error;
if (!(st->expat_capi = PyCapsule_GetPointer(st->expat_capsule, PyExpat_CAPSULE_NAME)))
goto error;
if (st->expat_capi) {
/* check that it's usable */
if (strcmp(st->expat_capi->magic, PyExpat_CAPI_MAGIC) != 0 ||
Expand Down