Skip to content

gh-146056: Fix TreeBuilder stack in xml.etree#146062

Open
vstinner wants to merge 1 commit intopython:mainfrom
vstinner:fix_etree_stack
Open

gh-146056: Fix TreeBuilder stack in xml.etree#146062
vstinner wants to merge 1 commit intopython:mainfrom
vstinner:fix_etree_stack

Conversation

@vstinner
Copy link
Member

@vstinner vstinner commented Mar 17, 2026

No longer create a stack of 20 items, but create an empty stack instead. It prevents crashes when the stack list is discovered by gc.get_referrers() or other functions.

Fix also reference counting in treebuilder_handle_end().

No longer create a stack of 20 items, but create an empty stack
instead. It prevents crashes when the stack list is discovered by
gc.get_referrers() or other functions.

Fix also reference counting in treebuilder_handle_end().
@vstinner
Copy link
Member Author

I added "skip news" since this issue requires calling gc.get_referrers() which is used in "regular code".

item = self->last;
self->last = Py_NewRef(self->this);
Py_XSETREF(self->last_for_tail, self->last);
Py_XSETREF(self->last_for_tail, Py_NewRef(self->last));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is unrelated.

If rewrite this code to be more explicit or safe, I would write something like

    PyObject *last = self->last;
    PyObject *last_for_tail = self->last_for_tail;
    PyObject *this = self->this;
    self->index--;
    self->this = Py_NewRef(PyList_GET_ITEM(self->stack, self->index));
    self->last = Py_NewRef(this);
    self->last_for_tail = Py_NewRef(this);
    Py_DECREF(last);
    Py_XDECREF(last_for_tail);

    if (treebuilder_append_event(self, self->end_event_obj, this) < 0) {
        Py_DECREF(this);
        return NULL;
    }

    return this;

But we should also look a the other ends -- how these attributes are set in other code in this file. This is a separate issue.

t->comment_factory = NULL;
t->pi_factory = NULL;
t->stack = PyList_New(20);
t->stack = PyList_New(0);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can have performance impact.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants