[3.12] gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224) (GH-145987) (#145999)
Yhg1s <[email protected]> Tue, 04 Aug 2026 05:15:54 -0400 (EDT)
| Newsgroups | gmane.comp.python.cvs |
|---|---|
| Message-ID | <[email protected]> |
aHR0cHM6Ly9naXRodWIuY29tL3B5dGhvbi9jcHl0aG9uL2NvbW1pdC8yNGNlODhiMjg1ZjU2ZWUx MTYyNmNmNWU0NzJhZjNjZDhjYzdjNjIxDQpjb21taXQ6IDI0Y2U4OGIyODVmNTZlZTExNjI2Y2Y1 ZTQ3MmFmM2NkOGNjN2M2MjENCmJyYW5jaDogMy4xMg0KYXV0aG9yOiBTdGFuIFVsYnJ5Y2ggPHN0 YW5AcHl0aG9uLm9yZz4NCmNvbW1pdHRlcjogWWhnMXMgPHRob21hc0BweXRob24ub3JnPg0KZGF0 ZTogMjAyNi0wOC0wNFQxMToxNTo0MCswMjowMA0Kc3VtbWFyeToNCg0KWzMuMTJdIGdoLTE0NTk4 NjogQXZvaWQgdW5ib3VuZCBDIHJlY3Vyc2lvbiBpbiBgY29udl9jb250ZW50X21vZGVsYCBpbiBg cHlleHBhdC5jYCAoQ1ZFIDIwMjYtNDIyNCkgKEdILTE0NTk4NykgKCMxNDU5OTkpDQoNCkZpeCBD IHN0YWNrIG92ZXJmbG93IChDVkUtMjAyNi00MjI0KSB3aGVuIGFuIEV4cGF0IHBhcnNlcg0Kd2l0 aCBhIHJlZ2lzdGVyZWQgYEVsZW1lbnREZWNsSGFuZGxlcmAgcGFyc2VzIGlubGluZSBEVEQNCmNv bnRhaW5pbmcgZGVlcGx5IG5lc3RlZCBjb250ZW50IG1vZGVsLg0KDQooY2hlcnJ5IHBpY2tlZCBm cm9tIGNvbW1pdCBlYjBlOGJlM2E3ZTExYjg3ZDE5OGEyYzNhZjFlZDBlY2NmNTMyNzY4KQ0KDQpD by1hdXRob3JlZC1ieTogQsOpbsOpZGlrdCBUcmFuIDwxMDc5NjYwMCtwaWNuaXh6QHVzZXJzLm5v cmVwbHkuZ2l0aHViLmNvbT4NCg0KZmlsZXM6DQpBIE1pc2MvTkVXUy5kL25leHQvU2VjdXJpdHkv MjAyNi0wMy0xNC0xNy0zMS0zOS5naC1pc3N1ZS0xNDU5ODYuaWZTU3I4LnJzdA0KTSBMaWIvdGVz dC90ZXN0X3B5ZXhwYXQucHkNCk0gTW9kdWxlcy9weWV4cGF0LmMNCg0KZGlmZiAtLWdpdCBhL0xp Yi90ZXN0L3Rlc3RfcHlleHBhdC5weSBiL0xpYi90ZXN0L3Rlc3RfcHlleHBhdC5weQ0KaW5kZXgg MzhmOTUxNTczZjBhZDVhLi4zN2Q5MDg2ZjQwYTgyN2QgMTAwNjQ0DQotLS0gYS9MaWIvdGVzdC90 ZXN0X3B5ZXhwYXQucHkNCisrKyBiL0xpYi90ZXN0L3Rlc3RfcHlleHBhdC5weQ0KQEAgLTY3NSw2 ICs2NzUsMjQgQEAgZGVmIHRlc3RfY2hhbmdlX3NpemVfMihzZWxmKToNCiAgICAgICAgIHBhcnNl ci5QYXJzZSh4bWwyLCBUcnVlKQ0KICAgICAgICAgc2VsZi5hc3NlcnRFcXVhbChzZWxmLm4sIDQp DQogDQorY2xhc3MgRWxlbWVudERlY2xIYW5kbGVyVGVzdCh1bml0dGVzdC5UZXN0Q2FzZSk6DQor ICAgIGRlZiB0ZXN0X2RlZXBseV9uZXN0ZWRfY29udGVudF9tb2RlbChzZWxmKToNCisgICAgICAg ICMgVGhpcyBzaG91bGQgcmFpc2UgYSBSZWN1cnNpb25FcnJvciBhbmQgbm90IGNyYXNoLg0KKyAg ICAgICAgIyBTZWUgaHR0cHM6Ly9naXRodWIuY29tL3B5dGhvbi9jcHl0aG9uL2lzc3Vlcy8xNDU5 ODYuDQorICAgICAgICBOID0gNTAwXzAwMA0KKyAgICAgICAgZGF0YSA9ICgNCisgICAgICAgICAg ICBiJzwhRE9DVFlQRSByb290IFtcbjwhRUxFTUVOVCByb290ICcNCisgICAgICAgICAgICArIGIn KGEsICcgKiBOICsgYidhJyArIGInKScgKiBODQorICAgICAgICAgICAgKyBiJz5cbl0+XG48cm9v dC8+XG4nDQorICAgICAgICApDQorDQorICAgICAgICBwYXJzZXIgPSBleHBhdC5QYXJzZXJDcmVh dGUoKQ0KKyAgICAgICAgcGFyc2VyLkVsZW1lbnREZWNsSGFuZGxlciA9IGxhbWJkYSBfMSwgXzI6 IE5vbmUNCisgICAgICAgIHdpdGggc3VwcG9ydC5pbmZpbml0ZV9yZWN1cnNpb24oKToNCisgICAg ICAgICAgICB3aXRoIHNlbGYuYXNzZXJ0UmFpc2VzKFJlY3Vyc2lvbkVycm9yKToNCisgICAgICAg ICAgICAgICAgcGFyc2VyLlBhcnNlKGRhdGEpDQorDQorDQogY2xhc3MgTWFsZm9ybWVkSW5wdXRU ZXN0KHVuaXR0ZXN0LlRlc3RDYXNlKToNCiAgICAgZGVmIHRlc3QxKHNlbGYpOg0KICAgICAgICAg eG1sID0gYiJcMFxyXG4iDQpkaWZmIC0tZ2l0IGEvTWlzYy9ORVdTLmQvbmV4dC9TZWN1cml0eS8y MDI2LTAzLTE0LTE3LTMxLTM5LmdoLWlzc3VlLTE0NTk4Ni5pZlNTcjgucnN0IGIvTWlzYy9ORVdT LmQvbmV4dC9TZWN1cml0eS8yMDI2LTAzLTE0LTE3LTMxLTM5LmdoLWlzc3VlLTE0NTk4Ni5pZlNT cjgucnN0DQpuZXcgZmlsZSBtb2RlIDEwMDY0NA0KaW5kZXggMDAwMDAwMDAwMDAwMDAwLi43OTUz NmQxZmVmNTQzZjINCi0tLSAvZGV2L251bGwNCisrKyBiL01pc2MvTkVXUy5kL25leHQvU2VjdXJp dHkvMjAyNi0wMy0xNC0xNy0zMS0zOS5naC1pc3N1ZS0xNDU5ODYuaWZTU3I4LnJzdA0KQEAgLTAs MCArMSw0IEBADQorOm1vZDpgeG1sLnBhcnNlcnMuZXhwYXRgOiBGaXhlZCBhIGNyYXNoIGNhdXNl ZCBieSB1bmJvdW5kZWQgQyByZWN1cnNpb24gd2hlbg0KK2NvbnZlcnRpbmcgZGVlcGx5IG5lc3Rl ZCBYTUwgY29udGVudCBtb2RlbHMgd2l0aA0KKzptZXRoOmB+eG1sLnBhcnNlcnMuZXhwYXQueG1s cGFyc2VyLkVsZW1lbnREZWNsSGFuZGxlcmAuDQorVGhpcyBhZGRyZXNzZXMgOmN2ZTpgMjAyNi00 MjI0YC4NCmRpZmYgLS1naXQgYS9Nb2R1bGVzL3B5ZXhwYXQuYyBiL01vZHVsZXMvcHlleHBhdC5j DQppbmRleCA3OTQ5MmNhNWM0Zjc5ZDMuLjg2NzM1NDBmMzU4MTQyZiAxMDA2NDQNCi0tLSBhL01v ZHVsZXMvcHlleHBhdC5jDQorKysgYi9Nb2R1bGVzL3B5ZXhwYXQuYw0KQEAgLTMsNiArMyw3IEBA DQogI2VuZGlmDQogDQogI2luY2x1ZGUgIlB5dGhvbi5oIg0KKyNpbmNsdWRlICJweWNvcmVfY2V2 YWwuaCIgICAgICAgICAgIC8vIF9QeV9FbnRlclJlY3Vyc2l2ZUNhbGwoKQ0KICNpbmNsdWRlICJw eWNvcmVfcnVudGltZS5oIiAgICAgICAgIC8vIF9QeV9JRCgpDQogI2luY2x1ZGUgPGN0eXBlLmg+ DQogDQpAQCAtNTc4LDYgKzU3OSwxMCBAQCBzdGF0aWMgUHlPYmplY3QgKg0KIGNvbnZfY29udGVu dF9tb2RlbChYTUxfQ29udGVudCAqIGNvbnN0IG1vZGVsLA0KICAgICAgICAgICAgICAgICAgICBQ eU9iamVjdCAqKCpjb252X3N0cmluZykoY29uc3QgWE1MX0NoYXIgKikpDQogew0KKyAgICBpZiAo X1B5X0VudGVyUmVjdXJzaXZlQ2FsbCgiIGluIGNvbnZfY29udGVudF9tb2RlbCIpKSB7DQorICAg ICAgICByZXR1cm4gTlVMTDsNCisgICAgfQ0KKw0KICAgICBQeU9iamVjdCAqcmVzdWx0ID0gTlVM TDsNCiAgICAgUHlPYmplY3QgKmNoaWxkcmVuID0gUHlUdXBsZV9OZXcobW9kZWwtPm51bWNoaWxk cmVuKTsNCiAgICAgaW50IGk7DQpAQCAtNTg5LDcgKzU5NCw3IEBAIGNvbnZfY29udGVudF9tb2Rl bChYTUxfQ29udGVudCAqIGNvbnN0IG1vZGVsLA0KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBjb252X3N0cmluZyk7DQogICAgICAgICAgICAgaWYgKGNo aWxkID09IE5VTEwpIHsNCiAgICAgICAgICAgICAgICAgUHlfWERFQ1JFRihjaGlsZHJlbik7DQot ICAgICAgICAgICAgICAgIHJldHVybiBOVUxMOw0KKyAgICAgICAgICAgICAgICBnb3RvIGRvbmU7 DQogICAgICAgICAgICAgfQ0KICAgICAgICAgICAgIFB5VHVwbGVfU0VUX0lURU0oY2hpbGRyZW4s IGksIGNoaWxkKTsNCiAgICAgICAgIH0NCkBAIC01OTcsNiArNjAyLDggQEAgY29udl9jb250ZW50 X21vZGVsKFhNTF9Db250ZW50ICogY29uc3QgbW9kZWwsDQogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIG1vZGVsLT50eXBlLCBtb2RlbC0+cXVhbnQsDQogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIGNvbnZfc3RyaW5nLG1vZGVsLT5uYW1lLCBjaGlsZHJlbik7DQogICAgIH0N Citkb25lOg0KKyAgICBfUHlfTGVhdmVSZWN1cnNpdmVDYWxsKCk7DQogICAgIHJldHVybiByZXN1 bHQ7DQogfQ0KIA0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXwpQeXRob24tY2hlY2tpbnMgbWFpbGluZyBsaXN0IC0tIHB5dGhvbi1jaGVja2luc0BweXRo b24ub3JnClRvIHVuc3Vic2NyaWJlIHNlbmQgYW4gZW1haWwgdG8gcHl0aG9uLWNoZWNraW5zLWxl YXZlQHB5dGhvbi5vcmcKaHR0cHM6Ly9tYWlsLnB5dGhvbi5vcmcvbWFpbG1hbjMvL2xpc3RzL3B5 dGhvbi1jaGVja2lucy5weXRob24ub3JnCk1lbWJlciBhZGRyZXNzOiBweXRob24tcHl0aG9uLWNo ZWNraW5zQG0uZ21hbmUtbXgub3JnCg==