The ssl module now rejects TLS certificate chains that contain any of a set of
compromised eMudhra intermediate CA keys. This is an extraordinary measure and
a last line of defense: removing trust is primarily the job of the platform root
store, and the built-in denylist only blocks connections while that update has
not yet reached the OS, a container image, or a bundled trust store in various
Python packages. Entries are added to the denylist only under a very high
threshold.
The denylist matches on the public key (the SHA-256 digest of the RFC-5280
SubjectPublicKeyInfo), so it also covers the cross-signed certificates that
reuse one of the distrusted keys.
(cherry picked from commit 7dd8b4736a)
Co-authored-by: Christian Heimes <christian@python.org>
Test PySlice_Check(), PySlice_New(), PySlice_GetIndices(), PySlice_Unpack(),
PySlice_AdjustIndices() and PySlice_GetIndicesEx() -- both the macro and the
deprecated function.
Document the length and step precondition of PySlice_AdjustIndices()
(cherry picked from commit 8c056c33aa)
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
Includes addition of `Modules/_ssl_data*.h` definitions backported from 3.14's `Modules/_ssl_data_35.h`.
(adapted from commit cf526738ca)
Co-authored-by: Petr Viktorin <encukou@gmail.com>
_CallPythonObject() only wrote restype->size bytes into the closure's result buffer, leaving the unused high-order bits of the ffi_arg-sized register untouched. libffi's ffi_prep_closure_loc() documents that integral types narrower than a machine register must be widened to fill it, sign-extending signed types. On architectures that always read the full register for narrow return values (s390x), this leaves garbage in the high bits, which broke libclang callbacks used by cindex.py.
(cherry picked from commit b6f9a50e65)
Co-authored-by: Lazizbek Ergashev <lazerg2@gmail.com>
[3.14] gh-158169: Clear `zlib.Decompress.unconsumed_tail` at end of stream (GH-158177) (GH-158229)
(cherry picked from commit 8122ff4818)
Co-authored-by: Stan Ulbrych <stan@python.org>
Co-authored-by: GruffElixir <samarthat9@gmail.com>
gh-157335: Fix out-of-bounds write in mmap.mmap.__setitem__ (#157438)
Fix out-of-bounds write in mmap.mmap.__setitem__() that could occur
when converting the index or the assigned value (via __index__()
for a single item, or via the buffer protocol for a slice) resized or closed
the mmap object during the assignment.
(cherry picked from commit 09bf4c5258)
Co-authored-by: Joseph Kerry <joerkerry@gmail.com>
Tk on macOS replaces the SIGINT, SIGHUP and SIGTERM handlers with its
own, which exits the process, so Ctrl-C terminated a tkinter program
instead of raising KeyboardInterrupt. Save the handlers installed by
Python before Tk_Init() and restore them after it.
This affects Tk 8.6.11 to 8.6.18 and 9.0 to 9.0.4. Tk itself is fixed
in 8.6.19 and 9.0.5.
(cherry picked from commit 4532b36db5)
On 3.13 there was no Tkinter_TkInit(), and tkappinit.c, which is used
when Python is built with WITH_APPINIT (as on macOS), called Tk_Init()
directly, bypassing the fix.
A __del__ of the user pointer could get the panel being deallocated
from top_panel() and crash the interpreter.
(cherry picked from commit df02e264c8)
Co-authored-by: Vyron Vasileiadis <hi@fedonman.com>
Due to a bug, some Unicode codepoint attributes were considered
for characters not yet defined in Unicode 3.2.0 or attributes
which changed in later Unicode versions. RFC 3454 (StringPrep)
requires using Unicode 3.2.0 strictly.
(cherry picked from commit 7e109d084d)
The cherry-pick needed reworking as GH-144815 wasn't backported to 3.14
and below, so unassigned characters don't have bidi values.
(cherry picked from commit 1e54caa096)
Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Stan Ulbrych <89152624+stanfromireland@users.noreply.github.com>
Co-authored-by: Petr Viktorin <encukou@gmail.com>
---------
Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Stan Ulbrych <89152624+stanfromireland@users.noreply.github.com>
gh-157142: Fix linking _freeze_module with built-in test modules (GH-157143)
Programs/_freeze_module is linked with Modules/getpath_noop.o rather than
Modules/getpath.o, and getpath_noop.c only defined _PyConfig_InitPathConfig().
With MODULE_BUILDTYPE=static (the default on wasm), _testinternalcapi.o is
part of LIBRARY_OBJS_OMIT_FROZEN and its get_getpath_codeobject() left
_Py_Get_Getpath_CodeObject() as an undefined reference. Define a stub for it.
(cherry picked from commit c8da735f4f)
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
gh-156939: Fix struct.pack('0p', bytes) (GH-157071)
If the Pascal string is empty (size=0), do not write the size prefix.
Previously, a NUL byte was written outsize the buffer (buffer
overflow). In practice, the write remains into allocated memory
and is silently ignored: no memory is corrupted.
(cherry picked from commit 23525c90f5)
Co-authored-by: Victor Stinner <vstinner@python.org>
Corrected, in the documentation and in the docstrings:
* GetInputContext() returns bytes, and its result extends to the end of the
buffered input;
* Parse() accepts a bytes-like object as well as a string, and ignores the
encoding declaration for a string;
* ParseFile() only supports binary files;
* XML_ERROR_XML_DECL was described as XML_ERROR_NO_ELEMENTS;
* UnparsedEntityDeclHandler is not restricted to Expat 1.2;
* GetSpecifiedAttributeCount() needs ordered_attributes.
Documented the intern parameter and attribute, namespace_prefixes,
SkippedEntityHandler, XML_CTYPE_MIXED and XML_CTYPE_NAME, and EXPAT_VERSION,
version_info and features.
Removed obsolete notes about Expat 1.2 and 1.95.0, and :noindex: from the
content model constants, which are not documented elsewhere; completed the
list of attribute types in AttlistDeclHandler.
(cherry picked from commit d16a691111)
XMLParser.feed() and ElementTree.parse() raised OverflowError, because Expat
takes the length as an int. The data is now fed to Expat in chunks of 1 MiB,
as xml.parsers.expat does since bpo-17089, so the pure Python implementation
already accepted such input.
(cherry picked from commit 9259e8ba4d)
ElementTree.parse() with a text file mis-decoded the text in the C
implementation: _parse_whole() encoded it as UTF-8, but left expat to honor
the encoding declared in the document. It now overrides the encoding, as
XMLParser.feed() already does for str data.
(cherry picked from commit c83013c92d)
If the console cancels a read because of Ctrl+C, but the SIGINT handler
does not raise an exception, restart the read instead of ending it as if
at end of file.
(cherry picked from commit c922aa0ddd)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Valeriya Sinevich <valeriya.sinevich@phystech.edu>
Co-authored-by: Zackery Spytz <zspytz@gmail.com>
Windows strips trailing dots and spaces from the last component of the path,
so os.stat('spam.bat ') opened the same file as os.stat('spam.bat'), but did
not set the execute permissions in st_mode, because the extension did not
match. They are now ignored, unless the \\?\ prefix disables the path
normalization.
(cherry picked from commit b7daede668)
gh-153772: Make abc isinstance() tolerate instances without __class__ (GH-154149)
The built-in isinstance() reads an instance's __class__ with a lookup that
suppresses AttributeError and falls back to the object's type, so
isinstance(obj, int) returns False for an object whose __class__ access
raises. ABCMeta.__instancecheck__ read __class__ directly instead, so
isinstance(obj, Mapping) leaked that AttributeError.
Fall back to type(instance) when __class__ is unavailable, in both the C
and the pure-Python implementations, so the abstract base classes behave
like the built-in isinstance(). Such objects are unusual, but they do turn
up in the wild (for example some Qt widgets).
(cherry picked from commit 3e245faf34)
Co-authored-by: Vyron Vasileiadis <hi@fedonman.com>
charset_loc_ignore() tested the whole set once per locale case and took
the disjunction, which complements a set before closing it under case
instead of after: [bc] matched b'B', but so did [^bc]. Match both cases
of the character against every set member instead.
(cherry picked from commit 6671d27327)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Passing n to the library is ncurses' reading of n: it stores n characters
and adds a terminator. NetBSD curses counts the terminator in n.
Ask a library that is neither ncurses nor PDCurses for n + 1, and read
again if it stored more than asked; truncating could split a multibyte
character. This is not possible for input, so getstr() is left as it is.
instr() now takes the length from the value returned by winnstr(), as
X/Open specifies, instead of searching for a terminator which it does not.
(cherry picked from commit 43a1869f7e)
Fix wrong types: instr() and getstr() return a bytes object, not a str, and
their n limits the number of bytes; getkey() returns a str; unctrl() returns
a bytes object. Make clear whether an integer standing for a character is an
encoded byte or a character code.
Rewrite the documentation of getch(), get_wch(), getkey(), getstr() and
instr(), following X/Open Curses.
The docstrings of getstr() and instr() said that n defaults to 2047, while
the limit on this branch is 1023.
(cherry picked from commit be87bfa8a1)
TextIOWrapper.tell() used a borrowed next_input from the snapshot across the
decoder's getstate/decode/setstate calls, so a decoder that reenters seek()
from getstate could free it and leave tell() reading freed memory. Own the
reference across those calls, matching the sibling textiowrapper_read_chunk.
(cherry picked from commit fa0ec86ab6)
Co-authored-by: tonghuaroot (童话) <tonghuaroot@gmail.com>
The setter released the old callback before validating the new value,
so a failed assignment or a deletion removed it.
(cherry picked from commit 67f4d53425)
Deleting the attribute crashed, and setting it to an integer which does not
fit in C long reported success with OverflowError set.
(cherry picked from commit daebcac92d)
The designation-table scan compiled its terminator only under Py_DEBUG, so a
release build walked off the table for an unknown charset set via setstate().
Make the terminator unconditional and report the byte as undecodable.
(cherry picked from commit f40043e095)
Co-authored-by: tonghuaroot (童话) <tonghuaroot@gmail.com>
Parameters with a default value which are not in any group were always
required in the generated argument parsing code, although they were
rendered as optional in the signature. They can now be omitted, and
ambiguous combinations of optional groups and parameters with a default
value are rejected.
(cherry picked from commit caac927830)
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
They were emitted in the iteration order of a set of group identifiers.
The identifiers of the groups before the required parameters are small
negative integers, -1 and -2 have the same hash, so their order depended
on the size of Py_hash_t, and the code generated on a 32-bit platform
differed from the checked in one.
They are now emitted in the order of the parameters.
(cherry picked from commit 7aec160315)
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* gh-154937: Fix `_thread._shutdown()` racing with `_thread.start_joinable_thread` on `ThreadHandle.ident` (GH-155085)
(cherry picked from commit a4095ee272)
Co-authored-by: Edward Xu <xuxiangad@gmail.com>
