Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e4a68e3

Browse files
Fidget-SpinnerFidget-Spinner
committed
Merge remote-tracking branch 'upstream/main' into tier2_inliner
2 parents 11262ea + b052fa3 commit e4a68e3

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

75 files changed

+1561
-710
lines changed

‎Doc/c-api/code.rst

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,13 @@ bound into a function.
3030
Return true if *co* is a :ref:`code object <code-objects>`.
3131
This function always succeeds.
3232
33-
.. c:function:: int PyCode_GetNumFree(PyCodeObject *co)
33+
.. c:function:: Py_ssize_t PyCode_GetNumFree(PyCodeObject *co)
3434
35-
Return the number of free variables in *co*.
35+
Return the number of free variables in a code object.
36+
37+
.. c:function:: int PyCode_GetFirstFree(PyCodeObject *co)
38+
39+
Return the position of the first free variable in a code object.
3640
3741
.. c:function:: PyCodeObject* PyUnstable_Code_New(int argcount, int kwonlyargcount, int nlocals, int stacksize, int flags, PyObject *code, PyObject *consts, PyObject *names, PyObject *varnames, PyObject *freevars, PyObject *cellvars, PyObject *filename, PyObject *name, PyObject *qualname, int firstlineno, PyObject *linetable, PyObject *exceptiontable)
3842

‎Doc/library/socket.rst

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -445,6 +445,11 @@ Constants
445445
Added ``IP_PKTINFO``, ``IP_UNBLOCK_SOURCE``, ``IP_BLOCK_SOURCE``,
446446
``IP_ADD_SOURCE_MEMBERSHIP``, ``IP_DROP_SOURCE_MEMBERSHIP``.
447447

448+
.. versionchanged:: 3.13
449+
Added ``SO_BINDTOIFINDEX``. On Linux this constant can be used in the
450+
same way that ``SO_BINDTODEVICE`` is used, but with the index of a
451+
network interface instead of its name.
452+
448453
.. data:: AF_CAN
449454
PF_CAN
450455
SOL_CAN_*

‎Doc/library/xml.rst

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ quadratic blowup **Vulnerable** (1) **Vulnerable** (1) **Vulnerable*
6868
external entity expansion Safe (5) Safe (2) Safe (3) Safe (5) Safe (4)
6969
`DTD`_ retrieval Safe (5) Safe Safe Safe (5) Safe
7070
decompression bomb Safe Safe Safe Safe **Vulnerable**
71+
large tokens **Vulnerable** (6) **Vulnerable** (6) **Vulnerable** (6) **Vulnerable** (6) **Vulnerable** (6)
7172
========================= ================== ================== ================== ================== ==================
7273

7374
1. Expat 2.4.1 and newer is not vulnerable to the "billion laughs" and
@@ -81,6 +82,11 @@ decompression bomb Safe Safe Safe
8182
4. :mod:`xmlrpc.client` doesn't expand external entities and omits them.
8283
5. Since Python 3.7.1, external general entities are no longer processed by
8384
default.
85+
6. Expat 2.6.0 and newer is not vulnerable to denial of service
86+
through quadratic runtime caused by parsing large tokens.
87+
Items still listed as vulnerable due to
88+
potential reliance on system-provided libraries. Check
89+
:const:`!pyexpat.EXPAT_VERSION`.
8490

8591

8692
billion laughs / exponential entity expansion
@@ -114,6 +120,13 @@ decompression bomb
114120
files. For an attacker it can reduce the amount of transmitted data by three
115121
magnitudes or more.
116122

123+
large tokens
124+
Expat needs to re-parse unfinished tokens; without the protection
125+
introduced in Expat 2.6.0, this can lead to quadratic runtime that can
126+
be used to cause denial of service in the application parsing XML.
127+
The issue is known as
128+
`CVE-2023-52425 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52425>`_.
129+
117130
The documentation for `defusedxml`_ on PyPI has further information about
118131
all known attack vectors with examples and references.
119132

‎Include/cpython/pyatomic.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -469,6 +469,9 @@ _Py_atomic_load_ptr_acquire(const void *obj);
469469
static inline void
470470
_Py_atomic_store_ptr_release(void *obj, void *value);
471471

472+
static inline void
473+
_Py_atomic_store_ssize_release(Py_ssize_t *obj, Py_ssize_t value);
474+
472475
static inline void
473476
_Py_atomic_store_int_release(int *obj, int value);
474477

@@ -484,6 +487,9 @@ _Py_atomic_load_uint64_acquire(const uint64_t *obj);
484487
static inline uint32_t
485488
_Py_atomic_load_uint32_acquire(const uint32_t *obj);
486489

490+
static inline Py_ssize_t
491+
_Py_atomic_load_ssize_acquire(const Py_ssize_t *obj);
492+
487493

488494
// --- _Py_atomic_fence ------------------------------------------------------
489495

‎Include/cpython/pyatomic_gcc.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -500,6 +500,10 @@ static inline void
500500
_Py_atomic_store_int_release(int *obj, int value)
501501
{ __atomic_store_n(obj, value, __ATOMIC_RELEASE); }
502502

503+
static inline void
504+
_Py_atomic_store_ssize_release(Py_ssize_t *obj, Py_ssize_t value)
505+
{ __atomic_store_n(obj, value, __ATOMIC_RELEASE); }
506+
503507
static inline int
504508
_Py_atomic_load_int_acquire(const int *obj)
505509
{ return __atomic_load_n(obj, __ATOMIC_ACQUIRE); }
@@ -516,6 +520,10 @@ static inline uint32_t
516520
_Py_atomic_load_uint32_acquire(const uint32_t *obj)
517521
{ return __atomic_load_n(obj, __ATOMIC_ACQUIRE); }
518522

523+
static inline Py_ssize_t
524+
_Py_atomic_load_ssize_acquire(const Py_ssize_t *obj)
525+
{ return __atomic_load_n(obj, __ATOMIC_ACQUIRE); }
526+
519527
// --- _Py_atomic_fence ------------------------------------------------------
520528

521529
static inline void

‎Include/cpython/pyatomic_msc.h

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -939,6 +939,18 @@ _Py_atomic_store_int_release(int *obj, int value)
939939
#endif
940940
}
941941

942+
static inline void
943+
_Py_atomic_store_ssize_release(Py_ssize_t *obj, Py_ssize_t value)
944+
{
945+
#if defined(_M_X64) || defined(_M_IX86)
946+
*(Py_ssize_t volatile *)obj = value;
947+
#elif defined(_M_ARM64)
948+
__stlr64((unsigned __int64 volatile *)obj, (unsigned __int64)value);
949+
#else
950+
# error "no implementation of _Py_atomic_store_ssize_release"
951+
#endif
952+
}
953+
942954
static inline int
943955
_Py_atomic_load_int_acquire(const int *obj)
944956
{
@@ -990,6 +1002,18 @@ _Py_atomic_load_uint32_acquire(const uint32_t *obj)
9901002
#endif
9911003
}
9921004

1005+
static inline Py_ssize_t
1006+
_Py_atomic_load_ssize_acquire(const Py_ssize_t *obj)
1007+
{
1008+
#if defined(_M_X64) || defined(_M_IX86)
1009+
return *(Py_ssize_t volatile *)obj;
1010+
#elif defined(_M_ARM64)
1011+
return (Py_ssize_t)__ldar64((unsigned __int64 volatile *)obj);
1012+
#else
1013+
# error "no implementation of _Py_atomic_load_ssize_acquire"
1014+
#endif
1015+
}
1016+
9931017
// --- _Py_atomic_fence ------------------------------------------------------
9941018

9951019
static inline void

‎Include/cpython/pyatomic_std.h

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -879,6 +879,14 @@ _Py_atomic_store_int_release(int *obj, int value)
879879
memory_order_release);
880880
}
881881

882+
static inline void
883+
_Py_atomic_store_ssize_release(Py_ssize_t *obj, Py_ssize_t value)
884+
{
885+
_Py_USING_STD;
886+
atomic_store_explicit((_Atomic(Py_ssize_t)*)obj, value,
887+
memory_order_release);
888+
}
889+
882890
static inline int
883891
_Py_atomic_load_int_acquire(const int *obj)
884892
{
@@ -908,7 +916,13 @@ _Py_atomic_load_uint32_acquire(const uint32_t *obj)
908916
{
909917
_Py_USING_STD;
910918
return atomic_load_explicit((const _Atomic(uint32_t)*)obj,
911-
memory_order_acquire);
919+
}
920+
921+
static inline Py_ssize_t
922+
_Py_atomic_load_ssize_acquire(const Py_ssize_t *obj)
923+
{
924+
_Py_USING_STD;
925+
return atomic_load_explicit((const _Atomic(Py_ssize_t)*)obj,
912926
}
913927

914928

‎Include/internal/pycore_dict.h

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,11 @@ struct _dictkeysobject {
136136
/* Kind of keys */
137137
uint8_t dk_kind;
138138

139+
#ifdef Py_GIL_DISABLED
140+
/* Lock used to protect shared keys */
141+
PyMutex dk_mutex;
142+
#endif
143+
139144
/* Version number -- Reset to 0 by any modification to keys */
140145
uint32_t dk_version;
141146

@@ -145,6 +150,7 @@ struct _dictkeysobject {
145150
/* Number of used entries in dk_entries. */
146151
Py_ssize_t dk_nentries;
147152

153+
148154
/* Actual hash table of dk_size entries. It holds indices in dk_entries,
149155
or DKIX_EMPTY(-1) or DKIX_DUMMY(-2).
150156
@@ -205,6 +211,8 @@ static inline PyDictUnicodeEntry* DK_UNICODE_ENTRIES(PyDictKeysObject *dk) {
205211
#define DICT_WATCHER_MASK ((1 << DICT_MAX_WATCHERS) - 1)
206212
#define DICT_WATCHER_AND_MODIFICATION_MASK ((1 << (DICT_MAX_WATCHERS + DICT_WATCHED_MUTATION_BITS)) - 1)
207213

214+
#define DICT_VALUES_SIZE(values) ((uint8_t *)values)[-1]
215+
208216
#ifdef Py_GIL_DISABLED
209217
#define DICT_NEXT_VERSION(INTERP) \
210218
(_Py_atomic_add_uint64(&(INTERP)->dict_state.global_version, DICT_VERSION_INCREMENT) + DICT_VERSION_INCREMENT)
@@ -250,7 +258,7 @@ _PyDictValues_AddToInsertionOrder(PyDictValues *values, Py_ssize_t ix)
250258
assert(ix < SHARED_KEYS_MAX_SIZE);
251259
uint8_t *size_ptr = ((uint8_t *)values)-2;
252260
int size = *size_ptr;
253-
assert(size+2 < ((uint8_t *)values)[-1]);
261+
assert(size+2 < DICT_VALUES_SIZE(values));
254262
size++;
255263
size_ptr[-size] = (uint8_t)ix;
256264
*size_ptr = size;

‎Include/internal/pycore_import.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ extern "C" {
1111

1212
#include "pycore_lock.h" // PyMutex
1313
#include "pycore_hashtable.h" // _Py_hashtable_t
14-
#include "pycore_time.h" // PyTime_t
1514

1615
extern int _PyImport_IsInitialized(PyInterpreterState *);
1716

‎Include/internal/pycore_interp.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -231,6 +231,7 @@ struct _is {
231231

232232
struct _Py_dict_state dict_state;
233233
struct _Py_exc_state exc_state;
234+
struct _Py_mem_interp_free_queue mem_free_queue;
234235

235236
struct ast_state ast;
236237
struct types_state types;

0 commit comments

Comments
 (0)