Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[3.12] gh-111784: Fix two segfaults in the elementtree module (GH-113405) #113446

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Dec 24, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
Fix segfaults in the ``_elementtree`` module.
Fix first segfault during deallocation of ``_elementtree.XMLParser`` instances by keeping strong reference
to ``pyexpat`` module in module state for capsule lifetime.
Fix second segfault which happens in the same deallocation process by keeping strong reference
to ``_elementtree`` module in ``XMLParser`` structure for ``_elementtree`` module lifetime.
16 changes: 14 additions & 2 deletions Modules/_elementtree.c
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,7 @@ typedef struct {
PyTypeObject *TreeBuilder_Type;
PyTypeObject *XMLParser_Type;

PyObject *expat_capsule;
struct PyExpat_CAPI *expat_capi;
} elementtreestate;

Expand Down Expand Up @@ -150,6 +151,7 @@ elementtree_clear(PyObject *m)
Py_CLEAR(st->ElementIter_Type);
Py_CLEAR(st->TreeBuilder_Type);
Py_CLEAR(st->XMLParser_Type);
Py_CLEAR(st->expat_capsule);

st->expat_capi = NULL;
return 0;
Expand All @@ -170,6 +172,7 @@ elementtree_traverse(PyObject *m, visitproc visit, void *arg)
Py_VISIT(st->ElementIter_Type);
Py_VISIT(st->TreeBuilder_Type);
Py_VISIT(st->XMLParser_Type);
Py_VISIT(st->expat_capsule);
return 0;
}

Expand Down Expand Up @@ -3065,6 +3068,7 @@ typedef struct {
PyObject *handle_close;

elementtreestate *state;
PyObject *elementtree_module;
} XMLParserObject;

/* helpers */
Expand Down Expand Up @@ -3611,7 +3615,11 @@ xmlparser_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
self->handle_start = self->handle_data = self->handle_end = NULL;
self->handle_comment = self->handle_pi = self->handle_close = NULL;
self->handle_doctype = NULL;
self->state = get_elementtree_state_by_type(type);
self->elementtree_module = PyType_GetModuleByDef(type, &elementtreemodule);
assert(self->elementtree_module != NULL);
Py_INCREF(self->elementtree_module);
// See gh-111784 for explanation why is reference to module needed here.
self->state = get_elementtree_state(self->elementtree_module);
}
return (PyObject *)self;
}
Expand Down Expand Up @@ -3788,6 +3796,7 @@ xmlparser_gc_clear(XMLParserObject *self)
EXPAT(st, ParserFree)(parser);
}

Py_CLEAR(self->elementtree_module);
Py_CLEAR(self->handle_close);
Py_CLEAR(self->handle_pi);
Py_CLEAR(self->handle_comment);
Expand Down Expand Up @@ -4347,7 +4356,10 @@ module_exec(PyObject *m)
goto error;

/* link against pyexpat */
st->expat_capi = PyCapsule_Import(PyExpat_CAPSULE_NAME, 0);
if (!(st->expat_capsule = _PyImport_GetModuleAttrString("pyexpat", "expat_CAPI")))
goto error;
if (!(st->expat_capi = PyCapsule_GetPointer(st->expat_capsule, PyExpat_CAPSULE_NAME)))
goto error;
if (st->expat_capi) {
/* check that it's usable */
if (strcmp(st->expat_capi->magic, PyExpat_CAPI_MAGIC) != 0 ||
Expand Down