From d3dd83794717ad183a9de1cd9bff7940e6b024f4 Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Sat, 14 Mar 2026 17:35:27 +0000 Subject: [PATCH 1/7] Fix crash in `conv_content_model` function in `pyexpat` --- Lib/test/test_pyexpat.py | 14 ++++++++++++++ .../2026-03-14-17-31-39.gh-issue-111111.ifSSr8.rst | 3 +++ Modules/pyexpat.c | 8 +++++++- 3 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 Misc/NEWS.d/next/Library/2026-03-14-17-31-39.gh-issue-111111.ifSSr8.rst diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py index 31bcee293b2b69..50cddd4439b683 100644 --- a/Lib/test/test_pyexpat.py +++ b/Lib/test/test_pyexpat.py @@ -701,6 +701,20 @@ def test_trigger_leak(self): parser.ElementDeclHandler = lambda _1, _2: None self.assertRaises(TypeError, parser.Parse, data, True) + def test_deeply_nested_content_model(self): + data = ('\n]>\n\n').encode('UTF-8') + + parser = expat.ParserCreate() + parser.ElementDeclHandler = lambda _1, _2: None + # This shouldn't crash: + try: + parser.ParseFile(BytesIO(data)) + except RecursionError: + pass + class MalformedInputTest(unittest.TestCase): def test1(self): xml = b"\0\r\n" diff --git a/Misc/NEWS.d/next/Library/2026-03-14-17-31-39.gh-issue-111111.ifSSr8.rst b/Misc/NEWS.d/next/Library/2026-03-14-17-31-39.gh-issue-111111.ifSSr8.rst new file mode 100644 index 00000000000000..62f3aff3fcb88c --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-03-14-17-31-39.gh-issue-111111.ifSSr8.rst @@ -0,0 +1,3 @@ +:mod:`xml.parsers.expat`: Fixed a crash caused by unbounded C recursion when +converting deeply nested XML content models with +:meth:`~xml.parsers.expat.xmlparser.ElementDeclHandler`. diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c index e9255038eee5b5..252554e4253113 100644 --- a/Modules/pyexpat.c +++ b/Modules/pyexpat.c @@ -607,6 +607,10 @@ static PyObject * conv_content_model(XML_Content * const model, PyObject *(*conv_string)(void *)) { + if (Py_EnterRecursiveCall(" in conv_content_model")) { + return NULL; + } + PyObject *result = NULL; PyObject *children = PyTuple_New(model->numchildren); int i; @@ -618,7 +622,7 @@ conv_content_model(XML_Content * const model, conv_string); if (child == NULL) { Py_XDECREF(children); - return NULL; + goto done; } PyTuple_SET_ITEM(children, i, child); } @@ -626,6 +630,8 @@ conv_content_model(XML_Content * const model, model->type, model->quant, conv_string, model->name, children); } +done: + Py_LeaveRecursiveCall(); return result; } From adb61a28cd52fa5c4e5ec2bae4a6fbf41cacfcb2 Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Sat, 14 Mar 2026 18:05:24 +0000 Subject: [PATCH 2/7] Update test --- Lib/test/test_pyexpat.py | 15 ++++++++------- Modules/pyexpat.c | 5 +++-- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py index 50cddd4439b683..44dbdedc54399b 100644 --- a/Lib/test/test_pyexpat.py +++ b/Lib/test/test_pyexpat.py @@ -701,19 +701,20 @@ def test_trigger_leak(self): parser.ElementDeclHandler = lambda _1, _2: None self.assertRaises(TypeError, parser.Parse, data, True) + @support.skip_if_unlimited_stack_size + @support.skip_emscripten_stack_overflow() + @support.skip_wasi_stack_overflow() def test_deeply_nested_content_model(self): data = ('\n]>\n\n').encode('UTF-8') parser = expat.ParserCreate() parser.ElementDeclHandler = lambda _1, _2: None - # This shouldn't crash: - try: - parser.ParseFile(BytesIO(data)) - except RecursionError: - pass + with self.assertRaises(RecursionError): + with support.infinite_recursion(): + parser.ParseFile(BytesIO(data)) class MalformedInputTest(unittest.TestCase): def test1(self): diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c index 252554e4253113..cadc6706243524 100644 --- a/Modules/pyexpat.c +++ b/Modules/pyexpat.c @@ -3,6 +3,7 @@ #endif #include "Python.h" +#include "pycore_ceval.h" // _Py_EnterRecursiveCall() #include "pycore_import.h" // _PyImport_SetModule() #include "pycore_pyhash.h" // _Py_HashSecret #include "pycore_traceback.h" // _PyTraceback_Add() @@ -607,7 +608,7 @@ static PyObject * conv_content_model(XML_Content * const model, PyObject *(*conv_string)(void *)) { - if (Py_EnterRecursiveCall(" in conv_content_model")) { + if (_Py_EnterRecursiveCall(" in conv_content_model")) { return NULL; } @@ -631,7 +632,7 @@ conv_content_model(XML_Content * const model, conv_string, model->name, children); } done: - Py_LeaveRecursiveCall(); + _Py_LeaveRecursiveCall(); return result; } From c3837afcefc8bdbf6ddcaacfe6a6baab39a199ab Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Sun, 15 Mar 2026 16:43:54 +0000 Subject: [PATCH 3/7] Simplify test --- Lib/test/test_pyexpat.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py index 44dbdedc54399b..6ae79d580d67a2 100644 --- a/Lib/test/test_pyexpat.py +++ b/Lib/test/test_pyexpat.py @@ -705,16 +705,16 @@ def test_trigger_leak(self): @support.skip_emscripten_stack_overflow() @support.skip_wasi_stack_overflow() def test_deeply_nested_content_model(self): - data = ('\n]>\n\n').encode('UTF-8') + data = (b'\n]>\n\n') parser = expat.ParserCreate() parser.ElementDeclHandler = lambda _1, _2: None - with self.assertRaises(RecursionError): - with support.infinite_recursion(): - parser.ParseFile(BytesIO(data)) + with support.infinite_recursion(): + with self.assertRaises(RecursionError): + parser.Parse(data) class MalformedInputTest(unittest.TestCase): def test1(self): From 2d3bdd0df105a8304ecf1305fd1aee684e13670e Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Sun, 15 Mar 2026 16:46:03 +0000 Subject: [PATCH 4/7] Simplify test a lil' more --- Lib/test/test_pyexpat.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py index 6ae79d580d67a2..73134de2adc948 100644 --- a/Lib/test/test_pyexpat.py +++ b/Lib/test/test_pyexpat.py @@ -705,9 +705,11 @@ def test_trigger_leak(self): @support.skip_emscripten_stack_overflow() @support.skip_wasi_stack_overflow() def test_deeply_nested_content_model(self): + # This should raise a RecursionError and not crash. + # See https://github.com/python/cpython/issues/ + N = 500_000 data = (b'\n]>\n\n') parser = expat.ParserCreate() From 1481875bc2e7e3bf7dc4df2fcd28e44de70c00aa Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Sun, 15 Mar 2026 19:36:55 +0000 Subject: [PATCH 5/7] Add issue number --- Lib/test/test_pyexpat.py | 8 +++++--- .../2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst} | 1 + 2 files changed, 6 insertions(+), 3 deletions(-) rename Misc/NEWS.d/next/{Library/2026-03-14-17-31-39.gh-issue-111111.ifSSr8.rst => Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst} (84%) diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py index 73134de2adc948..577ba9b528d40e 100644 --- a/Lib/test/test_pyexpat.py +++ b/Lib/test/test_pyexpat.py @@ -706,11 +706,13 @@ def test_trigger_leak(self): @support.skip_wasi_stack_overflow() def test_deeply_nested_content_model(self): # This should raise a RecursionError and not crash. - # See https://github.com/python/cpython/issues/ + # See https://github.com/python/cpython/issues/145986 N = 500_000 - data = (b'\n]>\n\n') + + b'>\n]>\n\n' + ) parser = expat.ParserCreate() parser.ElementDeclHandler = lambda _1, _2: None diff --git a/Misc/NEWS.d/next/Library/2026-03-14-17-31-39.gh-issue-111111.ifSSr8.rst b/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst similarity index 84% rename from Misc/NEWS.d/next/Library/2026-03-14-17-31-39.gh-issue-111111.ifSSr8.rst rename to Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst index 62f3aff3fcb88c..79536d1fef543f 100644 --- a/Misc/NEWS.d/next/Library/2026-03-14-17-31-39.gh-issue-111111.ifSSr8.rst +++ b/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst @@ -1,3 +1,4 @@ :mod:`xml.parsers.expat`: Fixed a crash caused by unbounded C recursion when converting deeply nested XML content models with :meth:`~xml.parsers.expat.xmlparser.ElementDeclHandler`. +This addresses :cve:`2026-4224`. From e62a670ccb9007bf42a9d0298c58d6d24970630b Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Sun, 15 Mar 2026 19:41:55 +0000 Subject: [PATCH 6/7] =?UTF-8?q?B=C3=A9n=C3=A9dikt's=20review?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com> --- Lib/test/test_pyexpat.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py index 577ba9b528d40e..d059ea1210510a 100644 --- a/Lib/test/test_pyexpat.py +++ b/Lib/test/test_pyexpat.py @@ -706,12 +706,12 @@ def test_trigger_leak(self): @support.skip_wasi_stack_overflow() def test_deeply_nested_content_model(self): # This should raise a RecursionError and not crash. - # See https://github.com/python/cpython/issues/145986 + # See https://github.com/python/cpython/issues/145986. N = 500_000 data = ( b'\n]>\n\n' + + b'(a, ' * N + b'a' + b')' * N + + b'>\n]>\n\n' ) parser = expat.ParserCreate() From 16d5b10f169d80a8f1ea30331d0ed83b6a48ba4f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?= <10796600+picnixz@users.noreply.github.com> Date: Sun, 15 Mar 2026 20:47:15 +0100 Subject: [PATCH 7/7] Update Lib/test/test_pyexpat.py --- Lib/test/test_pyexpat.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py index d059ea1210510a..f8afc16d3cb4cb 100644 --- a/Lib/test/test_pyexpat.py +++ b/Lib/test/test_pyexpat.py @@ -709,9 +709,9 @@ def test_deeply_nested_content_model(self): # See https://github.com/python/cpython/issues/145986. N = 500_000 data = ( - b'\n]>\n\n' + b'\n]>\n\n' ) parser = expat.ParserCreate()