Skip to content

gh-146056: Fix TreeBuilder stack in xml.etree#146062

Closed
vstinner wants to merge 1 commit intopython:mainfrom
vstinner:fix_etree_stack
Closed

gh-146056: Fix TreeBuilder stack in xml.etree#146062
vstinner wants to merge 1 commit intopython:mainfrom
vstinner:fix_etree_stack

Conversation

@vstinner
Copy link
Member

@vstinner vstinner commented Mar 17, 2026

No longer create a stack of 20 items, but create an empty stack instead. It prevents crashes when the stack list is discovered by gc.get_referrers() or other functions.

Fix also reference counting in treebuilder_handle_end().

No longer create a stack of 20 items, but create an empty stack
instead. It prevents crashes when the stack list is discovered by
gc.get_referrers() or other functions.

Fix also reference counting in treebuilder_handle_end().
@vstinner
Copy link
Member Author

I added "skip news" since this issue requires calling gc.get_referrers() which is used in "regular code".

item = self->last;
self->last = Py_NewRef(self->this);
Py_XSETREF(self->last_for_tail, self->last);
Py_XSETREF(self->last_for_tail, Py_NewRef(self->last));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is unrelated.

If rewrite this code to be more explicit or safe, I would write something like

    PyObject *last = self->last;
    PyObject *last_for_tail = self->last_for_tail;
    PyObject *this = self->this;
    self->index--;
    self->this = Py_NewRef(PyList_GET_ITEM(self->stack, self->index));
    self->last = Py_NewRef(this);
    self->last_for_tail = Py_NewRef(this);
    Py_DECREF(last);
    Py_XDECREF(last_for_tail);

    if (treebuilder_append_event(self, self->end_event_obj, this) < 0) {
        Py_DECREF(this);
        return NULL;
    }

    return this;

But we should also look a the other ends -- how these attributes are set in other code in this file. This is a separate issue.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wrote #146167 which uses your suggestion.

t->comment_factory = NULL;
t->pi_factory = NULL;
t->stack = PyList_New(20);
t->stack = PyList_New(0);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can have performance impact.

@vstinner
Copy link
Member Author

I abandon my change since a more generic change was merged: #146129.

@vstinner vstinner closed this Mar 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants