FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-148735: Fix a UAF in `Element.findtext()` by StanFromIreland · Pull Request #148738 · python/cpython · GitHub

/ cpython Public

gh-148735: Fix a UAF in Element.findtext() - #148738

Merged
StanFromIreland merged 3 commits into
python:mainfrom
StanFromIreland:findall
Apr 23, 2026
ConversationCommits (3)ChecksFiles changed
Merged

gh-148735: Fix a UAF in Element.findtext()#148738
StanFromIreland merged 3 commits into
python:mainfrom
StanFromIreland:findall

Conversation

StanFromIreland commented Apr 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

This was a regression introduced by c57623c.

cpython/Modules/_elementtree.c

Line 575 in ae55e9c

/* return borrowed reference to text attribute */

Fix a UAF in
ae55e9c 
`Element.findtext()`
StanFromIreland requested a review from picnixz April 18, 2026 20:41
bedevere-app Bot mentioned this pull request Apr 18, 2026
Closed
picnixz reviewed Apr 19, 2026
View reviewed changes
Comment thread Modules/_elementtree.c Outdated
picnixz reviewed Apr 22, 2026
View reviewed changes

picnixz left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

All the occurrences you change are of the form (get borrowed) followed by (incref) right? if so, it is ok to change it to (get strong ref) but otherwise we may have un-necessary incref/decref. Currently XML is not FT-safe but if we (I) want to make it so, we should avoid incref/decref in hot paths

Comment thread Misc/NEWS.d/next/Library/2026-04-18-21-39-15.gh-issue-148735.siw6DG.rst Outdated

serhiy-storchaka commented Apr 22, 2026

Copy link
Copy Markdown
Member

but otherwise we may have un-necessary incref/decref

The number of incerfs/decrefs remains the same. They are not unnecessary.

picnixz commented Apr 22, 2026

Copy link
Copy Markdown
Member

Yeah I was not sure about this as I am on mobile. Thanks for checking

serhiy-storchaka approved these changes Apr 22, 2026
View reviewed changes

serhiy-storchaka left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

LGTM. 👍

serhiy-storchaka added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 22, 2026
StanFromIreland merged commit 0469e6d into python:main Apr 23, 2026
102 of 108 checks passed
StanFromIreland deleted the findall branch April 23, 2026 14:48

miss-islington-app Bot commented Apr 23, 2026

Copy link
Copy Markdown

Thanks @StanFromIreland for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

miss-islington-app Bot commented Apr 23, 2026

Copy link
Copy Markdown

Sorry, @StanFromIreland, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 0469e6d38dcb3ff904690028cb3a25155bdcedae 3.13

bedevere-app Bot commented Apr 23, 2026

Copy link
Copy Markdown

GH-148916 is a backport of this pull request to the 3.14 branch.

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Apr 23, 2026

StanFromIreland commented Apr 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Thanks for the reviews!

bedevere-app Bot commented Apr 23, 2026

Copy link
Copy Markdown

GH-148923 is a backport of this pull request to the 3.13 branch.

bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Apr 23, 2026
StanFromIreland added a commit that referenced this pull request Apr 24, 2026
[3.14] gh-148735: Fix a UAF in Element.findtext() (GH-148738) (#148916
89f44ac 
)

(cherry picked from commit 0469e6d)

Co-authored-by: Stan Ulbrych <stan@python.org>
StanFromIreland added a commit that referenced this pull request Apr 25, 2026
[3.13] gh-148735: Fix a UAF in Element.findtext() (GH-148738) (#148923
feafd5f 
)

(cherry picked from commit 0469e6d)
ljfp pushed a commit to ljfp/cpython that referenced this pull request Apr 25, 2026
pythongh-148735: Fix a UAF in Element.findtext() (python#148738)
3c4d92e
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

serhiy-storchaka serhiy-storchaka approved these changes
vstinner Awaiting requested review from vstinner
picnixz Awaiting requested review from picnixz

Assignees

StanFromIreland

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL