delta/cpython-git.git/Modules, branch backport-24bcefc-3.6 github.com: python/cpython.git [3.6] closes bpo-38174: Update vendored expat library to 2.2.8. (GH-16410) 2019-09-26T05:00:26+00:00 Benjamin Peterson benjamin@python.org 2019-09-26T05:00:26+00:00 f0501630b0ba31448c230c756b1027647f4ef100 Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.. (cherry picked from commit 52b940803860e37bcc3f6096b2d24e7c20a0e807) 
Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes..
(cherry picked from commit 52b940803860e37bcc3f6096b2d24e7c20a0e807)
 Put pyexpatns.h include back. bpo-37437 (GH-14542) 2019-07-02T05:48:16+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2019-07-02T05:48:16+00:00 29d6905826d4417426e70f6209ca5e0db7921685 (cherry picked from commit 2cd07920bb7d2d319999394092190f37935dc421) Co-authored-by: Benjamin Peterson <benjamin@python.org> 
(cherry picked from commit 2cd07920bb7d2d319999394092190f37935dc421)

Co-authored-by: Benjamin Peterson <benjamin@python.org>
 closes bpo-37437: Update vendorized expat to 2.2.7. (GH-14436) 2019-06-28T04:16:48+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2019-06-28T04:16:48+00:00 6632906c08e1d4de0fceba42c47886be41b7ba3d (cherry picked from commit 3b03b09fc94425915c5b1225e9200a3a95bc827b) Co-authored-by: Benjamin Peterson <benjamin@python.org> 
(cherry picked from commit 3b03b09fc94425915c5b1225e9200a3a95bc827b)

Co-authored-by: Benjamin Peterson <benjamin@python.org>
 bpo-35746: Fix segfault in ssl's cert parser (GH-11569) (GH-11573) 2019-01-16T01:16:36+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2019-01-16T01:16:36+00:00 216a4d83c3b72f4fdcd81b588dc3f42cc461739a Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL distribution points with empty DP or URI correctly. A malicious or buggy certificate can result into segfault. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue35746 (cherry picked from commit a37f52436f9aa4b9292878b72f3ff1480e2606c3) Co-authored-by: Christian Heimes <christian@python.org> 
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue35746
(cherry picked from commit a37f52436f9aa4b9292878b72f3ff1480e2606c3)

Co-authored-by: Christian Heimes <christian@python.org>
 closes bpo-35643: Fix a SyntaxWarning: invalid escape sequence in Modules/_sha3/cleanup.py (GH-11413) 2019-01-07T07:25:06+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2019-01-07T07:25:06+00:00 3e0144a6c95433f347bb7e44a98c84deae8853ff (cherry picked from commit d466c43e55cd32af84e353f0e9a48b09b7534f61) Co-authored-by: Mickaël Schoentgen <contact@tiger-222.fr> 
(cherry picked from commit d466c43e55cd32af84e353f0e9a48b09b7534f61)

Co-authored-by: Mickaël Schoentgen <contact@tiger-222.fr>
 bpo-35444: Fix error handling when fail to look up builtin "getattr". (GH-11047) (GH-11107) (GH-11108) 2018-12-11T10:13:14+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2018-12-11T10:13:14+00:00 be6ec444729f727f304ae10f3a7e2feda3cc3aaa (cherry picked from commit bb86bf4c4eaa30b1f5192dab9f389ce0bb61114d) (cherry picked from commit 3cae16d2e98ffaa89ddd311df70a857dfaff4020) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com> 
(cherry picked from commit bb86bf4c4eaa30b1f5192dab9f389ce0bb61114d)
(cherry picked from commit 3cae16d2e98ffaa89ddd311df70a857dfaff4020)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
 [3.6] bpo-35454: Fix miscellaneous minor issues in error handling. (GH-11077) (GH-11106) 2018-12-11T07:27:50+00:00 Serhiy Storchaka storchaka@gmail.com 2018-12-11T07:27:50+00:00 8855d9339858683c9b4fcd50b02a7bca526d4726 (cherry picked from commit 8905fcc85a6fc3ac394bc89b0bbf40897e9497a6) 
(cherry picked from commit 8905fcc85a6fc3ac394bc89b0bbf40897e9497a6)
bpo-31374: expat doesn't include <pyconfig.h> on Windows (GH-11079) 2018-12-10T15:41:11+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2018-12-10T15:41:11+00:00 3acf30de90936fe3714bb62873e2523c0440e652 (cherry picked from commit b6ef6f69a9afc979640a5f9883f799de1364bff7) Co-authored-by: Victor Stinner <vstinner@redhat.com> 
(cherry picked from commit b6ef6f69a9afc979640a5f9883f799de1364bff7)

Co-authored-by: Victor Stinner <vstinner@redhat.com>
 bpo-31374: Include pyconfig.h earlier in expat (GH-11064) 2018-12-10T11:35:18+00:00 Miss Islington (bot) 31488909+miss-islington@users.noreply.github.com 2018-12-10T11:35:18+00:00 7215e4857123afa8577f63c1024bcd1889a96305 Include <pyconfig.h> ealier in Modules/expat/xmltok.c to define properly _POSIX_C_SOURCE. Python defines _POSIX_C_SOURCE as 200809L, whereas <features.h> (included indirectly by <string.h>) defines _POSIX_C_SOURCE as 199506L. (cherry picked from commit cf247359d5b7082044eea1fa94b5211a172b1ff6) Co-authored-by: Victor Stinner <vstinner@redhat.com> 
Include <pyconfig.h> ealier in Modules/expat/xmltok.c to define
properly _POSIX_C_SOURCE. Python defines _POSIX_C_SOURCE as 200809L,
whereas <features.h> (included indirectly by <string.h>) defines
_POSIX_C_SOURCE as 199506L.
(cherry picked from commit cf247359d5b7082044eea1fa94b5211a172b1ff6)

Co-authored-by: Victor Stinner <vstinner@redhat.com>
 bpo-35050: AF_ALG length check off-by-one error (GH-10058) (GH-11070) 2018-12-10T11:12:47+00:00 Victor Stinner vstinner@redhat.com 2018-12-10T11:12:47+00:00 bad41cefef6625807198a813d9dec2c08d59dc60 The length check for AF_ALG salg_name and salg_type had a off-by-one error. The code assumed that both values are not necessarily NULL terminated. However the Kernel code for alg_bind() ensures that the last byte of both strings are NULL terminated. Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit 2eb6ad8578fa9d764c21a92acd8e054e3202ad19) 
The length check for AF_ALG salg_name and salg_type had a off-by-one
error. The code assumed that both values are not necessarily NULL
terminated. However the Kernel code for alg_bind() ensures that the last
byte of both strings are NULL terminated.

Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 2eb6ad8578fa9d764c21a92acd8e054e3202ad19)