pool/python312
SHA256
11
0
Fork 1
Code Issues Pull Requests Activity

Fix patch

Browse Source 
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=140
This commit is contained in:
Matej Cepl
2025-05-27 14:38:51 +00:00
committed by Git OBS Bridge
parent 36a106a0a7
commit 37c1d3d2e3
1 changed files with 17 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
CVE-2025-4516-DecodeError-handler.patch
View File

@@ -32,7 +32,7 @@ Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Index: Python-3.12.10/Include/cpython/bytesobject.h
===================================================================
--- Python-3.12.10.orig/Include/cpython/bytesobject.h 2025-04-08 13:35:47.000000000 +0200
+++ Python-3.12.10/Include/cpython/bytesobject.h 2025-05-22 14:38:07.205729906 +0200
+++ Python-3.12.10/Include/cpython/bytesobject.h 2025-05-27 16:36:01.607634555 +0200
@@ -25,6 +25,10 @@
int use_bytearray);
@@ -47,7 +47,7 @@ Index: Python-3.12.10/Include/cpython/bytesobject.h
Index: Python-3.12.10/Include/cpython/unicodeobject.h
===================================================================
--- Python-3.12.10.orig/Include/cpython/unicodeobject.h 2025-04-08 13:35:47.000000000 +0200
+++ Python-3.12.10/Include/cpython/unicodeobject.h 2025-05-22 14:38:07.205905378 +0200
+++ Python-3.12.10/Include/cpython/unicodeobject.h 2025-05-27 16:36:01.608024960 +0200
@@ -684,6 +684,19 @@
);
/* Helper for PyUnicode_DecodeUnicodeEscape that detects invalid escape
@@ -70,8 +70,8 @@ Index: Python-3.12.10/Include/cpython/unicodeobject.h
Py_ssize_t length, /* size of string */
Index: Python-3.12.10/Lib/test/test_codeccallbacks.py
===================================================================
--- Python-3.12.10.orig/Lib/test/test_codeccallbacks.py 2025-05-22 14:37:58.935377659 +0200
+++ Python-3.12.10/Lib/test/test_codeccallbacks.py 2025-05-27 16:10:07.476764666 +0200
--- Python-3.12.10.orig/Lib/test/test_codeccallbacks.py 2025-05-27 16:35:57.334719437 +0200
+++ Python-3.12.10/Lib/test/test_codeccallbacks.py 2025-05-27 16:37:19.987527413 +0200
@@ -1,6 +1,7 @@
import codecs
import html.entities
@@ -114,15 +114,15 @@ Index: Python-3.12.10/Lib/test/test_codeccallbacks.py
+ self.assertEqual(decode(input, 'test.mutating2'), (expected, len(input)))
+ self.assertIn(msg, str(cm.warning))
+
+ check(br'\x0n\z', '\u0404\n\\z', r"invalid escape sequence '\\z'")
+ check(br'\x0n\z', '\u0404\n\\z', r"invalid escape sequence '\\\\z'")
+ check(br'\x0n\501', '\u0404\n\u0141', r"invalid octal escape sequence '\\501'")
+ check(br'\x0z', '\u0404\\z', r"invalid escape sequence '\z'")
+ check(br'\x0z', '\u0404\\z', r"invalid escape sequence '\\\\z'")
+
+ check(br'\x3n\zr', '\u0404\n\\zr', r"invalid escape sequence '\z'")
+ check(br'\x3zr', '\u0404\\zr', r"invalid escape sequence '\z'")
+ check(br'\x3z5', '\u0404\\z5', r"invalid escape sequence '\z'")
+ check(memoryview(br'\x3z5x')[:-1], '\u0404\\z5', r"invalid escape sequence '\z'")
+ check(memoryview(br'\x3z5xy')[:-2], '\u0404\\z5', r"invalid escape sequence '\z'")
+ check(br'\x3n\zr', '\u0404\n\\zr', r"invalid escape sequence '\\\\z'")
+ check(br'\x3zr', '\u0404\\zr', r"invalid escape sequence '\\\\z'")
+ check(br'\x3z5', '\u0404\\z5', r"invalid escape sequence '\\\\z'")
+ check(memoryview(br'\x3z5x')[:-1], '\u0404\\z5', r"invalid escape sequence '\\\\z'")
+ check(memoryview(br'\x3z5xy')[:-2], '\u0404\\z5', r"invalid escape sequence '\\\\z'")
+
+ check(br'\x5n\z', '\u0404\n\\z', r"invalid escape sequence '\z'")
+ check(br'\x5n\501', '\u0404\n\u0141', r"invalid octal escape sequence '\501'")
@@ -134,8 +134,8 @@ Index: Python-3.12.10/Lib/test/test_codeccallbacks.py
# better generating one more character to fill the extra space slot
Index: Python-3.12.10/Lib/test/test_codecs.py
===================================================================
--- Python-3.12.10.orig/Lib/test/test_codecs.py 2025-05-22 14:37:58.952566393 +0200
+++ Python-3.12.10/Lib/test/test_codecs.py 2025-05-22 14:38:07.206633606 +0200
--- Python-3.12.10.orig/Lib/test/test_codecs.py 2025-05-27 16:35:57.358417139 +0200
+++ Python-3.12.10/Lib/test/test_codecs.py 2025-05-27 16:36:01.609174295 +0200
@@ -1196,23 +1196,39 @@
check(br"[\1010]", b"[A0]")
check(br"[\x41]", b"[A]")
@@ -230,14 +230,14 @@ Index: Python-3.12.10/Lib/test/test_codecs.py
Index: Python-3.12.10/Misc/NEWS.d/next/Security/2025-05-09-20-22-54.gh-issue-133767.kN2i3Q.rst
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ Python-3.12.10/Misc/NEWS.d/next/Security/2025-05-09-20-22-54.gh-issue-133767.kN2i3Q.rst 2025-05-22 14:38:07.207057599 +0200
+++ Python-3.12.10/Misc/NEWS.d/next/Security/2025-05-09-20-22-54.gh-issue-133767.kN2i3Q.rst 2025-05-27 16:36:01.609723469 +0200
@@ -0,0 +1,2 @@
+Fix use-after-free in the "unicode-escape" decoder with a non-"strict" error
+handler.
Index: Python-3.12.10/Objects/bytesobject.c
===================================================================
--- Python-3.12.10.orig/Objects/bytesobject.c 2025-04-08 13:35:47.000000000 +0200
+++ Python-3.12.10/Objects/bytesobject.c 2025-05-22 14:38:07.207534041 +0200
+++ Python-3.12.10/Objects/bytesobject.c 2025-05-27 16:36:01.610066425 +0200
@@ -1048,10 +1048,11 @@
}
@@ -348,7 +348,7 @@ Index: Python-3.12.10/Objects/bytesobject.c
Index: Python-3.12.10/Objects/unicodeobject.c
===================================================================
--- Python-3.12.10.orig/Objects/unicodeobject.c 2025-04-08 13:35:47.000000000 +0200
+++ Python-3.12.10/Objects/unicodeobject.c 2025-05-22 14:38:07.209060814 +0200
+++ Python-3.12.10/Objects/unicodeobject.c 2025-05-27 16:36:01.610906297 +0200
@@ -6046,13 +6046,15 @@
/* --- Unicode Escape Codec ----------------------------------------------- */
@@ -470,7 +470,7 @@ Index: Python-3.12.10/Objects/unicodeobject.c
Index: Python-3.12.10/Parser/string_parser.c
===================================================================
--- Python-3.12.10.orig/Parser/string_parser.c 2025-04-08 13:35:47.000000000 +0200
+++ Python-3.12.10/Parser/string_parser.c 2025-05-22 14:38:07.209950694 +0200
+++ Python-3.12.10/Parser/string_parser.c 2025-05-27 16:36:01.611776325 +0200
@@ -181,15 +181,18 @@
len = p - buf;
s = buf;