python-interpreters/python312
SHA256
6
0
Fork 0
forked from pool/python312
Code Pull Requests Activity

Fix the patch

Browse Source 
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:Factory/python312?expand=0&rev=141
This commit is contained in:
Matej Cepl
2025-05-27 15:09:51 +00:00
committed by Git OBS Bridge
parent 7dd198cfe7
commit f28c965458
1 changed files with 14 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
CVE-2025-4516-DecodeError-handler.patch
View File

@@ -20,13 +20,13 @@ Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
--- ---
Include/cpython/bytesobject.h | 4 Include/cpython/bytesobject.h | 4
Include/cpython/unicodeobject.h | 13 ++ Include/cpython/unicodeobject.h | 13 ++
Lib/test/test_codeccallbacks.py | 39 ++++++ Lib/test/test_codeccallbacks.py | 41 ++++++
Lib/test/test_codecs.py | 52 ++++++-- Lib/test/test_codecs.py | 52 ++++++--
Misc/NEWS.d/next/Security/2025-05-09-20-22-54.gh-issue-133767.kN2i3Q.rst | 2 Misc/NEWS.d/next/Security/2025-05-09-20-22-54.gh-issue-133767.kN2i3Q.rst | 2
Objects/bytesobject.c | 54 +++++--- Objects/bytesobject.c | 54 +++++---
Objects/unicodeobject.c | 61 +++++++--- Objects/unicodeobject.c | 61 +++++++---
Parser/string_parser.c | 26 ++-- Parser/string_parser.c | 26 ++--
8 files changed, 194 insertions(+), 57 deletions(-) 8 files changed, 196 insertions(+), 57 deletions(-)
create mode 100644 Misc/NEWS.d/next/Security/2025-05-09-20-22-54.gh-issue-133767.kN2i3Q.rst create mode 100644 Misc/NEWS.d/next/Security/2025-05-09-20-22-54.gh-issue-133767.kN2i3Q.rst
Index: Python-3.12.10/Include/cpython/bytesobject.h Index: Python-3.12.10/Include/cpython/bytesobject.h
@@ -71,7 +71,7 @@ Index: Python-3.12.10/Include/cpython/unicodeobject.h
Index: Python-3.12.10/Lib/test/test_codeccallbacks.py Index: Python-3.12.10/Lib/test/test_codeccallbacks.py
=================================================================== ===================================================================
--- Python-3.12.10.orig/Lib/test/test_codeccallbacks.py 2025-05-27 16:35:57.334719437 +0200 --- Python-3.12.10.orig/Lib/test/test_codeccallbacks.py 2025-05-27 16:35:57.334719437 +0200
+++ Python-3.12.10/Lib/test/test_codeccallbacks.py 2025-05-27 16:37:19.987527413 +0200 +++ Python-3.12.10/Lib/test/test_codeccallbacks.py 2025-05-27 17:09:28.010622211 +0200
@@ -1,6 +1,7 @@ @@ -1,6 +1,7 @@
import codecs import codecs
import html.entities import html.entities
@@ -89,7 +89,7 @@ Index: Python-3.12.10/Lib/test/test_codeccallbacks.py
baddata = [ baddata = [
("ascii", b"\xff"), ("ascii", b"\xff"),
("utf-7", b"++"), ("utf-7", b"++"),
@@ -1159,6 +1160,42 @@ @@ -1159,6 +1160,44 @@
for (encoding, data) in baddata: for (encoding, data) in baddata:
self.assertEqual(data.decode(encoding, "test.mutating"), "\u4242") self.assertEqual(data.decode(encoding, "test.mutating"), "\u4242")
@@ -114,15 +114,17 @@ Index: Python-3.12.10/Lib/test/test_codeccallbacks.py
+ self.assertEqual(decode(input, 'test.mutating2'), (expected, len(input))) + self.assertEqual(decode(input, 'test.mutating2'), (expected, len(input)))
+ self.assertIn(msg, str(cm.warning)) + self.assertIn(msg, str(cm.warning))
+ +
+ check(br'\x0n\z', '\u0404\n\\z', r"invalid escape sequence '\\\\z'") + # The warning message for invalid escape sequences seems to have an extra layer of backslash escaping.
+ # It's likely due to how PyErr_WarnFormat handles the character after the initial backslash.
+ # '\\\\z' in the regex will match '\\z' in the actual string.
+ check(br'\x0n\z', '\u0404\n\\z', r"invalid escape sequence '\\\\\\\\z'")
+ check(br'\x0n\501', '\u0404\n\u0141', r"invalid octal escape sequence '\\501'") + check(br'\x0n\501', '\u0404\n\u0141', r"invalid octal escape sequence '\\501'")
+ check(br'\x0z', '\u0404\\z', r"invalid escape sequence '\\\\z'") + check(br'\x0z', '\u0404\\z', r"invalid escape sequence '\\\\\\\\z'")
+ + check(br'\x3n\zr', '\u0404\n\\zr', r"invalid escape sequence '\\\\\\\\z'")
+ check(br'\x3n\zr', '\u0404\n\\zr', r"invalid escape sequence '\\\\z'") + check(br'\x3zr', '\u0404\\zr', r"invalid escape sequence '\\\\\\\\z'")
+ check(br'\x3zr', '\u0404\\zr', r"invalid escape sequence '\\\\z'") + check(br'\x3z5', '\u0404\\z5', r"invalid escape sequence '\\\\\\\\z'")
+ check(br'\x3z5', '\u0404\\z5', r"invalid escape sequence '\\\\z'") + check(memoryview(br'\x3z5x')[:-1], '\u0404\\z5', r"invalid escape sequence '\\\\\\\\z'")
+ check(memoryview(br'\x3z5x')[:-1], '\u0404\\z5', r"invalid escape sequence '\\\\z'") + check(memoryview(br'\x3z5xy')[:-2], '\u0404\\z5', r"invalid escape sequence '\\\\\\\\z'")
+ check(memoryview(br'\x3z5xy')[:-2], '\u0404\\z5', r"invalid escape sequence '\\\\z'")
+ +
+ check(br'\x5n\z', '\u0404\n\\z', r"invalid escape sequence '\z'") + check(br'\x5n\z', '\u0404\n\\z', r"invalid escape sequence '\z'")
+ check(br'\x5n\501', '\u0404\n\u0141', r"invalid octal escape sequence '\501'") + check(br'\x5n\501', '\u0404\n\u0141', r"invalid octal escape sequence '\501'")