gh-148441: Avoid integer overflow in Expat's CharacterDataHandler by ByteFlowing1337 · Pull Request #148904 · python/cpython

ByteFlowing1337 · 2026-04-23T05:18:11Z

Fix the buffer overflow issue in #148441 , which will cause a core dump.

Issue: Heap Buffer Overflow in pyexpat Character Data Buffering #148441

…dler

…vpCkR.rst Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

ByteFlowing1337 · 2026-04-25T13:29:41Z

Done.

ByteFlowing1337 · 2026-04-25T17:07:00Z

@picnixz Thanks for the review. Please let me know if you have any further suggestions.

picnixz · 2026-04-25T17:08:42Z

The EMScripten tests fail. I suspect that we don't have enough memory on those machines. So you need to also ensure that you have enough memory (I don't remembner the resourdces to request, something likie big_memory)

Try to fix unstable Windows CI test failure?

ByteFlowing1337 · 2026-04-26T05:37:51Z

Now all CI tests pass!

picnixz · 2026-04-26T07:22:31Z

Thanks, I'll merge it in a few days to let others have a look if they want to. Until then, you don't need to update your branch (in general, don't update your branch unless main has changed in a non-compatible way (e.g., new CI failures)).

hartwork · 2026-04-26T17:01:14Z

        call_character_handler(self, data, len);
    else {
-        if ((self->buffer_used + len) > self->buffer_size) {
+        if (len > (self->buffer_size - self->buffer_used)) {


This looks like a fix to an integer overflow rather than a buffer overflow. Am missing something?

The cause is indeed an integer overflow, but I think the ASAN report says "heap-buffer overflow" in this case (so the result is a buffer overflow at the end). I'll just write "a crash" (people don't really care about the cause/exact result: if it crashes, it's bad; they can read the issue for more details).

I've updated the title to reflect what the PR did but I'll stay vague in the NEWS.

…vpCkR.rst

ByteFlowing1337 · 2026-05-10T13:40:43Z

@picnixz ping, 2 weeks have passed since your approval. Is it ready to be merged? :)

miss-islington-app · 2026-05-10T13:42:39Z

Thanks @ByteFlowing1337 for the PR, and @picnixz for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington-app · 2026-05-10T13:42:39Z

Thanks @ByteFlowing1337 for the PR, and @picnixz for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

miss-islington-app · 2026-05-10T13:42:39Z

Thanks @ByteFlowing1337 for the PR, and @picnixz for merging it 🌮🎉.. I'm working now to backport this PR to: 3.15.
🐍🍒⛏🤖

bedevere-app · 2026-05-10T13:42:54Z

GH-149637 is a backport of this pull request to the 3.13 branch.

picnixz · 2026-05-10T13:43:00Z

, 2 weeks have passed since your approval. Is it ready to be merged? :)

I should say 2 weeks have passed since I forgot about it :') sorry!

bedevere-app · 2026-05-10T13:43:00Z

GH-149638 is a backport of this pull request to the 3.14 branch.

bedevere-app · 2026-05-10T13:43:05Z

GH-149639 is a backport of this pull request to the 3.15 branch.

…ler (GH-148904) (#149638) gh-148441: Avoid integer overflow in Expat's CharacterDataHandler (GH-148904) (cherry picked from commit bc1be4f) Co-authored-by: ByteFlow <fakeshadow1337@gmail.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

…ler (GH-148904) (#149639) gh-148441: Avoid integer overflow in Expat's CharacterDataHandler (GH-148904) (cherry picked from commit bc1be4f) Co-authored-by: ByteFlow <fakeshadow1337@gmail.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

ByteFlowing1337 added 2 commits April 23, 2026 13:05

pythongh-148535: Fix heap buffer overflow in pyexpat CharacterDataHan…

6138a78

…dler

Add test for heap overflow in expat parser's CharacterDataHandler

8f8884b

bedevere-app Bot added the awaiting review label Apr 23, 2026

bedevere-app Bot mentioned this pull request Apr 23, 2026

Heap Buffer Overflow in pyexpat Character Data Buffering #148441

Open

picnixz self-requested a review April 23, 2026 21:00

picnixz reviewed Apr 25, 2026

View reviewed changes

Comment thread Lib/test/test_pyexpat.py Outdated

Comment thread Lib/test/test_pyexpat.py Outdated

Comment thread Lib/test/test_pyexpat.py Outdated

Comment thread Misc/NEWS.d/next/Library/2026-04-23-12-50-15.gh-issue-148441.zvpCkR.rst Outdated

ByteFlowing1337 and others added 3 commits April 25, 2026 20:38

Update Misc/NEWS.d/next/Library/2026-04-23-12-50-15.gh-issue-148441.z…

588fa76

…vpCkR.rst Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Update Lib/test/test_pyexpat.py

2e070e9

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Update test_pyexpat.py

22edd46

ByteFlowing1337 added 4 commits April 26, 2026 11:14

Add bigmemtest decorator for test

9c3c841

Merge branch 'main' into fix-148441

01cf649

Merge branch 'main' into fix-148441

9e84a9b

Increase memory usage in bigmemtest decorator

98dd6f8

Try to fix unstable Windows CI test failure?

picnixz approved these changes Apr 26, 2026

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting review labels Apr 26, 2026

hartwork reviewed Apr 26, 2026

View reviewed changes

picnixz changed the title ~~gh-148441: Fix heap buffer overflow in pyexpat CharacterDataHandler~~ gh-148441: Fix crash in Expat's CharacterDataHandler with large character data Apr 26, 2026

picnixz reviewed Apr 26, 2026

View reviewed changes

Comment thread Misc/NEWS.d/next/Library/2026-04-23-12-50-15.gh-issue-148441.zvpCkR.rst Outdated

Update Misc/NEWS.d/next/Library/2026-04-23-12-50-15.gh-issue-148441.z…

de2f62c

…vpCkR.rst

picnixz reviewed Apr 26, 2026

View reviewed changes

Comment thread Lib/test/test_pyexpat.py Outdated

Update Lib/test/test_pyexpat.py

baaf37d

picnixz changed the title ~~gh-148441: Fix crash in Expat's CharacterDataHandler with large character data~~ gh-148441: Avoid integer overflow in Expat's CharacterDataHandler Apr 26, 2026

picnixz merged commit bc1be4f into python:main May 10, 2026
55 checks passed

bedevere-app Bot removed the awaiting merge label May 10, 2026

picnixz added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes labels May 10, 2026

bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label May 10, 2026

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label May 10, 2026

bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label May 10, 2026

ByteFlowing1337 deleted the fix-148441 branch May 10, 2026 13:47

Uh oh!

Conversation

ByteFlowing1337 commented Apr 23, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ByteFlowing1337 commented Apr 25, 2026

Uh oh!

ByteFlowing1337 commented Apr 25, 2026

Uh oh!

picnixz commented Apr 25, 2026

Uh oh!

ByteFlowing1337 commented Apr 26, 2026

Uh oh!

picnixz commented Apr 26, 2026

Uh oh!

hartwork Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

picnixz Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

picnixz Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ByteFlowing1337 commented May 10, 2026

Uh oh!

Uh oh!

miss-islington-app Bot commented May 10, 2026

Uh oh!

miss-islington-app Bot commented May 10, 2026

Uh oh!

miss-islington-app Bot commented May 10, 2026

Uh oh!

bedevere-app Bot commented May 10, 2026

Uh oh!

picnixz commented May 10, 2026

Uh oh!

bedevere-app Bot commented May 10, 2026

Uh oh!

bedevere-app Bot commented May 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ByteFlowing1337 commented Apr 23, 2026 •

edited by bedevere-app Bot

Loading