Skip to content

gh-148735: Fix a UAF in Element.findtext()#148738

Merged
StanFromIreland merged 3 commits intopython:mainfrom
StanFromIreland:findall
Apr 23, 2026
Merged

gh-148735: Fix a UAF in Element.findtext()#148738
StanFromIreland merged 3 commits intopython:mainfrom
StanFromIreland:findall

Conversation

@StanFromIreland
Copy link
Copy Markdown
Member

@StanFromIreland StanFromIreland commented Apr 18, 2026

This was a regression introduced by c57623c.

/* return borrowed reference to text attribute */

`Element.findtext()`
Comment thread Modules/_elementtree.c Outdated
Copy link
Copy Markdown
Member

@picnixz picnixz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All the occurrences you change are of the form (get borrowed) followed by (incref) right? if so, it is ok to change it to (get strong ref) but otherwise we may have un-necessary incref/decref. Currently XML is not FT-safe but if we (I) want to make it so, we should avoid incref/decref in hot paths

Comment thread Misc/NEWS.d/next/Library/2026-04-18-21-39-15.gh-issue-148735.siw6DG.rst Outdated
Comment thread Misc/NEWS.d/next/Library/2026-04-18-21-39-15.gh-issue-148735.siw6DG.rst Outdated
@serhiy-storchaka
Copy link
Copy Markdown
Member

but otherwise we may have un-necessary incref/decref

The number of incerfs/decrefs remains the same. They are not unnecessary.

@picnixz
Copy link
Copy Markdown
Member

picnixz commented Apr 22, 2026

Yeah I was not sure about this as I am on mobile. Thanks for checking

Copy link
Copy Markdown
Member

@serhiy-storchaka serhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. 👍

@serhiy-storchaka serhiy-storchaka added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 22, 2026
@StanFromIreland StanFromIreland merged commit 0469e6d into python:main Apr 23, 2026
102 of 108 checks passed
@StanFromIreland StanFromIreland deleted the findall branch April 23, 2026 14:48
@miss-islington-app
Copy link
Copy Markdown

Thanks @StanFromIreland for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

@miss-islington-app
Copy link
Copy Markdown

Sorry, @StanFromIreland, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 0469e6d38dcb3ff904690028cb3a25155bdcedae 3.13

@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented Apr 23, 2026

GH-148916 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Apr 23, 2026
@StanFromIreland
Copy link
Copy Markdown
Member Author

StanFromIreland commented Apr 23, 2026

Thanks for the reviews!

@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented Apr 23, 2026

GH-148923 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Apr 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants