[3.4] bpo-34623: Use XML_SetHashSalt in _elementtree #9953
Merged
Conversation
The C accelerated _elementtree module now initializes hash randomization salt from _Py_HashSecret instead of libexpat's default CPRNG. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue34623 (cherry picked from commit cb5778f) Co-authored-by: Christian Heimes <christian@python.org>
) https://bugs.python.org/issue34623 (cherry picked from commit 026337a) Co-authored-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue34623
| @@ -3259,6 +3259,11 @@ xmlparser_init(PyObject *self, PyObject *args, PyObject *kwds) | |||
| PyErr_NoMemory(); | |||
| return -1; | |||
| } | |||
| /* expat < 2.1.0 has no XML_SetHashSalt() */ | |||
| if (EXPAT(SetHashSalt) != NULL) { | |||
| EXPAT(SetHashSalt)(self_xp->parser, | |||
stratakis
Oct 18, 2018
Author
Contributor
This is the only line that has been modified from the previous PR's. Namely it's self_xp->parser on 3.4. On the other branches it's self->parser due to argumentclinication.
This is the only line that has been modified from the previous PR's. Namely it's self_xp->parser on 3.4. On the other branches it's self->parser due to argumentclinication.
|
Oh, Travis CI failed on a random failure: I scheduled a new job. |
|
I closed/reopened the PR to trigger a new Travis CI job. |
|
@larryhastings: Hi Larry, would you mind to merge this security fix? |
|
@larryhastings: Please replace |
|
Thank for the backported fix! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Backport for the 3.4 branch.
https://bugs.python.org/issue34623