From 0c50fa41c639b7523f9a09f48928c72ea1f0bbcc Mon Sep 17 00:00:00 2001
From: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Date: Sun, 15 Mar 2026 21:46:06 +0000
Subject: [PATCH 1/2] [3.10] gh-145986: Avoid unbound C recursion in
`conv_content_model` in `pyexpat.c` (CVE 2026-4224) (GH-145987)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fix C stack overflow (CVE-2026-4224) when an Expat parser
with a registered `ElementDeclHandler` parses inline DTD
containing deeply nested content model.
---------
(cherry picked from commit eb0e8be3a7e11b87d198a2c3af1ed0eccf532768)
(cherry picked from commit e5caf45faac74b0ed869e3336420cffd3510ce6e)
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
---
Lib/test/support/__init__.py | 17 ++++++++
Lib/test/test_pyexpat.py | 20 +++++++++-
Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst | 4 ++
Modules/pyexpat.c | 8 +++-
4 files changed, 46 insertions(+), 3 deletions(-)
create mode 100644 Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
Index: Python-3.6.15/Lib/test/support/__init__.py
===================================================================
--- Python-3.6.15.orig/Lib/test/support/__init__.py 2026-03-24 23:47:18.488031766 +0100
+++ Python-3.6.15/Lib/test/support/__init__.py 2026-03-25 00:32:14.874234970 +0100
@@ -110,7 +110,7 @@
"threading_setup", "threading_cleanup", "reap_threads", "start_threads",
# miscellaneous
"check_warnings", "check_no_resource_warning", "EnvironmentVarGuard",
- "run_with_locale", "swap_item",
+ "run_with_locale", "swap_item", "infinite_recursion",
"swap_attr", "Matcher", "set_memlimit", "SuppressCrashReport", "sortdict",
"run_with_tz", "PGO", "missing_compiler_executable", "fd_count",
"fails_with_expat_2_6_0", "is_expat_2_6_0", "control_characters_c0",
@@ -2296,6 +2296,40 @@
if item in obj:
del obj[item]
+
+def infinite_recursion(max_depth=None):
+ if max_depth is None:
+ # Pick a number large enough to cause problems
+ # but not take too long for code that can handle
+ # very deep recursion.
+ max_depth = 20000
+ elif max_depth < 3:
+ raise ValueError("max_depth must be at least 3, got {}".format(max_depth))
+ depth = get_recursion_depth()
+ depth = max(depth - 1, 1) # Ignore infinite_recursion() frame.
+ limit = depth + max_depth
+ return set_recursion_limit(limit)
+
+
+@contextlib.contextmanager
+def set_recursion_limit(limit):
+ old_limit = sys.getrecursionlimit()
+ try:
+ sys.setrecursionlimit(limit)
+ yield
+ finally:
+ sys.setrecursionlimit(old_limit)
+
+
+def get_recursion_depth():
+ depth = 0
+ frame = sys._getframe()
+ while frame is not None:
+ depth += 1
+ frame = frame.f_back
+ return depth
+
+
def strip_python_stderr(stderr):
"""Strip the stderr of a Python process from potential debug output
emitted by the interpreter.
Index: Python-3.6.15/Lib/test/test_pyexpat.py
===================================================================
--- Python-3.6.15.orig/Lib/test/test_pyexpat.py 2026-03-24 23:47:18.107056869 +0100
+++ Python-3.6.15/Lib/test/test_pyexpat.py 2026-03-24 23:47:18.553705217 +0100
@@ -11,7 +11,7 @@
from xml.parsers import expat
from xml.parsers.expat import errors
-from test.support import sortdict, is_expat_2_6_0
+from test.support import sortdict, is_expat_2_6_0, infinite_recursion
class SetAttributeTest(unittest.TestCase):
@@ -642,6 +642,24 @@
parser.Parse(xml2, 1)
self.assertEqual(self.n, 4)
+class ElementDeclHandlerTest(unittest.TestCase):
+ def test_deeply_nested_content_model(self):
+ # This should raise a RecursionError and not crash.
+ # See https://github.com/python/cpython/issues/145986.
+ N = 500_000
+ data = (
+ b'\n]>\n\n'
+ )
+
+ parser = expat.ParserCreate()
+ parser.ElementDeclHandler = lambda _1, _2: None
+ with infinite_recursion():
+ with self.assertRaises(RecursionError):
+ parser.Parse(data)
+
+
class MalformedInputTest(unittest.TestCase):
def test1(self):
xml = b"\0\r\n"
Index: Python-3.6.15/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ Python-3.6.15/Misc/NEWS.d/next/Security/2026-03-14-17-31-39.gh-issue-145986.ifSSr8.rst 2026-03-24 23:47:18.554103598 +0100
@@ -0,0 +1,4 @@
+:mod:`xml.parsers.expat`: Fixed a crash caused by unbounded C recursion when
+converting deeply nested XML content models with
+:meth:`~xml.parsers.expat.xmlparser.ElementDeclHandler`.
+This addresses `CVE-2026-4224 `_.
Index: Python-3.6.15/Modules/pyexpat.c
===================================================================
--- Python-3.6.15.orig/Modules/pyexpat.c 2021-09-04 05:49:41.000000000 +0200
+++ Python-3.6.15/Modules/pyexpat.c 2026-03-24 23:47:18.554450562 +0100
@@ -520,6 +520,10 @@
conv_content_model(XML_Content * const model,
PyObject *(*conv_string)(const XML_Char *))
{
+ if (Py_EnterRecursiveCall(" in conv_content_model")) {
+ return NULL;
+ }
+
PyObject *result = NULL;
PyObject *children = PyTuple_New(model->numchildren);
int i;
@@ -531,7 +535,7 @@
conv_string);
if (child == NULL) {
Py_XDECREF(children);
- return NULL;
+ goto done;
}
PyTuple_SET_ITEM(children, i, child);
}
@@ -539,6 +543,8 @@
model->type, model->quant,
conv_string,model->name, children);
}
+done:
+ Py_LeaveRecursiveCall();
return result;
}