The long_from_string_base() might return a small integer, when the
_pylong.py is used to do conversion. Hence, we must be careful here to
not smash it "small int" bit by using the _PyLong_FlipSign().
Co-authored-by: Victor Stinner <vstinner@python.org>
(cherry picked from commit db5936c5b89aa19e04d63120e0cf5bbc73bf2420)
Co-authored-by: Sergey B Kirpichev <skirpichev@gmail.com>
gh-146059: Call fast_save_leave() in pickle save_frozenset() (GH-146173)
Add more pickle tests: test also nested structures.
(cherry picked from commit 5c0dcb3e0d817bd8c28e8efcdb97103cd9210989)
Co-authored-by: Victor Stinner <vstinner@python.org>
Use uniform standard signature syntax in the tutorial and in
the array and collections modules documentation.
(cherry picked from commit 17070f41d4ccf5e82e5841e467b3aef5294f2c9a)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
gh-145633: Fix struct.pack('f') on s390x (#146422)
Use PyFloat_Pack4() to raise OverflowError.
Add more tests on packing/unpacking floats.
(cherry picked from commit 8de70b31c59b1d572d95f8bb471a09cfe4cd2b13)
Co-authored-by: Sergey B Kirpichev <skirpichev@gmail.com>
It occurs in a code which perhaps never executed.
(cherry picked from commit 6ea84b2726bb6a1a8a6819d30c368ac34c50eabe)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Base64 decoder (see binascii.a2b_base64(), base64.b64decode(), etc)
no longer ignores excess data after the first padded quad in non-strict
(default) mode. Instead, in conformance with RFC 4648, it ignores the
pad character, "=", if it is present before the end of the encoded data.
(cherry picked from commit 4561f6418a691b3e89aef0901f53fe0dfb7f7c0e)
(cherry picked from commit e31c55121620189a0d1a07b689762d8ca9c1b7fa)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
gh-146092: Raise MemoryError on allocation failure in _zoneinfo (GH-146165)
(cherry picked from commit 6450b1d142b6254d2e3b2eba47d69125ca79b3fe)
Co-authored-by: Victor Stinner <vstinner@python.org>
gh-146093: Fix csv _set_str(): check if PyUnicode_DecodeASCII() failed (GH-146113)
The function can fail on a memory allocation failure.
Bug reported by devdanzin.
(cherry picked from commit 724c7c8146f44a7c737ec4588a1ee4b9db994f6f)
Co-authored-by: Victor Stinner <vstinner@python.org>
* gh-145986: Avoid unbound C recursion in `conv_content_model` in `pyexpat.c` (CVE 2026-4224) (GH-145987)
Fix C stack overflow (CVE-2026-4224) when an Expat parser
with a registered `ElementDeclHandler` parses inline DTD
containing deeply nested content model.
---------
(cherry picked from commit eb0e8be3a7e11b87d198a2c3af1ed0eccf532768)
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
* Remvoe `skip_if_unlimited_stack_size` decorator
* Remove more decorators not on this branch
---------
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
(cherry picked from commit 2d35f9bc1cf61b27639ed992dfbf363ab436fd8b)
Includes test fix-up from GH-145788
(cherry picked from commit aa4240ebea1aacc907b1efa58e7f547d90cff3b1)
Co-authored-by: Thomas Kowalski <thom.kowa@gmail.com>
Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com>
Only set the format attribute after successful (re-)initialization.
(cherry picked from commit 3f33bf83e8496737b86333bc9ec55dc3ccb3faca)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
* gh-145376: Fix crashes in md5module.c
Fix a possible NULL pointer dereference in `md5module.c`.
This can only occur in error paths taken when the interpreter fails to allocate memory.
(cherry-picked from c1d77683213c400fca144692654845e6f5418981)
* 📜🤖 Added by blurb_it.
* Update Modules/md5module.c
---------
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
gh-145335: Fix crash when passing -1 as fd in os.pathconf (GH-145390)
(cherry picked from commit 5c3a47b94a39f87c36b1f36704d80775802ad034)
Co-authored-by: AN Long <aisk@users.noreply.github.com>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
`_struct.c`: Fix UB from integer overflow in `prepare_s` (GH-145158)
Avoid possible undefined behaviour from signed overflow in `struct` module
As discovered via oss-fuzz.
(cherry picked from commit fd0400585eb957c7d10812d87a8cb9e1f3c72519)
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
* [3.13] gh-143698: correctly check `scheduler` and `setpgroup` values for `os.posix_spawn[p]` (GH-143699)
Fix an issue where passing invalid arguments to `os.posix_spawn[p]` functions
raised a SystemError instead of a TypeError, and allow to explicitly use `None`
for `scheduler` and `setpgroup` as specified in the docs.
(cherry picked from commit 347fc438cf903c1d7fa5063464ae2e93c11b2232)
(cherry picked from commit 8b7b5a994602824a5e41cf2516691212fcdfa25e)
(cherry picked from commit bcabbd02f6fb98ee143fc9f3e47e71ded3b7747f)
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Pierre Le Marre <dev@wismill.eu>
gh-144833: Fix use-after-free in SSL module when SSL_new() fails (GH-144843)
In newPySSLSocket(), when SSL_new() returns NULL, Py_DECREF(self)
was called before _setSSLError(get_state_ctx(self), ...), causing
a use-after-free. Additionally, get_state_ctx() was called with
self (PySSLSocket*) instead of sslctx (PySSLContext*), which is
a type confusion bug.
Fix by calling _setSSLError() before Py_DECREF() and using
sslctx instead of self for get_state_ctx().
(cherry picked from commit c91638ca0671b8038831f963ed44e66cdda006a2)
Co-authored-by: Ramin Farajpour Cami <ramin.blackhat@gmail.com>
Lookup for CJK ideograms and Hangul syllables is now case-insensitive,
as is the case for other character names.
(cherry picked from commit e66f4a5a9c7ce744030d6352bf5575639b1096cc)
Co-authored-by: James <snoopjedi@gmail.com>
This was causing ucd_3_2_0.numeric() to pick up only decimal
changes between Unicode 3.2.0 and the current version.
(cherry picked from commit 3e0322ff16f47caa3e273d453f007d3918b8ac80)
Co-authored-by: William Meehan <wmeehan@fb.com>
(cherry picked from commit d5cb9f6a9b6f48cc08c4422259498d4fd023357a)
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
- generate_sbom.py: Exclude the refresh script from SBOM
- Modules/expat/refresh.sh: Expand the list of manual steps
(cherry picked from commit 51d309988b3041cae20cca89172b4fd825c9a1cc)
gh-142555: Fix null pointer dereference in array.__setitem__ via re-entrant __index__ (GH-142713)
(cherry picked from commit 39f16a93ef7b39c3fc5a1a5b706512168baee499)
Co-authored-by: AN Long <aisk@users.noreply.github.com>
gh-144380: Fix incorrect type check in `buffered_iternext()` (GH-144381)
(cherry picked from commit 40d07cad38bf3ce60f4ca03f1836e8650fe40df5)
Co-authored-by: Ruiyang Ke <me@ry.ke>
gh-144100: Fix crash for POINTER(str) used in ctypes argtypes (#144108)
(cherry picked from commit 8f459255eba2b6639f1912e5c5e318a7cdafada1)
Co-authored-by: VanshAgarwal24036 <148854295+VanshAgarwal24036@users.noreply.github.com>
[3.13] gh-144023: Prevent follow_symlinks from being allowed with an fd of 0 (GH-144022)
The check was (fd > 0), should be (fd >= 0).
(cherry picked from commit fa44efa0ef1972ac1e2f66996303154be11f605e)
Co-authored-by: AZero13 <gfunni234@gmail.com>
Update struct.__doc__: _Bool available unconditionally (GH-143716)
This amends commit a9296e7f3be4d6c22271b25c86467ff867c63bbb.
(cherry picked from commit 31c81ab0a2fb7009a76426617991a9b539ab0180)
Co-authored-by: Sergey B Kirpichev <skirpichev@gmail.com>
gh-143249: Fix buffer leak when overlapped operation fails to start on windows (GH-143250)
(cherry picked from commit 103a384bfdeafc68ab39ea9bf8838a8b2eec83dd)
Co-authored-by: Yongtao Huang <yongtaoh2022@gmail.com>
