Skip to content

gh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor#148396

Merged
gpshead merged 4 commits intopython:mainfrom
StanFromIreland:mem-stale
Apr 13, 2026
Merged

gh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor#148396
gpshead merged 4 commits intopython:mainfrom
StanFromIreland:mem-stale

Conversation

@StanFromIreland
Copy link
Copy Markdown
Member

@StanFromIreland StanFromIreland commented Apr 11, 2026 •
edited by bedevere-app bot
Loading

@bedevere-app bedevere-app bot mentioned this pull request Apr 11, 2026
Open
emmatyping
emmatyping approved these changes Apr 11, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@emmatyping emmatyping left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for fixing this!

@picnixz picnixz changed the title gh-148395: Fix a possible UAF in {LZMA, BZ2, _Zlib}Decompressor gh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor Apr 11, 2026
picnixz
picnixz reviewed Apr 11, 2026
View reviewed changes
@gpshead gpshead merged commit 8fc66ae into python:main Apr 13, 2026
54 checks passed
@gpshead gpshead added awaiting merge needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 13, 2026
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland @miss-islington
pythongh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor (…
5b8d240 
…pythonGH-148396)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)

Co-authored-by: Stan Ulbrych <stan@python.org>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148479 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Apr 13, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland @miss-islington
pythongh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor (…
c8d8173 
…pythonGH-148396)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)

Co-authored-by: Stan Ulbrych <stan@python.org>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148480 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Apr 13, 2026
gpshead pushed a commit that referenced this pull request Apr 13, 2026
@miss-islington @StanFromIreland
[3.13] gh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor (
c3cf71c 
GH-148396) (#148479)

gh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (GH-148396)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)

Co-authored-by: Stan Ulbrych <stan@python.org>
gpshead pushed a commit that referenced this pull request Apr 13, 2026
@miss-islington @StanFromIreland
[3.14] gh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor (
6a5f79c 
GH-148396) (#148480)

gh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (GH-148396)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)

Co-authored-by: Stan Ulbrych <stan@python.org>
@StanFromIreland StanFromIreland added the needs backport to 3.12 only security fixes label Apr 13, 2026
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2 3.10

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland @miss-islington
pythongh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor (…
e100aea 
…pythonGH-148396)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)

Co-authored-by: Stan Ulbrych <stan@python.org>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148503 is a backport of this pull request to the 3.12 branch.

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2 3.11

@bedevere-app bedevere-app bot removed the needs backport to 3.12 only security fixes label Apr 13, 2026
StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.11] pythongh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decomp…
72d9d77 
…ressor` (pythonGH-148396)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)

Co-authored-by: Stan Ulbrych <stan@python.org>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148504 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Apr 13, 2026
StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland
pythongh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor (…
fe18959 
…pythonGH-148396)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress

(cherry picked from commit 8fc66ae)
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148505 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.10 only security fixes label Apr 13, 2026
@sethmlarson sethmlarson added type-security A security issue needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Apr 13, 2026
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2 3.11

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2 3.10

@sethmlarson
Copy link
Copy Markdown
Contributor

sethmlarson commented Apr 13, 2026

Apologies, I was working on an old version of the page without the 3.11/3.10 backports. Ignore the noise.

@StanFromIreland StanFromIreland removed needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Apr 13, 2026
mandree added a commit to mandree/freebsd-ports that referenced this pull request Apr 13, 2026
@mandree
lang/python314: Security update + other fixes
c43bbd6 
Fix critical use-after-free bug in LZMA/BZ2/ZLib decompressor routines
when reusing decompressor instances after a MemoryError was raised from
one. See
<https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/>
<https://www.cve.org/CVERecord?id=CVE-2026-6100>
<python/cpython#148396>

Obtained from:	python/cpython@c8d8173
Security:	CVE-2026-6100
Security:	b8e9f33c-375d-11f1-a119-e36228bfe7d4

While here:

- fix DEBUG build/package (several %%ABI%% were in the wrong place
  in pkg-plist that caused failed installs)
- switch to using system textproc/expat2 library
- issue warnings in pre-test that IPV6, PYMALLOC are required and
  DEBUG also breaks one self-test
- bump PORTREVISION
- drop LTOFULL again and make LTO use =full
@xint-public-bug-mirror xint-public-bug-mirror bot mentioned this pull request Apr 13, 2026
Open
pablogsal pushed a commit that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.10] gh-148395: Fix a possible UAF in {LZMA,BZ2}Decompressor (GH-…
47128e6 
…148396) (#148505)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress

(cherry picked from commit 8fc66ae)
pablogsal pushed a commit that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.11] gh-148395: Fix a possible UAF in {LZMA,BZ2}Decompressor (GH-…
e20c6c9 
…148396) (#148504)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress

(cherry picked from commit 8fc66ae)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

@emmatyping emmatyping emmatyping approved these changes

@picnixz picnixz Awaiting requested review from picnixz

Assignees

@gpshead gpshead

Labels

awaiting merge type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@StanFromIreland @bedevere-bot @sethmlarson @gpshead @emmatyping @picnixz