cpython/Lib
Miss Islington (bot) b64441e485
[3.14] gh-119342: Fix a potential denial of service in plistlib (GH-119343) (GH-142143)
Reading a specially prepared small Plist file could cause OOM because file's
read(n) preallocates a bytes object for reading the specified amount of
data. Now plistlib reads large data by chunks, therefore the upper limit of
consumed memory is proportional to the size of the input file.
(cherry picked from commit 694922cf40)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
2025-12-01 15:54:58 +00:00
..
__phello__
_pyrepl [3.14] gh-139246: zero-width word paste can be wrong in default repl (GH-139254) (GH-140796) 2025-11-07 13:50:06 +01:00
asyncio [3.14] gh-103847: fix cancellation safety of asyncio.create_subprocess_exec (GH-140805) (#141446) 2025-11-13 17:03:04 +05:30
collections [3.14] gh-140911: Ensure that UserString.index() and UserString.rindex() accept UserString as argument (GH-140945) (GH-141946) 2025-11-25 13:56:05 +00:00
compression [3.14] gh-132983: Split `_zstd_set_c_parameters` (GH-133921) (#134838) 2025-05-28 17:25:06 +01:00
concurrent [3.14] gh-141125: delete unused import textwrap in interpreter.py (GH-141126) (#141177) 2025-11-07 00:29:25 +00:00
ctypes [3.14] gh-140041: Fix import of ctypes on Android and Cygwin when ABI flags are present (GH-140178) (#140180) 2025-10-15 22:08:35 +00:00
curses
dbm [3.14] gh-135386: Fix "unable to open database file" errors on readonly DB (GH-135566) (GH-138056) 2025-10-08 11:41:09 +03:00
email [3.14] gh-136063: fix quadratic-complexity parsing in email.message._parseparam (GH-136072) (#140827) 2025-11-30 14:30:56 +02:00
encodings [3.14] gh-135069: Fix exception message in encodings.idna module (GH-135071) (#136235) 2025-07-03 10:18:27 +00:00
ensurepip [3.14] gh-140874: Upgrade bundled pip to 25.3 (GH-140876) (gh-140881) 2025-11-01 11:21:51 +00:00
html [3.14] gh-140875: Fix handling of unclosed charrefs before EOF in HTMLParser (GH-140904) (GH-141745) 2025-11-19 12:43:24 +00:00
http [3.14] gh-119452: Fix a potential virtual memory allocation denial of service in http.server (GH-119455) 2025-12-01 12:59:09 +00:00
idlelib [3.14] Minor fixes to idle.rst and regenerate help.html (GH-140037) (#141121) 2025-11-06 08:51:28 +00:00
importlib [3.14] gh-140633: AppleFrameworkLoader: Ignore AttributeError when setting __file__ (GH-140635) (GH-140660) 2025-10-27 14:08:00 +01:00
json [3.14] gh-140793: Improve documentatation and tests for the ensure_ascii option in the json module (GH-140906) (GH-141227) 2025-11-08 10:32:44 +00:00
logging [3.14] gh-138162: Fix logging.LoggerAdapter with merge_extra=True and without the extra argument (GH-140511) (GH-140784) 2025-10-30 11:19:27 +00:00
multiprocessing [3.14] gh-133146: Add the old public get_value method to documentation and refactor code. (GH-133301) (#142110) 2025-11-30 13:06:56 -08:00
pathlib [3.14] GH-133789: Fix unpickling of pathlib objects pickled in Python 3.13 (GH-133831) (#140276) 2025-10-17 22:23:01 +00:00
pydoc_data Python 3.14.0 2025-10-07 12:34:52 +03:00
re [3.14] gh-140797: Forbid capturing groups in re.Scanner lexicon patterns (GH-140944) (GH-140982) 2025-11-04 11:21:33 +00:00
site-packages
sqlite3
string [3.14] GH-132661: Add `string.templatelib.convert()` (GH-135217) (#136671) 2025-07-15 10:22:24 +00:00
sysconfig [3.14] Synced docs and docstring for sysconfig.get_platform (GH-135530) (#138976) 2025-10-04 17:55:25 +03:00
test [3.14] gh-119342: Fix a potential denial of service in plistlib (GH-119343) (GH-142143) 2025-12-01 15:54:58 +00:00
tkinter [3.14] gh-126008: Improve docstrings for Tkinter cget and configure methods (GH-133303) (GH-137660) 2025-10-07 22:34:36 +02:00
tomllib
turtledemo
unittest [3.14] gh-136442: Fix unittest to return exit code 5 when setUpClass raises an exception (GH-136487) (#141576) 2025-11-15 01:25:19 +00:00
urllib [3.14] gh-140691: urllib.request: Close FTP control socket if data socket can't connect (GH-140835) (GH-141555) 2025-11-14 17:27:33 +01:00
venv [3.14] gh-134060: Don't create a certain symlink in venv if platform does not support it (GH-134061) 2025-05-18 22:33:14 +03:00
wsgiref
xml [3.14] gh-135640: Adds more type checking to ElementTree (GH-135643) (GH-136225) 2025-07-03 08:15:01 +00:00
xmlrpc [3.14] gh-136839: Refactor simple dict.update calls (GH-136811) (#136840) 2025-07-19 17:36:31 +00:00
zipfile [3.14] gh-139700: Check consistency of the zip64 end of central directory record (GH-139702) (GH-139706) 2025-10-07 23:16:26 +02:00
zoneinfo [3.14] GH-137841: Open tzdata/zones file with UTF-8 encoding (GH-137872) (#141607) 2025-11-20 18:23:40 +02:00
__future__.py
__hello__.py
_aix_support.py
_android_support.py [3.14] Make Android streams respect the unbuffered (-u) option (GH-138806) (#139108) 2025-09-29 11:16:25 +03:00
_apple_support.py
_ast_unparse.py [3.14] gh-138774: use value to ast.unparse code when str is None in ast.Interpolation (GH-139415) (#140503) 2025-10-23 14:39:02 +00:00
_collections_abc.py [3.14] gh-118803: Improve documentation around ByteString deprecation (GH-139115) (#139136) 2025-09-18 17:54:43 +00:00
_colorize.py [3.14] gh-141570: can_colorize: Expect fileno() to raise OSError, as documented (GH-141716) (#141747) 2025-11-19 14:29:15 +00:00
_compat_pickle.py
_ios_support.py
_markupbase.py
_opcode_metadata.py
_osx_support.py
_py_abc.py
_py_warnings.py [3.14] gh-140691: urllib.request: Close FTP control socket if data socket can't connect (GH-140835) (GH-141555) 2025-11-14 17:27:33 +01:00
_pydatetime.py [3.14] gh-123681: Check NORMALIZE_CENTURY behavior at runtime; require C99 (GH-136022) (GH-137947) 2025-10-07 19:59:06 +02:00
_pydecimal.py [3.14] gh-102431: Clarify constraints on operands of Decimal logical operations (GH-102836) (#140105) 2025-10-14 15:44:30 +02:00
_pyio.py [3.14] gh-140607: Validate returned byte count in RawIOBase.read (GH-140611) (#140728) 2025-10-29 13:31:48 +01:00
_pylong.py
_sitebuiltins.py
_strptime.py [3.14] gh-136028: Fix parsing month names containing "İ" (U+0130) in strptime() (GH-136029) (GH-136037) 2025-06-27 14:12:15 +00:00
_threading_local.py
_weakrefset.py
abc.py
annotationlib.py [3.14] gh-141489: Simplify closure/freevar iteration in annotationlib._build_closure() (GH-141490) (#141776) 2025-11-20 04:33:18 +00:00
antigravity.py
argparse.py [3.14] GH-139809: Fix argparse subcommand prog not respecting color environment variables (GH-139818) (#139866) 2025-10-09 17:19:54 +00:00
ast.py [3.14] gh-134718: Fix ast.dump() for empty non-default values (GH-134926) (GH-134931) 2025-05-30 18:24:59 +03:00
base64.py [3.14] gh-138775: fix handle python -m base64 stdin correct with EOF signal (GH-138776) (#141432) 2025-11-12 00:12:57 +00:00
bdb.py [3.14] gh-136057: Allow step and next to step over for loops (GH-136160) (#141640) 2025-11-16 22:22:11 +00:00
bisect.py
bz2.py
calendar.py
cmd.py
code.py
codecs.py [3.14] gh-52876: Implement missing parameter in codecs.StreamReaderWriter functions (GH-136498) (#136514) 2025-07-10 16:09:45 +00:00
codeop.py
colorsys.py
compileall.py
configparser.py [3.14] gh-65697: Improved error msg for configparser key validation (GH-135527) (#135541) 2025-06-15 16:38:15 +00:00
contextlib.py
contextvars.py
copy.py
copyreg.py
cProfile.py
csv.py
dataclasses.py [3.14] gh-137530: generate an __annotate__ function for dataclasses __init__ (GH-137711) (#141352) 2025-11-10 07:14:32 -08:00
datetime.py
decimal.py
difflib.py [3.14] gh-128051: Fix tests if sys.float_repr_style is 'legacy' (GH-135908) (#136025) 2025-06-27 10:26:51 +00:00
dis.py
doctest.py [3.14] gh-136914: Fix support of cached functions and properties in DocTest's lineno computation (GH-136930) (#137616) 2025-10-07 20:48:10 +02:00
enum.py [3.14] gh-136764: improve comment in enum.verify.__call__ (GH-136774) (GH-136841) 2025-07-19 11:00:15 -07:00
filecmp.py
fileinput.py
fnmatch.py
fractions.py [3.14] gh-87790: support thousands separators for formatting fractional part of Fraction (GH-132204) (#136364) 2025-07-07 19:24:24 +03:00
ftplib.py
functools.py [3.14] gh-140873: Fix the singledispatchmethod documentation (GH-141523) 2025-11-18 13:16:39 +02:00
genericpath.py [3.14] gh-135034: Normalize link targets in tarfile, add os.path.realpath(strict='allow_missing') (gh-135037) (gh-135065) 2025-06-03 14:05:00 +02:00
getopt.py
getpass.py [3.14] gh-138514: getpass: restrict echo_char to a single ASCII character (GH-138591) (#138988) 2025-09-17 17:20:45 +03:00
gettext.py
glob.py [3.14] docs: be clearer that glob results are unordered (GH-140184) (#140339) 2025-10-20 07:31:05 +03:00
graphlib.py
gzip.py
hashlib.py [3.14] gh-134696: align OpenSSL and HACL*-based hash functions constructors AC signatures (GH-134713) (#134961) 2025-06-01 10:26:56 +02:00
heapq.py [3.14] gh-137239: Add *_max functions to heapq.__all__ (gh-137241) (#137256) 2025-10-07 23:22:07 +05:30
hmac.py [3.14] gh-136912: fix handling of OverflowError in hmac.digest (GH-136917) (#137116) 2025-10-08 12:09:45 +02:00
imaplib.py [3.14] gh-78319: Fix implementation of IMAP APPEND UTF8 (GH-9436) (GH-139406) 2025-10-07 22:12:30 +02:00
inspect.py [3.14] gh-139783: Fix inspect.getsourcelines() for the case when a decorator is followed by a comment or an empty line (GH-139836) (GH-139889) 2025-10-10 08:18:32 +00:00
io.py
ipaddress.py [3.14] gh-141497: Make ipaddress.IP{v4,v6}Network.hosts() always returning an iterator (GH-141547) (GH-141673) 2025-11-17 17:56:55 +00:00
keyword.py
linecache.py [3.14] gh-140228: Avoid making unnecessary syscalls in linecache for frozen modules (GH-140377) (#140738) 2025-10-29 09:26:38 -07:00
locale.py [3.14] gh-133967: Do not normalize locale name 'C.UTF-8' to 'en_US.UTF-8' (GH-135347) (GH-135349) 2025-06-11 12:43:20 +03:00
lzma.py
mailbox.py
mimetypes.py [3.14] gh-136507: Fix mimetypes CLI to handle multiple file parameters (GH-136508) (GH-138140) 2025-10-07 19:59:52 +02:00
modulefinder.py
netrc.py [3.14] gh-135815: skip netrc security checks if os.getuid is missing (GH-135816) (#135825) 2025-06-22 20:12:57 +00:00
ntpath.py [3.14] gh-136065: Fix quadratic complexity in os.path.expandvars() (GH-134952) (GH-140844) 2025-10-31 17:43:23 +01:00
nturl2path.py
numbers.py [3.14] gh-122450: Expand documentation for `Rational and Fraction` (GH-136800) (#137363) 2025-10-07 19:15:22 +01:00
opcode.py
operator.py
optparse.py
os.py [3.14] gh-120057: add os.reload_environ to __all__ (GH-140763) (#140773) 2025-10-29 22:22:20 +00:00
pdb.py [3.14] gh-125115 : Refactor the pdb parsing issue so positional arguments can pass through (GH-140933) (#141635) 2025-11-16 19:35:42 +00:00
pickle.py
pickletools.py [3.14] gh-139646: fix typo in pickletools error message (GH-139647) (GH-139649) 2025-10-07 20:19:01 +02:00
pkgutil.py
platform.py [3.14] gh-141600: Fix musl version detection on Void Linux (GH-141850) 2025-11-22 18:47:47 +00:00
plistlib.py [3.14] gh-119342: Fix a potential denial of service in plistlib (GH-119343) (GH-142143) 2025-12-01 15:54:58 +00:00
poplib.py
posixpath.py [3.14] gh-136065: Fix quadratic complexity in os.path.expandvars() (GH-134952) (GH-140844) 2025-10-31 17:43:23 +01:00
pprint.py
profile.py
pstats.py
pty.py
py_compile.py
pyclbr.py
pydoc.py [3.14] gh-139076: Fix regression in pydoc not showing extension functions (GH-139077) (GH-139160) 2025-10-07 21:57:28 +02:00
queue.py [3.14] Fix Queue.shutdown docs for condition to unblock a join (gh-137088) (#141073) 2025-11-06 11:11:31 +05:30
quopri.py
random.py
reprlib.py [3.14] gh-135487: fix reprlib.Repr.repr_int when given very large integers (GH-135506) (#135887) 2025-06-24 12:02:02 +00:00
rlcompleter.py
runpy.py
sched.py
secrets.py
selectors.py
shelve.py
shlex.py [3.14] gh-138804: Check type in shlex.quote (GH-138809) (#138846) 2025-09-13 21:29:50 +03:00
shutil.py [3.14] gh-132983: Add missing references to Zstandard in shutil docstrings (GH-136617) (#137052) 2025-07-25 12:30:11 +03:00
signal.py
site.py [3.14] gh-138993: Dedent credits text (GH-138994) (#140088) 2025-10-15 14:05:47 +03:00
smtplib.py [3.14] gh-139434: Update selected RFC 2822 references to RFC 5322 (GH-139435) (#141025) 2025-11-04 16:23:16 -05:00
socket.py
socketserver.py
sre_compile.py
sre_constants.py
sre_parse.py
ssl.py
stat.py
statistics.py [3.14] gh-140938: Raise ValueError for infinite inputs to stdev/pstdev (GH-141531) (#141575) 2025-11-14 18:58:40 -08:00
stringprep.py
struct.py
subprocess.py [3.14] gh-74389: gh-70560: subprocess.Popen.communicate() now ignores stdin.flush error when closed (GH-142061) (#142064) 2025-11-28 23:03:05 -08:00
symtable.py
tabnanny.py
tarfile.py [3.14] gh-81325: Support path-like objects with streaming TarFile (GH-137188) (#137365) 2025-10-07 20:40:42 +02:00
tempfile.py [3.14] gh-132124: improve safety nets for creating AF_UNIX socket files (GH-134085) (#134447) 2025-05-21 17:36:32 +00:00
textwrap.py [3.14] gh-139065: Fix trailing space before long word in textwrap (GH-139070) (GH-139902) 2025-10-10 13:54:46 +00:00
this.py
threading.py [3.14] gh-114827: clarify threading.Event.wait timeout behavior (GH-114834) (#140100) 2025-10-14 14:13:33 +00:00
timeit.py
token.py
tokenize.py [3.14] gh-63161: Fix tokenize.detect_encoding() (GH-139446) (GH-140378) 2025-10-20 17:34:56 +00:00
trace.py
traceback.py [3.14] gh-137576: Fix for Basic REPL showing incorrect code in tracebacks with PYTHONSTARTUP (GH-137625) (#137771) 2025-08-27 18:28:20 +03:00
tracemalloc.py
tty.py
turtle.py [3.14] gh-138772: Fix and improve documentation for turtle color functions (GH-139325) (GH-140047) 2025-10-13 15:56:26 +00:00
types.py
typing.py [3.14] gh-138859: Account for ParamSpec defaults that are not lists … (GH-138868) (#140207) 2025-10-16 13:26:29 -07:00
uuid.py [3.14] gh-135244: generate UUID random Node ID with a CSPRNG as per RFC 9562, §6.10.3 (GH-135226) (#135255) 2025-06-08 12:13:04 +00:00
warnings.py
wave.py [3.14] gh-136523: Fix wave.Wave_write emitting an unraisable when open raises (GH-136529) (GH-136606) 2025-07-16 07:26:52 +00:00
weakref.py
webbrowser.py
zipapp.py
zipimport.py