Skip to content

[3.12] gh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor (GH-148396) - #148503

Merged
Yhg1s merged 3 commits into
python:3.12from
miss-islington:backport-8fc66ae-3.12
Aug 4, 2026
Merged

[3.12] gh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor (GH-148396)#148503
Yhg1s merged 3 commits into
python:3.12from
miss-islington:backport-8fc66ae-3.12

Conversation

@miss-islington

@miss-islingtonmiss-islington commented Apr 13, 2026•
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Contributor

Fix dangling input pointer after MemoryError in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)

Co-authored-by: Stan Ulbrych stan@python.org

@StanFromIreland@miss-islington
pythongh-148395: Fix a possible UAF in{LZMA,BZ2,_Zlib}Decompressor(…
e100aea
…pythonGH-148396)
Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)
Co-authored-by: Stan Ulbrych <stan@python.org>
@bedevere-appbedevere-appBot mentioned this pull request Apr 13, 2026
Merged
@bedevere-appbedevere-appBot mentioned this pull request Apr 13, 2026
Closed
@StanFromIreland

StanFromIreland commented Apr 13, 2026

Copy link
Copy Markdown
Member

Damn, too many tabs and I edited the wrong backport :-/

StanFromIreland
StanFromIreland reviewed Apr 13, 2026
View reviewed changes
Comment threadMisc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst Outdated
jef-n added a commit to jef-n/OSGeo4W that referenced this pull request Apr 16, 2026
@jef-n
python3: applypython/cpython#148503(CVE-2026-6100)
cd9ad91
@github-actions

This comment was marked as spam.

Sign in to view
@github-actionsgithub-actionsBot added the stale Stale PR or inactive for long period of time. label May 18, 2026
@StanFromIrelandStanFromIreland removed the stale Stale PR or inactive for long period of time. label May 18, 2026
@martinmarques

martinmarques commented Jul 8, 2026

Copy link
Copy Markdown

@StanFromIreland is the review still ongoing, or is this PR stalled?

@StanFromIreland

StanFromIreland commented Jul 8, 2026

Copy link
Copy Markdown
Member

This will be merged before the next release.

@gonzalemario

gonzalemario commented Jul 8, 2026

Copy link
Copy Markdown

It's interesting that from at least out of 5 different branches (3.10 to 3.14), all the PRs have been merged already but 3.12. At least that's what I got from #148395

If I may, do you know why?

@StanFromIreland

StanFromIreland commented Jul 8, 2026

Copy link
Copy Markdown
Member

They have different release managers, and it's up to their discretion.

@martinmarques

martinmarques commented Jul 9, 2026

Copy link
Copy Markdown

This will be merged before the next release.

Is there a date for this? I was under the impression that once the major version goes into security support, releases happen at the discretion of the manager. But here it looks like there is some timeline for the next release.

BTW, I appreciate your prompt response

@StanFromIreland

StanFromIreland commented Jul 9, 2026

Copy link
Copy Markdown
Member

There's no timeline.

@Vamsi-kluVamsi-klu mentioned this pull request Jul 26, 2026
Closed
4 tasks
@Yhg1s
Yhg1s merged commit ea8d735 into python:3.12Aug 4, 2026
28 checks passed
@miss-islington
miss-islington deleted the backport-8fc66ae-3.12 branch August 4, 2026 09:18
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@StanFromIrelandStanFromIrelandStanFromIreland left review comments

Assignees

@Yhg1sYhg1s

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@miss-islington@StanFromIreland@martinmarques@gonzalemario@Yhg1s