Skip to content

[3.3] bpo-29591, bpo-30694: Upgrade Modules/expat to libexpat 2.2.1 (#2164) #2204

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jul 16, 2017
Merged

[3.3] bpo-29591, bpo-30694: Upgrade Modules/expat to libexpat 2.2.1 (#2164) #2204

merged 5 commits into from
Jul 16, 2017

Conversation

vstinner
Copy link
Member

  • bpo-29591: Upgrade Modules/expat to libexpat 2.2

  • bpo-29591: Restore Python changes on expat

  • bpo-29591: Remove expat config of unsupported platforms

Remove the configuration (Modules/expat/*config.h) of unsupported
platforms:

  • Amiga

  • MacOS Classic on PPC32

  • Open Watcom

  • bpo-29591: Remove useless XML_HAS_SET_HASH_SALT

The XML_HAS_SET_HASH_SALT define of Modules/expat/expat.h became
useless since our local expat copy was upgrade to expat 2.1 (it's now
expat 2.2.0).

(cherry picked from commit 23ec4b5)

* bpo-29591: Upgrade Modules/expat to libexpat 2.2

* bpo-29591: Restore Python changes on expat

* bpo-29591: Remove expat config of unsupported platforms

Remove the configuration (Modules/expat/*config.h) of unsupported
platforms:

* Amiga
* MacOS Classic on PPC32
* Open Watcom

* bpo-29591: Remove useless XML_HAS_SET_HASH_SALT

The XML_HAS_SET_HASH_SALT define of Modules/expat/expat.h became
useless since our local expat copy was upgrade to expat 2.1 (it's now
expat 2.2.0).

(cherry picked from commit 23ec4b5)
@vstinner
Copy link
Member Author

As for the PR #2203 (backport for Python 3.4), Travis CI and AppVeyor are not configured on the 3.3 branch :-(

@vstinner
Copy link
Member Author

This backport is different from my other "libexpat update" backports since Python 3.3 still uses libexpat 2.1.0, whereas other branches use libexpat 2.1.1 (.1 vs .0). But the result is the same: with this PR, Python 3.3 will get libexpat 2.2.0.

@vstinner
Copy link
Member Author

So this PR also fixes vulnerabilities of libexpat 2.1.0 which has been fixed in libexpat 2.1.1:
http://python-security.readthedocs.io/vuln/issue_26556_expat_2.1.1.html

@vstinner vstinner added the type-security A security issue label Jun 23, 2017
vstinner and others added 3 commits June 23, 2017 15:58
New file: Modules/expat/siphash.h.
(cherry picked from commit 5ff7132)
bpo-30726, bpo-29591: libexpat 2.2.1 of Modules/expat/ now uses
a winconfig.h configuration file which already defines:

* XML_NS
* XML_DTD
* BYTEORDER=1234
* XML_CONTEXT_BYTES=1024
* HAVE_MEMMOVE

Remove these defines from PCbuild/_elementtree.vcxproj to prevent
compiler warnings.

Co-Authored-By: Jeremy Kloth <[email protected]>
(cherry picked from commit c8fb58b)
…2319)

* bpo-30726: Fix elementtree warnings on Windows

Caused by usage of `getenv` which should be safe. And a few integer
truncations which should also be ok.

* bpo-30726: Don't ignore libexpat warnings which haypo intends to fix upstream

(cherry picked from commit 87c6555)
@vstinner
Copy link
Member Author

I updated my PR to now upgrade libexpat from 2.1.1 to 2.2.1 (previously, it was to upgrade to 2.2.0). I also included PCbuild/_elementtree.vcxproj changes to fix compiler warnings.

@vstinner vstinner changed the title [3.3] bpo-29591: Upgrade Modules/expat to libexpat 2.2 (#2164) [3.3] bpo-29591: Upgrade Modules/expat to libexpat 2.2.1 (#2164) Jun 23, 2017
@vstinner vstinner changed the title [3.3] bpo-29591: Upgrade Modules/expat to libexpat 2.2.1 (#2164) [3.3] bpo-29591, bpo-30694: Upgrade Modules/expat to libexpat 2.2.1 (#2164) Jul 11, 2017
@ned-deily ned-deily merged commit ab90986 into python:3.3 Jul 16, 2017
@vstinner vstinner deleted the expat33 branch August 10, 2017 23:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type-security A security issue
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants