Skip to content

Commit 013edbc

Browse files
mandreeDaniel Engberg
mandree
authored and
Daniel Engberg
committed
lang/python314: Security update + other fixes
Fix critical use-after-free bug in LZMA/BZ2/ZLib decompressor routines when reusing decompressor instances after a MemoryError was raised from one. While here: - fix DEBUG build/package (several %%ABI%% were in the wrong place in pkg-plist that caused failed installs) - switch to using system textproc/expat2 library - issue warnings in pre-test that IPV6, PYMALLOC are required and DEBUG also breaks one self-test - bump PORTREVISION - drop LTOFULL again and make LTO use =full References: https://mail.python.org/archives/list/[email protected]/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3 https://www.cve.org/CVERecord?id=CVE-2026-6100 python/cpython#148396 Obtained from: GitHub repo python/cpython@c8d8173 Security: CVE-2026-6100 b8e9f33c-375d-11f1-a119-e36228bfe7d4
1 parent 97f22e4 commit 013edbc

3 files changed

Lines changed: 104 additions & 32 deletions

File tree

‎lang/python314/Makefile‎

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
PORTNAME= python
22
DISTVERSION= ${PYTHON_DISTVERSION} # see Makefile.version
3+
PORTREVISION= 1
34
CATEGORIES= lang python
45
MASTER_SITES= PYTHON/ftp/python/${DISTVERSION:C/[a-z].*//}
56
PKGNAMESUFFIX= ${PYTHON_SUFFIX}
@@ -12,7 +13,8 @@ WWW= https://www.python.org/
1213

1314
LICENSE= PSFL
1415

15-
LIB_DEPENDS= libffi.so:devel/libffi \
16+
LIB_DEPENDS= libexpat.so:textproc/expat2 \
17+
libffi.so:devel/libffi \
1618
libzstd.so:archivers/zstd
1719

1820
USES= compiler:c11 cpe ncurses pathfix pkgconfig readline \
@@ -32,7 +34,7 @@ PYTHON_VERSION= python${PYTHON_VER}
3234
PYTHON_SUFFIX= ${PYTHON_VER:S/.//g}
3335

3436
DISABLED_EXTENSIONS= _gdbm _sqlite3 _tkinter
35-
CONFIGURE_ARGS+= --enable-shared --without-ensurepip
37+
CONFIGURE_ARGS+= --enable-shared --without-ensurepip --with-system-expat
3638
CONFIGURE_ENV+= OPT="" # Null out OPT to respect user CFLAGS and remove optimizations
3739

3840
INSTALL_TARGET= altinstall # Don't want cloberring of unprefixed files
@@ -54,13 +56,12 @@ PLIST_SUB= ABI=${ABIFLAGS} \
5456
XYZDOT=${DISTVERSION:C/[a-z].*//} \
5557
OSMAJOR=${OSVERSION:C/([0-9]*)[0-9]{5}/\1/} # For plat-freebsd* in pkg-plist. https://bugs.python.org/issue19554
5658

57-
OPTIONS_DEFINE= DEBUG IPV6 LIBMPDEC NLS PYMALLOC
59+
OPTIONS_DEFINE= DEBUG IPV6 LIBMPDEC LTO NLS PYMALLOC
5860
OPTIONS_DEFAULT= LIBMPDEC LTO PYMALLOC
59-
OPTIONS_EXCLUDE_powerpc64= LTO LTOFULL
60-
OPTIONS_EXCLUDE_riscv64= LTO LTOFULL
61-
OPTIONS_RADIO= HASH LTO
61+
OPTIONS_EXCLUDE_powerpc64= LTO
62+
OPTIONS_EXCLUDE_riscv64= LTO
63+
OPTIONS_RADIO= HASH
6264
OPTIONS_RADIO_HASH= FNV SIPHASH
63-
OPTIONS_RADIO_LTO= LTO LTOFULL
6465
OPTIONS_SUB= yes
6566

6667
LIBMPDEC_DESC= Use libmpdec from ports instead of bundled version
@@ -82,8 +83,7 @@ IPV6_CONFIGURE_ENABLE= ipv6
8283
LIBMPDEC_CONFIGURE_ON= --with-system-libmpdec
8384
LIBMPDEC_LIB_DEPENDS= libmpdec.so:math/mpdecimal
8485

85-
LTO_CONFIGURE_ON= --with-lto
86-
LTOFULL_CONFIGURE_ON= --with-lto=full
86+
LTO_CONFIGURE_ON= --with-lto=full
8787

8888
# Use CPPFLAGS over CFLAGS due to -I ordering, causing elementtree and pyexpat
8989
# to break in Python 2.7, or preprocessor complaints in Python >= 3.3
@@ -133,7 +133,6 @@ post-patch:
133133
# disable the detection of includes and library from e2fsprogs-libuuid,
134134
# which introduces hidden dependency and breaks build
135135
@${REINPLACE_CMD} -e 's|uuid/uuid.h|ignore_&|' ${WRKSRC}/configure
136-
137136
# disable detection of multiarch as it breaks with clang >= 13, which adds a
138137
# major.minor version number in -print-multiarch output, confusing Python
139138
@${REINPLACE_CMD} -e 's|^\( *MULTIARCH=\).*--print-multiarch.*|\1|' ${WRKSRC}/configure
@@ -142,6 +141,8 @@ post-patch:
142141
. for _module in ${DISABLED_EXTENSIONS}
143142
@${ECHO_CMD} ${_module} >> ${WRKSRC}/Modules/Setup.local
144143
. endfor
144+
# Strip Expat module
145+
${RM} -R ${WRKSRC}/Modules/expat
145146

146147
post-install:
147148
.if ! ${PORT_OPTIONS:MDEBUG}
@@ -185,10 +186,16 @@ pre-test:
185186
@${ECHO_CMD} "=== NOTE: the py314-* gdbm, sqlite3, tkinter modules must be rebuilt before the test ==="
186187
.if ${PORT_OPTIONS:MDEBUG}
187188
@${ECHO_CMD} "=== NOTE: The test_ssl test is known to fail with DEBUG option enabled ==="
189+
.endif
190+
.if empty(PORT_OPTIONS:MIPV6)
191+
@${ECHO_CMD} "=== NOTE: Some asynch tests require IPV6 support enabled, expect some test failures ==="
192+
.endif
193+
.if empty(PORT_OPTIONS:MPYMALLOC)
194+
@${ECHO_CMD} "=== NOTE: Some tests depend on PYMALLOC option enabled, expect some test failures ==="
188195
.endif
189196
sleep 5
190197

191198
post-clean:
192-
${RM} ${_sigstorebundle}
199+
@${RM} ${_sigstorebundle}
193200

194201
.include <bsd.port.mk>

‎lang/python314/files/patch-gh-148395-fix-possible-uaf-in-decompressors‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
From c8d8173c4b06d06902c99ec010ad785a30952880 Mon Sep 17 00:00:00 2001
2+
From: Stan Ulbrych <[email protected]>
3+
Date: Mon, 13 Apr 2026 02:14:54 +0100
4+
Subject: [PATCH] gh-148395: Fix a possible UAF in
5+
`{LZMA,BZ2,_Zlib}Decompressor` (GH-148396)
6+
7+
Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
8+
(cherry picked from commit 8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2)
9+
10+
Co-authored-by: Stan Ulbrych <[email protected]>
11+
---
12+
.../Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst | 5 +++++
13+
Modules/_bz2module.c | 1 +
14+
Modules/_lzmamodule.c | 1 +
15+
Modules/zlibmodule.c | 1 +
16+
4 files changed, 8 insertions(+)
17+
create mode 100644 Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
18+
19+
diff --git a/Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst b/Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
20+
new file mode 100644
21+
index 00000000000000..9502189ab199c1
22+
--- /dev/null
23+
+++ ./Misc/NEWS.d/next/Security/2026-04-10-16-28-21.gh-issue-148395.kfzm0G.rst
24+
@@ -0,0 +1,5 @@
25+
+Fix a dangling input pointer in :class:`lzma.LZMADecompressor`,
26+
+:class:`bz2.BZ2Decompressor`, and internal :class:`!zlib._ZlibDecompressor`
27+
+when memory allocation fails with :exc:`MemoryError`, which could let a
28+
+subsequent :meth:`!decompress` call read or write through a stale pointer to
29+
+the already-released caller buffer.
30+
diff --git a/Modules/_bz2module.c b/Modules/_bz2module.c
31+
index 9e85e0de42cd8d..055ce82e7d2863 100644
32+
--- ./Modules/_bz2module.c
33+
+++ b/Modules/_bz2module.c
34+
@@ -593,6 +593,7 @@ decompress(BZ2Decompressor *d, char *data, size_t len, Py_ssize_t max_length)
35+
return result;
36+
37+
error:
38+
+ bzs->next_in = NULL;
39+
Py_XDECREF(result);
40+
return NULL;
41+
}
42+
diff --git a/Modules/_lzmamodule.c b/Modules/_lzmamodule.c
43+
index 462c2181fa6036..6785dc56730c5c 100644
44+
--- ./Modules/_lzmamodule.c
45+
+++ b/Modules/_lzmamodule.c
46+
@@ -1120,6 +1120,7 @@ decompress(Decompressor *d, uint8_t *data, size_t len, Py_ssize_t max_length)
47+
return result;
48+
49+
error:
50+
+ lzs->next_in = NULL;
51+
Py_XDECREF(result);
52+
return NULL;
53+
}
54+
diff --git a/Modules/zlibmodule.c b/Modules/zlibmodule.c
55+
index 5b6b0c5cac864a..a86aa5fdbb576c 100644
56+
--- ./Modules/zlibmodule.c
57+
+++ b/Modules/zlibmodule.c
58+
@@ -1675,6 +1675,7 @@ decompress(ZlibDecompressor *self, uint8_t *data,
59+
return result;
60+
61+
error:
62+
+ self->zst.next_in = NULL;
63+
Py_XDECREF(result);
64+
return NULL;
65+
}

‎lang/python314/pkg-plist‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -363,9 +363,9 @@ lib/python%%XYDOT%%/__pycache__/_sitebuiltins.cpython-%%XY%%.pyc
363363
lib/python%%XYDOT%%/__pycache__/_strptime.cpython-%%XY%%.opt-1.pyc
364364
lib/python%%XYDOT%%/__pycache__/_strptime.cpython-%%XY%%.opt-2.pyc
365365
lib/python%%XYDOT%%/__pycache__/_strptime.cpython-%%XY%%.pyc
366-
lib/python%%XYDOT%%/__pycache__/_sysconfigdata__freebsd_.cpython-%%XY%%.opt-1.pyc
367-
lib/python%%XYDOT%%/__pycache__/_sysconfigdata__freebsd_.cpython-%%XY%%.opt-2.pyc
368-
lib/python%%XYDOT%%/__pycache__/_sysconfigdata__freebsd_.cpython-%%XY%%.pyc
366+
lib/python%%XYDOT%%/__pycache__/_sysconfigdata_%%ABI%%_freebsd_.cpython-%%XY%%.opt-1.pyc
367+
lib/python%%XYDOT%%/__pycache__/_sysconfigdata_%%ABI%%_freebsd_.cpython-%%XY%%.opt-2.pyc
368+
lib/python%%XYDOT%%/__pycache__/_sysconfigdata_%%ABI%%_freebsd_.cpython-%%XY%%.pyc
369369
lib/python%%XYDOT%%/__pycache__/_threading_local.cpython-%%XY%%.opt-1.pyc
370370
lib/python%%XYDOT%%/__pycache__/_threading_local.cpython-%%XY%%.opt-2.pyc
371371
lib/python%%XYDOT%%/__pycache__/_threading_local.cpython-%%XY%%.pyc
@@ -882,8 +882,8 @@ lib/python%%XYDOT%%/_pyrepl/windows_console.py
882882
lib/python%%XYDOT%%/_pyrepl/windows_eventqueue.py
883883
lib/python%%XYDOT%%/_sitebuiltins.py
884884
lib/python%%XYDOT%%/_strptime.py
885-
lib/python%%XYDOT%%/_sysconfig_vars__freebsd_.json
886-
lib/python%%XYDOT%%/_sysconfigdata__freebsd_.py
885+
lib/python%%XYDOT%%/_sysconfig_vars_%%ABI%%_freebsd_.json
886+
lib/python%%XYDOT%%/_sysconfigdata_%%ABI%%_freebsd_.py
887887
lib/python%%XYDOT%%/_threading_local.py
888888
lib/python%%XYDOT%%/_weakrefset.py
889889
lib/python%%XYDOT%%/abc.py
@@ -1120,18 +1120,18 @@ lib/python%%XYDOT%%/concurrent/interpreters/__pycache__/_queues.cpython-%%XY%%.o
11201120
lib/python%%XYDOT%%/concurrent/interpreters/__pycache__/_queues.cpython-%%XY%%.pyc
11211121
lib/python%%XYDOT%%/concurrent/interpreters/_crossinterp.py
11221122
lib/python%%XYDOT%%/concurrent/interpreters/_queues.py
1123-
lib/python%%XYDOT%%/config-%%XYDOT%%/Makefile
1124-
lib/python%%XYDOT%%/config-%%XYDOT%%/Setup
1125-
lib/python%%XYDOT%%/config-%%XYDOT%%/Setup.bootstrap
1126-
lib/python%%XYDOT%%/config-%%XYDOT%%/Setup.local
1127-
lib/python%%XYDOT%%/config-%%XYDOT%%/Setup.stdlib
1128-
lib/python%%XYDOT%%/config-%%XYDOT%%/config.c
1129-
lib/python%%XYDOT%%/config-%%XYDOT%%/config.c.in
1130-
lib/python%%XYDOT%%/config-%%XYDOT%%/install-sh
1131-
lib/python%%XYDOT%%/config-%%XYDOT%%/libpython%%XYDOT%%%%ABI%%.a
1132-
lib/python%%XYDOT%%/config-%%XYDOT%%/makesetup
1133-
lib/python%%XYDOT%%/config-%%XYDOT%%/python-config.py
1134-
lib/python%%XYDOT%%/config-%%XYDOT%%/python.o
1123+
lib/python%%XYDOT%%/config-%%XYDOT%%%%ABI%%/Makefile
1124+
lib/python%%XYDOT%%/config-%%XYDOT%%%%ABI%%/Setup
1125+
lib/python%%XYDOT%%/config-%%XYDOT%%%%ABI%%/Setup.bootstrap
1126+
lib/python%%XYDOT%%/config-%%XYDOT%%%%ABI%%/Setup.local
1127+
lib/python%%XYDOT%%/config-%%XYDOT%%%%ABI%%/Setup.stdlib
1128+
lib/python%%XYDOT%%/config-%%XYDOT%%%%ABI%%/config.c
1129+
lib/python%%XYDOT%%/config-%%XYDOT%%%%ABI%%/config.c.in
1130+
lib/python%%XYDOT%%/config-%%XYDOT%%%%ABI%%/install-sh
1131+
lib/python%%XYDOT%%/config-%%XYDOT%%%%ABI%%/libpython%%XYDOT%%%%ABI%%.a
1132+
lib/python%%XYDOT%%/config-%%XYDOT%%%%ABI%%/makesetup
1133+
lib/python%%XYDOT%%/config-%%XYDOT%%%%ABI%%/python-config.py
1134+
lib/python%%XYDOT%%/config-%%XYDOT%%%%ABI%%/python.o
11351135
lib/python%%XYDOT%%/configparser.py
11361136
lib/python%%XYDOT%%/contextlib.py
11371137
lib/python%%XYDOT%%/contextvars.py
@@ -2581,9 +2581,9 @@ lib/python%%XYDOT%%/lib-dynload/_elementtree.cpython-%%XY%%%%ABI%%.so
25812581
lib/python%%XYDOT%%/lib-dynload/_hmac.cpython-%%XY%%%%ABI%%.so
25822582
%%SUPPORTED_OPENSSL%%lib/python%%XYDOT%%/lib-dynload/_hashlib.cpython-%%XY%%%%ABI%%.so
25832583
lib/python%%XYDOT%%/lib-dynload/_heapq.cpython-%%XY%%%%ABI%%.so
2584-
lib/python%%XYDOT%%/lib-dynload/_interpchannels.cpython-%%XY%%.so
2585-
lib/python%%XYDOT%%/lib-dynload/_interpqueues.cpython-%%XY%%.so
2586-
lib/python%%XYDOT%%/lib-dynload/_interpreters.cpython-%%XY%%.so
2584+
lib/python%%XYDOT%%/lib-dynload/_interpchannels.cpython-%%XY%%%%ABI%%.so
2585+
lib/python%%XYDOT%%/lib-dynload/_interpqueues.cpython-%%XY%%%%ABI%%.so
2586+
lib/python%%XYDOT%%/lib-dynload/_interpreters.cpython-%%XY%%%%ABI%%.so
25872587
lib/python%%XYDOT%%/lib-dynload/_json.cpython-%%XY%%%%ABI%%.so
25882588
lib/python%%XYDOT%%/lib-dynload/_lsprof.cpython-%%XY%%%%ABI%%.so
25892589
lib/python%%XYDOT%%/lib-dynload/_lzma.cpython-%%XY%%%%ABI%%.so
@@ -8313,4 +8313,4 @@ lib/python%%XYDOT%%/zoneinfo/_tzpath.py
83138313
lib/python%%XYDOT%%/zoneinfo/_zoneinfo.py
83148314
libdata/pkgconfig/python-%%XYDOT%%-embed.pc
83158315
libdata/pkgconfig/python-%%XYDOT%%.pc
8316-
share/man/man1/python%%XYDOT%%%%ABI%%.1.gz
8316+
share/man/man1/python%%XYDOT%%.1.gz

0 commit comments

Comments
 (0)