Skip to content

gh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor#148396

Merged
gpshead merged 4 commits intopython:mainfrom
StanFromIreland:mem-stale
Apr 13, 2026
Merged

gh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor#148396
gpshead merged 4 commits intopython:mainfrom
StanFromIreland:mem-stale

Conversation

@StanFromIreland
Copy link
Copy Markdown
Member

@StanFromIreland StanFromIreland commented Apr 11, 2026 •
edited by bedevere-app bot
Loading

@bedevere-app bedevere-app bot mentioned this pull request Apr 11, 2026
Open
emmatyping
emmatyping approved these changes Apr 11, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@emmatyping emmatyping left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for fixing this!

@picnixz picnixz changed the title gh-148395: Fix a possible UAF in {LZMA, BZ2, _Zlib}Decompressor gh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor Apr 11, 2026
picnixz
picnixz reviewed Apr 11, 2026
View reviewed changes
@gpshead gpshead merged commit 8fc66ae into python:main Apr 13, 2026
54 checks passed
@gpshead gpshead added awaiting merge needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 13, 2026
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland @miss-islington
pythongh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor (…
5b8d240 
…pythonGH-148396)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)

Co-authored-by: Stan Ulbrych <stan@python.org>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148479 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Apr 13, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland @miss-islington
pythongh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor (…
c8d8173 
…pythonGH-148396)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)

Co-authored-by: Stan Ulbrych <stan@python.org>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148480 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Apr 13, 2026
gpshead pushed a commit that referenced this pull request Apr 13, 2026
@miss-islington @StanFromIreland
[3.13] gh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor (
c3cf71c 
GH-148396) (#148479)

gh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (GH-148396)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)

Co-authored-by: Stan Ulbrych <stan@python.org>
gpshead pushed a commit that referenced this pull request Apr 13, 2026
@miss-islington @StanFromIreland
[3.14] gh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor (
6a5f79c 
GH-148396) (#148480)

gh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decompressor` (GH-148396)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)

Co-authored-by: Stan Ulbrych <stan@python.org>
@StanFromIreland StanFromIreland deleted the mem-stale branch April 13, 2026 06:38
@StanFromIreland
Copy link
Copy Markdown
Member Author

StanFromIreland commented Apr 13, 2026

Backporting everywhere, as this is GHSA-2fvp-c227-m694/CVE-2026-6100.

@StanFromIreland StanFromIreland added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Apr 13, 2026
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2 3.10

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland @miss-islington
pythongh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor (…
e100aea 
…pythonGH-148396)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)

Co-authored-by: Stan Ulbrych <stan@python.org>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148503 is a backport of this pull request to the 3.12 branch.

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2 3.11

@bedevere-app bedevere-app bot removed the needs backport to 3.12 only security fixes label Apr 13, 2026
StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland
[3.11] pythongh-148395: Fix a possible UAF in `{LZMA,BZ2,_Zlib}Decomp…
72d9d77 
…ressor` (pythonGH-148396)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress
(cherry picked from commit 8fc66ae)

Co-authored-by: Stan Ulbrych <stan@python.org>
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148504 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Apr 13, 2026
StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Apr 13, 2026
@StanFromIreland
pythongh-148395: Fix a possible UAF in {LZMA,BZ2,_Zlib}Decompressor (…
fe18959 
…pythonGH-148396)

Fix dangling input pointer after `MemoryError` in _lzma/_bz2/_ZlibDecompressor.decompress

(cherry picked from commit 8fc66ae)
@bedevere-app
Copy link
Copy Markdown

bedevere-app bot commented Apr 13, 2026

GH-148505 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.10 only security fixes label Apr 13, 2026
@sethmlarson sethmlarson added type-security A security issue needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Apr 13, 2026
@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2 3.11

@miss-islington-app
Copy link
Copy Markdown

miss-islington-app bot commented Apr 13, 2026

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2 3.10

@sethmlarson
Copy link
Copy Markdown
Contributor

sethmlarson commented Apr 13, 2026

Apologies, I was working on an old version of the page without the 3.11/3.10 backports. Ignore the noise.

@StanFromIreland StanFromIreland removed needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Apr 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

@emmatyping emmatyping emmatyping approved these changes

@picnixz picnixz Awaiting requested review from picnixz

Assignees

@gpshead gpshead

Labels

awaiting merge type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@StanFromIreland @bedevere-bot @sethmlarson @gpshead @emmatyping @picnixz