Repository navigation
Release 3.10.22.3 - #123
Merged
Merged
Conversation
…rfile extended headers (pythonGH-151498) (pythonGH-151978) tarfile reads a member's extended header (a GNU long name/link or a pax header) with a single read sized by the header's size field: buf = tarfile.fileobj.read(self._block(self.size)) The size is taken from the archive and is not validated, so a ~512-byte crafted file can claim several gigabytes (or, via base-256 encoding, far more) and make read() pre-allocate that much memory -- on open/iterate, before any extraction filter runs. Read the extended-header data in bounded chunks instead, so an oversized or truncated header can no longer force a huge allocation. The bytes returned for valid archives are unchanged. (cherry picked from commit da99711) Co-authored-by: Shardul Deshpande <iamsharduld@users.noreply.github.com> (cherry picked from commit b83961a) 3.10.22.x: the test_tarfile conflict was context only (test_extractfile_attrs, pythongh-74468, isn't on this line); only the ReadSizeRecorder and ExtendedHeaderMemoryTest classes are added.
pyexpatns.h prefixes the bundled Expat's exported symbols with PyExpat_ so they cannot clash with a system libexpat loaded in the same process. Expat 2.9.0 added XML_SetHashSalt16Bytes, which pyexpat and _elementtree call, but the header did not rename it (upstream main does not either). The AllocTracker functions are already renamed on this line. Same change as 3.7.17.x 69ab1c8 (#117 review). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…3.10.22.3 release
ActiveState release of the end-of-life 3.10 line, on top of 3.10.22.2: the libffi 3.5+ ctypes build fix for Windows (bpo-45898, pythongh-92356), the pythongh-151497 tarfile extended-header fix, and the remaining pyexpatns.h renames for Expat 2.9.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
manoelc-dev
self-requested a review
October 29, 2026 22:42
ezequielp-activestate
approved these changes
Oct 29, 2026
ezequielp-activestate
left a comment
ezequielp-activestate
left a comment
There was a problem hiding this comment.
Approving.
- This release's diff is the libffi ctypes backport plus the pythongh-151497 /
pyexpatns.hchange, both reviewed separately, plus thepatchlevel.hbump to 3.10.22.3 and the What's New section. - The What's New section matches the code.
🟡 Non-blocking: besides dropping FFI_BUILDING, the _ctypes.vcxproj change defines USING_MALLOC_CLOSURE_DOT_C=1. On Windows, callback thunks then come from malloc_closure.c free-list pages rather than libffi's ffi_closure_alloc, because HAVE_FFI_CLOSURE_ALLOC isn't defined there. Upstream 3.11+ does the same, so this isn't a problem, but it is a runtime change beyond the build fix, and the release notes could mention it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 3.10.22.3, on top of 3.10.22.2. Merging this PR also merges #118 and #122: both branches are merged in unchanged, so GitHub marks them merged.
What's in it
ffi < 3.4.6cap was dropped. With this release the patch can be dropped.pyexpatns.hrenames for Expat 2.9.0.PY_VERSION3.10.22.3 and the "Notable changes in 3.10.22.3" section of What's New.Testing
test_ctypes,test_tarfile,test_pyexpat,test_xml_etree,test_xml_etree_c,test_saxandtest_minidompass.test_ctypespasses.pyexpatns.h: see 3.10.22.x: gh-151497 tarfile pre-allocation; rename XML_SetHashSalt16Bytes #122.