Repository navigation
Release 3.9.25.4 - #124
Merged
Merged
Release 3.9.25.4#124
Conversation
…9791) (cherry picked from commit 38f331d) 3.9.25.x: 3.9's format table keeps the 'u'/'U'/'Z' entries under #ifdef CTYPES_UNICODE, so the conflict in formattable and in _ctypes_get_fielddesc() was resolved with upstream's NULL-initialised table and _ctypes_init_fielddesc() call, and the matching cases in _ctypes_init_fielddesc() are guarded the same way. Needed on Windows once the build uses libffi 3.5 or later, whose ffi.h always declares the ffi_type_* symbols dllimport, so the static table no longer compiles (C2099).
…file extended headers (pythonGH-151498) (pythonGH-151978) tarfile reads a member's extended header (a GNU long name/link or a pax header) with a single read sized by the header's size field: buf = tarfile.fileobj.read(self._block(self.size)) The size is taken from the archive and is not validated, so a ~512-byte crafted file can claim several gigabytes (or, via base-256 encoding, far more) and make read() pre-allocate that much memory -- on open/iterate, before any extraction filter runs. Read the extended-header data in bounded chunks instead, so an oversized or truncated header can no longer force a huge allocation. The bytes returned for valid archives are unchanged. (cherry picked from commit da99711) Co-authored-by: Shardul Deshpande <iamsharduld@users.noreply.github.com> (cherry picked from commit b83961a) 3.9.25.x: the test_tarfile conflict was context only (test_extractfile_attrs, pythongh-74468, isn't on this line); only the ReadSizeRecorder and ExtendedHeaderMemoryTest classes are added.
pyexpatns.h prefixes the bundled Expat's exported symbols with PyExpat_ so they cannot clash with a system libexpat loaded in the same process. Expat 2.9.0 added XML_SetAllocTrackerActivationThreshold and XML_SetAllocTrackerMaximumAmplification (pythongh-90949, CVE-2025-59375) and XML_SetHashSalt16Bytes, but the header did not rename them. The first two match upstream, 3.10.22.x and 3.7.17.x; pyexpat and _elementtree call XML_SetHashSalt16Bytes, which upstream does not rename yet either. Same change as 3.7.17.x 69ab1c8 (#117 review). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ActiveState release of the end-of-life 3.9 line, on top of 3.9.25.3: the libffi 3.5+ ctypes build fix for Windows (bpo-45898, pythongh-92356), the pythongh-151497 tarfile extended-header fix, and the remaining pyexpatns.h renames for Expat 2.9.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
manoelc-dev
self-requested a review
October 29, 2026 22:36
ezequielp-activestate
approved these changes
Oct 29, 2026
ezequielp-activestate
left a comment
ezequielp-activestate
left a comment
There was a problem hiding this comment.
Approving.
- This release's diff is the libffi ctypes backport plus the pythongh-151497 /
pyexpatns.hchange, both reviewed separately, plus thepatchlevel.hbump to 3.9.25.4 and the What's New section. - The What's New section matches the code.
🟡 Non-blocking: besides dropping FFI_BUILDING, the _ctypes.vcxproj change defines USING_MALLOC_CLOSURE_DOT_C=1. On Windows, callback thunks then come from malloc_closure.c free-list pages rather than libffi's ffi_closure_alloc, because HAVE_FFI_CLOSURE_ALLOC isn't defined there. Upstream 3.11+ does the same, so this isn't a problem, but it is a runtime change beyond the build fix, and the release notes could mention it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 3.9.25.4, on top of 3.9.25.3. Merging this PR also merges #119 and #121: both branches are merged in unchanged, so GitHub marks them merged.
What's in it
ffi < 3.4.6cap was dropped. With this release the patch can be dropped.pyexpatns.hrenames for Expat 2.9.0.PY_VERSION3.9.25.4 and the "Notable changes in 3.9.25.4" section of What's New.Testing
test_ctypes,test_tarfile,test_pyexpat,test_xml_etree,test_xml_etree_c,test_saxandtest_minidompass.test_ctypespasses.pyexpatns.h: see 3.9.25.x: gh-151497 tarfile pre-allocation; pyexpatns.h renames #121.