gh-142557: fix UAF in `bytearray.__mod__` when object is mutated while formatting `%`-style arguments (GH-143213)
(cherry picked from commit 61ee04834b)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
The result tuple was leaked if __ctypes_from_outparam__() failed for any item.
(cherry picked from commit 579c5b496b)
Signed-off-by: Yongtao Huang <yongtaoh2022@gmail.com>
Co-authored-by: Yongtao Huang <yongtaoh2022@gmail.com>
gh-142975: During GC, mark frozen objects with a merged zero refcount for destruction (GH-143156)
(cherry picked from commit 8611f74e08)
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
This happened when the Counter was mutated when incrementing
the value for an existing key.
(cherry picked from commit 86d904588e)
Co-authored-by: kaushal trivedi <155625932+Kaushalt2004@users.noreply.github.com>
The unknown-8bit trick was designed to deal with unknown bytes in an
ASCII message, and it works fine for that. However, I also tried to
extend it to handle bytes that can't be decoded using the charset
specified in an encoded word, and there it fails because there can be
other non-ASCII characters that were *successfully* decoded. The fix is
simple: do the unknown-8bit encoding using the utf-8 codec. This is
especially appropriate since anyone trying to do recovery on an unknown
byte string will probably attempt utf-8 first.
(cherry picked from commit 1e17ccd030)
Co-authored-by: R. David Murray <rdmurray@bitdance.com>
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Count the number of Element attribute accesses as a proxy for work done.
With double the amount of work, a ratio of 2.0 indicates linear scaling
and 4.0 quadratic scaling. Use 3.2 as an intermediate threshold.
(cherry picked from commit 57937a8e5e)
Co-authored-by: Sam Gross <colesbury@gmail.com>
gh-109263: Start process from spawn context in multiprocessing no longer have side effect (GH-135813)
(cherry picked from commit c2202a7e66)
Co-authored-by: AN Long <aisk@users.noreply.github.com>
gh-122431: Correct the non-negative error message in `readline.append_history_file` (GH-143075)
"positive" -> "non-negative", since zero is included.
(cherry picked from commit a273bc99d2)
Co-authored-by: Zheng Yu <dataisland@outlook.com>
gh-89152: Note truth testing exception in `stdtypes.rst` (GH-137640)
(cherry picked from commit 3c0888b25b)
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
gh-143010: Prevent a TOCTOU issue by only calling open once (GH-143011)
RDM: per AZero13's research the 'x' option did not exist when this code was written, This
modernization can thus drop the fd trick in _create_carefully and just use open with 'x' to achieve the same goal more securely.
(cherry picked from commit a88d1b8dab)
Co-authored-by: AZero13 <gfunni234@gmail.com>
Co-authored-by: sobolevn <mail@sobolevn.me>
gh-143057: avoid locking in `tracemalloc` C-APIs when it is not enabled (GH-143065)
(cherry picked from commit e728b006de)
Co-authored-by: Kumar Aditya <kumaraditya@python.org>
gh-143046: Make asyncio REPL respect the `-q` flag (quiet mode) (GH-143047)
(cherry picked from commit 6213a512bf)
Co-authored-by: Bartosz Sławecki <bartosz@ilikepython.com>
gh-79986: Add parsing for References/In-Reply-To email headers (GH-137201)
This is a followup to 46d88a1131 (GH-13397),
which added parsing for Message-ID. Similar handling is needed for the
other two identification headers.
(cherry picked from commit 79aa43a979)
Co-authored-by: elenril <anton@khirnov.net>
gh-70647: Better promote how to safely parse yearless dates in datetime. (GH-116179)
* gh-70647: Better promote how to safely parse yearless dates in datetime.
Every four years people encounter this because it just isn't obvious.
This moves the footnote up to a note with a code example.
We'd love to change the default year value for datetime but doing
that could have other consequences for existing code. This documented
workaround *always* works.
* doctest code within note is bad, dedent.
* Update to match the error message.
* remove no longer referenced footnote
* ignore the warning in the doctest
* use Petr's suggestion for the docs to hide the warning processing
* cover date.strptime (3.14) as well
(cherry picked from commit b8d3fddba6)
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
gh-142145: relax the no-longer-quadratic test timing (GH-143030)
* gh-142145: relax the no-longer-quadratic test timing
* require cpu resource
(cherry picked from commit 8d2d7bb2e7)
Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
gh-142754: Ensure that Element & Attr instances have the ownerDocument attribute (GH-142794)
(cherry picked from commit 1cc7551b3f)
Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
gh-143012: use `Py_ssize_t` cast for `PyBytes_FromStringAndSize` (GH-143013)
(cherry picked from commit 5989095dfd)
Co-authored-by: AZero13 <gfunni234@gmail.com>
gh-142560: prevent use-after-free in search-like methods by exporting buffer in bytearray (GH-142938)
(cherry picked from commit 220f0b1077)
Co-authored-by: wangxiaolei <fatelei@gmail.com>
gh-142527: Docs: Clarify that random.seed() discards the sign of an integer input (GH-142483)
If *a* is an integer, the sign of *a* is discarded in the C source code. Clarify this behavior to prevent foot guns, where a common use case might naively assume that flipping the sign will produce different sequences (e.g. for a train/test split of a synthetic data generator in machine learning).
(cherry picked from commit 610aabfef2)
Co-authored-by: Andrej <andrej.karpathy@gmail.com>
Co-authored-by: Adam Turner <9087854+AA-Turner@users.noreply.github.com>
gh-142784: make the asyncio REPL call `loop.close()` at exit (GH-142785)
(cherry picked from commit ddfc155d3a)
Co-authored-by: Bartosz Sławecki <bartosz@ilikepython.com>
gh-142873: Do not check for `PyContextVar_CheckExact` twice in `PyContextVar_Set` (GH-142874)
(cherry picked from commit e61a447d0e)
Co-authored-by: sobolevn <mail@sobolevn.me>
gh-142876: remove reference to thread in documentation of `asyncio.Queue.shutdown` (GH-142888)
(cherry picked from commit 77c8e6a2b8)
Co-authored-by: Damian Birchler <damian@damianbirchler.net>
decimal docs: specification link and examples (GH-128698)
(cherry picked from commit 2450be607c)
Co-authored-by: Sergey B Kirpichev <skirpichev@gmail.com>
Co-authored-by: RUANG (James Roy) <longjinyii@outlook.com>
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
gh-112127: Fix possible use-after-free in atexit.unregister() (GH-114092)
(cherry picked from commit 2b466c47c3)
Co-authored-by: Benjamin Johnson <ben332004@gmail.com>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
