[3.9] gh-95778: CVE-2020-10735: Prevent DoS by very large int() (#96502)
* Correctly pre-check for int-to-str conversion (#96537)
Converting a large enough `int` to a decimal string raises `ValueError` as expected. However, the raise comes _after_ the quadratic-time base-conversion algorithm has run to completion. For effective DOS prevention, we need some kind of check before entering the quadratic-time loop. Oops! =)
The quick fix: essentially we catch _most_ values that exceed the threshold up front. Those that slip through will still be on the small side (read: sufficiently fast), and will get caught by the existing check so that the limit remains exact.
The justification for the current check. The C code check is:
```c
max_str_digits / (3 * PyLong_SHIFT) <= (size_a - 11) / 10
```
In GitHub markdown math-speak, writing $M$ for `max_str_digits`, $L$ for `PyLong_SHIFT` and $s$ for `size_a`, that check is:
$$\left\lfloor\frac{M}{3L}\right\rfloor \le \left\lfloor\frac{s - 11}{10}\right\rfloor$$
From this it follows that
$$\frac{M}{3L} < \frac{s-1}{10}$$
hence that
$$\frac{L(s-1)}{M} > \frac{10}{3} > \log_2(10).$$
So
$$2^{L(s-1)} > 10^M.$$
But our input integer $a$ satisfies $|a| \ge 2^{L(s-1)}$, so $|a|$ is larger than $10^M$. This shows that we don't accidentally capture anything _below_ the intended limit in the check.
Co-authored-by: Gregory P. Smith [Google LLC] <greg@krypto.org> Co-authored-by: Christian Heimes <christian@python.org> Co-authored-by: Mark Dickinson <dickinsm@gmail.com>
Gbp-Pq: Name 0002-3.9-gh-95778-CVE-2020-10735-Prevent-DoS-by-very-larg.patch
Matthias Klose [Tue, 20 Jan 2026 10:45:10 +0000 (11:45 +0100)]
langpack-gettext
# DP: Description: support alternative gettext tree in
# DP: /usr/share/locale-langpack; if a file is present in both trees,
# DP: prefer the newer one
# DP: Upstream status: Ubuntu-Specific
# DP: Description: support alternative gettext tree in
# DP: /usr/share/locale-langpack; if a file is present in both trees,
# DP: prefer the newer one
# DP: Upstream status: Ubuntu-Specific
Matthias Klose [Tue, 20 Jan 2026 10:45:10 +0000 (11:45 +0100)]
distutils-sysconfig
# DP: Get CONFIGURE_CFLAGS, CONFIGURE_CPPFLAGS, CONFIGURE_LDFLAGS from
# DP: the python build, when CFLAGS, CPPFLAGS, LDSHARED) are not set
# DP: in the environment.
# DP: Get CONFIGURE_CFLAGS, CONFIGURE_CPPFLAGS, CONFIGURE_LDFLAGS from
# DP: the python build, when CFLAGS, CPPFLAGS, LDSHARED) are not set
# DP: in the environment.
Matthias Klose [Tue, 20 Jan 2026 10:45:10 +0000 (11:45 +0100)]
distutils-install-layout
# DP: distutils: Add an option --install-layout=deb, which
# DP: - installs into $prefix/dist-packages instead of $prefix/site-packages.
# DP: - doesn't encode the python version into the egg name.
# DP: distutils: Add an option --install-layout=deb, which
# DP: - installs into $prefix/dist-packages instead of $prefix/site-packages.
# DP: - doesn't encode the python version into the egg name.
* Non-maintainer upload by the LTS Team.
* Add salsa-ci.yml.
* Drop Build-Conflicts: git.
* Unexport PYTHONIOENCODING to unbreak tests on Salsa.
* Disable test_mmap as it fails on Salsa.
* Apply upstream patches for the following CVEs:
- CVE-2022-37454: integer overflow and buffer overflow in the Keccak XKCP
SHA-3 implementation.
- CVE-2025-4516: issue in bytes.decode("unicode_escape",
error="ignore|replace")
- CVE-2025-6069: quadratic complexity in html.parser.HTMLParser
- CVE-2025-6075: performance degradation in os.path.expandvars()
- CVE-2025-8194: infinite loop and deadlock in tarfile
- CVE-2025-8291: incorrect ZIP64 End of Central Directory handling
- CVE-2025-12084: quadratic complexity in xml.dom.minidom appendChild etc
- CVE-2025-13836: OOM or other DoS due to incorrect Content-Length
handling in http.client
- CVE-2025-13837: OOM or other DoS due to incorrect data size handling
in plistlib
* Update libpython symbols.
projects / python3.9.git / log