[3.13] gh-119342: Fix a potential denial of service in plistlib (GH-119343) (GH-142144)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 1 Dec 2025 15:50:28 +0000 (16:50 +0100)
committerArnaud Rebillout <arnaudr@debian.org>
Thu, 14 May 2026 03:00:00 +0000 (10:00 +0700)
commit4023181f9fdafd04d2e36350a5459b0747d92c62
tree13e13479ea0bd9c507b2f13cd690513dd88a652a
parent13c5d1b9a3e66cc2771936999e3f282acb38e012
[3.13] gh-119342: Fix a potential denial of service in plistlib (GH-119343) (GH-142144)

Reading a specially prepared small Plist file could cause OOM because file's
read(n) preallocates a bytes object for reading the specified amount of
data. Now plistlib reads large data by chunks, therefore the upper limit of
consumed memory is proportional to the size of the input file.
(cherry picked from commit 694922cf40aa3a28f898b5f5ee08b71b4922df70)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Origin: backport, https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba

Gbp-Pq: Name CVE-2025-13837.patch
Lib/plistlib.py
Lib/test/test_plistlib.py
Misc/NEWS.d/next/Security/2024-05-21-22-11-31.gh-issue-119342.BTFj4Z.rst [new file with mode: 0644]