- From a3febe3cba14b89885f42ca2f0224096a52885f6 Mon Sep 17 00:00:00 2001

- From: Antoine Pitrou <antoine@python.org>

- Date: Mon, 23 Apr 2018 13:19:42 +0200

- Subject: [PATCH] bpo-33329: Fix multiprocessing regression on newer glibcs

- 

- Starting with glibc 2.27.9000-xxx, sigaddset() can return EINVAL for some

- reserved signal numbers between 1 and NSIG.  The `range(1, NSIG)` idiom

- is commonly used to select all signals for blocking with `pthread_sigmask`.

- So we ignore the sigaddset() return value until we expose sigfillset()

- to provide a better idiom.

- ---

-  .../next/Library/2018-04-23-13-21-39.bpo-33329.lQ-Eod.rst  |  1 +

-  Modules/signalmodule.c                                     | 14 ++++++++------

-  2 files changed, 9 insertions(+), 6 deletions(-)

-  create mode 100644 Misc/NEWS.d/next/Library/2018-04-23-13-21-39.bpo-33329.lQ-Eod.rst

- 

- diff --git a/Misc/NEWS.d/next/Library/2018-04-23-13-21-39.bpo-33329.lQ-Eod.rst b/Misc/NEWS.d/next/Library/2018-04-23-13-21-39.bpo-33329.lQ-Eod.rst

- new file mode 100644

- index 000000000000..d1a4e56d04b9

- --- /dev/null

- +++ b/Misc/NEWS.d/next/Library/2018-04-23-13-21-39.bpo-33329.lQ-Eod.rst

- @@ -0,0 +1 @@

- +Fix multiprocessing regression on newer glibcs

- diff --git a/Modules/signalmodule.c b/Modules/signalmodule.c

- index 791616014384..35fd87e2d1e7 100644

- --- a/Modules/signalmodule.c

- +++ b/Modules/signalmodule.c

- @@ -819,7 +819,6 @@ iterable_to_sigset(PyObject *iterable, sigset_t *mask)

-      int result = -1;

-      PyObject *iterator, *item;

-      long signum;

- -    int err;

-  

-      sigemptyset(mask);

-  

- @@ -841,11 +840,14 @@ iterable_to_sigset(PyObject *iterable, sigset_t *mask)

-          Py_DECREF(item);

-          if (signum == -1 && PyErr_Occurred())

-              goto error;

- -        if (0 < signum && signum < NSIG)

- -            err = sigaddset(mask, (int)signum);

- -        else

- -            err = 1;

- -        if (err) {

- +        if (0 < signum && signum < NSIG) {

- +            /* bpo-33329: ignore sigaddset() return value as it can fail

- +             * for some reserved signals, but we want the `range(1, NSIG)`

- +             * idiom to allow selecting all valid signals.

- +             */

- +            (void) sigaddset(mask, (int)signum);

- +        }

- +        else {

-              PyErr_Format(PyExc_ValueError,

-                           "signal number %ld out of range", signum);

-              goto error;

- From 5f610ec2043aa6b52cb6a6b5e436df091a4f2d91 Mon Sep 17 00:00:00 2001

- From: Christian Heimes <christian@python.org>

- Date: Tue, 18 Sep 2018 14:38:58 +0200

- Subject: [PATCH] bpo-34623: Use XML_SetHashSalt in _elementtree (GH-9146)

- 

- The C accelerated _elementtree module now initializes hash randomization

- salt from _Py_HashSecret instead of libexpat's default CPRNG.

- 

- Signed-off-by: Christian Heimes <christian@python.org>

- 

- https://bugs.python.org/issue34623

- (cherry picked from commit cb5778f00ce48631c7140f33ba242496aaf7102b)

- 

- Co-authored-by: Christian Heimes <christian@python.org>

- ---

-  Include/pyexpat.h                                            | 4 +++-

-  .../next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst   | 2 ++

-  Modules/_elementtree.c                                       | 5 +++++

-  Modules/pyexpat.c                                            | 5 +++++

-  4 files changed, 15 insertions(+), 1 deletion(-)

-  create mode 100644 Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst

- 

- diff --git a/Include/pyexpat.h b/Include/pyexpat.h

- index 44259bf6d716..07020b5dc964 100644

- --- a/Include/pyexpat.h

- +++ b/Include/pyexpat.h

- @@ -3,7 +3,7 @@

-  

-  /* note: you must import expat.h before importing this module! */

-  

- -#define PyExpat_CAPI_MAGIC  "pyexpat.expat_CAPI 1.0"

- +#define PyExpat_CAPI_MAGIC  "pyexpat.expat_CAPI 1.1"

-  #define PyExpat_CAPSULE_NAME "pyexpat.expat_CAPI"

-  

-  struct PyExpat_CAPI

- @@ -48,6 +48,8 @@ struct PyExpat_CAPI

-      enum XML_Status (*SetEncoding)(XML_Parser parser, const XML_Char *encoding);

-      int (*DefaultUnknownEncodingHandler)(

-          void *encodingHandlerData, const XML_Char *name, XML_Encoding *info);

- +    /* might be none for expat < 2.1.0 */

- +    int (*SetHashSalt)(XML_Parser parser, unsigned long hash_salt);

-      /* always add new stuff to the end! */

-  };

-  

- diff --git a/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst b/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst

- new file mode 100644

- index 000000000000..31ad92ef8582

- --- /dev/null

- +++ b/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst

- @@ -0,0 +1,2 @@

- +The C accelerated _elementtree module now initializes hash randomization

- +salt from _Py_HashSecret instead of libexpat's default CSPRNG.

- diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c

- index 1dfdb3ce34f3..4b86f96a70d3 100644

- --- a/Modules/_elementtree.c

- +++ b/Modules/_elementtree.c

- @@ -3305,6 +3305,11 @@ _elementtree_XMLParser___init___impl(XMLParserObject *self, PyObject *html,

-          PyErr_NoMemory();

-          return -1;

-      }

- +    /* expat < 2.1.0 has no XML_SetHashSalt() */

- +    if (EXPAT(SetHashSalt) != NULL) {

- +        EXPAT(SetHashSalt)(self->parser,

- +                           (unsigned long)_Py_HashSecret.expat.hashsalt);

- +    }

-  

-      if (target) {

-          Py_INCREF(target);

- diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c

- index c8a01d4e088e..c52079e518f2 100644

- --- a/Modules/pyexpat.c

- +++ b/Modules/pyexpat.c

- @@ -1877,6 +1877,11 @@ MODULE_INITFUNC(void)

-      capi.SetStartDoctypeDeclHandler = XML_SetStartDoctypeDeclHandler;

-      capi.SetEncoding = XML_SetEncoding;

-      capi.DefaultUnknownEncodingHandler = PyUnknownEncodingHandler;

- +#if XML_COMBINED_VERSION >= 20100

- +    capi.SetHashSalt = XML_SetHashSalt;

- +#else

- +    capi.SetHashSalt = NULL;

- +#endif

-  

-      /* export using capsule */

-      capi_object = PyCapsule_New(&capi, PyExpat_CAPSULE_NAME, NULL);

- Version: %{pybasever}.6

- Release: 6%{?dist}

- Source: http://www.python.org/ftp/python/%{version}/Python-%{version}.tar.xz

- # 00302 #

- # Fix multiprocessing regression on newer glibcs

- # See: https://bugzilla.redhat.com/show_bug.cgi?id=1569933

- # and: https://bugs.python.org/issue33329

- Patch302: 00302-fix-multiprocessing-regression-on-newer-glibcs.patch

- 

- # 00310 #

- # CVE-2018-14647

- # Use XML_SetHashSalt in _elementtree

- # rhbz#1631822

- # Fixed upstream https://bugs.python.org/issue34623

- Patch310: 00310-use-xml-sethashsalt-in-elementtree.patch

- 

- %setup -q -n Python-%{version}%{?prerel}

- %patch302 -p1

- %patch310 -p1

- SHA512 (Python-3.5.6.tar.xz) = 1ccf287dbe8594eb577c1197c19d882fbe235c72f4c01cda23258f2add8a93e639b41ebaf556508b867cbe1b4c1fc4e1cf457d70b98cf7a1502013660a7e0ac1