Repository navigation
UAF: xml.etree.ElementTree.Element.__deepcopy__ when concurrent mutations happen #133009
Description
Crash report
What happened?
Reproducer:
import xml.etree.ElementTree as ET
from copy import deepcopy
class Evil(ET.Element):
def __deepcopy__(self, memo):
root.clear()
return self
root = ET.Element('a')
root.append(Evil('x'))
deepcopy(root)CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
Output from running 'python -VV' on the command line:
Python 3.14.0a7+ (heads/main:7f02ded29fb, Apr 26 2025, 14:29:01) [GCC 7.5.0]
Activity
gh-133009: fix UAF in `xml.etree.ElementTree.Element.__deepcopy__` (#…
pythongh-133009: fix UAF in `xml.etree.ElementTree.Element.__deepcopy…
pythongh-133009: fix UAF in `xml.etree.ElementTree.Element.__deepcopy…
[3.13] gh-133009: fix UAF in `xml.etree.ElementTree.Element.__deepcop…
[3.14] gh-133009: fix UAF in `xml.etree.ElementTree.Element.__deepcop…
pythongh-133009: fix UAF in `xml.etree.ElementTree.Element.__deepcopy…
pythongh-133009: fix UAF in `xml.etree.ElementTree.Element.__deepcopy…