gh-145883: Fix two heap-buffer-overflows in `_zoneinfo` by StanFromIreland · Pull Request #145885 · python/cpython

StanFromIreland · 2026-03-12T21:04:33Z

Issue: _zoneinfo: heap buffer overflow reads from malformed TZif data #145883

Lib/zoneinfo/_common.py

Lib/test/test_zoneinfo/test_zoneinfo.py

bedevere-app · 2026-03-16T15:26:50Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

Lib/zoneinfo/_common.py

Modules/_zoneinfo.c

StanFromIreland · 2026-03-16T15:59:08Z

I have made the requested changes; please review again

bedevere-app · 2026-03-16T15:59:15Z

Thanks for making the requested changes!

@encukou, @pganssle: please review the changes made to this pull request.

Lib/zoneinfo/_common.py

Modules/_zoneinfo.c

serhiy-storchaka

LGTM. 👍

I only have questions about some auxiliary files.

.gitattributes

serhiy-storchaka · 2026-03-31T09:45:35Z

Tools/build/compute-changes.py

+    # zoneinfo
+    Path("Lib/zoneinfo/"),
+    Path("Modules/_zoneinfo.c"),


What is it about? How is this list use and why these additions are necessary?

This is the list of files that triggers CIFuzz, we started fuzzing zoneinfo (which found one of the two bugs the following day) in python/library-fuzzers@eb273d5. It's not related to the issue, but it's so small I think including it here is fine.

miss-islington-app · 2026-04-04T12:29:38Z

Thanks @StanFromIreland for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

miss-islington-app · 2026-04-04T12:29:38Z

Thanks @StanFromIreland for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

…GH-145885) (cherry picked from commit fe9befc) Co-authored-by: Stan Ulbrych <stan@python.org>

bedevere-app · 2026-04-04T12:29:44Z

GH-148086 is a backport of this pull request to the 3.13 branch.

…GH-145885) (cherry picked from commit fe9befc) Co-authored-by: Stan Ulbrych <stan@python.org>

bedevere-app · 2026-04-04T12:29:49Z

GH-148087 is a backport of this pull request to the 3.14 branch.

…5885) (#148087) (cherry picked from commit fe9befc) Co-authored-by: Stan Ulbrych <stan@python.org>

…5885) (#148086) (cherry picked from commit fe9befc) Co-authored-by: Stan Ulbrych <stan@python.org>

Fix two heap-buffer-overflows in zoneinfo

b764373

StanFromIreland requested review from serhiy-storchaka and sethmlarson March 12, 2026 21:04

StanFromIreland requested a review from pganssle as a code owner March 12, 2026 21:04

bedevere-app bot added the awaiting review label Mar 12, 2026

bedevere-app bot mentioned this pull request Mar 12, 2026

_zoneinfo: heap buffer overflow reads from malformed TZif data #145883

Closed

StanFromIreland added 2 commits March 12, 2026 21:05

Mimize testcase + blurb

0f27a07

Add zoneinfo to compute-changes.py

bf3f3a5

StanFromIreland requested review from AA-Turner, hugovk and webknjaz as code owners March 12, 2026 21:09

encukou approved these changes Mar 13, 2026

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting review labels Mar 13, 2026

pganssle requested changes Mar 16, 2026

View reviewed changes

Lib/zoneinfo/_common.py Outdated Show resolved Hide resolved

Lib/zoneinfo/_common.py Outdated Show resolved Hide resolved

Lib/test/test_zoneinfo/test_zoneinfo.py Show resolved Hide resolved

bedevere-app bot added awaiting changes and removed awaiting merge labels Mar 16, 2026

serhiy-storchaka reviewed Mar 16, 2026

View reviewed changes

Lib/zoneinfo/_common.py Outdated Show resolved Hide resolved

Lib/zoneinfo/_common.py Outdated Show resolved Hide resolved

Modules/_zoneinfo.c Show resolved Hide resolved

Change test + simplify check.

eacad9a

bedevere-app bot added awaiting change review and removed awaiting changes labels Mar 16, 2026

bedevere-app bot requested review from encukou and pganssle March 16, 2026 15:59

serhiy-storchaka reviewed Mar 16, 2026

View reviewed changes

Lib/zoneinfo/_common.py Outdated Show resolved Hide resolved

Modules/_zoneinfo.c Show resolved Hide resolved

Move check

f13b289

StanFromIreland requested a review from serhiy-storchaka March 18, 2026 22:04

serhiy-storchaka approved these changes Mar 31, 2026

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting change review labels Mar 31, 2026

StanFromIreland added 2 commits March 31, 2026 11:54

Remvoe .gittattributes changes

1ae5455

Merge branch 'main' into zoneinfo-overflows

5ac2687

StanFromIreland merged commit fe9befc into python:main Apr 4, 2026
63 checks passed

StanFromIreland deleted the zoneinfo-overflows branch April 4, 2026 12:29

bedevere-app bot removed the awaiting merge label Apr 4, 2026

StanFromIreland added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 4, 2026

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 4, 2026

pythongh-145883: Fix two heap-buffer-overflows in _zoneinfo (python…

c3034de

…GH-145885) (cherry picked from commit fe9befc) Co-authored-by: Stan Ulbrych <stan@python.org>

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Apr 4, 2026

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 4, 2026

pythongh-145883: Fix two heap-buffer-overflows in _zoneinfo (python…

5bf02b3

…GH-145885) (cherry picked from commit fe9befc) Co-authored-by: Stan Ulbrych <stan@python.org>

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Apr 4, 2026

StanFromIreland added a commit that referenced this pull request Apr 4, 2026

[3.14] gh-145883: Fix two heap-buffer-overflows in _zoneinfo (GH-14…

64207c9

…5885) (#148087) (cherry picked from commit fe9befc) Co-authored-by: Stan Ulbrych <stan@python.org>

StanFromIreland added a commit that referenced this pull request Apr 4, 2026

[3.13] gh-145883: Fix two heap-buffer-overflows in _zoneinfo (GH-14…

df89a70

…5885) (#148086) (cherry picked from commit fe9befc) Co-authored-by: Stan Ulbrych <stan@python.org>

pablogsal mentioned this pull request Apr 4, 2026

gh-130273: Fix traceback color output with unicode characters #142529

Open

Uh oh!

Conversation

StanFromIreland commented Mar 12, 2026 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bedevere-app bot commented Mar 16, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

StanFromIreland commented Mar 16, 2026

Uh oh!

bedevere-app bot commented Mar 16, 2026

Uh oh!

Uh oh!

Uh oh!

serhiy-storchaka left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

serhiy-storchaka Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

StanFromIreland Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

miss-islington-app bot commented Apr 4, 2026

Uh oh!

miss-islington-app bot commented Apr 4, 2026

Uh oh!

bedevere-app bot commented Apr 4, 2026

Uh oh!

bedevere-app bot commented Apr 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

StanFromIreland commented Mar 12, 2026 •

edited by bedevere-app bot

Loading