[issue41215] AIX: build fails for xlc/xlC since new PEG parser

David Edelsohn added the comment: I don't believe that this is an XLC bug, but I suspect that it is undefined behavior / implementation-defined behavior. I suspect that this is tripping over AIX/XLC null behavior. AIX specifically and intentionally maps the first page of memory at address 0

[issue41177] ConvertingList and ConvertingTuple lack iterators and ConvertingDict lacks items()

Brett Hannigan added the comment: Thanks. I don't know why it still says CLA not signed - I signed it a week ago, but I'll try to figure that out this week. -- ___ Python tracker

[issue41215] AIX: build fails for xlc/xlC since new PEG parser

Michael Felt added the comment: On 06/07/2020 16:35, Pablo Galindo Salgado wrote: > Pablo Galindo Salgado added the comment: > >> Glad you figured it out! > Well, this is not over ;) > > We should confirm that this is either a bug in XLC or a violation of C99 probably a bug (that they might

[issue41177] ConvertingList and ConvertingTuple lack iterators and ConvertingDict lacks items()

Vinay Sajip added the comment: OK, seems like a reasonable use case. I haven't looked at the PR yet, as it still has a "CLA not signed" label, and I normally wait until the CLA is signed before looking more closely at PRs. -- ___ Python tracker

[issue39562] Asynchronous comprehensions don't work in asyncio REPL

Change by Pablo Galindo Salgado : -- priority: -> release blocker ___ Python tracker ___ ___ Python-bugs-list mailing list

[issue39562] Asynchronous comprehensions don't work in asyncio REPL

Change by Pablo Galindo Salgado : -- resolution: fixed -> status: closed -> open ___ Python tracker ___ ___ Python-bugs-list

[issue41208] An exploitable segmentation fault in marshal module

Christian Heimes added the comment: That line in Ray Project is a potential arbitrary code execution vulnerability. If an attacker is able to inject a custom pickle stream, then they can easily take over the service. Please report the issue to the project. It might be a simple score of a

[issue39562] Asynchronous comprehensions don't work in asyncio REPL

Matthias Bussonnier added the comment: This make non-await list comprehension coroutine-code-objects as well: https://bugs.python.org/issue41218 import ast import inspect cell = '[x for x in l]' code = compile(cell, "<>", "exec",

[issue41218] PyCF_ALLOW_TOP_LEVEL_AWAIT + list comprehension set .CO_COROUTINE falg.

Matthias Bussonnier added the comment: (crossref https://github.com/ipython/ipython/issues/12422) -- ___ Python tracker ___ ___

[issue41208] An exploitable segmentation fault in marshal module

Iman Sharafodin added the comment: It's interesting that you would not count a critical segfault in Pickle as a threat, because there are numerous libraries that are Unpickling untrusted user data (even-though some of them are using RestrictedUnpickler to protect themselves but a segfault

[issue41218] PyCF_ALLOW_TOP_LEVEL_AWAIT + list comprehension set .CO_COROUTINE falg.

New submission from Matthias Bussonnier : As far as I can tell sometime in 3.8.x (likely 3.8.3) the following snippet changed result: import ast import inspect cell = '[x for x in l]' code = compile(cell, "<>", "exec", flags=getattr(ast,'PyCF_ALLOW_TOP_LEVEL_AWAIT', 0x0))

[issue41177] ConvertingList and ConvertingTuple lack iterators and ConvertingDict lacks items()

Brett Hannigan added the comment: I encountered the need for the iterators when trying to create a subclass of the QueueHandler class that would manage both the QueueHandler and the QueueListener. The implementation is very similar to that described in this Medium post:

[issue41208] An exploitable segmentation fault in marshal module

Serhiy Storchaka added the comment: In this particular case unmarshalling creates a tuple containing a reference to itself which is used as a key in a dict. Calculating a hash of such tuple leads to infinite recursion which overflows the programming stack. There is no efficient way to

[issue26205] Better specify number of nested scopes

Eryk Sun added the comment: > There is one local namespace for each class and function. There is one > nonlocal namespace for each nested function. In the first sentence, replace "class" with "class statement" and "function" with "function call". The second sentence could use

[issue41208] An exploitable segmentation fault in marshal module

Christian Heimes added the comment: Yes, it's like pickle, but it is not like you think. The pickle module has a similar security disclaimer, https://docs.python.org/dev/library/pickle.html . We might agree to fix segfaults in unpickler code if the fix is simple and does not cause backwards

[issue41208] An exploitable segmentation fault in marshal module

Serhiy Storchaka added the comment: No, unlike to marshal the pickle format is a Turing-complete language. Just loading pickle data can cause to execution of arbitrary code. marshal is more "safe" in this regard -- in worst case you can just crash when load it. It may be interesting to make

[issue41215] AIX: build fails for xlc/xlC since new PEG parser

Pablo Galindo Salgado added the comment: > Glad you figured it out! Well, this is not over ;) We should confirm that this is either a bug in XLC or a violation of C99 -- ___ Python tracker

[issue41215] AIX: build fails for xlc/xlC since new PEG parser

Michael Felt added the comment: Glad you figured it out! I doubt I would have. Thx!! On 06/07/2020 14:37, Pablo Galindo Salgado wrote: > Pablo Galindo Salgado added the comment: > > This is enough to reproduce the problem: > > #include > > typedef struct { > char *str; > int type;

[issue41177] ConvertingList and ConvertingTuple lack iterators and ConvertingDict lacks items()

Vinay Sajip added the comment: > If it is not goal I don't have a goal to make these part of a documented API. OP, can you share a use case where you need to iterate over these internal structures? -- ___ Python tracker

[issue41208] An exploitable segmentation fault in marshal module

Iman Sharafodin added the comment: I thought it's like Pickle. Then if we find an exploitable segfault just in Pickle, you would count it as a threat? -- ___ Python tracker

[issue36302] distutils creates unreproducible .so files

Ronald Oussoren added the comment: That's the problem with any change to distutils, the API is unclear and that causes any change to be potentially breaking for existing users. That's why distutils has been mostly stagnant for years. I have no particular wish w.r.t. changing behaviour, I've

[issue41208] An exploitable segmentation fault in marshal module

Christian Heimes added the comment: Python's thread model is: If an attacker can create a malicious PYC file and feed it to a Python process, then they already have full code execution privileges. There is no need to exploit a segfault. Because the marshal module should only be used for PYC

[issue37207] Use PEP 590 vectorcall to speed up calls to range(), list() and dict()

Dong-hee Na added the comment: New changeset 97558d6b08a656eae209d49b206f703cee0359a2 by Dong-hee Na in branch '3.9': [3.9] bpo-37207: Update whatsnews for 3.9 (GH-21337) https://github.com/python/cpython/commit/97558d6b08a656eae209d49b206f703cee0359a2 --

[issue41206] behaviour change with EmailMessage.set_content

Karthikeyan Singaravelan added the comment: Łukasz, There is already a PR open for this from May linking to original issue at https://github.com/python/cpython/pull/20542 . I missed it during triaging this issue. I guess someone needs to approve that PR and merge it to master to backport to

[issue37207] Use PEP 590 vectorcall to speed up calls to range(), list() and dict()

Change by Dong-hee Na : -- pull_requests: +20496 pull_request: https://github.com/python/cpython/pull/21350 ___ Python tracker ___

[issue41206] behaviour change with EmailMessage.set_content

Change by Karthikeyan Singaravelan : -- keywords: +patch pull_requests: +20495 stage: -> patch review pull_request: https://github.com/python/cpython/pull/21349 ___ Python tracker

[issue41216] eval don't load local variable in dict and list comprehensions.

Eric V. Smith added the comment: Agreed that this is a duplicate, so I'm closing it. -- nosy: +eric.smith resolution: -> duplicate stage: -> resolved status: open -> closed superseder: -> eval() function in List Comprehension doesn't work ___

[issue41206] behaviour change with EmailMessage.set_content

Łukasz Langa added the comment: Yes. -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue41215] AIX: build fails for xlc/xlC since new PEG parser

Pablo Galindo Salgado added the comment: This is enough to reproduce the problem: #include typedef struct { char *str; int type; } KeywordToken; static KeywordToken *the_array[] = { NULL, NULL, (KeywordToken[]) { {"if", 510}, {"in", 518}, {"as",

[issue9348] Calling argparse's add_argument with the wrong number of metavars causes delayed error message

daniel hahler added the comment: This adds overhead, since it creates a formatter and uses it for formatting only for validation purposes. I think it is better to only have the error when the formatter is actually used (i.e. the help is displayed - which is not the typical use case, and it

[issue41215] AIX: build fails for xlc/xlC since new PEG parser

Change by Pablo Galindo Salgado : -- Removed message: https://bugs.python.org/msg373107 ___ Python tracker ___ ___ Python-bugs-list

[issue41206] behaviour change with EmailMessage.set_content

Karthikeyan Singaravelan added the comment: There is a behavior change with my fix. 7bit is returned for Content-Transfer-Encoding before commit and skipping the heuristic if line is empty to avoid ValueError will return quoted-printable for Content-Transfer-Encoding. This is a behavior

[issue40275] test.support has way too many imports

STINNER Victor added the comment: New changeset deb016224cc506503fb05e821a60158c83918ed4 by Hai Shi in branch 'master': bpo-40275: Use new test.support helper submodules in tests (GH-21317) https://github.com/python/cpython/commit/deb016224cc506503fb05e821a60158c83918ed4 --

[issue41208] An exploitable segmentation fault in marshal module

STINNER Victor added the comment: Python doesn't implement any protection against invalid PYC files to avoid any performance overhead at runtime. Maybe we can close this issue as WONTFIX. -- ___ Python tracker

[issue41215] AIX: build fails for xlc/xlC since new PEG parser

Pablo Galindo Salgado added the comment: This is enough to reproduce the problem: #include typedef struct { char *str; int type; } KeywordToken; static KeywordToken *the_array[] = { NULL, NULL, (KeywordToken[]) { {"if", 510}, {"in", 518}, {"as",

[issue36302] distutils creates unreproducible .so files

STINNER Victor added the comment: > An unfortunate side effect of this change is that changes the build order > even if the source list order is relevant. That sounds like a new feature. I don't think that it was supported previously. Or maybe it was more an implementation detail. Please

[issue41208] An exploitable segmentation fault in marshal module

Iman Sharafodin added the comment: What about patching that as a crash? -- ___ Python tracker ___ ___ Python-bugs-list mailing

[issue41208] An exploitable segmentation fault in marshal module

Iman Sharafodin added the comment: By using our proprietary fuzzer. I'm a cybersecurity researcher. -- ___ Python tracker ___ ___

[issue41207] distutils.command.build_ext raises FileNotFoundError

STINNER Victor added the comment: > Programs trapping CompileError but not FileNotFoundError will crash where > once they had error handling. Do you mean mean that spawn() of distutils.spawn should catch FileNotFoundError and raise a CompilerError instead? It seems like before my commit

[issue41208] An exploitable segmentation fault in marshal module

STINNER Victor added the comment: According to the Python Security Model, this issue is not security vulnerability: (*) https://python-security.readthedocs.io/security.html#python-security-model The marshal is not intended to be used to load untrusted code. That's why its documentation

[issue41206] behaviour change with EmailMessage.set_content

Karthikeyan Singaravelan added the comment: Sure, I guess the fix would be to check for lines to be non-empty before doing a call to max and also convert the report as a test case? -- ___ Python tracker

[issue41207] distutils.command.build_ext raises FileNotFoundError

Łukasz Langa added the comment: Good catch! The unification change is 3.10 only but I'm totally fine accepting the _compile fix in Python 3.9. -- ___ Python tracker ___

[issue41206] behaviour change with EmailMessage.set_content

Łukasz Langa added the comment: Good catch! No need to revert anything. The raised ValueError is a relatively simple thing to fix. xtreak, mind making a follow-up PR to restore behavior with no \n characters? -- ___ Python tracker

[issue41215] AIX: build fails for xlc/xlC since new PEG parser

Pablo Galindo Salgado added the comment: Ok, this is definitively something going on with XLC. This patch solves the segfault: diff --git a/Parser/pegen/parse.c b/Parser/pegen/parse.c index 9d3ac575df..e5511bf815 100644 --- a/Parser/pegen/parse.c +++ b/Parser/pegen/parse.c @@ -1,6 +1,6 @@

[issue41215] AIX: build fails for xlc/xlC since new PEG parser

Pablo Galindo Salgado added the comment: Ok, I have investigated more and it seems that XLC is miscompiling the keyword list. For instance, if you add: index 9d3ac575df..70d431e6be 100644 --- a/Parser/pegen/parse.c +++ b/Parser/pegen/parse.c @@ -1,6 +1,6 @@ -// @generated by pegen.py from

[issue40874] Update to libmpdec-2.5.0

Stefan Krah added the comment: More than that, I had *promised* Matthias privately to release a new libmpdec for the sqrt-max-prec feature a couple of months ago. I request that further packaging issues will be dealt with primarily by Matthias and myself. --

[issue40874] Update to libmpdec-2.5.0

Change by Christian Heimes : -- nosy: -christian.heimes ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue37207] Use PEP 590 vectorcall to speed up calls to range(), list() and dict()

Łukasz Langa added the comment: New changeset b4a9263708cc67c98c4d53b16933f6e5dd07990f by Dong-hee Na in branch 'master': bpo-37207: Update whatsnews for 3.9 (GH-21337) https://github.com/python/cpython/commit/b4a9263708cc67c98c4d53b16933f6e5dd07990f -- nosy: +lukasz.langa

[issue37207] Use PEP 590 vectorcall to speed up calls to range(), list() and dict()

Change by miss-islington : -- pull_requests: +20494 pull_request: https://github.com/python/cpython/pull/21347 ___ Python tracker ___

[issue40874] Update to libmpdec-2.5.0

Stefan Krah added the comment: > The standalone libmpdec had to be updated, and was updated according to the Debian-friendly way requested by Matthias himself. Not updated, of course the sqrt-max-prec *had never been* in the standalone libmpdec, it is new in 2.5.0. --

[issue40874] Update to libmpdec-2.5.0

Stefan Krah added the comment: As noted in the first message of this thread, the sqrt-max-prec feature (requested by Mark and Tim) was already in 3.9 long before the beta freeze. I'm not sure why this is not clear from the original message. That fix is safe for Python, but not for the

[issue18080] setting CC no longer overrides default linker for extension module builds on OS X

Ned Deily added the comment: > Would you like me to file a separate bug for this issue? Or apply that patch? > Or something else? OK, if I understand correctly, the problem you describe does not affect cPython because cPython's Distutils does not use get_config_vars(), only

[issue41215] AIX: build fails for xlc/xlC since new PEG parser

Pablo Galindo Salgado added the comment: If I check out commit c5fc15685202cda73f7c3f5c6f299b0945f58508 I get a crash, but not on master or 3.9 HEAD. So whatever error happens with XLC in the PEG parser c5fc15685202cda73f7c3f5c6f299b0945f58508 seems that is already solved. Could you confirm

[issue41215] AIX: build fails for xlc/xlC since new PEG parser

Pablo Galindo Salgado added the comment: I tried compiling Python 3.10 with XLC on AIX and I get a crash in a different place that does not involve the parser: _PyEval_EvalFrameDefault(tstate = 0x200764e0, f = 0x300b5190, throwflag = 0), line 427 in "object.h" _PyEval_EvalCode(tstate =

[issue41212] Emoji Unicode failing in standard release of Python 3.8.3 / tkinter 8.6.8

Ben Griffin added the comment: Wow, well if you are right, then TCL/TK is a showstopper for us, and we will have to consider an alternative to tkinter. Frankly, I am aghast that any active software would be limited to fixed width characters. We moved our languages over to multiwidth

[issue41018] warning: 'Tk_MainWindow' is deprecated: first deprecated

Ronald Oussoren added the comment: The deprecation warnings are a specific "feature" of the copy of Tcl/Tk shipped by Apple, and do not reflect the status of this API upstream. The correct fix is to either ignore these warnings when building, or better to use a different install of Tcl/Tk

[issue26205] Better specify number of nested scopes

Terry J. Reedy added the comment: Besides the sentence now revised, the initial post referenced confusion with 'middle scope' in "If a name is declared global, then all references and assignments go directly to the middle scope containing the module's global names." This has not been

[issue41210] LZMADecompressor.decompress(FORMAT_RAW) truncate output when input is paticular LZMA+BCJ data

Ma Lin added the comment: The docs[1] said: Compression filters: FILTER_LZMA1 (for use with FORMAT_ALONE) FILTER_LZMA2 (for use with FORMAT_XZ and FORMAT_RAW) But your code uses a combination of `FILTER_LZMA1` and `FORMAT_RAW`, is this ok? [1]

[issue26205] Better specify number of nested scopes

Terry J. Reedy added the comment: Since you ask, here is a extended summary of namespaces. There is one built-in namespace. There is one global namespace for each module, which is also the local namespace for top level code in that module. There is one local namespace for each class and

[issue28681] Clarify multiple function names in the tutorial

Change by Terry J. Reedy : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___

[issue11105] Compiling evil ast crashes interpreter

Batuhan Taskaya added the comment: > With 3.9 on Windows, using Benjamin's example, I do not get the Windows > equivalent of a seg fault. However, execution stops at compile with no > exception, including SystemExit. I can still reproduce on Linux, $ python Python 3.10.0a0

[issue40204] Docs build error with Sphinx 3.0 due to invalid C declaration

Matthias Klose added the comment: please note that pinning usually is not a solution for Linux distributions. Yes, the most wanted fix would be to fix sphinx 3.x not to break compatibility with 2.x. Or limit 3.9 to 2.x features for now. -- nosy: +doko

[issue40275] test.support has way too many imports

STINNER Victor added the comment: New changeset a089d21df1ea502b995d8e8a3bcc937cce030802 by Hai Shi in branch 'master': bpo-40275: Use new test.support helper submodules in tests (GH-21315) https://github.com/python/cpython/commit/a089d21df1ea502b995d8e8a3bcc937cce030802 --

[issue40275] test.support has way too many imports

STINNER Victor added the comment: New changeset 883bc638335a57a6e6a6344c2fc132c4f9a0ec42 by Hai Shi in branch 'master': bpo-40275: Use new test.support helper submodules in tests (GH-21314) https://github.com/python/cpython/commit/883bc638335a57a6e6a6344c2fc132c4f9a0ec42 --

[issue41206] behaviour change with EmailMessage.set_content

Matthias Klose added the comment: that's a regression for the 3.8 branch, marking as a release blocker for 3.8.4. This should be a documented change for 3.9, and probably reverted/fixed for 3.8. -- keywords: +3.8regression, 3.9regression nosy: +doko, lukasz.langa priority: normal

[issue41206] behaviour change with EmailMessage.set_content

Change by Matthias Klose : -- nosy: +ivyl ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue41212] Emoji Unicode failing in standard release of Python 3.8.3 / tkinter 8.6.8

E. Paine added the comment: Sorry, the point I was trying to make was that, unlike UTF-8, Tcl doesn't support variable length characters and they are instead fixed at 16 bits (by default). So, while Python and UTF-8 are perfectly happy with the emoji, unless Tcl is compiled with a

[issue34938] Fix mimetype.init() to account for from import

Change by Terry J. Reedy : -- versions: +Python 3.10 -Python 2.7, Python 3.7, Python 3.8, Python 3.9 ___ Python tracker ___ ___

[issue34689] Lib/sysconfig.py expands non-variables

Change by Terry J. Reedy : -- nosy: +berker.peksag, serhiy.storchaka versions: +Python 3.10 -Python 2.7, Python 3.5, Python 3.6, Python 3.7, Python 3.8 ___ Python tracker ___

[issue17576] PyNumber_Index() is not int-subclass friendly (or operator.index() docos lie)

Change by Terry J. Reedy : -- versions: +Python 3.10, Python 3.9 -Python 2.7, Python 3.3, Python 3.4 ___ Python tracker ___ ___

[issue20353] Hanging bug with multiprocessing + sqlite3 + tkinter (OS X 10.9 only)

Change by Terry J. Reedy : -- resolution: -> out of date stage: -> resolved status: open -> closed ___ Python tracker ___ ___

[issue23885] urllib.quote horribly mishandles unicode as second parameter

Change by Terry J. Reedy : -- resolution: -> out of date stage: -> resolved status: open -> closed ___ Python tracker ___ ___

[issue11105] Compiling evil ast crashes interpreter

Terry J. Reedy added the comment: With 3.9 on Windows, using Benjamin's example, I do not get the Windows equivalent of a seg fault. However, execution stops at compile with no exception, including SystemExit. These examples amount to limited fuzz testing of compile(). I think it should

[issue24670] os.chdir breaks result of os.path.abspath(__file__) and os.path.realpath(__file__)

Terry J. Reedy added the comment: I interpret Serhiy's comment as 'not a bug'. In any case, the linked issue changed __file__ to an absolute path, and 2.7 is frozen. -- nosy: +terry.reedy resolution: -> not a bug stage: -> resolved status: open -> closed

[issue41217] Obsolete note for default asyncio event loop on Windows

New submission from Csaba Nemes : In the documentation of asyncio, a Note is present in the "Running Subprocesses" section: "The default asyncio event loop on Windows does not support subprocesses", however, from 3.8 the default event loop is ProactorEventLoop on Windows, that does support

[issue27578] inspect.findsource raises exception with empty __init__.py

Terry J. Reedy added the comment: I agree that getsource raising is a bug. I would more at the behavior and doc for getlines before I decided about that. -- nosy: +terry.reedy versions: -Python 2.7, Python 3.5, Python 3.6, Python 3.9 ___ Python

[issue37363] Additional PEP578 hooks

Stéphane Wirtel added the comment: Hi @Christian, When you have time for my last question. Thank you, -- ___ Python tracker ___

[issue39189] Use io.DEFAULT_BUFFER_SIZE for filecmp BUFSIZE variable

Change by Terry J. Reedy : -- versions: +Python 3.10 -Python 2.7, Python 3.5, Python 3.6, Python 3.7, Python 3.8 ___ Python tracker ___

[issue13554] Tkinter doesn't use higher resolution app icon

Change by Terry J. Reedy : -- resolution: -> third party stage: -> resolved status: open -> closed ___ Python tracker ___ ___

[issue22433] Argparse considers unknown optional arguments with spaces as a known positional argument

Change by Terry J. Reedy : -- versions: +Python 3.10 -Python 2.7 ___ Python tracker ___ ___ Python-bugs-list mailing list

[issue34908] netrc parsing is overly strict

Change by Terry J. Reedy : -- versions: +Python 3.10 -Python 2.7, Python 3.7 ___ Python tracker ___ ___ Python-bugs-list mailing

[issue34154] Tkinter __init__ documentations sometimes missing valid keyword values

Change by Terry J. Reedy : -- versions: +Python 3.10 -Python 2.7, Python 3.6, Python 3.7, Python 3.8 ___ Python tracker ___ ___

[issue26212] Python with ncurses6.0 will not load _curses module on Solaris 10

Change by Terry J. Reedy : -- resolution: -> out of date stage: -> resolved status: open -> closed ___ Python tracker ___ ___

[issue27154] Regression in file.writelines behavior

Terry J. Reedy added the comment: Removing 'b' and 'u', writelines([s]) and write(s) both now read as s. -- nosy: +terry.reedy resolution: -> out of date stage: -> resolved status: open -> closed ___ Python tracker

[issue41208] An exploitable segmentation fault in marshal module

Serhiy Storchaka added the comment: How did you get this file? -- ___ Python tracker ___ ___ Python-bugs-list mailing list

[issue35773] test_bdb fails on non-UTF-8 locale

Michael Felt added the comment: Thanks for getting back to this. ++1 :) On 25/06/2020 11:49, Serhiy Storchaka wrote: > Serhiy Storchaka added the comment: > > test_bdb fails on non-UTF-8 locale because Python executes a Python code from > the corresponding "encodings" submodule. There are

[issue41215] AIX: build fails for xlc/xlC since new PEG parser

Michael Felt added the comment: My apologies for lack of context. On 05/07/2020 20:27, Pablo Galindo Salgado wrote: > Pablo Galindo Salgado added the comment: > > Unfortunately, I am having a hard time parsing your error description because > is not immediate to distinguish: > > - What is

<    1   2