CPython vulnerabilities applicable to PyPy, March 2021
I'm sorry but I don't really have time right now to re-learn Mercurial and submit the fixes but I've been able to do a quick audit.
The following CPython patches need to be applied PyPy (2.7, 3.6 and 3.7):
- bpo-42051: Reject XML entity declarations in plist files (GH-22760) (GH-22801) (GH-22804)
- bpo-41944: No longer call eval() on content received via HTTP in the CJK codec tests (GH-22566) (GH-22579)
- bpo-42967: only use '&' as a query string separator (GH-24297) (GH-24532) -- warning, this is a breaking change
- bpo-40791: Make compare_digest more constant-time. (GH-23438) -- this one needs to be specially updated for pypy, see below
The following apply to PyPy3 only:
- bpo-42103: Improve validation of Plist files. (GH-22882) (#23117)
The respective commits for PyPy3.6 and 3.7 can be found on the respective cpython repo branches. I maintain backports of the relevant patches to Python 2.7 in the gentoo-2.7-vanilla branch of Gentoo fork.
All changes except for compare_digest apply cleanly to lib-python/*. compare_digest below:
diff --git a/pypy/module/operator/tscmp.c b/pypy/module/operator/tscmp.c index b68db6d2c9..92c237c4f9 100644 --- a/pypy/module/operator/tscmp.c +++ b/pypy/module/operator/tscmp.c @@ -17,7 +17,7 @@ pypy_tscmp(const char *a, const char *b, long len_a, long len_b) volatile const char *left; volatile const char *right; long i; - char result; + volatile char result; /* loop count depends on length of b */ length = len_b;
Hope this helps.