…0174)

* Fix potential division by zero in BZ2_Malloc()
* Avoid division by zero in PyLzma_Malloc()
* Avoid division by zero and integer overflow in PyZlib_Malloc()

Reported by Svace static analyzer.
(cherry picked from commit 3d4fabb)

Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>

Topics include opening, title and status bar, .py* extension, and running.
(cherry picked from commit ea9c8bd)

Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>

(cherry picked from commit 53835e9)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

(cherry picked from commit c0799ec)

Co-authored-by: Gus Goulart <augusto@goulart.me>

Fix test_bdb when running Python is isolated mode.

(cherry picked from commit c0799ec)

…H-10204)

After commit d0f49d2, the output of the
test suite is always buffered as the test output needs to be included in
the JUnit file in same cases (as when a test fails). This has the
consequence that printing or using debuggers (like pdb) in the test
suite does not result in a good user experience anymore.

This commit modifies the test suite runner so it only captures the test
output when the JUnit file is requested to fix the regression so prints
and debuggers are usable again.
(cherry picked from commit 0227748)

Co-authored-by: Pablo Galindo <Pablogsal@gmail.com>

)

The root widget was accessed as a global variable in the Application's method.
(cherry picked from commit a80af77)

Co-authored-by: Daniel Lovell <lovell.daniel92@gmail.com>

…H-10248)

…H-10231). (GH-10254)

(cherry picked from commit 3f819ca)

(cherry picked from commit c9a6168)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

…gument. (GH-10217)

_io.IncrementalNewlineDecoder's initializer possibly assigns out-of-range
value to the bitwise struct field.
(cherry picked from commit b08746b)

Co-authored-by: Xiang Zhang <angwerzx@126.com>

Don't call _Py_FatalError_PrintExc() nor flush_std_files() if the
current thread doesn't hold the GIL, or if the current thread
has no Python state thread.

(cherry picked from commit 3a228ab)

…0268). (GH-10281)

(cherry picked from commit 4b5e62d)

Co-authored-by: Pablo Aguiar <scorphus@gmail.com>

https://bugs.python.org/issue35075
(cherry picked from commit bf46a09)

Co-authored-by: Pablo Galindo <Pablogsal@gmail.com>

* Include memo in the documented signature of copy.deepcopy()

The memo argument is mentioned lower on the doc page under writing a
`__deepcopy__` method, but is not included in the documented function signature.
This makes it easy to miss, and can lead to incorrect/buggy implementations of
`__deepcopy__` -- which is exatly what just happpend to me!
(cherry picked from commit 0200928)

Co-authored-by: Stephan Hoyer <shoyer@gmail.com>

…w match `setup.py` (GH-10289)

This could cause compile errors on macOS or other platforms.
(cherry picked from commit 318ab63)

Co-authored-by: Max Bélanger <aeromax@gmail.com>

Some methods in the os module can accept path-like objects. This is documented in the general documentation but not in the function docstrings. To keep both in sync, the docstrings need to be updated to reflect that path-like objects are also accepted..
(cherry picked from commit b942707)

Co-authored-by: BNMetrics <luna@bnmetrics.com>

Use `__GNUC__` instead of non-existing `__GNUC_MAJOR__`.

(cherry picked from commit e2ed5ad)

(cherry picked from commit fe62d87)

Co-authored-by: İsmail Arılık <arilik.ismail@gmail.com>

GH-10318) (GH-10326)

(cherry picked from commit 59668aa)

Co-authored-by: Lysandros Nikolaou <lisandrosnik@gmail.com>

…ferent lines. (GH-10284) (GH-10335)

Two kind of mistakes:

1. Missed space. After concatenating there is no space between words.

2. Missed comma. Causes unintentional concatenating in a list of strings..
(cherry picked from commit 34fd4c2)

…H-10332) (GH-10338) (GH-10339)

(cherry picked from commit 083a7a1)
(cherry picked from commit 6ad277b)

§31.5.6.3. Importing a source file directly: `module_from_spec` is new in Python 3.5.
(cherry picked from commit 16c8a53)

Co-authored-by: E Kawashima <e-kwsm@users.noreply.github.com>

The section is renamed from "IDLE -- console differences".  It mostly
covers the implications of using custom sys.stdxxx objects.
(cherry picked from commit 5e79090)

Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>

(This should have been done with the first PR for this issue.)
(cherry picked from commit f1d3efc)

Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>

… systems. (GH-10347)

The test depended on '/usr/share/zoneinfo/posixrules' or equivalent
because it set TZ without explicit DST transition rules. At least
on OpenSUSE Tumbleweed that file is linked to '/etc/localtime',
making the test fail with certain local timezones,
such as 'Europe/Moscow' which doesn't have DST transitions since 2011.
(cherry picked from commit f1b9ad3)

Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>

Add a new subsection to the doc.
(cherry picked from commit 75d9d59)

Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>

A program that runs indefinitely can overfill memory.
(cherry picked from commit 76cd0c3)

Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>

(cherry picked from commit ea6a28c)

Co-authored-by: Andrés Delfino <adelfino@gmail.com>

…alidation and encoding behavior (GH-16448) (GH-16462)

(cherry picked from commit 7774d78)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>

(cherry picked from commit 4504b45)

Co-authored-by: Julien Palard <julien@palard.fr>

(cherry picked from commit 3f36043)

Co-authored-by: Ned Deily <nad@python.org>

(cherry picked from commit dfe726b)

Co-authored-by: Kyle Stanley <aeros167@gmail.com>

(cherry picked from commit 01659ca)

Co-authored-by: Ned Deily <nad@python.org>

The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular
expression denial of service (REDoS).

LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar
to parse Set-Cookie headers returned by a server.
Processing a response from a malicious HTTP server can lead to extreme
CPU usage and execution will be blocked for a long time.

The regex contained multiple overlapping \s* capture groups.
Ignoring the ?-optional capture groups the regex could be simplified to

    \d+-\w+-\d+(\s*\s*\s*)$

Therefore, a long sequence of spaces can trigger bad performance.

Matching a malicious string such as

    LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!")

caused catastrophic backtracking.

The fix removes ambiguity about which \s* should match a particular
space.

You can create a malicious server which responds with Set-Cookie headers
to attack all python programs which access it e.g.

    from http.server import BaseHTTPRequestHandler, HTTPServer

    def make_set_cookie_value(n_spaces):
        spaces = " " * n_spaces
        expiry = f"1-c-1{spaces}!"
        return f"b;Expires={expiry}"

    class Handler(BaseHTTPRequestHandler):
        def do_GET(self):
            self.log_request(204)
            self.send_response_only(204)  GH- Don't bother sending Server and Date
            n_spaces = (
                int(self.path[1:])  GH- Can GET e.g. /100 to test shorter sequences
                if len(self.path) > 1 else
                65506  GH- Max header line length 65536
            )
            value = make_set_cookie_value(n_spaces)
            for i in range(99):  GH- Not necessary, but we can have up to 100 header lines
                self.send_header("Set-Cookie", value)
            self.end_headers()

    if __name__ == "__main__":
        HTTPServer(("", 44020), Handler).serve_forever()

This server returns 99 Set-Cookie headers. Each has 65506 spaces.
Extracting the cookies will pretty much never complete.

Vulnerable client using the example at the bottom of
https://docs.python.org/3/library/http.cookiejar.html :

    import http.cookiejar, urllib.request
    cj = http.cookiejar.CookieJar()
    opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))
    r = opener.open("http://localhost:44020/")

The popular requests library was also vulnerable without any additional
options (as it uses http.cookiejar by default):

    import requests
    requests.get("http://localhost:44020/")

* Regression test for http.cookiejar REDoS

If we regress, this test will take a very long time.

* Improve performance of http.cookiejar.ISO_DATE_RE

A string like

"444444" + (" " * 2000) + "A"

could cause poor performance due to the 2 overlapping \s* groups,
although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was.
(cherry picked from commit 1b779bf)

Co-authored-by: bcaller <bcaller@users.noreply.github.com>

…put format (GH-17418) (GH-17444)

(cherry picked from commit a62ad47)

Co-authored-by: Matthew Rollings <1211162+stealthcopter@users.noreply.github.com>

…USEADDR (GH-17311). (GH-17571)

(cherry picked from commit ab513a3)

Co-authored-by: Kyle Stanley <aeros167@gmail.com>

Co-authored-by: tirkarthi
(cherry picked from commit 1988344)

Co-authored-by: Kyle Stanley <aeros167@gmail.com>

…nt()'s *reuse_address* parameter (GH-17595). (GH-17632)

(cherry picked from commit f501db2)

Co-authored-by: Kyle Stanley <aeros167@gmail.com>

…acOS Catalina (GH-17636) (GH-17638)

(cherry picked from commit bf3aa10)

Co-authored-by: Ned Deily <nad@python.org>

Small grammatical change.