(cherry picked from commit 55f41e4)

…ACP!=1252. (GH-7278) (GH-7279)

Define _CRT_SECURE_NO_WARNINGS in the Visual Studio pythoncore
project to make quiet security warnings when building zlib C files
(Modules\zlib\ subdirectory).

(cherry picked from commit c9566b8)

Co-authored-by: Andre Delfino <adelfino@gmail.com>

…. (GH-11001) (GH-11008)

(cherry picked from commit 42b1d61)
(cherry picked from commit 7a2cf1e)

…11068)

Fix xml.dom.minidom cloneNode() on a document with an entity: pass
the correct arguments to the user data handler of an entity (fix an
old copy/paste mistake).

Bug spotted and fix proposed by Charalampos Stratakis, initial
reproducer written by Petr Viktorin.

Co-Authored-By: Charalampos Stratakis <cstratak@redhat.com>
Co-Authored-By: Petr Viktorin <encukou@gmail.com>
(cherry picked from commit 8e04186)

Include <pyconfig.h> ealier in Modules/expat/xmltok.c to define
properly _POSIX_C_SOURCE. Python defines _POSIX_C_SOURCE as 200809L,
whereas <features.h> (included indirectly by <string.h>) defines
_POSIX_C_SOURCE as 199506L.
(cherry picked from commit cf24735)

Co-authored-by: Victor Stinner <vstinner@redhat.com>

Use GCC __attribute__((unused)) to mark the debug variable 'filename'
as unused in Python/ceval.c.

Include <pyconfig.h> ealier in Modules/expat/xmlparse.c to define
properly _POSIX_C_SOURCE and _XOPEN_SOURCE.

https://bugs.python.org/issue35401
(cherry picked from commit 419b5ff)

Co-authored-by: Ned Deily <nad@python.org>

…1101)

(cherry picked from commit 7cf3d8e)

Co-authored-by: Ned Deily <nad@python.org>

… private Tcl/Tk 8.6 (GH-11110)

(cherry picked from commit cb34218)

* bpo-16039: CVE-2013-1752: Change use of readline() in
  imaplib.IMAP4_SSL to limit line length. Remove IMAP4_SSL.readline()
  and IMAP4_SSL.read() to inherit safe IMAP4 implementation.
* bpo-20118: reenable test_linetoolong() of test_imaplib
  on ThreadedNetworkedTests and ThreadedNetworkedTestsSSL.
  The test now sets the _MAXLINE limit to 10 characters.

…H-11158)

bpo-34279, bpo-35412: support.run_unittest() no longer raises
TestDidNotRun if a test result contains skipped tests. The
exception is now only raised if no test have been run and no test
have been skipped.

(cherry picked from commit 3a8f4fe)

…) (GH-11213)

check_environ() of distutils.utils now catchs KeyError on calling
pwd.getpwuid(): don't create the HOME environment variable in this
case.

(cherry picked from commit 17d0c05)

…yCArg_repr(). (GH-10853)

Use "ll" instead of the nonstandard "q".
(cherry picked from commit 062cbb6)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

…(). (GH-11033) (GH-11234)

In _localemodule.c and selectmodule.c, remove dead code that would
cause double decrefs if run.

In addition, replace PyList_SetItem() with PyList_SET_ITEM() in cases
where a new list is populated and there is no possibility of an error.

In addition, check if the list changed size in the loop in array_array_fromlist().
(cherry picked from commit 99d56b5)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

…11229)

"dll" would leak if an error occurred in _validate_paramflags() or
GenericPyCData_new().
(cherry picked from commit d77d97c)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

GH-11175) (GH-11249)

(cherry picked from commit 842acaa)

(cherry picked from 0854b92)

)

This addresses C extension build errors related to an undefined _hypot
symbol when building with the Microsoft Visual C++ Compiler for Python
2.7 [1] or MinGWPy [2]. It also addresses errors when building a C++
extension with MinGWPy and C++11 from cmath, 'error "::hypot' has not
been declared'

[1] https://www.microsoft.com/en-us/download/details.aspx?id=44266
[2] https://mingwpy.github.io/

….1 (GH-11101)"

This reverts commit aa58050.

Due to regressions found with using Tk 8.6.9.1, build the python.org
macOS installers with Tcl/Tk 8.6.8 as used in previous releases.

(cherry picked from commit 9a69ae8)

…-11409)

… diff (#11482)

* bpo-24746: Avoid stripping trailing whitespace in doctest fancy diff

* [2.7] bpo-24746: Avoid stripping trailing whitespace in doctest fancy diff (GH-10639).
(cherry picked from commit cbb1645)

Co-authored-by: Sanyam Khurana <8039608+CuriousLearner@users.noreply.github.com>

(cherry picked from commit 91c6158)

Co-authored-by: Andre Delfino <adelfino@gmail.com>

…11501) (#11512)

…trings. (GH-11515)

…H-11276) (GH-11534)

Format character "%s" in PyString_FromFormat() no longer read memory
past the limit if precision is specified.
(cherry picked from commit d586ccb)

…II format strings (GH-8948)

(cherry picked from commit 1cffd0e)

Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>

…ode. (GH-11127)

Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue35746
(cherry picked from commit a37f524)

Co-authored-by: Christian Heimes <christian@python.org>

…H-11734)

(cherry picked from commit 598e15d)

Co-authored-by: jdemeyer <J.Demeyer@UGent.be>

(cherry picked from commit e9bc417)

Co-authored-by: Mariatta <Mariatta@users.noreply.github.com>

(cherry picked from commit 9db56fb)

Co-authored-by: Julien Palard <julien@palard.fr>

Add credit for the cert parser vulnerability. Mention also Cisco
TALOS-2018-0758 identifier.

GH-10607)

Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests to test with latest OpenSSL.

Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit 3e630c5)
Co-authored-by: Christian Heimes <christian@python.org>

The options OP_NO_COMPRESSION, OP_CIPHER_SERVER_PREFERENCE,
OP_SINGLE_DH_USE, OP_SINGLE_ECDH_USE, OP_NO_SSLv2 (except
for PROTOCOL_SSLv2), and OP_NO_SSLv3 (except for PROTOCOL_SSLv3)
are set by default. The initial cipher suite list contains only
HIGH ciphers, no NULL ciphers and MD5 ciphers (except for PROTOCOL_SSLv2).

(cherry picked from commit 358cfd4)

Partial backport from cb5b68a

Co-authored-by: Christian Heimes <christian@python.org>

)

Backport of TLS 1.3 related fixes from 3.7.

Misc fixes and workarounds for compatibility with OpenSSL 1.1.1 from git
master and TLS 1.3 support. With OpenSSL 1.1.1, Python negotiates TLS 1.3 by
default. Some test cases only apply to TLS 1.2.

OpenSSL 1.1.1 has added a new option OP_ENABLE_MIDDLEBOX_COMPAT for TLS
1.3. The feature is enabled by default for maximum compatibility with
broken middle boxes. Users should be able to disable the hack and CPython's test suite needs
it to verify default options

Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 2a4ee8a)

GH-11879)

multissltests: fix _build_src(), add 'cwd' variable.

… by one character (GH-4517) (GH-11749)

Add one char to MsiSummaryInfoGetProperty() output
Based on the patch in [bpo-1104](https://bugs.python.org/issue1104) by Anthony Tuininga (atuining) and Mark McMahon (markm)
(cherry picked from commit 2de576e)

Co-authored-by: Tzu-ping Chung <uranusjr@gmail.com>





https://bugs.python.org/issue1104

…ng (GH-11911)

https://bugs.python.org/issue35126

https://bugs.python.org/issue35584
(cherry picked from commit 3bacf61)

Co-authored-by: Raymond Hettinger <rhettinger@users.noreply.github.com>

…H-12014)

…Cocoa Tk (GH-12015)

Per POSIX, `nice(3)` requires `unistd.h` and `exit(3)` requires `stdlib.h`.

Fixing the test will prevent false positives with pedantic compilers like clang.
(cherry picked from commit 90c6fac)

Co-authored-by: ngie-eign <1574099+ngie-eign@users.noreply.github.com>

…on). (GH-12027) (GH-12050)

The standard math library (libm) may follow IEEE-754 recommendation to
include an implementation of sinPi(), i.e. sinPi(x):=sin(pi*x).
And this triggers a name clash, found by FreeBSD developer
Steve Kargl, who worked on putting sinpi into libm used on FreeBSD
(it has to be named "sinpi", not "sinPi", cf. e.g.
https://en.cppreference.com/w/c/experimental/fpext4).

Did you know an API documented as printing the pending traceback would sometimes exit the process?

You do now.
(cherry picked from commit 4173772)

Co-authored-by: Gregory P. Smith <greg@krypto.org>

…riginal patch by Kevin Walzer. (GH-12034)

…riginal patch by Kevin Walzer. (GH-12034)

…values (GH-12100)

Fix two unlikely reference leaks in _hashopenssl. The leaks only occur in
out-of-memory cases. Thanks to Charalampos Stratakis.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue36179.
(cherry picked from commit b7bc283)

Co-authored-by: Christian Heimes <christian@python.org>



https://bugs.python.org/issue36179

…12105)

Fix off-by-one bug in cPickle that caused it to use uninitialised memory on truncated pickles read from FILE*s.

GH-12177)

Use test_support.TEST_HTTP_URL (pythontest.net) instead of http://www.example.com/.

GH-12163)

Fix linuxaudiodev.linux_audio_device() error handling:
close the internal file descriptor if it fails to open the device.

The s_get() function leaks the result variable on low memory.
Partially backport commit 19b5254
to fix it.

Remove 's' mention as there's no argument.
(cherry picked from commit e942e7b)

Co-authored-by: Andre Delfino <adelfino@gmail.com>

…ators (GH-12201)

…H-12074)

(cherry picked from commit bf94cc7)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

Cherry picked by hand from a0e911b

* Update pip to 19.0.3
* Update setuptools to 40.8.0
(cherry picked from commit 01e0f43)

Co-authored-by: Pradyun Gedam <pradyunsg@gmail.com>

Patch written by David Malcolm.

Co-Authored-By: David Malcolm <dmalcolm@redhat.com>

…le (GH-12327)

Fix reference leaks in _hotshot.LogReaderType on PyTuple_New() failure.

…-12330)

Fix a reference leak in json if parsing a floating point number fails.

If PyOS_string_to_double() fails in _match_number_str():
decrement numstr ref counter.

…2329)

Fix a reference leak in _bufferedreader_read_all():
_io.BufferedIOMixin.read() leaks a reference on 'data'
when it reads the whole file content but flush() fails.

…H-12332)

Fix an unlikely memory leak on conversion from string to float in the
function _Py_dg_strtod() used by float(str), complex(str),
pickle.load(), marshal.load(), etc.

Fix an unlikely memory leak in _Py_dg_strtod() on "undfl:" label:
rewrite memory management in this function to always release all
memory before exiting the function. Initialize variables to NULL, and
set them to NULL after calling Bfree() at the "cont:" label.

Note: Bfree(NULL) is well defined: it does nothing.

(cherry picked from commit 9776b06)

…H-12349)

Fix CFLAGS in customize_compiler() of distutils.sysconfig: when the
CFLAGS environment variable is defined, don't override CFLAGS variable with
the OPT variable anymore.

Initial patch written by David Malcolm.

Co-Authored-By: David Malcolm <dmalcolm@redhat.com>
(cherry picked from commit 86082c2)

…-12417)

The test test_customize_compiler() now mocks all sysconfig variables
and all environment variables used by customize_compiler().

(cherry picked from commit 72c7b37)

(cherry picked from commit dfc8fc1)

Fix buffer overflow in send() and sendall() methods of socket.socket
for data larger than 2 GiB.

(cherry picked from commit 74ae50e)

Co-authored-by: CAM Gerlach <CAM.Gerlach@Gerlach.CAM>

…c() fails (GH-12334)

(cherry picked from commit 9ae513c)

(cherry picked from commit fc8284e)

Co-authored-by: Jean-François B <jfbu@free.fr>

…12470)

(cherry picked from commit cb90c89)

…w(). (GH-12534)

Add missing Py_DECREF()s.

* bpo-34085: Improve wording on classmethod/staticmethod

* Address comments from Éric

* Address comments from Éric
(cherry picked from commit 548cb60)

Co-authored-by: Andre Delfino <adelfino@gmail.com>

) (GH-12554)

(cherry picked from commit 0523c39)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

…H-9821) (GH-12568)

(cherry picked from commit 6cd658b)


Co-authored-by: Tal Einat <taleinat+github@gmail.com>


https://bugs.python.org/issue34203

(cherry picked from commit f760610)

Co-authored-by: Andre Delfino <adelfino@gmail.com>

…tives (GH-10605)

(cherry picked from commit d5a5a33)

Co-authored-by: Philipp A <flying-sheep@web.de>

…ces. (GH-12241)

…k_nextc() (12601)

Remove the PyMem_FREE() call added in cb90c89.  The buffer will be
freed when PyTokenizer_Free() is called on the tokenizer state.
(cherry picked from commit cda139d)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

…_reduce(). (GH-12106) (GH-12643)

(cherry picked from commit 5f2c508)

…w(). (GH-12660) (GH-12678)

(cherry picked from commit 487b73a)

Fix reference leak hunting in regrtest: compute also deltas (of
reference count and file descriptor count) during warmup, to ensure
that everything is initialized before starting to hunt reference
leaks.

Other changes:

* Replace gc.collect() with support.gc_collect() in clear_caches()
* dash_R() is now more quiet with --quiet option (don't display
  progress).
* Precompute the full range for "for it in range(repcount):" to
  ensure that the iteration doesn't allocate anything new.
* dash_R() now is responsible to call warm_caches().

(cherry picked from commit 5aaac94)

Set CUSTOMIZED_OSX_COMPILER to True to disable
_osx_support.customize_compiler().

A fix for 69e9691, which resulted in lchmod being disabled on all platforms, not just Linux.

(cherry picked from commit ed709d5)

"make tags" and "make TAGS" now also parse Modules/_io/*.c
and Modules/_io/*.h.

(cherry picked from commit 21a74a9)

…H-12687) (GH-12916)

(cherry picked from commit 56ed864)



https://bugs.python.org/issue9194

GH-12949)

bpo-28552, bpo-7774: Fix distutils.sysconfig if sys.executable is
None or an empty string: use os.getcwd() to initialize project_base.

Fix also the distutils build command: don't use sys.executable if
it's evaluated as false (None or empty string).

…P8. (GH-13008)

(cherry picked from commit ee0309f)

Co-authored-by: Utkarsh Gupta <guptautkarsh2102@gmail.com>

…() (GH-13017)

(cherry picked from commit 11e4a94)

Co-authored-by: Xtreak <tir.karthi@gmail.com>

…H-13026) (GH-13063)

(cherry picked from commit c4e78b1)

…13179)

Patch by Mike Taylor.

GH-13199)

* [2.7] bpo-36816: Update the self-signed.pythontest.net cert (GH-13192)

We updated the server, our testsuite must match.

https://bugs.python.org/issue36816

✈️ CLE -> DEN ✈️ #pycon2019 #beyonce
(cherry picked from commit 6bd8173)

The 2.7 tree also needed a certificate in the capath directory updated.
The filename for that was determined by `openssl x509 -in $cert.pem -subject_hash`.

Authored-by: Gregory P. Smith <greg@krypto.org>