gh-119342: Fix a potential denial of service in plistlib by serhiy-storchaka · Pull Request #119343 · python/cpython

serhiy-storchaka · 2024-05-21T19:15:30Z

Reading a specially prepared small Plist file could cause OOM because file's read(n) preallocates a bytes object for reading the specified amount of data. Now plistlib reads large data by chunks, therefore the upper limit of consumed memory is proportional to the size of the input file.

Issue: Out-of-memory when loading a Plist #119342

Reading a specially prepared small Plist file could cause OOM because file's read(n) preallocates a bytes object for reading the specified amount of data. Now plistlib reads large data by chunks, therefore the upper limit of consumed memory is proportional to the size of the input file.

Lib/plistlib.py

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

gpshead · 2024-05-24T19:59:26Z

I've marked this Draft for now as discussion on this on the security response team list is not complete. (we'll summarize that in a public issue once it has settled)

encukou · 2025-01-27T13:43:36Z

See #119514 (comment) for results of the PSRT discussion.

miss-islington-app · 2025-12-01T15:28:21Z

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

…nGH-119343) Reading a specially prepared small Plist file could cause OOM because file's read(n) preallocates a bytes object for reading the specified amount of data. Now plistlib reads large data by chunks, therefore the upper limit of consumed memory is proportional to the size of the input file. (cherry picked from commit 694922c) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app · 2025-12-01T15:28:33Z

GH-142143 is a backport of this pull request to the 3.14 branch.

miss-islington-app · 2025-12-01T15:28:34Z

Sorry, @serhiy-storchaka, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 694922cf40aa3a28f898b5f5ee08b71b4922df70 3.12

miss-islington-app · 2025-12-01T15:28:38Z

Sorry, @serhiy-storchaka, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 694922cf40aa3a28f898b5f5ee08b71b4922df70 3.11

bedevere-app · 2025-12-01T15:28:40Z

GH-142144 is a backport of this pull request to the 3.13 branch.

miss-islington-app · 2025-12-01T15:28:42Z

Sorry, @serhiy-storchaka, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 694922cf40aa3a28f898b5f5ee08b71b4922df70 3.10

…19343) (GH-142144) Reading a specially prepared small Plist file could cause OOM because file's read(n) preallocates a bytes object for reading the specified amount of data. Now plistlib reads large data by chunks, therefore the upper limit of consumed memory is proportional to the size of the input file. (cherry picked from commit 694922c) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

…pythonGH-119343) Reading a specially prepared small Plist file could cause OOM because file's read(n) preallocates a bytes object for reading the specified amount of data. Now plistlib reads large data by chunks, therefore the upper limit of consumed memory is proportional to the size of the input file. (cherry picked from commit 694922c) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

…19343) (GH-142143) Reading a specially prepared small Plist file could cause OOM because file's read(n) preallocates a bytes object for reading the specified amount of data. Now plistlib reads large data by chunks, therefore the upper limit of consumed memory is proportional to the size of the input file. (cherry picked from commit 694922c) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app · 2025-12-01T15:55:23Z

GH-142149 is a backport of this pull request to the 3.12 branch.

…pythonGH-119343) Reading a specially prepared small Plist file could cause OOM because file's read(n) preallocates a bytes object for reading the specified amount of data. Now plistlib reads large data by chunks, therefore the upper limit of consumed memory is proportional to the size of the input file. (cherry picked from commit 694922c) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app · 2025-12-01T15:57:29Z

GH-142150 is a backport of this pull request to the 3.11 branch.

…pythonGH-119343) Reading a specially prepared small Plist file could cause OOM because file's read(n) preallocates a bytes object for reading the specified amount of data. Now plistlib reads large data by chunks, therefore the upper limit of consumed memory is proportional to the size of the input file. (cherry picked from commit 694922c) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app · 2025-12-01T15:58:39Z

GH-142151 is a backport of this pull request to the 3.10 branch.

bedevere-bot · 2025-12-01T16:23:28Z

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot AMD64 Debian root 3.14 (tier-1) has failed when building commit b64441e.

What do you need to do:

Don't panic.
Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1742/builds/727) and take a look at the build logs.
Check if the failure is related to this commit (b64441e) or if it is a false positive.
If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1742/builds/727

Summary of the results of the build (if available):

==

Click to see traceback logs

Traceback (most recent call last):
  File "/root/buildarea/3.14.angelico-debian-amd64/build/Lib/test/support/__init__.py", line 847, in gc_collect
    gc.collect()
ResourceWarning: unclosed file <_io.FileIO name=13 mode='wb' closefd=True>


Traceback (most recent call last):
  File "/root/buildarea/3.14.angelico-debian-amd64/build/Lib/test/support/__init__.py", line 847, in gc_collect
    gc.collect()
ResourceWarning: unclosed file <_io.FileIO name=11 mode='wb' closefd=True>

…nGH-119343) Reading a specially prepared small Plist file could cause OOM because file's read(n) preallocates a bytes object for reading the specified amount of data. Now plistlib reads large data by chunks, therefore the upper limit of consumed memory is proportional to the size of the input file.

…19343) (#142149) Reading a specially prepared small Plist file could cause OOM because file's read(n) preallocates a bytes object for reading the specified amount of data. Now plistlib reads large data by chunks, therefore the upper limit of consumed memory is proportional to the size of the input file. (cherry picked from commit 694922c)

serhiy-storchaka added type-security A security issue needs backport to 3.8 needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes labels May 21, 2024

serhiy-storchaka requested a review from ronaldoussoren May 21, 2024 19:15

bedevere-app bot added the awaiting core review label May 21, 2024

bedevere-app bot mentioned this pull request May 21, 2024

Out-of-memory when loading a Plist #119342

Open

picnixz reviewed May 22, 2024

View reviewed changes

Lib/plistlib.py Outdated Show resolved Hide resolved

Lib/plistlib.py Outdated Show resolved Hide resolved

Lib/plistlib.py Outdated Show resolved Hide resolved

serhiy-storchaka and others added 2 commits May 22, 2024 16:00

Apply suggestions from code review

efcb8c5

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Use a named constant.

412032b

gpshead marked this pull request as draft May 24, 2024 19:58

bedevere-app bot removed the awaiting core review label May 24, 2024

hugovk removed the needs backport to 3.8 label Oct 9, 2024

gpshead mentioned this pull request Jan 20, 2025

gh-119511: Fix a potential denial of service in imaplib #119514

Merged

serhiy-storchaka added the needs backport to 3.14 bugs and security fixes label May 8, 2025

ambv removed the needs backport to 3.9 label Oct 31, 2025

serhiy-storchaka changed the title ~~gh-119342: Fix OOM vulnerability in plistlib~~ gh-119342: Fix a potential denial of service in plistlib Nov 18, 2025

Update 2024-05-21-22-11-31.gh-issue-119342.BTFj4Z.rst

64fc738

serhiy-storchaka marked this pull request as ready for review November 18, 2025 13:41

bedevere-app bot added the awaiting core review label Nov 18, 2025

Merge branch 'main' into plistlib-oom

ae1d2bc

gpshead approved these changes Nov 24, 2025

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting core review labels Nov 24, 2025

serhiy-storchaka added 2 commits December 1, 2025 16:22

Merge branch 'main' into plistlib-oom

9e18b74

Address review comments.

82093fb

serhiy-storchaka merged commit 694922c into python:main Dec 1, 2025
46 checks passed

serhiy-storchaka deleted the plistlib-oom branch December 1, 2025 15:28

bedevere-app bot removed the awaiting merge label Dec 1, 2025

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Dec 1, 2025

miss-islington-app bot assigned serhiy-storchaka Dec 1, 2025

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Dec 1, 2025

bedevere-app bot removed the needs backport to 3.12 only security fixes label Dec 1, 2025

bedevere-app bot removed the needs backport to 3.11 only security fixes label Dec 1, 2025

bedevere-app bot removed the needs backport to 3.10 only security fixes label Dec 1, 2025

Uh oh!

Conversation

serhiy-storchaka commented May 21, 2024 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gpshead commented May 24, 2024

Uh oh!

encukou commented Jan 27, 2025

Uh oh!

Uh oh!

miss-islington-app bot commented Dec 1, 2025

Uh oh!

bedevere-app bot commented Dec 1, 2025

Uh oh!

miss-islington-app bot commented Dec 1, 2025

Uh oh!

miss-islington-app bot commented Dec 1, 2025

Uh oh!

bedevere-app bot commented Dec 1, 2025

Uh oh!

miss-islington-app bot commented Dec 1, 2025

Uh oh!

bedevere-app bot commented Dec 1, 2025

Uh oh!

bedevere-app bot commented Dec 1, 2025

Uh oh!

bedevere-app bot commented Dec 1, 2025

Uh oh!

bedevere-bot commented Dec 1, 2025

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

serhiy-storchaka commented May 21, 2024 •

edited by bedevere-app bot

Loading