pyexpat: CPython can be crashed through resetting StartDoctypeDeclHandler with pyexpat at the wrong time #160442

Hello!

It has been brought to my attention that the Expat XML parser can be crashed via a segmentation fault by resetting member StartDoctypeDeclHandler at the wrong time, like this:

from xml.parsers.expat import ParserCreate

parser = ParserCreate()

def reset_start_doctype_handler():
    parser.StartDoctypeDeclHandler = None
    return True

parser.StartDoctypeDeclHandler = lambda *_: None
parser.NotStandaloneHandler = reset_start_doctype_handler

parser.Parse(b"<!DOCTYPE r SYSTEM \"s\"><r/>", True)

This affects all versions of Python with all versions of Expat up to 2.9.0 including. Expat upstream pull request libexpat/libexpat#1437 fixes this issue for itself and CPython and the fix will be contained in the next release that may come out as early as next Monday. So updating to the next release will fix this for Python for free, I just wanted to let you know.

Credits for this finding go to Bartłomiej Dmitruk (@hackerman70000) of https://www.striga.ai/ .

Bartłomiej reported this as defense-in-depth to me and we both do not consider this a vulnerability. If you come to difference conclusions, please let me know.

Best, Sebastian

CC @StanFromIreland @picnixz