Release 3.10.22.3

Doc/whatsnew/3.10.rst

@@ -2524,3 +2524,31 @@ tempfile
   a :exc:`PermissionError` is no longer masked by :exc:`NotADirectoryError`
   (:issue:`43153`), and cleanup no longer recurses endlessly when the
   temporary directory itself cannot be removed (:gh:`79325`).
+
+
+Notable changes in 3.10.22.3
+============================
+
+This is an ActiveState release of the 3.10 line, on top of 3.10.22.2.
+
+tarfile
+-------
+
+* Opening an archive no longer pre-allocates the size a GNU long name/link
+  or pax extended header claims.  The header is read in bounded chunks, so a
+  small crafted archive cannot force a multi-gigabyte allocation before any
+  extraction filter runs.  (:gh:`151497`.)
+
+Build Changes
+-------------
+
+* :mod:`ctypes` builds on Windows against libffi 3.5 and later.  Those
+  versions always declare libffi's ``ffi_type_*`` objects as DLL imports
+  under MSVC, which broke the static initializers in
+  :file:`Modules/_ctypes/cfield.c`.  The format table is now filled in at
+  run time, and the Windows project no longer defines ``FFI_BUILDING``.
+  (Backport of :issue:`45898` and :gh:`92356`.)
+* :file:`Modules/expat/pyexpatns.h` now also renames
+  ``XML_SetHashSalt16Bytes``, which Expat 2.9.0 added, so every function of
+  the bundled Expat carries the ``PyExpat_`` prefix and cannot clash with
+  another copy of Expat loaded in the same process.

Include/patchlevel.h

@@ -23,7 +23,7 @@
 #define PY_RELEASE_SERIAL       0
 
 /* Version as a string */
-#define PY_VERSION              "3.10.22.2"
+#define PY_VERSION              "3.10.22.3"
 /*--end constants--*/
 
 /* Version as a single 4-byte hex number, e.g. 0x010502B2 == 1.5.2b2.

Lib/tarfile.py

@@ -261,6 +261,32 @@ def copyfileobj(src, dst, length=None, exception=OSError, bufsize=None):
         dst.write(buf)
     return
 
+# Maximum number of bytes read in a single call when reading a member's
+# extended header (a GNU long name/link or a pax header).  The size of such
+# a header is taken from the archive and is not trustworthy, so it is read in
+# bounded chunks to avoid a huge up-front allocation when a crafted or
+# truncated archive claims far more data than the file actually contains
+# (gh-151497).
+_EXTHEADER_READ_CHUNK = 1024 * 1024  # 1 MiB
+
+def _safe_read(fileobj, size):
+    """Read up to *size* bytes from *fileobj* in bounded chunks.
+
+    Returns the same bytes as ``fileobj.read(size)`` would (including a short
+    result at end of file), but limits pre-allocation, so an
+    oversized size field in a crafted header cannot force a huge allocation.
+    """
+    if size <= _EXTHEADER_READ_CHUNK:
+        return fileobj.read(size)
+    chunks = []
+    while size > 0:
+        chunk = fileobj.read(min(size, _EXTHEADER_READ_CHUNK))
+        if not chunk:
+            break
+        chunks.append(chunk)
+        size -= len(chunk)
+    return b"".join(chunks)
+
 def _safe_print(s):
     encoding = getattr(sys.stdout, 'encoding', None)
     if encoding is not None:
@@ -1401,7 +1427,7 @@ def _proc_gnulong(self, tarfile):
         """Process the blocks that hold a GNU longname
            or longlink member.
         """
-        buf = tarfile.fileobj.read(self._block(self.size))
+        buf = _safe_read(tarfile.fileobj, self._block(self.size))
 
         # Fetch the next header and process it.
         try:
@@ -1457,7 +1483,7 @@ def _proc_pax(self, tarfile):
            POSIX.1-2008.
         """
         # Read the header information.
-        buf = tarfile.fileobj.read(self._block(self.size))
+        buf = _safe_read(tarfile.fileobj, self._block(self.size))
 
         # A pax header stores supplemental information for either
         # the following file (extended) or all following files

Lib/test/test_tarfile.py

@@ -475,6 +475,54 @@ def test_length_zero_header(self):
             with tarfile.open(support.findfile('recursion.tar')) as tar:
                 pass
 
+
+class ReadSizeRecorder(io.BytesIO):
+    # Records the largest size ever passed to read(), so a test can check
+    # that tarfile does not request far more data than the archive holds
+    # (which on a real file would pre-allocate it).
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.max_read_size = 0
+
+    def read(self, size=-1):
+        if size is not None and size >= 0:
+            self.max_read_size = max(self.max_read_size, size)
+        return super().read(size)
+
+
+@support.cpython_only
+class ExtendedHeaderMemoryTest(unittest.TestCase):
+    # gh-151497: the size of a GNU long name/link or a pax extended header is
+    # read from the archive and is untrusted.  A crafted header can claim a
+    # size far larger than the file actually contains; opening such an archive
+    # must not try to read (and so pre-allocate) the claimed size in one go.
+
+    def crafted_archive(self, hdrtype):
+        tarinfo = tarfile.TarInfo("A")
+        tarinfo.type = hdrtype
+        tarinfo.size = 0xFFFFFFFF  # ~4 GiB claimed in a 512-byte header
+        return tarinfo.tobuf(format=tarfile.GNU_FORMAT)
+
+    def check(self, hdrtype):
+        fobj = ReadSizeRecorder(self.crafted_archive(hdrtype))
+        try:
+            with tarfile.open(fileobj=fobj, mode="r:") as tar:
+                tar.getmembers()
+        except tarfile.ReadError:
+            pass  # a truncated header is fine; we only check the allocation
+        # The bogus ~4 GiB size must never reach a single read() call.
+        self.assertLessEqual(fobj.max_read_size, tarfile._EXTHEADER_READ_CHUNK)
+
+    def test_gnu_longname_oversized_size(self):
+        self.check(tarfile.GNUTYPE_LONGNAME)
+
+    def test_gnu_longlink_oversized_size(self):
+        self.check(tarfile.GNUTYPE_LONGLINK)
+
+    def test_pax_header_oversized_size(self):
+        self.check(tarfile.XHDTYPE)
+
+
 class MiscReadTestBase(CommonReadTest):
     def requires_name_attribute(self):
         pass

Misc/NEWS.d/next/Library/2021-11-26-10-46-09.bpo-45898.UIfhsb.rst

@@ -0,0 +1,2 @@
+:mod:`ctypes` no longer defines ``ffi_type_*`` symbols in ``cfield.c``. The
+symbols have been provided by libffi for over a decade.

Misc/NEWS.d/next/Library/2022-05-05-19-25-09.gh-issue-92356.uvxWdu.rst

@@ -0,0 +1 @@
+Fixed a performance regression in ctypes function calls.

Misc/NEWS.d/next/Library/2026-06-15-15-32-36.gh-issue-151497.1cfmSV.rst

@@ -0,0 +1,4 @@
+Opening a :mod:`tarfile` archive no longer attempts to pre-allocate a huge
+buffer when a crafted or truncated member claims an oversized extended header
+(a GNU long name/link or a pax header).  The extended header is now read in
+bounded chunks, so its size field can no longer trigger memory exhaustion.