diff options
| author | Gregory P. Smith <greg@krypto.org> | 2012-03-14 21:26:55 (GMT) |
|---|---|---|
| committer | Gregory P. Smith <greg@krypto.org> | 2012-03-14 21:26:55 (GMT) |
| commit | 8e91cf6a5e5be8f84132498d5654d6ad2e4d54c2 (patch) | |
| tree | 3c473971bf386649c6a8179c48a59146cd85c63e /Modules/pyexpat.c | |
| parent | 273cd1812a7c8646b52aa3afee1c5db5a0e539d6 (diff) | |
| download | cpython-8e91cf6a5e5be8f84132498d5654d6ad2e4d54c2.zip cpython-8e91cf6a5e5be8f84132498d5654d6ad2e4d54c2.tar.gz cpython-8e91cf6a5e5be8f84132498d5654d6ad2e4d54c2.tar.bz2 | |
Fixes issue #14234: CVE-2012-0876: Randomize hashes of xml attributes
in the hash table internal to the pyexpat module's copy of the expat
library to avoid a denial of service due to hash collisions.
Patch by David Malcolm with some modifications by the expat project.
Diffstat (limited to 'Modules/pyexpat.c')
| -rw-r--r-- | Modules/pyexpat.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c index 4e806e2..3ff56f4 100644 --- a/Modules/pyexpat.c +++ b/Modules/pyexpat.c @@ -1245,6 +1245,8 @@ newxmlparseobject(char *encoding, char *namespace_separator, PyObject *intern) else { self->itself = XML_ParserCreate(encoding); } + XML_SetHashSalt(self->itself, + (unsigned long)_Py_HashSecret.prefix); self->intern = intern; Py_XINCREF(self->intern); #ifdef Py_TPFLAGS_HAVE_GC |