From 6c7e32f6a82fac22d52b4b27330286bd8982cc75 Mon Sep 17 00:00:00 2001
From: "Miss Islington (bot)"
 <31488909+miss-islington@users.noreply.github.com>
Date: Sun, 8 Jan 2023 05:19:37 -0800
Subject: gh-100689: Revert "bpo-41798: pyexpat: Allocate the expat_CAPI on the
 heap memory (GH-24061)" (GH-100745)

* gh-100689: Revert "bpo-41798: pyexpat: Allocate the expat_CAPI on the heap memory (GH-24061)"

This reverts commit 7c83eaa536d2f436ae46211ca48692f576c732f0.
(cherry picked from commit b034fd3e5926c63a681a211087b4c666834c7525)

Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
---
 .../2023-01-04-12-58-59.gh-issue-100689.Ce0ITG.rst |  1 +
 Modules/pyexpat.c                                  | 67 +++++++++-------------
 2 files changed, 28 insertions(+), 40 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Library/2023-01-04-12-58-59.gh-issue-100689.Ce0ITG.rst

diff --git a/Misc/NEWS.d/next/Library/2023-01-04-12-58-59.gh-issue-100689.Ce0ITG.rst b/Misc/NEWS.d/next/Library/2023-01-04-12-58-59.gh-issue-100689.Ce0ITG.rst
new file mode 100644
index 0000000..09aeab7
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2023-01-04-12-58-59.gh-issue-100689.Ce0ITG.rst
@@ -0,0 +1 @@
+Fix crash in :mod:`pyexpat` by statically allocating ``PyExpat_CAPI`` capsule.
diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
index a971342..a74d804 100644
--- a/Modules/pyexpat.c
+++ b/Modules/pyexpat.c
@@ -1886,13 +1886,6 @@ error:
 }
 #endif
 
-static void
-pyexpat_destructor(PyObject *op)
-{
-    void *p = PyCapsule_GetPointer(op, PyExpat_CAPSULE_NAME);
-    PyMem_Free(p);
-}
-
 static int
 pyexpat_exec(PyObject *mod)
 {
@@ -1980,46 +1973,40 @@ pyexpat_exec(PyObject *mod)
     MYCONST(XML_PARAM_ENTITY_PARSING_ALWAYS);
 #undef MYCONST
 
-    struct PyExpat_CAPI *capi = PyMem_Calloc(1, sizeof(struct PyExpat_CAPI));
-    if (capi == NULL) {
-        PyErr_NoMemory();
-        return -1;
-    }
+    static struct PyExpat_CAPI capi;
     /* initialize pyexpat dispatch table */
-    capi->size = sizeof(*capi);
-    capi->magic = PyExpat_CAPI_MAGIC;
-    capi->MAJOR_VERSION = XML_MAJOR_VERSION;
-    capi->MINOR_VERSION = XML_MINOR_VERSION;
-    capi->MICRO_VERSION = XML_MICRO_VERSION;
-    capi->ErrorString = XML_ErrorString;
-    capi->GetErrorCode = XML_GetErrorCode;
-    capi->GetErrorColumnNumber = XML_GetErrorColumnNumber;
-    capi->GetErrorLineNumber = XML_GetErrorLineNumber;
-    capi->Parse = XML_Parse;
-    capi->ParserCreate_MM = XML_ParserCreate_MM;
-    capi->ParserFree = XML_ParserFree;
-    capi->SetCharacterDataHandler = XML_SetCharacterDataHandler;
-    capi->SetCommentHandler = XML_SetCommentHandler;
-    capi->SetDefaultHandlerExpand = XML_SetDefaultHandlerExpand;
-    capi->SetElementHandler = XML_SetElementHandler;
-    capi->SetNamespaceDeclHandler = XML_SetNamespaceDeclHandler;
-    capi->SetProcessingInstructionHandler = XML_SetProcessingInstructionHandler;
-    capi->SetUnknownEncodingHandler = XML_SetUnknownEncodingHandler;
-    capi->SetUserData = XML_SetUserData;
-    capi->SetStartDoctypeDeclHandler = XML_SetStartDoctypeDeclHandler;
-    capi->SetEncoding = XML_SetEncoding;
-    capi->DefaultUnknownEncodingHandler = PyUnknownEncodingHandler;
+    capi.size = sizeof(capi);
+    capi.magic = PyExpat_CAPI_MAGIC;
+    capi.MAJOR_VERSION = XML_MAJOR_VERSION;
+    capi.MINOR_VERSION = XML_MINOR_VERSION;
+    capi.MICRO_VERSION = XML_MICRO_VERSION;
+    capi.ErrorString = XML_ErrorString;
+    capi.GetErrorCode = XML_GetErrorCode;
+    capi.GetErrorColumnNumber = XML_GetErrorColumnNumber;
+    capi.GetErrorLineNumber = XML_GetErrorLineNumber;
+    capi.Parse = XML_Parse;
+    capi.ParserCreate_MM = XML_ParserCreate_MM;
+    capi.ParserFree = XML_ParserFree;
+    capi.SetCharacterDataHandler = XML_SetCharacterDataHandler;
+    capi.SetCommentHandler = XML_SetCommentHandler;
+    capi.SetDefaultHandlerExpand = XML_SetDefaultHandlerExpand;
+    capi.SetElementHandler = XML_SetElementHandler;
+    capi.SetNamespaceDeclHandler = XML_SetNamespaceDeclHandler;
+    capi.SetProcessingInstructionHandler = XML_SetProcessingInstructionHandler;
+    capi.SetUnknownEncodingHandler = XML_SetUnknownEncodingHandler;
+    capi.SetUserData = XML_SetUserData;
+    capi.SetStartDoctypeDeclHandler = XML_SetStartDoctypeDeclHandler;
+    capi.SetEncoding = XML_SetEncoding;
+    capi.DefaultUnknownEncodingHandler = PyUnknownEncodingHandler;
 #if XML_COMBINED_VERSION >= 20100
-    capi->SetHashSalt = XML_SetHashSalt;
+    capi.SetHashSalt = XML_SetHashSalt;
 #else
-    capi->SetHashSalt = NULL;
+    capi.SetHashSalt = NULL;
 #endif
 
     /* export using capsule */
-    PyObject *capi_object = PyCapsule_New(capi, PyExpat_CAPSULE_NAME,
-                                          pyexpat_destructor);
+    PyObject *capi_object = PyCapsule_New(&capi, PyExpat_CAPSULE_NAME, NULL);
     if (capi_object == NULL) {
-        PyMem_Free(capi);
         return -1;
     }
 
-- 
cgit v0.12