(cherry picked from commit 55f41e4)

Define _CRT_SECURE_NO_WARNINGS in the Visual Studio pythoncore
project to make quiet security warnings when building zlib C files
(Modules\zlib\ subdirectory).

(cherry picked from commit c9566b8)

Co-authored-by: Andre Delfino <adelfino@gmail.com>

…11068)

Fix xml.dom.minidom cloneNode() on a document with an entity: pass
the correct arguments to the user data handler of an entity (fix an
old copy/paste mistake).

Bug spotted and fix proposed by Charalampos Stratakis, initial
reproducer written by Petr Viktorin.

Co-Authored-By: Charalampos Stratakis <cstratak@redhat.com>
Co-Authored-By: Petr Viktorin <encukou@gmail.com>
(cherry picked from commit 8e04186)

Include <pyconfig.h> ealier in Modules/expat/xmltok.c to define
properly _POSIX_C_SOURCE. Python defines _POSIX_C_SOURCE as 200809L,
whereas <features.h> (included indirectly by <string.h>) defines
_POSIX_C_SOURCE as 199506L.
(cherry picked from commit cf24735)

Co-authored-by: Victor Stinner <vstinner@redhat.com>

Use GCC __attribute__((unused)) to mark the debug variable 'filename'
as unused in Python/ceval.c.

Include <pyconfig.h> ealier in Modules/expat/xmlparse.c to define
properly _POSIX_C_SOURCE and _XOPEN_SOURCE.

…1101)

(cherry picked from commit 7cf3d8e)

Co-authored-by: Ned Deily <nad@python.org>

(cherry picked from commit cb34218)

…) (GH-11213)

check_environ() of distutils.utils now catchs KeyError on calling
pwd.getpwuid(): don't create the HOME environment variable in this
case.

(cherry picked from commit 17d0c05)

…yCArg_repr(). (GH-10853)

Use "ll" instead of the nonstandard "q".
(cherry picked from commit 062cbb6)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

…(). (GH-11033) (GH-11234)

In _localemodule.c and selectmodule.c, remove dead code that would
cause double decrefs if run.

In addition, replace PyList_SetItem() with PyList_SET_ITEM() in cases
where a new list is populated and there is no possibility of an error.

In addition, check if the list changed size in the loop in array_array_fromlist().
(cherry picked from commit 99d56b5)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

…11229)

"dll" would leak if an error occurred in _validate_paramflags() or
GenericPyCData_new().
(cherry picked from commit d77d97c)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

….1 (GH-11101)"

This reverts commit aa58050.

Due to regressions found with using Tk 8.6.9.1, build the python.org
macOS installers with Tcl/Tk 8.6.8 as used in previous releases.

(cherry picked from commit 9a69ae8)

… diff (#11482)

* bpo-24746: Avoid stripping trailing whitespace in doctest fancy diff

* [2.7] bpo-24746: Avoid stripping trailing whitespace in doctest fancy diff (GH-10639).
(cherry picked from commit cbb1645)

Co-authored-by: Sanyam Khurana <8039608+CuriousLearner@users.noreply.github.com>

…H-11276) (GH-11534)

Format character "%s" in PyString_FromFormat() no longer read memory
past the limit if precision is specified.
(cherry picked from commit d586ccb)

…II format strings (GH-8948)

(cherry picked from commit 1cffd0e)

Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>

Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue35746
(cherry picked from commit a37f524)

Co-authored-by: Christian Heimes <christian@python.org>

Add credit for the cert parser vulnerability. Mention also Cisco
TALOS-2018-0758 identifier.

The options OP_NO_COMPRESSION, OP_CIPHER_SERVER_PREFERENCE,
OP_SINGLE_DH_USE, OP_SINGLE_ECDH_USE, OP_NO_SSLv2 (except
for PROTOCOL_SSLv2), and OP_NO_SSLv3 (except for PROTOCOL_SSLv3)
are set by default. The initial cipher suite list contains only
HIGH ciphers, no NULL ciphers and MD5 ciphers (except for PROTOCOL_SSLv2).

(cherry picked from commit 358cfd4)

)

Backport of TLS 1.3 related fixes from 3.7.

Misc fixes and workarounds for compatibility with OpenSSL 1.1.1 from git
master and TLS 1.3 support. With OpenSSL 1.1.1, Python negotiates TLS 1.3 by
default. Some test cases only apply to TLS 1.2.

OpenSSL 1.1.1 has added a new option OP_ENABLE_MIDDLEBOX_COMPAT for TLS
1.3. The feature is enabled by default for maximum compatibility with
broken middle boxes. Users should be able to disable the hack and CPython's test suite needs
it to verify default options

Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 2a4ee8a)

GH-11879)

multissltests: fix _build_src(), add 'cwd' variable.

Per POSIX, `nice(3)` requires `unistd.h` and `exit(3)` requires `stdlib.h`.

Fixing the test will prevent false positives with pedantic compilers like clang.
(cherry picked from commit 90c6fac)

Co-authored-by: ngie-eign <1574099+ngie-eign@users.noreply.github.com>

…on). (GH-12027) (GH-12050)

The standard math library (libm) may follow IEEE-754 recommendation to
include an implementation of sinPi(), i.e. sinPi(x):=sin(pi*x).
And this triggers a name clash, found by FreeBSD developer
Steve Kargl, who worked on putting sinpi into libm used on FreeBSD
(it has to be named "sinpi", not "sinPi", cf. e.g.
https://en.cppreference.com/w/c/experimental/fpext4).

Did you know an API documented as printing the pending traceback would sometimes exit the process?

You do now.
(cherry picked from commit 4173772)

Co-authored-by: Gregory P. Smith <greg@krypto.org>

…riginal patch by Kevin Walzer. (GH-12034)

…12105)

Fix off-by-one bug in cPickle that caused it to use uninitialised memory on truncated pickles read from FILE*s.

GH-12163)

Fix linuxaudiodev.linux_audio_device() error handling:
close the internal file descriptor if it fails to open the device.

The s_get() function leaks the result variable on low memory.
Partially backport commit 19b5254
to fix it.

Remove 's' mention as there's no argument.
(cherry picked from commit e942e7b)

Co-authored-by: Andre Delfino <adelfino@gmail.com>

…H-12074)

(cherry picked from commit bf94cc7)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

* Update pip to 19.0.3
* Update setuptools to 40.8.0
(cherry picked from commit 01e0f43)

Co-authored-by: Pradyun Gedam <pradyunsg@gmail.com>

…le (GH-12327)

Fix reference leaks in _hotshot.LogReaderType on PyTuple_New() failure.

…-12330)

Fix a reference leak in json if parsing a floating point number fails.

If PyOS_string_to_double() fails in _match_number_str():
decrement numstr ref counter.

…2329)

Fix a reference leak in _bufferedreader_read_all():
_io.BufferedIOMixin.read() leaks a reference on 'data'
when it reads the whole file content but flush() fails.

…H-12332)

Fix an unlikely memory leak on conversion from string to float in the
function _Py_dg_strtod() used by float(str), complex(str),
pickle.load(), marshal.load(), etc.

Fix an unlikely memory leak in _Py_dg_strtod() on "undfl:" label:
rewrite memory management in this function to always release all
memory before exiting the function. Initialize variables to NULL, and
set them to NULL after calling Bfree() at the "cont:" label.

Note: Bfree(NULL) is well defined: it does nothing.

(cherry picked from commit 9776b06)

…-12417)

The test test_customize_compiler() now mocks all sysconfig variables
and all environment variables used by customize_compiler().

(cherry picked from commit 72c7b37)

(cherry picked from commit dfc8fc1)

Fix buffer overflow in send() and sendall() methods of socket.socket
for data larger than 2 GiB.

(cherry picked from commit 74ae50e)

Co-authored-by: CAM Gerlach <CAM.Gerlach@Gerlach.CAM>

(cherry picked from commit fc8284e)

Co-authored-by: Jean-François B <jfbu@free.fr>

…w(). (GH-12534)

Add missing Py_DECREF()s.

* bpo-34085: Improve wording on classmethod/staticmethod

* Address comments from Éric

* Address comments from Éric
(cherry picked from commit 548cb60)

Co-authored-by: Andre Delfino <adelfino@gmail.com>

(cherry picked from commit f760610)

Co-authored-by: Andre Delfino <adelfino@gmail.com>

…tives (GH-10605)

(cherry picked from commit d5a5a33)

Co-authored-by: Philipp A <flying-sheep@web.de>

Fix reference leak hunting in regrtest: compute also deltas (of
reference count and file descriptor count) during warmup, to ensure
that everything is initialized before starting to hunt reference
leaks.

Other changes:

* Replace gc.collect() with support.gc_collect() in clear_caches()
* dash_R() is now more quiet with --quiet option (don't display
  progress).
* Precompute the full range for "for it in range(repcount):" to
  ensure that the iteration doesn't allocate anything new.
* dash_R() now is responsible to call warm_caches().

(cherry picked from commit 5aaac94)

Set CUSTOMIZED_OSX_COMPILER to True to disable
_osx_support.customize_compiler().

(cherry picked from commit 11e4a94)

Co-authored-by: Xtreak <tir.karthi@gmail.com>

…or old TLS (GH-13124) (GH-13253)

Modern Linux distros such as Debian Buster have default OpenSSL system
configurations that reject connections to servers with weak certificates
by default. This causes our test suite run with external networking
resources enabled to skip these tests when they encounter such a
failure.

Fixing the network servers is a separate issue.
(cherry picked from commit 2cc0223)

Changes to test_ssl.py required as 2.7 has legacy protocol tests.

The test_httplib.py change is omitted from this backport as
self-signed.pythontest.net's certificate was updated and the
test_nntplib.py change is not applicable on 2.7.

Authored-by: Gregory P. Smith greg@krypto.org

…peobject.c. (GH-13403)

(cherry picked from commit 53d378c)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>

…H-13315)

Disallow control chars in http URLs in urllib2.urlopen.  This
addresses a potential security problem for applications that do not
sanity check their URLs where http request headers could be injected.

Disable https related urllib tests on a build without ssl (GH-13032)
These tests require an SSL enabled build. Skip these tests when
python is built without SSL to fix test failures.

Use httplib.InvalidURL instead of ValueError as the new error case's
exception. (GH-13044)

Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz>

(cherry picked from commit 7e200e0)

Notes on backport to Python 2.7:

* test_urllib tests urllib.urlopen() which quotes the URL and so is
  not vulerable to HTTP Header Injection.
* Add tests to test_urllib2 on urllib2.urlopen().
* Reject non-ASCII characters: range 0x80-0xff.

 CVE-2019-9948: Avoid file reading as disallowing the unnecessary URL scheme in urllib.urlopen().

Fix possible overflow in wrap_lenfunc() when
sizeof(long) < sizeof(Py_ssize_t) (e.g., 64-bit Windows).

(cherry picked from commit 05f1641)

…ows (GH-13629)

Skip the test if xrange(sys.maxsize) raises an OverflowError.

(cherry picked from commit 59e7bbc)

Co-authored-by: Julien Palard <julien@palard.fr>

This avoids the search dialogs being hidden behind the editor window.

(cherry picked from commit 554450f)

* regrtest: Add --cleanup option to remove "test_python_*" directories
  of previous failed test jobs.
* Add "make cleantest" to run "python -m test --cleanup".

(cherry picked from commit 47fbc4e)

(cherry picked from commit c0295db)

(cherry picked from commit 3b03b09)

Co-authored-by: Benjamin Peterson <benjamin@python.org>

…4202)

_PyWarnings_Init() only allocates memory once at startup but it is
not released at exit. Ignore this issue to be able to catch other
bugs more easily.

Also fix a name misspelling.
(cherry picked from commit 45bc61b)

Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>

0 is a legal index.
(cherry picked from commit f8709e8)

Co-authored-by: Terry Jan Reedy <tjreedy@udel.edu>

(cherry picked from commit 2a3d4d9)

Co-authored-by: Benjamin Peterson <benjamin@python.org>

…positional-only (GH-9499)

(cherry picked from commit 79042ac)

Co-authored-by: Tal Einat <taleinat@gmail.com>

…5349)

If this service had thoroughly vanished, we could just ignore the
test until someone gets around to either recreating such a service
or redesigning the test to somehow work locally.  The
`support.transient_internet` mechanism catches the failure to
resolve the domain name, and skips the test.

But in fact the domain snakebite.net does still exist, as do its
nameservers -- and they can be quite slow to reply.  As a result
this test can easily take 20-30s before it gets auto-skipped.

So, skip the test explicitly up front.
(cherry picked from commit 5b95a15)

Co-authored-by: Greg Price <gnprice@gmail.com>

Fixed wrong link to Telnet.open() method in telnetlib documentation.
(cherry picked from commit e0b6117)

Co-authored-by: Michael Anckaert <michael.anckaert@sinax.be>

(cherry picked from commit d0b10a6)

Fix file descriptors transfer in multiprocessing on FreeBSD: use
CMSG_SPACE() rather than CMSG_LEN(); see RFC 3542.

GH-15808)

The link we have points to the version from Unicode 6.0.0, dated 2010.
There have been numerous updates to it since then:
  https://www.unicode.org/reports/tr44/GH-Modifications

Change the link to one that points to the current version. Also, use HTTPS..
(cherry picked from commit 64c6ac7)

Co-authored-by: Greg Price <gnprice@gmail.com>

…calls (GH-15822)

If FormatMessageW() is passed the FORMAT_MESSAGE_FROM_SYSTEM flag
without FORMAT_MESSAGE_IGNORE_INSERTS, it will fail if there are
insert sequences in the message definition.
(cherry picked from commit a656365)

Fixes a build error with OpenSSL 1.1.0. There is already code in the
`_ssl.c` that handles all the weird cases of the NPN config macros (with
various OpenSSL & LibreSSL versions).
That code will provide a HAVE_NPN variable, which should be used in the
rest of the code to check whether (or what) to compile regarding NPN.

This change adds HAVE_NPN in the remaining places where it should have been
placed.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>


https://bugs.python.org/issue35264

(cherry picked from commit 10c452b)

Co-authored-by: Pradyun Gedam <pradyunsg@gmail.com>

…alidation and encoding behavior (GH-16476)

Backporting this change, I observe a couple of things:

1. The _encode_request call is no longer meaningful because the request construction will implicitly encode the request using the default encoding when the format string is used (request = '%s %s %s'...). In order to keep the code as consistent as possible, I decided to include the call as a pass-through. I'd be just as happy to remove it entirely, but I'll leave that up to the reviewer to decide. It's okay that this functionality is disabled on Python 2 because this functionality was mainly around bpo-36274, which was mainly a concern with the transition to Python 3.
2. Because _encode_request is no longer meaningful, neither is the test for it, so I've removed that test. Therefore, the meaningful part of this test is that for bpo-38216, adding a (underscore-protected) hook to customize/disable validation.

(cherry picked from commit 7774d78)

Co-authored-by: Jason R. Coombs <jaraco@jaraco.com>

…H-16635)

(cherry picked from commit ee171a2)

Co-authored-by: Pablo Galindo <Pablogsal@gmail.com>

Also addresses doc build failures documented in bpo-32200.
(cherry picked from commit 7324b5c)

Co-authored-by: Julien Palard <julien@palard.fr>

Previous to commit ee171a2 the logline was working because of self.info() (now
deprecated) defaults to an empty message.
(cherry picked from commit c3f52a5)

Co-authored-by: Xtreak <tirkarthi@users.noreply.github.com>

…-16638)

Rather than requiring the path to blurb and/or sphinx-build to be specified to the make rule, enhance the Doc/Makefile to look for each first in a virtual environment created by make venv and, if not found, look on the normal process PATH. This allows the Doc/Makefile to take advantage of an installed spinx-build or blurb and, thus, do the right thing most of the time. Also, make the directory for the venv be configurable and document the `make venv` target..
(cherry picked from commit 590665c)

Co-authored-by: Ned Deily <nad@python.org>

(cherry picked from commit 3f36043)

Co-authored-by: Ned Deily <nad@python.org>

AddRefActCtx() does not return a value.

(cherry picked from commit 01659ca)

Co-authored-by: Ned Deily <nad@python.org>

(cherry picked from commit d898d20)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

…IX_C_SOURCE (GH-16733)

(cherry picked from commit 8177404)

Co-authored-by: Pablo Galindo <Pablogsal@gmail.com>

In all these cases, we know the exact length we want copied, so memcpy is the right function to use.

…acOS Catalina (GH-17636)

(cherry picked from commit bf3aa10)

Co-authored-by: Ned Deily <nad@python.org>

(cherry picked from commit 946b29e)

Co-authored-by: Benjamin Peterson <benjamin@python.org>

(cherry picked from commit 32f1443)

Co-authored-by: Ned Deily <nad@python.org>