pyexpat: segmentation fault when `--with-system-expat` is specified

[y-tag]

BPO	45329
Nosy	@vstinner, @serhiy-storchaka, @miss-islington, @y-tag
PRs	bpo-45329: Fix freed memory access in pyexpat.c #28649 [3.10] bpo-45329: Fix freed memory access in pyexpat.c (GH-28649) #28692 [3.9] bpo-45329: Fix freed memory access in pyexpat.c (GH-28649) #28693
Files	pyexpat-log.txt

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2021-10-02.13:22:32.626>
created_at = <Date 2021-09-30.11:21:11.613>
labels = ['extension-modules', '3.10', 'type-crash', '3.11']
title = 'pyexpat: segmentation fault when `--with-system-expat` is specified'
updated_at = <Date 2021-10-02.13:22:32.626>
user = 'https://github.com/y-tag'

bugs.python.org fields:

activity = <Date 2021-10-02.13:22:32.626>
actor = 'serhiy.storchaka'
assignee = 'none'
closed = True
closed_date = <Date 2021-10-02.13:22:32.626>
closer = 'serhiy.storchaka'
components = ['Extension Modules']
creation = <Date 2021-09-30.11:21:11.613>
creator = 'y-tag'
dependencies = []
files = ['50317']
hgrepos = []
issue_num = 45329
keywords = ['patch']
message_count = 3.0
messages = ['402949', '403050', '403051']
nosy_count = 4.0
nosy_names = ['vstinner', 'serhiy.storchaka', 'miss-islington', 'y-tag']
pr_nums = ['28649', '28692', '28693']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue45329'
versions = ['Python 3.10', 'Python 3.11']

[y-tag]

Some tests, which are related to pyexpat, get failed with ./configure --with-system-expat.

11 tests failed:                       
    test_minidom test_multiprocessing_fork                                                               
    test_multiprocessing_forkserver test_multiprocessing_spawn
    test_plistlib test_pulldom test_pyexpat test_sax test_xml_etree
    test_xml_etree_c test_xmlrpc

Since 3.10.0b2, [Modules/pyexpat.c](https://github.com/python/cpython/blob/main/Modules/pyexpat.c) has been broken.
I guess this is caused by accessing freed memory.
For more detail, please refer to the attached file.

[serhiy-storchaka]

New changeset 0742abd by TAGAMI Yukihiro in branch 'main':
bpo-45329: Fix freed memory access in pyexpat.c (GH-28649)
0742abd

[miss-islington]

New changeset 22cf6a2 by Miss Islington (bot) in branch '3.10':
bpo-45329: Fix freed memory access in pyexpat.c (GH-28649)
22cf6a2