Commit Graph

11297 Commits

Author SHA1 Message Date
Miss Islington (bot) 9c87fbe54e
Valgrind no longer supports --db-attach=yes. (GH-18568) (#18576)
(cherry picked from commit c0cb8beb38)

Co-authored-by: Stefan Krah <skrah@bytereef.org>

Co-authored-by: Stefan Krah <skrah@bytereef.org>
2020-02-20 19:38:19 +01:00
Miss Islington (bot) 0721f7afb0
Use the new recommended number of repetitions in the refleak tests. (GH-18569) (#18574)
(cherry picked from commit 1246d89203)

Co-authored-by: Stefan Krah <skrah@bytereef.org>

Co-authored-by: Stefan Krah <skrah@bytereef.org>
2020-02-20 19:31:39 +01:00
Miss Islington (bot) 471d2b9ce0
Update runall.bat to the latest Windows build system. (GH-18571) (#18573)
(cherry picked from commit 9b833e00e4)

Co-authored-by: Stefan Krah <skrah@bytereef.org>

Co-authored-by: Stefan Krah <skrah@bytereef.org>
2020-02-20 19:31:11 +01:00
Steve Dower a00b5be5f7
bpo-39184: Add audit events to functions in `fcntl`, `msvcrt`, `os`, `resource`, `shutil`, `signal`, `syslog` (GH-18407)
Co-authored-by: Saiyang Gou <gousaiyang@163.com>
2020-02-13 08:30:27 +00:00
Miss Islington (bot) 669981b3b1
closes bpo-39621: Make buf arg to md5_compress be const. (GH-18497)
(cherry picked from commit 597ebed748)

Co-authored-by: Andy Lester <andy@petdance.com>
2020-02-12 21:12:53 -08:00
Miss Islington (bot) 190433d815
closes bpo-39605: Fix some casts to not cast away const. (GH-18453)
gcc -Wcast-qual turns up a number of instances of casting away constness of pointers. Some of these can be safely modified, by either:

Adding the const to the type cast, as in:

-    return _PyUnicode_FromUCS1((unsigned char*)s, size);
+    return _PyUnicode_FromUCS1((const unsigned char*)s, size);

or, Removing the cast entirely, because it's not necessary (but probably was at one time), as in:

-    PyDTrace_FUNCTION_ENTRY((char *)filename, (char *)funcname, lineno);
+    PyDTrace_FUNCTION_ENTRY(filename, funcname, lineno);

These changes will not change code, but they will make it much easier to check for errors in consts
(cherry picked from commit e6be9b59a9)

Co-authored-by: Andy Lester <andy@petdance.com>
2020-02-11 18:47:20 -08:00
Miss Islington (bot) dc56f5f488 bpo-39590: make deque.__contains__ and deque.count hold strong references (GH-18421) (GH-18423)
(cherry picked from commit c6dedde160)

Co-authored-by: sweeneyde <36520290+sweeneyde@users.noreply.github.com>

Co-authored-by: sweeneyde <36520290+sweeneyde@users.noreply.github.com>
2020-02-09 00:39:28 -08:00
Miss Islington (bot) 3498ac55bc
bpo-39184: Add audit events to command execution functions in os and pty modules (GH-17824)
(cherry picked from commit 95f6001021)

Co-authored-by: Saiyang Gou <gousaiyang@163.com>
2020-02-04 16:32:32 -08:00
Miss Islington (bot) 30e769382d
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295)
When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc469454ec added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c0746f2)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
2020-02-04 13:41:55 -08:00
Antoine Pitrou 1723687339
[3.8] bpo-39492: Fix a reference cycle between reducer_override and a Pickler instance (GH-18266) (#18316)
https://bugs.python.org/issue39492

Automerge-Triggered-By: @pitrou
(cherry picked from commit 0f2f35e)

Co-authored-by: Pierre Glaser <pierreglaser@msn.com>
2020-02-02 21:22:57 +01:00
Miss Islington (bot) 46735c7e10
bpo-39393: Misleading error message on dependent DLL resolution failure (GH-18093)
(cherry picked from commit 13c1c3556f)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>
2020-01-28 02:00:16 -08:00
Miss Islington (bot) a46728a570
bpo-39426: Fix outdated default and highest protocols in docs (GH-18154)
Some portions of the pickle documentation hadn't been updated for the pickle protocol changes in Python 3.8 (new protocol 5, default protocol 4). This PR fixes those docs.

https://bugs.python.org/issue39426
(cherry picked from commit e9652e8d58)

Co-authored-by: Mark Dickinson <mdickinson@enthought.com>
2020-01-24 02:20:35 -08:00
Miss Islington (bot) 993811ffe7
bpo-39421: Fix posible crash in heapq with custom comparison operators (GH-18118)
* bpo-39421: Fix posible crash in heapq with custom comparison operators

* fixup! bpo-39421: Fix posible crash in heapq with custom comparison operators

* fixup! fixup! bpo-39421: Fix posible crash in heapq with custom comparison operators
(cherry picked from commit 79f89e6e5a)

Co-authored-by: Pablo Galindo <Pablogsal@gmail.com>
2020-01-23 07:22:25 -08:00
Miss Islington (bot) eb9ba2f66d bpo-16575: Disabled checks for union types being passed by value. (GH-17960) (GH-17964)
Although the underlying libffi issue remains open, adding these
checks have caused problems in third-party projects which are in
widespread use. See the issue for examples.

The corresponding tests have also been skipped.

(cherry picked from commit c12440c371)
2020-01-12 11:41:07 +00:00
Miss Islington (bot) 45e5750a01
closes bpo-39262: Use specific out-of-memory message in _sharedexception_bind. (GH-17908)
(cherry picked from commit 5cae042f68)

Co-authored-by: Alex Henrie <alexhenrie24@gmail.com>
2020-01-08 19:07:38 -08:00
Miss Islington (bot) aa3efea9c5 bpo-38532: Add missing decrefs in PyCFuncPtr_FromDll() (GH-17811)
(cherry picked from commit e02ab59fdf)

Co-authored-by: Zackery Spytz <zspytz@gmail.com>
2020-01-03 13:50:11 +01:00
Miss Islington (bot) 9d3cacd590
[3.8] bpo-38820: OpenSSL 3.0.0 compatibility. (GH-17190) (GH-17499)
test_openssl_version now accepts version 3.0.0.

getpeercert() no longer returns IPv6 addresses with a trailing new line.

Signed-off-by: Christian Heimes <christian@python.org>


https://bugs.python.org/issue38820
(cherry picked from commit 2b7de6696b)


Co-authored-by: Christian Heimes <christian@python.org>


https://bugs.python.org/issue38820



Automerge-Triggered-By: @tiran
2019-12-07 09:20:27 -08:00
Miss Islington (bot) ce0a2a8620
Make repr of C accelerated TaskWakeupMethWrapper the same as of pure Python version (GH-17484)
(cherry picked from commit 969ae7aca8)

Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>
2019-12-07 03:41:41 -08:00
Miss Islington (bot) 836cf31a3c
bpo-37931: Fix crash on OSX re-initializing os.environ (GH-15428)
On most platforms, the `environ` symbol is accessible everywhere.

In a dylib on OSX, it's not easily accessible, you need to find it with
_NSGetEnviron.

The code was caching the *value* of environ. But a setenv() can change the value,
leaving garbage at the old value. Fix: don't cache the value of environ, just
read it every time.
(cherry picked from commit 723f71abf7)

Co-authored-by: Benoit Hudson <benoit@imgspc.com>
2019-12-06 11:32:33 -08:00
Miss Islington (bot) f4a21d3b23
bpo-38965: Fix faulthandler._stack_overflow() on GCC 10 (GH-17467)
Use the "volatile" keyword to prevent tail call optimization
on any compiler, rather than relying on compiler specific pragma.
(cherry picked from commit 8b787964e0)

Co-authored-by: Victor Stinner <vstinner@python.org>
2019-12-04 12:30:31 -08:00
Miss Islington (bot) 68669ef788
bpo-38634: Allow non-apple build to cope with libedit (GH-16986)
The readline module now detects if Python is linked to libedit at runtime
on all platforms.  Previously, the check was only done on macOS.

If Python is used as a library by a binary linking to libedit, the linker
resolves the rl_initialize symbol required by the readline module against
libedit instead of libreadline, which leads to a segfault.

Take advantage of the existing supporting code to have readline module being
compatible with both situations.
(cherry picked from commit 7105319ada)

Co-authored-by: serge-sans-paille <serge.guelton@telecom-bretagne.eu>
2019-12-04 08:21:16 -08:00
Victor Stinner 84c36c152a
bpo-36854: Fix reference counter in PyInit__testcapi() (GH-17338)
Increment properly Py_True/Py_False reference counter for
_testcapi.WITH_PYMALLOC variable.
2019-11-22 13:39:36 +01:00
Miss Islington (bot) daf7a082b2
bpo-38823: Fix refleak in _tracemalloc init error handling (GH-17235)
(cherry picked from commit d51a363a43)

Co-authored-by: Brandt Bucher <brandtbucher@gmail.com>
2019-11-20 02:26:48 -08:00
Miss Islington (bot) a5ed2fe0ee
bpo-38823: Fix refleaks in faulthandler init error path on Windows (GH-17250)
(cherry picked from commit ac2235432c)

Co-authored-by: Brandt Bucher <brandtbucher@gmail.com>
2019-11-19 15:31:08 -08:00
Miss Islington (bot) bec7015dcc
bpo-38622: Ensure ctypes.PyObj_FromPtr audit event passes tuples as a single argument (GH-17243)
(cherry picked from commit dcf1f83de8)

Co-authored-by: Steve Dower <steve.dower@python.org>
2019-11-18 13:59:51 -08:00
Miss Islington (bot) 47db7439dd
bpo-38622: Add missing audit events for ctypes module (GH-17158)
(cherry picked from commit 00923c6399)

Co-authored-by: Steve Dower <steve.dower@python.org>
2019-11-18 11:53:34 -08:00
Miss Islington (bot) 42a4359390
bpo-38823: Clean up refleaks in _tkinter initialization. (GH-17206)
https://bugs.python.org/issue38823
(cherry picked from commit 289cf0fbf7)

Co-authored-by: Brandt Bucher <brandtbucher@gmail.com>
2019-11-18 07:10:31 -08:00
Miss Islington (bot) bef2815533 bpo-16576: Add checks for bitfields passed by value to functions. (GH-17097) (GH-17223)
(cherry picked from commit 106271568c)
2019-11-18 14:29:15 +00:00
Miss Islington (bot) 1fe79a4340
bpo-38823: Clean up refleaks in _contextvars initialization. (GH-17198)
https://bugs.python.org/issue38823
(cherry picked from commit 143a97f641)

Co-authored-by: Brandt Bucher <brandtbucher@gmail.com>
2019-11-16 16:16:33 -08:00
Miss Islington (bot) 48f4f75bae
bpo-38823: Clean up refleaks in _asyncio initialization. (GH-17195)
https://bugs.python.org/issue38823
(cherry picked from commit c3f6bdc332)

Co-authored-by: Brandt Bucher <brandtbucher@gmail.com>
2019-11-16 14:44:15 -08:00
Miss Islington (bot) 25ce77dd24
bpo-38677: Fix arraymodule error handling in module initialization. (GH-17039)
(cherry picked from commit b44ffc8b40)

Co-authored-by: Marco Paolini <mpaolini@users.noreply.github.com>
2019-11-15 01:37:26 -08:00
Miss Islington (bot) 694c03fabb
bpo-38785: Prevent asyncio from crashing (GH-17144)
if parent `__init__` is not called from a constructor of object derived from `asyncio.Future`

https://bugs.python.org/issue38785
(cherry picked from commit dad6be5ffe)

Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>
2019-11-13 13:54:56 -08:00
Benjamin Peterson 9788f97bf6
[3.8] closes bpo-27805: Ignore ESPIPE in initializing seek of append-mode files. (GH-17136)
This change, which follows the behavior of C stdio's fdopen and Python 2's file object, allows pipes to be opened in append mode..
(cherry picked from commit 74fa9f723f)
2019-11-12 15:54:19 -08:00
Miss Islington (bot) 7c20888e71
bpo-38684: haslib: fix build when Blake2 not enabled in OpenSSL (GH-17043)
(cherry picked from commit 6552563b3d)

Co-authored-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2019-11-05 22:10:05 -08:00
Vinay Sajip 9528997048
[3.8] bpo-16575: Add checks for unions passed by value to functions. (GH-16799) (GH-17016)
(cherry picked from commit 79d4ed102a)
2019-10-31 13:34:05 +00:00
Miss Islington (bot) 5fb81420d5
bpo-38418: Fixes audit event for os.system to be named 'os.system' (GH-16670)
https://bugs.python.org/issue38418

Automerge-Triggered-By: @zooba
(cherry picked from commit fbe3c76c7c)

Co-authored-by: Steve Dower <steve.dower@python.org>
2019-10-18 09:32:14 -07:00
Victor Stinner f82ce5b1b1
[3.8] bpo-36389: Backport debug enhancements from master (GH-16796)
* bpo-36389: _PyObject_CheckConsistency() available in release mode (GH-16612)

bpo-36389, bpo-38376: The _PyObject_CheckConsistency() function is
now also available in release mode. For example, it can be used to
debug a crash in the visit_decref() function of the GC.

Modify the following functions to also work in release mode:

* _PyDict_CheckConsistency()
* _PyObject_CheckConsistency()
* _PyType_CheckConsistency()
* _PyUnicode_CheckConsistency()

Other changes:

* _PyMem_IsPtrFreed(ptr) now also returns 1 if ptr is NULL
  (equals to 0).
* _PyBytesWriter_CheckConsistency() now returns 1 and is only used
  with assert().
* Reorder _PyObject_Dump() to write safe fields first, and only
  attempt to render repr() at the end.

(cherry picked from commit 6876257eaa)

* bpo-36389: Fix _PyBytesWriter in release mode (GH-16624)

Fix _PyBytesWriter API when Python is built in release mode with
assertions.

(cherry picked from commit 60ec6efd96)

* bpo-38070: Enhance visit_decref() debug trace (GH-16631)

subtract_refs() now pass the parent object to visit_decref() which
pass it to _PyObject_ASSERT(). So if the "is freed" assertion fails,
the parent is used in debug trace, rather than the freed object. The
parent object is more likely to contain useful information. Freed
objects cannot be inspected are are displayed as "<object at xxx is
freed>" with no other detail.

(cherry picked from commit 4d5f94b8cd)

* Fix also a typo in PYMEM_DEADBYTE macro comment

* bpo-36389: Add newline to _PyObject_AssertFailed() (GH-16629)

Add a newline between the verbose object dump and the Py_FatalError()
logs for readability.

(cherry picked from commit 7775349895)
2019-10-15 03:06:16 +02:00
Miss Islington (bot) ba44ea6ff8
bpo-37731: Reorder includes in xmltok.c to avoid redefinition of _POSIX_C_SOURCE (GH-16733)
(cherry picked from commit 8177404d52)

Co-authored-by: Pablo Galindo <Pablogsal@gmail.com>
2019-10-12 12:32:48 -07:00
Pablo Galindo 0bd9fac7a8 [3.8] bpo-38379: don't claim objects are collected when they aren't (GH-16658) (GH-16683)
* [bpo-38379](https://bugs.python.org/issue38379):  when a finalizer resurrects an object,
nothing is actually collected in this run of gc.
Change the stats to relect that truth.
(cherry picked from commit ecbf35f933)

Co-authored-by: Tim Peters <tim.peters@gmail.com>





https://bugs.python.org/issue38379



Automerge-Triggered-By: @pablogsal
2019-10-09 14:25:06 -07:00
Vinay Sajip d004a5b082
bpo-38368: Added fix for ctypes crash when handling arrays in structs/unions. (GH-16589) (GH-16671)
(cherry picked from commit e8bedbddad)
2019-10-09 06:47:57 +01:00
Miss Islington (bot) 13915a3100
bpo-36356: Fix memory leak in _asynciomodule.c (GH-16598)
(cherry picked from commit 321def805a)

Co-authored-by: Ben Harper <btharper1221@gmail.com>
2019-10-07 09:38:00 -07:00
Miss Islington (bot) dc191245d8
bpo-13153: Use OS native encoding for converting between Python and Tcl. (GH-16545)
On Windows use UTF-16 (or UTF-32 for 32-bit Tcl_UniChar) with the
"surrogatepass" error handler for converting to/from Tcl Unicode objects.

On Linux use UTF-8 with the "surrogateescape" error handler for converting
to/from Tcl String objects.

Converting strings from Tcl to Python and back now never fails
(except MemoryError).
(cherry picked from commit 06cb94bc84)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
2019-10-04 03:28:54 -07:00
Victor Stinner bfe1f74e39
[3.8] bpo-3832: Fix compiler warnings (GH-16518)
* bpo-38321: Fix _asynciomodule.c compiler warning (GH-16493)

bpo-38248, bpo-38321: Fix warning:

    modules\_asynciomodule.c(2667):
    warning C4102: 'set_exception': unreferenced label

The related goto has been removed by
commit edad4d89e3.

(cherry picked from commit efe74b6369)

* bpo-38321: Fix PyCStructUnionType_update_stgdict() warning (GH-16492)

bpo-22273, bpo-38321: Fix following warning:

    modules\_ctypes\stgdict.c(704):
    warning C4244: 'initializing': conversion from 'Py_ssize_t' to 'int', possible loss of data

(cherry picked from commit c9a413ede4)
2019-10-01 13:52:00 +02:00
Miss Islington (bot) d49f096cc4
bpo-38304: PyConfig_InitPythonConfig() cannot fail anymore (GH-16509)
PyConfig_InitPythonConfig() and PyConfig_InitIsolatedConfig() no
longer return PyStatus: they cannot fail anymore.
(cherry picked from commit 8462a4936b)

Co-authored-by: Victor Stinner <vstinner@redhat.com>
2019-10-01 03:26:04 -07:00
Victor Stinner bdace21b76 bpo-38304: Remove PyConfig.struct_size (GH-16500)
For now, we'll rely on the fact that the config structures aren't covered by the stable ABI.

We may revisit this in the future if we further explore the idea of offering a stable embedding API.
2019-10-01 08:46:42 +10:00
Miss Islington (bot) 92ca515ee1 Clear weakrefs in garbage found by the GC (GH-16495) (#16499)
Fix a bug due to the interaction of weakrefs and the cyclic garbage
collector. We must clear any weakrefs in garbage in order to prevent
their callbacks from executing and causing a crash.
(cherry picked from commit bcda460baf)

Co-authored-by: Neil Schemenauer <nas-github@arctrix.com>
2019-09-30 19:27:46 +02:00
Christian Heimes bfca56b3dd [3.8] bpo-38270: More fixes for strict crypto policy (GH-16418) (#16437)
test_hmac and test_hashlib test built-in hashing implementations and
OpenSSL-based hashing implementations. Add more checks to skip OpenSSL
implementations when a strict crypto policy is active.

Use EVP_DigestInit_ex() instead of EVP_DigestInit() to initialize the
EVP context. The EVP_DigestInit() function clears alls flags and breaks
usedforsecurity flag again.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue38270.
(cherry picked from commit 9055815809)

Co-authored-by: Christian Heimes <christian@python.org>
2019-09-30 09:10:38 +02:00
Victor Stinner 6e128382b3
bpo-38304: Add PyConfig.struct_size (GH-16451) (GH-16453)
Add a new struct_size field to PyPreConfig and PyConfig structures to
allow to modify these structures in the future without breaking the
backward compatibility.

* Replace private _config_version field with public struct_size field
  in PyPreConfig and PyConfig.
* Public PyPreConfig_InitIsolatedConfig() and
  PyPreConfig_InitPythonConfig()
  return type becomes PyStatus, instead of void.
* Internal _PyConfig_InitCompatConfig(),
  _PyPreConfig_InitCompatConfig(), _PyPreConfig_InitFromConfig(),
  _PyPreConfig_InitFromPreConfig() return type becomes PyStatus,
  instead of void.
* Remove _Py_CONFIG_VERSION
* Update the Initialization Configuration documentation.

(cherry picked from commit 441b10cf28)
2019-09-28 04:50:43 +02:00
Victor Stinner 96c8475362
[3.8] bpo-38234: Backport init path config changes from master (GH-16423)
* bpo-38234: Py_SetPath() uses the program full path (GH-16357)

Py_SetPath() now sets sys.executable to the program full path
(Py_GetProgramFullPath()), rather than to the program name
(Py_GetProgramName()).

Fix also memory leaks in pathconfig_set_from_config().

(cherry picked from commit 1ce152a42e)

* bpo-38234: Add tests for Python init path config (GH-16358)


(cherry picked from commit bb6bf7d342)

* bpo-38234: test_embed: test pyvenv.cfg and pybuilddir.txt (GH-16366)

Add test_init_pybuilddir() and test_init_pyvenv_cfg() to test_embed
to test pyvenv.cfg and pybuilddir.txt configuration files.

Fix sysconfig._generate_posix_vars(): pybuilddir.txt uses UTF-8
encoding, not ASCII.

(cherry picked from commit 52ad33abbf)

* bpo-38234: Cleanup getpath.c (GH-16367)

* search_for_prefix() directly calls reduce() if found is greater
  than 0.
* Add calculate_pybuilddir() subfunction.
* search_for_prefix(): add path string buffer for readability.
* Fix some error handling code paths: release resources on error.
* calculate_read_pyenv(): rename tmpbuffer to filename.
* test.pythoninfo now also logs windows.dll_path

(cherry picked from commit 221fd84703)

* bpo-38234: Fix test_embed pathconfig tests (GH-16390)

bpo-38234: On macOS and FreeBSD, the temporary directory can be
symbolic link. For example, /tmp can be a symbolic link to /var/tmp.
Call realpath() to resolve all symbolic links.

(cherry picked from commit 00508a7407)

* bpo-38234: Add test_init_setpath_config() to test_embed (GH-16402)

* Add test_embed.test_init_setpath_config(): test Py_SetPath()
  with PyConfig.
* test_init_setpath() and test_init_setpythonhome() no longer call
  Py_SetProgramName(), but use the default program name.
* _PyPathConfig: isolated, site_import  and base_executable
  fields are now only available on Windows.
* If executable is set explicitly in the configuration, ignore
  calculated base_executable: _PyConfig_InitPathConfig() copies
  executable to base_executable.
* Complete path config documentation.

(cherry picked from commit 8bf39b606e)

* bpo-38234: Complete init config documentation (GH-16404)


(cherry picked from commit 88feaecd46)

* bpo-38234: Fix test_embed.test_init_setpath_config() on FreeBSD (GH-16406)

Explicitly preinitializes with a Python preconfiguration to avoid
Py_SetPath() implicit preinitialization with a compat
preconfiguration.

Fix also test_init_setpath() and test_init_setpythonhome() on macOS:
use self.test_exe as the executable (and base_executable), rather
than shutil.which('python3').

(cherry picked from commit 49d99f01e6)

* bpo-38234: Py_Initialize() sets global path configuration (GH-16421)

* Py_InitializeFromConfig() now writes PyConfig path configuration to
  the global path configuration (_Py_path_config).
* Add test_embed.test_get_pathconfig().
* Fix typo in _PyWideStringList_Join().

(cherry picked from commit 12f2f177fc)
2019-09-26 16:17:34 +02:00
Benjamin Peterson d75bf44a28
[3.8] closes bpo-38174: Update vendored expat library to 2.2.8. (GH-16409)
Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.
(cherry picked from commit 52b9408038)
2019-09-25 21:57:14 -07:00