From c731b42997c71b14dfa09e765b5d0b849a1e0525 Mon Sep 17 00:00:00 2001
From: PengLAI Code <rel-eng@openanolis.org>
Date: Thu, 6 Aug 2026 11:17:17 +0800
Subject: [PATCH] [CVE] [Distro] add patch to fix CVE-2026-4224

to #IK5181

Adapted from upstream patch.

project: TC2024080204

Assisted-by: PengLAI Code <rel-eng@openanolis.org>
---
 001038-bugfix-for-CVE-2026-4224.patch | 80 +++++++++++++++++++++++++++
 python3.spec                          |  9 ++-
 2 files changed, 88 insertions(+), 1 deletion(-)
 create mode 100644 001038-bugfix-for-CVE-2026-4224.patch

diff --git a/001038-bugfix-for-CVE-2026-4224.patch b/001038-bugfix-for-CVE-2026-4224.patch
new file mode 100644
index 0000000..96ca80d
--- /dev/null
+++ b/001038-bugfix-for-CVE-2026-4224.patch
@@ -0,0 +1,80 @@
+From: Anolis OS Security <security@openanolis.org>
+Subject: [PATCH] gh-145986: Avoid unbound C recursion in conv_content_model in pyexpat.c (CVE-2026-4224)
+
+Fix C stack overflow (CVE-2026-4224) when an Expat parser with a registered
+ElementDeclHandler parses an inline DTD containing a deeply nested content
+model. conv_content_model() recursed once per nesting level without any depth
+limit, so attacker-controlled XML could exhaust the C stack and crash the
+interpreter.
+
+Guard the recursion with Py_EnterRecursiveCall()/Py_LeaveRecursiveCall() so
+excessive nesting raises RecursionError instead of crashing.
+
+Backported from upstream CPython 3.11 branch commit
+642865ddf4b232da1f3b1f7abcfa3254c4bfe785 (cherry-picked from
+eb0e8be3a7e11b87d198a2c3af1ed0eccf532768, GH-145987). Adapted for 3.11.6:
+the upstream change uses the internal _Py_EnterRecursiveCall() from
+pycore_ceval.h, but Modules/pyexpat.c in this tree is built without
+Py_BUILD_CORE, so the equivalent public Py_EnterRecursiveCall() API is used
+and no new include is required.
+
+Upstream issue: https://github.com/python/cpython/issues/145986
+---
+--- a/Modules/pyexpat.c	2026-08-06 11:11:44.075816450 +0800
++++ b/Modules/pyexpat.c	2026-08-06 11:12:08.240574305 +0800
+@@ -517,6 +517,10 @@
+ conv_content_model(XML_Content * const model,
+                    PyObject *(*conv_string)(const XML_Char *))
+ {
++    if (Py_EnterRecursiveCall(" in conv_content_model")) {
++        return NULL;
++    }
++
+     PyObject *result = NULL;
+     PyObject *children = PyTuple_New(model->numchildren);
+     int i;
+@@ -528,7 +532,7 @@
+                                                  conv_string);
+             if (child == NULL) {
+                 Py_XDECREF(children);
+-                return NULL;
++                goto done;
+             }
+             PyTuple_SET_ITEM(children, i, child);
+         }
+@@ -536,6 +540,8 @@
+                                model->type, model->quant,
+                                conv_string,model->name, children);
+     }
++done:
++    Py_LeaveRecursiveCall();
+     return result;
+ }
+ 
+--- a/Lib/test/test_pyexpat.py	2026-08-06 11:11:44.075816450 +0800
++++ b/Lib/test/test_pyexpat.py	2026-08-06 11:12:21.999005786 +0800
+@@ -671,6 +671,24 @@
+         parser.Parse(xml2, True)
+         self.assertEqual(self.n, 4)
+ 
++class ElementDeclHandlerTest(unittest.TestCase):
++    def test_deeply_nested_content_model(self):
++        # This should raise a RecursionError and not crash.
++        # See https://github.com/python/cpython/issues/145986.
++        N = 500_000
++        data = (
++            b'<!DOCTYPE root [\n<!ELEMENT root '
++            + b'(a, ' * N + b'a' + b')' * N
++            + b'>\n]>\n<root/>\n'
++        )
++
++        parser = expat.ParserCreate()
++        parser.ElementDeclHandler = lambda _1, _2: None
++        with support.infinite_recursion():
++            with self.assertRaises(RecursionError):
++                parser.Parse(data)
++
++
+ class MalformedInputTest(unittest.TestCase):
+     def test1(self):
+         xml = b"\0\r\n"
diff --git a/python3.spec b/python3.spec
index 91ab16d..bf03050 100644
--- a/python3.spec
+++ b/python3.spec
@@ -1,4 +1,4 @@
-%define anolis_release 30
+%define anolis_release 31
 %global pybasever 3.11
 
 # pybasever without the dot:
@@ -330,6 +330,9 @@ Patch001036: 001036-bugfix-for-CVE-2026-7774.patch
 # https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6.patch
 Patch001037: 001037-bugfix-for-CVE-2026-9669.patch
 
+# https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785.patch
+Patch001038: 001038-bugfix-for-CVE-2026-4224.patch
+
 # ==========================================
 # Descriptions, and metadata for subpackages
 # ==========================================
@@ -1601,6 +1604,10 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Thu Aug 06 2026 PengLAI Code <rel-eng@openanolis.org> - 3.11.6-31
+- Fix CVE-2026-4224
+- Adapted by PengLAI Code
+
 * Thu Jul 30 2026 tomcruiseqi <tomcruiseqi@inspur.com> - 3.11.6-30
 - Fix CVE-2026-9669
 
-- 
Gitee