Crash report

What happened?

A UAF in Element.remove was fixed in #68279 but one can mutate the child's list during .remove and cause an OOB crash:

import xml.etree.ElementTree as ET class EvilElement(ET.Element): def __eq__(self, other): base.clear() return False base = ET.Element('a') base.append(EvilElement('a')) base.append(EvilElement('a')) base.remove(ET.Element('b'))

Attacked code:

I think we need to introduce some state integer to check that there is no evil mutation (similar to what's being done for OrderedDict).

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

No response

Linked PRs

• gh-126033: Fix crash in _elementtree.c where evil tags/elements occurs #126079
• gh-126033: fix a crash in xml.etree.ElementTree.Element.remove when concurrent mutations happen #126124
• [3.13] gh-126033: fix UAF in xml.etree.ElementTree.Element.remove when concurrent mutations happen (GH-126124) #131929
• [3.12] gh-126033: fix UAF in xml.etree.ElementTree.Element.remove when concurrent mutations happen (GH-126124) #131930