gh-143241: Fix infinite loop in zoneinfo._common.load_data #143243

fatihhcelik · 2025-12-28T12:22:35Z

Issue: Infinite loop when reading incomplete ZoneInfo file in zoneinfo._common.load_data #143241

bedevere-app · 2025-12-28T12:22:39Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

python-cla-bot · 2025-12-28T12:22:40Z

All commit authors signed the Contributor License Agreement.

serhiy-storchaka

LGTM. 👍

Please add a NEWS entry, users will be glad to know that that bug was fixed.

I would not call it a DoS.

Lib/test/test_zoneinfo/test_zoneinfo.py

Misc/NEWS.d/next/Library/2025-12-28-12-38-53.gh-issue-143241.yW250u.rst

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Lib/test/test_zoneinfo/test_zoneinfo.py

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Lib/zoneinfo/_common.py

Remove unnecessary tz_bytes variable. Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

…om_file

Misc/NEWS.d/next/Library/2025-12-28-13-49-06.gh-issue-143241.5H4b8d.rst

…W250u.rst

…H4b8d.rst Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

picnixz · 2025-12-28T14:19:30Z

I'm going to wait for the CI to be green and then I'll merge.

miss-islington-app · 2025-12-28T14:48:47Z

Thanks @fatihhcelik for the PR, and @picnixz for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

…ythonGH-143243) Correctly reject truncated TZif files in `ZoneInfo.from_file`. --------- (cherry picked from commit 3ca1f2a) Co-authored-by: Fatih Çelik <fcelik.ft@gmail.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-app · 2025-12-28T14:48:57Z

GH-143251 is a backport of this pull request to the 3.14 branch.

bedevere-app · 2025-12-28T14:49:02Z

GH-143252 is a backport of this pull request to the 3.13 branch.

…H-143243) (#143252) gh-143241: Fix infinite loop in `zoneinfo._common.load_data` (GH-143243) Correctly reject truncated TZif files in `ZoneInfo.from_file`. --------- (cherry picked from commit 3ca1f2a) Co-authored-by: Fatih Çelik <fcelik.ft@gmail.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

…H-143243) (#143251) gh-143241: Fix infinite loop in `zoneinfo._common.load_data` (GH-143243) Correctly reject truncated TZif files in `ZoneInfo.from_file`. --------- (cherry picked from commit 3ca1f2a) Co-authored-by: Fatih Çelik <fcelik.ft@gmail.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

pythongh-143241: Fix infinite loop DoS in zoneinfo._common.load_data

be21254

fatihhcelik requested a review from pganssle as a code owner December 28, 2025 12:22

bedevere-app bot mentioned this pull request Dec 28, 2025

Infinite loop when reading incomplete ZoneInfo file in zoneinfo._common.load_data #143241

Closed

bedevere-app bot added the awaiting review label Dec 28, 2025

serhiy-storchaka added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Dec 28, 2025

serhiy-storchaka approved these changes Dec 28, 2025

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting review labels Dec 28, 2025

fatihhcelik changed the title ~~gh-143241: Fix infinite loop DoS in zoneinfo._common.load_data~~ gh-143241: Fix infinite loop in zoneinfo._common.load_data Dec 28, 2025

📜🤖 Added by blurb_it.

a240d3a