Fix crash in conv_content_model function in pyexpat

Author: StanFromIreland

Lib/test/test_pyexpat.py

@@ -701,6 +701,20 @@ def test_trigger_leak(self):
         parser.ElementDeclHandler = lambda _1, _2: None
         self.assertRaises(TypeError, parser.Parse, data, True)
 
+    def test_deeply_nested_content_model(self):
+        data = ('<!DOCTYPE root [\n<!ELEMENT root '
+              + '(a, ' * 200000 + 'a'
+              + ')' * 200000
+              + '>\n]>\n<root/>\n').encode('UTF-8')
+
+        parser = expat.ParserCreate()
+        parser.ElementDeclHandler = lambda _1, _2: None
+        # This shouldn't crash:
+        try:
+            parser.ParseFile(BytesIO(data))
+        except RecursionError:
+            pass
+
 class MalformedInputTest(unittest.TestCase):
     def test1(self):
         xml = b"\0\r\n"

Misc/NEWS.d/next/Library/2026-03-14-17-31-39.gh-issue-111111.ifSSr8.rst

@@ -0,0 +1,3 @@
+:mod:`xml.parsers.expat`: Fixed a crash caused by unbounded C recursion when
+converting deeply nested XML content models with
+:meth:`~xml.parsers.expat.xmlparser.ElementDeclHandler`.

Modules/pyexpat.c

@@ -607,6 +607,10 @@ static PyObject *
 conv_content_model(XML_Content * const model,
                    PyObject *(*conv_string)(void *))
 {
+    if (Py_EnterRecursiveCall(" in conv_content_model")) {
+        return NULL;
+    }
+
     PyObject *result = NULL;
     PyObject *children = PyTuple_New(model->numchildren);
     int i;
@@ -618,14 +622,16 @@ conv_content_model(XML_Content * const model,
                                                  conv_string);
             if (child == NULL) {
                 Py_XDECREF(children);
-                return NULL;
+                goto done;
             }
             PyTuple_SET_ITEM(children, i, child);
         }
         result = Py_BuildValue("(iiO&N)",
                                model->type, model->quant,
                                conv_string, model->name, children);
     }
+done:
+    Py_LeaveRecursiveCall();
     return result;
 }