Issue #24091: Fixed various crashes in corner cases in C implementation of

ElementTree.

diff --cc Lib/test/test_xml_etree.py
Simple merge

diff --cc Misc/NEWS
Simple merge

diff --cc Modules/_elementtree.c
index ebdb95b05ec9c9b11211636cb76663bc88cd3bdb,136f19cae64844fbf47ac0a03e690106529de16b..ea770517c14bff53e35a98e2f70d7f2400d66cab
--- 1/Modules/_elementtree.c
--- 2/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@@ -1081,22 -1032,17 +1081,22 @@@ checkpath(PyObject* tag
      return 1; /* unknown type; might be path expression */
  }
  
 -static PyObject*
 -element_extend(ElementObject* self, PyObject* args)
 +/*[clinic input]
 +_elementtree.Element.extend
 +
 +    elements: object
 +    /
 +
 +[clinic start generated code]*/
 +
 +static PyObject *
 +_elementtree_Element_extend(ElementObject *self, PyObject *elements)
 +/*[clinic end generated code: output=f6e67fc2ff529191 input=807bc4f31c69f7c0]*/
  {
      PyObject* seq;
-     Py_ssize_t i, seqlen = 0;
+     Py_ssize_t i;
  
 -    PyObject* seq_in;
 -    if (!PyArg_ParseTuple(args, "O:extend", &seq_in))
 -        return NULL;
 -
 -    seq = PySequence_Fast(seq_in, "");
 +    seq = PySequence_Fast(elements, "");
      if (!seq) {
          PyErr_Format(
              PyExc_TypeError,
@@@ -1156,11 -1102,16 +1159,16 @@@ _elementtree_Element_find_impl(ElementO
  
      for (i = 0; i < self->extra->length; i++) {
          PyObject* item = self->extra->children[i];
-         if (Element_CheckExact(item) &&
-             PyObject_RichCompareBool(((ElementObject*)item)->tag, path, Py_EQ) == 1) {
-             Py_INCREF(item);
+         int rc;
+         if (!Element_CheckExact(item))
+             continue;
+         Py_INCREF(item);
 -        rc = PyObject_RichCompareBool(((ElementObject*)item)->tag, tag, Py_EQ);
++        rc = PyObject_RichCompareBool(((ElementObject*)item)->tag, path, Py_EQ);
+         if (rc > 0)
              return item;
-         }
+         Py_DECREF(item);
+         if (rc < 0)
+             return NULL;
      }
  
      Py_RETURN_NONE;
@@@ -1197,14 -1144,24 +1205,24 @@@ _elementtree_Element_findtext_impl(Elem
  
      for (i = 0; i < self->extra->length; i++) {
          ElementObject* item = (ElementObject*) self->extra->children[i];
-         if (Element_CheckExact(item) &&
-             (PyObject_RichCompareBool(item->tag, path, Py_EQ) == 1)) {
+         int rc;
+         if (!Element_CheckExact(item))
+             continue;
+         Py_INCREF(item);
 -        rc = PyObject_RichCompareBool(item->tag, tag, Py_EQ);
++        rc = PyObject_RichCompareBool(item->tag, path, Py_EQ);
+         if (rc > 0) {
              PyObject* text = element_get_text(item);
-             if (text == Py_None)
+             if (text == Py_None) {
+                 Py_DECREF(item);
                  return PyUnicode_New(0, 0);
+             }
              Py_XINCREF(text);
+             Py_DECREF(item);
              return text;
          }
+         Py_DECREF(item);
+         if (rc < 0)
+             return NULL;
      }
  
      Py_INCREF(default_value);
@@@ -1494,19 -1421,16 +1516,21 @@@ _elementtree_Element_makeelement_impl(E
      return elem;
  }
  
 -static PyObject*
 -element_remove(ElementObject* self, PyObject* args)
 +/*[clinic input]
 +_elementtree.Element.remove
 +
 +    subelement: object(subclass_of='&Element_Type')
 +    /
 +
 +[clinic start generated code]*/
 +
 +static PyObject *
 +_elementtree_Element_remove_impl(ElementObject *self, PyObject *subelement)
 +/*[clinic end generated code: output=38fe6c07d6d87d1f input=d52fc28ededc0bd8]*/
  {
 -    int i;
 +    Py_ssize_t i;
+     int rc;
 -    PyObject* element;
 -    PyObject* found;
 -
 -    if (!PyArg_ParseTuple(args, "O!:remove", &Element_Type, &element))
 -        return NULL;
++    PyObject *found;
  
      if (!self->extra) {
          /* element has no children, so raise exception */
@@@ -1518,14 -1442,17 +1542,17 @@@
      }
  
      for (i = 0; i < self->extra->length; i++) {
 -        if (self->extra->children[i] == element)
 +        if (self->extra->children[i] == subelement)
              break;
-         if (PyObject_RichCompareBool(self->extra->children[i], subelement, Py_EQ) == 1)
 -        rc = PyObject_RichCompareBool(self->extra->children[i], element, Py_EQ);
++        rc = PyObject_RichCompareBool(self->extra->children[i], subelement, Py_EQ);
+         if (rc > 0)
              break;
+         if (rc < 0)
+             return NULL;
      }
  
-     if (i == self->extra->length) {
+     if (i >= self->extra->length) {
 -        /* element is not in children, so raise exception */
 +        /* subelement is not in children, so raise exception */
          PyErr_SetString(
              PyExc_ValueError,
              "list.remove(x): x not in list"