Expat could crash if given the wrong kind of input by never stopping its
tokenizing step.
Thanks to Ivan Krstić for the patch.
diff --git a/Misc/ACKS b/Misc/ACKS
index defa802..dc87dc2 100644
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -183,6 +183,7 @@
Dima Dorfman
Cesar Douady
Dean Draayer
+Fred L. Drake, Jr.
John DuBois
Paul Dubois
Graham Dumpleton
@@ -371,7 +372,6 @@
Lucas de Jonge
John Jorgensen
Jens B. Jorgensen
-Fred L. Drake, Jr.
Andreas Jung
Tattoo Mabonzo K.
Bob Kahn
@@ -408,6 +408,7 @@
Michael Kremer
Fabian Kreutz
Hannu Krosing
+Ivan Krstić
Andrew Kuchling
Vladimir Kushnir
Cameron Laird
diff --git a/Misc/NEWS b/Misc/NEWS
index 54758ae..42e14a2 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -1227,6 +1227,9 @@
Extension Modules
-----------------
+- Fix a segfault in expat when given a specially crafted input lead to the
+ tokenizer not stopping.
+
- Issue #6561: '\d' in a regex now matches only characters with
Unicode category 'Nd' (Number, Decimal Digit). Previously it also
matched characters with category 'No'.