gh-144984: Fix crash in ExternalEntityParserCreate() error paths

[raminfp]

Fix crash when ExternalEntityParserCreate() hits an error path
(allocation failure). Py_DECREF(new_parser) calls xmlparse_dealloc()
on a partially-initialized object where handlers is NULL, causing a
NULL pointer dereference in clear_handlers. Additionally,
Py_CLEAR(parent) in dealloc already decrements the parent's refcount,
making the subsequent Py_DECREF(self) a double-decrement.

• Add NULL guard in clear_handlers
• Set parent = NULL before Py_DECREF(new_parser) in each error path

• Issue: NULL deref + Double Py_DECREF in pyexpat ExternalEntityParserCreate() #144984

[picnixz]

LGTM, though let's quickly ask @hartwork on that since he wrote that PR.

[picnixz]

@hugovk What's our policy about fixing security issues? should we backport them as far as the original security fix went?

[benediktjohannes]

@picnixz very interesting question! I asked that question to myself as well one time in #144118 where it was indirectly answered because this was only backported to the versions that still recieve bug fixes and not the ones which recieve security updates, but I'm not quite sure whether this is the best solution. And maybe my comment just wasn't seen anymore, but this would at least be consistent. So if this is also backported, I suggest that #144118 should be as well.

[benediktjohannes]

I hope this helps a little bit! 👍

[benediktjohannes]

@picnixz very interesting question! I asked that question to myself as well one time in #144118 where it was indirectly answered because this was only backported to the versions that still recieve bug fixes and not the ones which recieve security updates, but I'm not quite sure whether this is the best solution. And maybe my comment just wasn't seen anymore, but this would at least be consistent. So if this is also backported, I suggest that #144118 should be as well.

"And one other question: How do we handle this concerning backports? Theoretically this is a bug fix, so it should be ported back to only a few supported versions (those recieving bug fixes and not those only recieving security updates) while this seems kind of interesting to me because the other patch (the denial of these chars) was a security update and for this reason applied backward also to those versions only getting security updates and this included this kind of "bug" and for this reason a "old version" now has a new bug through a new update which is not any more patched if we don't apply this to the ones only recieving security updates which is maybe a little bit a of a problem because those using older versions probably do this because they want them to be stable and in this case we "added a bug" / removed a feature and we won't apply it back to them. So will we also merge this to 3.10 and so on?" was my original comment on the other issue (so that you don't have to search for this)