Possible resource exhaustation of `expandvars` in `Tools/freeze/checkextensions.py`

Bug Description:
The code will re-scan the newly generated content after replacing the variable. If a variable is defined to contain itself (i.e., a recursive definition), this process will fall into infinite recursion.

This recursion can lead to two forms of attacks: one is to cause an infinite loop and deplete CPU resources, and the other is to cause the string to grow infinitely and deplete memory resources. The final result will all lead to the application crashing or being unresponsive.

Vulnerability Locations :
1.https://github.com/python/cpython/blob/e64395e8eb8d3a9e35e3e534e87d427ff27ab0a5/Tools/freeze/checkextensions.py#L72

Repair Status:
None

Common Information:

• CPython Version: main branch
• Operating System: Linux
• Credits: Finder is kexinoh (Xiangfan Wu) from QI-ANXIN Technology Research Institute.

Linked PRs

• gh-136093

Tools/freeze/checkextensions.py の 72 行目付近から始めてください。ここでは、変数置換後に expandvars が生成された内容を再スキャンしています。自己参照する変数定義を再現し、リンクされている gh-136093 の作業を調査してください。再帰的な展開によって CPU やメモリが枯渇しなくなり、既存の動作が維持されれば完了です。