The s_get() function leaks the result variable on low memory.
Partially backport commit 19b52545
to fix it.

Fix linuxaudiodev.linux_audio_device() error handling:
close the internal file descriptor if it fails to open the device.

Use test_support.TEST_HTTP_URL (pythontest.net) instead of http://www.example.com/.

Fix off-by-one bug in cPickle that caused it to use uninitialised memory on truncated pickles read from FILE*s.

Fix two unlikely reference leaks in _hashopenssl. The leaks only occur in
out-of-memory cases. Thanks to Charalampos Stratakis.
Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue36179.
(cherry picked from commit b7bc283a)
Co-authored-by: Christian Heimes <christian@python.org>



https://bugs.python.org/issue36179

bpo-32129: Avoid blurry IDLE application icon on macOS with Tk 8.6. Original patch by Kevin Walzer. (GH-12034)

bpo-32129: Avoid blurry IDLE application icon on macOS with Tk 8.6. Original patch by Kevin Walzer. (GH-12034)

Did you know an API documented as printing the pending traceback would sometimes exit the process?

You do now.
(cherry picked from commit 41737720)
Co-authored-by: Gregory P. Smith <greg@krypto.org>

The standard math library (libm) may follow IEEE-754 recommendation to
include an implementation of sinPi(), i.e. sinPi(x):=sin(pi*x).
And this triggers a name clash, found by FreeBSD developer
Steve Kargl, who worked on putting sinpi into libm used on FreeBSD
(it has to be named "sinpi", not "sinPi", cf. e.g.
https://en.cppreference.com/w/c/experimental/fpext4).

Per POSIX, `nice(3)` requires `unistd.h` and `exit(3)` requires `stdlib.h`.

Fixing the test will prevent false positives with pedantic compilers like clang.
(cherry picked from commit 90c6face)
Co-authored-by: ngie-eign <1574099+ngie-eign@users.noreply.github.com>

https://bugs.python.org/issue35584
(cherry picked from commit 3bacf612)
Co-authored-by: Raymond Hettinger <rhettinger@users.noreply.github.com>

https://bugs.python.org/issue35126

[2.7] bpo-1104: msilib.SummaryInfo.GetProperty() truncates the string by one character (GH-4517) (GH-11749)



Add one char to MsiSummaryInfoGetProperty() output
Based on the patch in [bpo-1104](https://bugs.python.org/issue1104) by Anthony Tuininga (atuining) and Mark McMahon (markm)
(cherry picked from commit 2de576e1)
Co-authored-by: Tzu-ping Chung <uranusjr@gmail.com>





https://bugs.python.org/issue1104

multissltests: fix _build_src(), add 'cwd' variable.

Backport of TLS 1.3 related fixes from 3.7.

Misc fixes and workarounds for compatibility with OpenSSL 1.1.1 from git
master and TLS 1.3 support. With OpenSSL 1.1.1, Python negotiates TLS 1.3 by
default. Some test cases only apply to TLS 1.2.

OpenSSL 1.1.1 has added a new option OP_ENABLE_MIDDLEBOX_COMPAT for TLS
1.3. The feature is enabled by default for maximum compatibility with
broken middle boxes. Users should be able to disable the hack and CPython's test suite needs
it to verify default options
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 2a4ee8aa01d61b6a9c8e9c65c211e61bdb471826)

Partial backport from cb5b68abCo-authored-by: Christian Heimes <christian@python.org>

The options OP_NO_COMPRESSION, OP_CIPHER_SERVER_PREFERENCE,
OP_SINGLE_DH_USE, OP_SINGLE_ECDH_USE, OP_NO_SSLv2 (except
for PROTOCOL_SSLv2), and OP_NO_SSLv3 (except for PROTOCOL_SSLv3)
are set by default. The initial cipher suite list contains only
HIGH ciphers, no NULL ciphers and MD5 ciphers (except for PROTOCOL_SSLv2).

(cherry picked from commit 358cfd42)

Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests to test with latest OpenSSL.

Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit 3e630c541b35c96bfe5619165255e559f577ee71)
Co-authored-by: Christian Heimes <christian@python.org>

Add credit for the cert parser vulnerability. Mention also Cisco
TALOS-2018-0758 identifier.

(cherry picked from commit 9db56fb8)
Co-authored-by: Julien Palard <julien@palard.fr>

(cherry picked from commit e9bc4172)
Co-authored-by: Mariatta <Mariatta@users.noreply.github.com>

(cherry picked from commit 598e15d4)
Co-authored-by: jdemeyer <J.Demeyer@UGent.be>

Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.
Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue35746
(cherry picked from commit a37f5243)
Co-authored-by: Christian Heimes <christian@python.org>