python3: fix CVE-2026-7210

CVE-2026-7210 is a hash-flooding denial-of-service vulnerability in
Python's XML parsing modules (xml.parsers.expat, xml.etree.ElementTree).
An attacker can craft XML input that forces O(n²) hash collisions in
libexpat's internal name dictionary, causing excessive CPU consumption.

The previous mitigation seeded libexpat's hash function with only 4
bytes of entropy, which is insufficient against a determined attacker.
This patch upgrades to XML_SetHashSalt16Bytes (libexpat >= 2.8.0),
providing a full 16-byte secret. Older expat versions fall back
gracefully to the legacy XML_SetHashSalt via a runtime NULL check.

Backport patch to fix CVE-2026-7210.
https://nvd.nist.gov/vuln/detail/CVE-2026-7210

Upstream fix:
  24b8f12544

-- Changes from Upstream --

Replace compile-time version checks with runtime detection of the
XML_SetHashSalt16Bytes function using #pragma weak. This allows using
backported security fixes from expat even when version macros haven't
been bumped (in thus case expat 2.6.4 with CVE-2026-41080).

- Add weak symbol declaration for XML_SetHashSalt16Bytes
- Convert newxmlparseobject() version check to runtime NULL check
- Convert pyexpat_exec() CAPI export check to runtime NULL check

Tested with ptest:
  Before: PASSED: 40019, FAILED: 0, SKIPPED: 1882
  After: PASSED: 40020, FAILED: 0, SKIPPED: 1882

CVE: CVE-2026-7210

(From OE-Core rev: d753c46085c9d31f3b68d59f863855c909a6f400)

Signed-off-by: Amaury Couderc <amaury.couderc@est.tech>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>

meta/recipes-devtools/python/python3_3.12.13.bb

@@ -47,6 +47,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
            file://CVE-2026-11940.patch \
            file://CVE-2026-11972.patch \
            file://CVE-2026-9669.patch \
+           file://CVE-2026-7210.patch \
            "
 
 SRC_URI:append:class-native = " \