gh-152959: Raise ValueError for a <key> outside a <dict> in plistlib

_PlistParser.end_key evaluated self.stack[-1] before checking whether the
stack was empty, so a <key> element outside a <dict> (for example at the
document root) leaked an IndexError instead of a ValueError. Guard the
empty-stack case, matching the sibling add_object handler. The binary plist
format does not use this path and is unaffected.

Author: tonghuaroot

Lib/plistlib.py

@@ -243,7 +243,8 @@ def end_dict(self):
         self.stack.pop()
 
     def end_key(self):
-        if self.current_key or not isinstance(self.stack[-1], dict):
+        if (self.current_key or not self.stack
+                or not isinstance(self.stack[-1], dict)):
             raise ValueError("unexpected key at line %d" %
                              self.parser.CurrentLineNumber)
         self.current_key = self.get_data()

Lib/test/test_plistlib.py

@@ -876,6 +876,12 @@ def test_invalidreal(self):
         self.assertRaises(ValueError, plistlib.loads,
                           b"<plist><integer>not real</integer></plist>")
 
+    def test_invalidkey(self):
+        for xml in (b"<plist><key>x</key></plist>",
+                    b'<?xml version="1.0"?><key>x</key>',
+                    b"<plist><array><key>x</key></array></plist>"):
+            self.assertRaises(ValueError, plistlib.loads, xml)
+
     def test_integer_notations(self):
         pl = b"<plist><integer>456</integer></plist>"
         value = plistlib.loads(pl)

Misc/NEWS.d/next/Library/2026-07-03-15-30-00.gh-issue-152959.Kx7Qm2.rst

@@ -0,0 +1,2 @@
+:mod:`plistlib` now raises :exc:`ValueError` for a ``<key>`` outside a
+``<dict>`` in an XML plist. Patch by tonghuaroot.