-
-
Notifications
You must be signed in to change notification settings - Fork 29.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
STORE_ATTR_WITH_HINT
has potential use-after-free
#123083
Labels
3.12
bugs and security fixes
3.13
bugs and security fixes
3.14
new features, bugs and security fixes
interpreter-core
(Objects, Python, Grammar, and Parser dirs)
type-bug
An unexpected behavior, bug, or error
Comments
This segfaults in 3.11 to 3.14. The crash is more reliable in debug builds: import gc
class MyObject:
pass
class EvilAttr:
def __init__(self, dict):
self.dict = dict
def __del__(self):
if 'attr' in self.dict:
del self.dict['attr']
gc.collect() # untracks dict
def set_attr(obj):
obj.attr = EvilAttr(obj.__dict__)
def main():
obj = MyObject()
obj.__dict__ = {}
for _ in range(10):
set_attr(obj)
if __name__ == "__main__":
main() |
corona10
added a commit
to corona10/cpython
that referenced
this issue
Aug 17, 2024
corona10
added a commit
to corona10/cpython
that referenced
this issue
Aug 20, 2024
corona10
added a commit
to corona10/cpython
that referenced
this issue
Aug 21, 2024
corona10
added a commit
that referenced
this issue
Aug 22, 2024
corona10
added a commit
to corona10/cpython
that referenced
this issue
Aug 22, 2024
…R_WITH_HINT`` (pythongh-123092) (cherry picked from commit 297f2e0) Co-authored-by: Donghee Na <donghee.na@python.org>
corona10
added a commit
to corona10/cpython
that referenced
this issue
Aug 22, 2024
…R_WITH_HINT`` (pythongh-123092) (cherry picked from commit 297f2e0) Co-authored-by: Donghee Na <donghee.na@python.org>
This was referenced Aug 22, 2024
corona10
added a commit
that referenced
this issue
Aug 22, 2024
corona10
added a commit
that referenced
this issue
Aug 22, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
3.12
bugs and security fixes
3.13
bugs and security fixes
3.14
new features, bugs and security fixes
interpreter-core
(Objects, Python, Grammar, and Parser dirs)
type-bug
An unexpected behavior, bug, or error
Bug report
The order of operations in
STORE_ATTR_WITH_HINT
differs from the dictionary implementation in a way that is not safe:cpython/Python/bytecodes.c
Lines 2235 to 2242 in 35d8ac7
It's not safe to call
_PyObject_GC_MAY_BE_TRACKED(value)
after thePy_XDECREF
call. The dictionary may hold the only strong reference tovalue
inep->me_value
, and that can be modified during thePy_XDECREF
call.Note that
dictobject.c
does the tracking before modifying the dictionary -- not after it -- and so avoids this problem.Linked PRs
STORE_ATTR_WITH_HINT
#123092The text was updated successfully, but these errors were encountered: