Skip to content

Lack of error handling in posix.stat implementation leads to crash on interrupt #102890

@chgnrdv

Description

@chgnrdv

_pystat_fromstructstat function doesn't check that calls to _pystat_l128_from_l64_l64 or fill_time didn't fail and/or exception wasn't set on current tstate, so subsequent calls to fill_time can lead to crash. I can't find less complicated reproducer yet, since it may require some exotic and perhaps nonexistent data to be passed to posix.stat.
Reproduced on current main (76350e8), platform is linux (x86_64).

import posix
import random
import threading
import _thread
import time

def crasher_thread():
    time.sleep(0.000001 * random.randint(1, 30))
    _thread.interrupt_main()

def try_crash():
    try:
        ct = threading.Thread(target=crasher_thread)
        ct.start()
        posix.stat(__file__)  # filename of any existing file
        ct.join()
    except KeyboardInterrupt:
        pass

for i in range(1000):
    try_crash()

Output:

Fatal Python error: _Py_CheckSlotResult: Slot * of type int succeeded with an exception set
Python runtime state: initialized
KeyboardInterrupt

Current thread 0x00007f1a12016740 (most recent call first):
  File "/home/.../repro.py", line 15 in try_crash
  File "/home/.../repro.py", line 21 in <module>
Aborted (core dumped)

I'll submit a PR with possible fix.

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    extension-modulesC modules in the Modules dirtype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions