Use after free in PyObject_GetState

[pkt]

BPO	24097
Nosy	@pitrou, @avassalotti, @benjaminp, @serhiy-storchaka
Files	poc_getstate.py getstate_borrowed_ref.patch test_issue24097.patch getstate_borrowed_ref_with_test-2.7.patch getstate_borrowed_ref_with_test-3.4.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/pitrou'
closed_at = <Date 2015-11-25.16:37:39.506>
created_at = <Date 2015-05-01.14:05:35.520>
labels = ['extension-modules', 'type-crash']
title = 'Use after free in PyObject_GetState'
updated_at = <Date 2015-11-25.16:37:39.505>
user = 'https://bugs.python.org/pkt'

bugs.python.org fields:

activity = <Date 2015-11-25.16:37:39.505>
actor = 'serhiy.storchaka'
assignee = 'pitrou'
closed = True
closed_date = <Date 2015-11-25.16:37:39.506>
closer = 'serhiy.storchaka'
components = ['Extension Modules']
creation = <Date 2015-05-01.14:05:35.520>
creator = 'pkt'
dependencies = []
files = ['39248', '39842', '39953', '40936', '40937']
hgrepos = []
issue_num = 24097
keywords = ['patch']
message_count = 9.0
messages = ['242313', '246069', '246070', '246102', '246122', '246949', '254001', '254002', '255366']
nosy_count = 7.0
nosy_names = ['pitrou', 'alexandre.vassalotti', 'benjamin.peterson', 'Arfrever', 'python-dev', 'serhiy.storchaka', 'pkt']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue24097'
versions = ['Python 2.7', 'Python 3.4', 'Python 3.5', 'Python 3.6']

[pkt]

# Program received signal SIGSEGV, Segmentation fault.
# 0x080f27b2 in PyObject_Hash (v=<unknown at remote 0x405720e4>) at Objects/object.c:746
# 746 if (tp->tp_hash != NULL)
# (gdb) bt
# #0 0x080f27b2 in PyObject_Hash (v=<unknown at remote 0x405720e4>) at Objects/object.c:746
# #1 0x080e1717 in PyDict_SetItem (op={}, key=<unknown at remote 0x405720e4>, value=None) at Objects/dictobject.c:1201
# #2 0x0810e8a0 in _PyObject_GetState (obj=<Y at remote 0x405731bc>) at Objects/typeobject.c:3657
# #3 0x081100e9 in reduce_2 (obj=<Y at remote 0x405731bc>) at Objects/typeobject.c:3949
# #4 0x08110551 in _common_reduce (self=<Y at remote 0x405731bc>, proto=2) at Objects/typeobject.c:4012
# #5 0x08110641 in object_reduce (self=<Y at remote 0x405731bc>, args=(2,)) at Objects/typeobject.c:4032
#
# (gdb) frame 2
# #2 0x0810e8a0 in _PyObject_GetState (obj=<Y at remote 0x405731bc>) at Objects/typeobject.c:3657
\bpo-3657 int err = PyDict_SetItem(slots, name, value);
# (gdb) print *name
# $1 = {ob_next = 0xdbdbdbdb, _ob_prev = 0xdbdbdbdb, ob_refcnt = -606348325, ob_type = 0xdbdbdbdb}
#
# "name" is freed inside __getattr_ and is later used by PyDict_SetItem.

[pkt]

ping

[pitrou]

Thanks for the report. Here is a patch.

[benjaminp]

lgtm

[serhiy-storchaka]

The fix LGTM.

It would be nice to add a test.

[serhiy-storchaka]

Here is a test for this issue.

[serhiy-storchaka]

In 2.7 the test doesn't crash, but __reduce__ produces invalid recursive structure.

[serhiy-storchaka]

Here is backported to 2.7 patch with test. Can you review the test and commit the patch Antoine?