Use after free in xmlparser_setevents (1)

[pkt]

BPO	24103
Nosy	@tiran, @serhiy-storchaka
Files	poc_xml_setevents1.py xmlparser_setevents_refcnt_bugs.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/serhiy-storchaka'
closed_at = <Date 2015-12-24.09:54:27.706>
created_at = <Date 2015-05-01.14:15:15.567>
labels = ['extension-modules', 'expert-XML', 'type-crash']
title = 'Use after free in xmlparser_setevents (1)'
updated_at = <Date 2015-12-24.09:54:27.704>
user = 'https://bugs.python.org/pkt'

bugs.python.org fields:

activity = <Date 2015-12-24.09:54:27.704>
actor = 'serhiy.storchaka'
assignee = 'serhiy.storchaka'
closed = True
closed_date = <Date 2015-12-24.09:54:27.706>
closer = 'serhiy.storchaka'
components = ['Extension Modules', 'XML']
creation = <Date 2015-05-01.14:15:15.567>
creator = 'pkt'
dependencies = []
files = ['39254', '41347']
hgrepos = []
issue_num = 24103
keywords = ['patch']
message_count = 5.0
messages = ['242320', '246068', '246145', '256658', '256959']
nosy_count = 5.0
nosy_names = ['christian.heimes', 'Arfrever', 'python-dev', 'serhiy.storchaka', 'pkt']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue24103'
versions = ['Python 3.5', 'Python 3.6']

[pkt]

# xmlparser_setevents(XMLParserObject *self, PyObject* args)
# {
# ...
# /* clear out existing events */
# Py_CLEAR(target->start_event_obj);
# 1 Py_CLEAR(target->end_event_obj);
# Py_CLEAR(target->start_ns_event_obj);
# Py_CLEAR(target->end_ns_event_obj);
#
# ...
#
# seqlen = PySequence_Size(events_seq);
# for (i = 0; i < seqlen; ++i) {
# 3 PyObject *event_name_obj = PySequence_Fast_GET_ITEM(events_seq, i);
# ...
#
# if (event_name == NULL) {
# ...
# return NULL;
# } else if (strcmp(event_name, "start") == 0) {
# ...
# } else if (strcmp(event_name, "end") == 0) {
# Py_INCREF(event_name_obj);
# 2 Py_XDECREF(target->end_event_obj);
# target->end_event_obj = event_name_obj;
# }
# ...
# }
# ...
# }
#
# This one leverages nested _setevents invocations. First invocation sets
# target->end_event_obj to S1 instance. On seconds invocation,
# target->end_event_obj has refcnt==1, so DECREF at line 1 triggers S1.__del__().
# Destructor invokes _setevents again and sets target->end_event_obj to a S3
# instance (with refcnt==1). After we return from nested call at line 1,
# execution continues until it hits an "end" element. At line 2 S3.__del__() is
# called and it deallocates "events_seq". This triggers a controlled OOB (we can
# call it a use after free too) read at line 3. We can control a PyObject pointer.
#
# Program received signal SIGSEGV, Segmentation fault.
# 0x4068563b in xmlparser_setevents (self=0x40669e4c, args=([], [])) at /home/p/Python-3.4.1/Modules/_elementtree.c:3560
\bpo-3560 PyObject *event_name_obj = PySequence_Fast_GET_ITEM(events_seq, i);
# (gdb) print i
# $1 = 1337
# (gdb) print *(PyListObject*)events_seq
# $2 = {ob_base = {ob_base = {_ob_next = 0x40669df4, _ob_prev = 0x4055f814, ob_refcnt = 3, ob_type = 0x830e1c0 <PyList_Type>},
# ob_size = 0}, ob_item = 0x0, allocated = 0}

[pkt]

ping

[pkt]

ping

[serhiy-storchaka]

Proposed patch fixes both this issue and bpo-24104. With the special macro proposed in bpo-20440 it can be better.

[python-dev]

New changeset deda5b5160d2 by Serhiy Storchaka in branch '2.7':
Issue bpo-24103: Fixed possible use after free in ElementTree.iterparse().
https://hg.python.org/cpython/rev/deda5b5160d2

New changeset ed62cf0cf256 by Serhiy Storchaka in branch '3.5':
Issue bpo-24103: Fixed possible use after free in ElementTree.XMLPullParser.
https://hg.python.org/cpython/rev/ed62cf0cf256

New changeset 8a14af800f96 by Serhiy Storchaka in branch 'default':
Issue bpo-24103: Fixed possible use after free in ElementTree.XMLPullParser.
https://hg.python.org/cpython/rev/8a14af800f96