Buffer overflow in kqueue.control()

[serhiy-storchaka]

BPO	30058
Nosy	@serhiy-storchaka, @koobs
PRs	bpo-30058: Fixed buffer overflow in select.kqueue.control(). #1095 [3.6] bpo-30058: Fixed buffer overflow in select.kqueue.control(). (GH-1095) #3973 [2.7] bpo-30058: Fixed buffer overflow in select.kqueue.control(). (GH-1095). #3976

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/serhiy-storchaka'
closed_at = <Date 2017-10-12.21:13:33.168>
created_at = <Date 2017-04-12.17:13:38.494>
labels = ['extension-modules', '3.7', 'type-crash']
title = 'Buffer overflow in kqueue.control()'
updated_at = <Date 2017-10-12.21:13:33.167>
user = 'https://github.com/serhiy-storchaka'

bugs.python.org fields:

activity = <Date 2017-10-12.21:13:33.167>
actor = 'serhiy.storchaka'
assignee = 'serhiy.storchaka'
closed = True
closed_date = <Date 2017-10-12.21:13:33.168>
closer = 'serhiy.storchaka'
components = ['Extension Modules', 'FreeBSD']
creation = <Date 2017-04-12.17:13:38.494>
creator = 'serhiy.storchaka'
dependencies = []
files = []
hgrepos = []
issue_num = 30058
keywords = ['patch']
message_count = 6.0
messages = ['291563', '291565', '304281', '304282', '304286', '304289']
nosy_count = 2.0
nosy_names = ['serhiy.storchaka', 'koobs']
pr_nums = ['1095', '3973', '3976']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue30058'
versions = ['Python 2.7', 'Python 3.6', 'Python 3.7']

[serhiy-storchaka]

The first parameter of kqueue.control() is documented as an iterable. But actually it should have a length. kqueue.control() uses PyObject_Size() for allocating an array and PyObject_GetIter()+PyIter_Next() for iterating kevent objects and filling the array. If the length and the iterator are not consistent this can lead to writing past the end of the array.

[serhiy-storchaka]

Proposed patch presumably fixes the issue. But since this is *BSD specific I can't even check that it is compiled.

[serhiy-storchaka]

I have tested it on FreeBSD, found and fixed one bug.

[serhiy-storchaka]

New changeset de07210 by Serhiy Storchaka in branch 'master':
bpo-30058: Fixed buffer overflow in select.kqueue.control(). (bpo-1095)
de07210

[serhiy-storchaka]

New changeset c923da1 by Serhiy Storchaka (Miss Islington (bot)) in branch '3.6':
[3.6] bpo-30058: Fixed buffer overflow in select.kqueue.control(). (GH-1095) (bpo-3973)
c923da1

[serhiy-storchaka]

New changeset 9aa6024 by Serhiy Storchaka in branch '2.7':
[2.7] bpo-30058: Fixed buffer overflow in select.kqueue.control(). (GH-1095). (bpo-3976)
9aa6024