Core dump when use uninitialized _json objects

[serhiy-storchaka]

BPO	30243
Nosy	@rhettinger, @etrepum, @ezio-melotti, @serhiy-storchaka
PRs	bpo-30243: Fixed the possibility of a crash in _json. #1420 [3.6] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) #1469 [3.5] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) #1470 [2.7] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) #1471

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/serhiy-storchaka'
closed_at = <Date 2017-05-05.08:22:42.344>
created_at = <Date 2017-05-03.06:41:50.176>
labels = ['extension-modules', '3.7', 'type-crash']
title = 'Core dump when use uninitialized _json objects'
updated_at = <Date 2017-05-05.08:22:42.343>
user = 'https://github.com/serhiy-storchaka'

bugs.python.org fields:

activity = <Date 2017-05-05.08:22:42.343>
actor = 'serhiy.storchaka'
assignee = 'serhiy.storchaka'
closed = True
closed_date = <Date 2017-05-05.08:22:42.344>
closer = 'serhiy.storchaka'
components = ['Extension Modules']
creation = <Date 2017-05-03.06:41:50.176>
creator = 'serhiy.storchaka'
dependencies = []
files = []
hgrepos = []
issue_num = 30243
keywords = []
message_count = 6.0
messages = ['292846', '293043', '293050', '293058', '293059', '293074']
nosy_count = 4.0
nosy_names = ['rhettinger', 'bob.ippolito', 'ezio.melotti', 'serhiy.storchaka']
pr_nums = ['1420', '1469', '1470', '1471']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue30243'
versions = ['Python 2.7', 'Python 3.5', 'Python 3.6', 'Python 3.7']

[serhiy-storchaka]

It is possible to get a core dump by using uninitialized _json objects.

$ ./python -c "import _json; _json.make_scanner.__new__(_json.make_scanner)('', 0)"
Segmentation fault (core dumped)
$ ./python -c "import _json; _json.make_encoder.__new__(_json.make_encoder)([0], 0)"
Segmentation fault (core dumped)

The cause is that make_scanner and make_encoder classes implement __new__ and __init__. The __new__ methods create uninitialized object, with NULLs pointers, the __init__ methods initialize them. Possible solutions are: 1) set fields to Py_None rather than NULL in __new__; 2) check every pointer for NULL before using; 3) just remove __init__ methods and make initialization in __new__ methods. Since the scanner and the encoder are not inheritable classes, the latter solution look the most preferable to me.

[serhiy-storchaka]

Repeated calling of the __init__ method caused memory leaks.

[serhiy-storchaka]

New changeset 76a3e51 by Serhiy Storchaka in branch 'master':
bpo-30243: Fixed the possibility of a crash in _json. (bpo-1420)
76a3e51

[serhiy-storchaka]

New changeset 39b73dd by Serhiy Storchaka in branch '3.6':
[3.6] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) (bpo-1469)
39b73dd

[serhiy-storchaka]

New changeset ee22948 by Serhiy Storchaka in branch '3.5':
[3.5] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) (bpo-1470)
ee22948

[serhiy-storchaka]

New changeset 5d7a18f by Serhiy Storchaka in branch '2.7':
[2.7] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) (bpo-1471)
5d7a18f