use-after-free in BufferedReader.readinto()

[phi-gamma]

BPO	39510
Nosy	@benjaminp, @miss-islington, @phi-gamma
PRs	bpo-39510: Fix use-after-free in BufferedReader.readinto() #18295 [3.8] closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295) #18348 [3.7] closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295) #18349 [3.6] closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295) #18350

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2020-02-04.21:25:25.467>
created_at = <Date 2020-01-31.15:19:52.093>
labels = []
title = 'use-after-free in BufferedReader.readinto()'
updated_at = <Date 2020-02-04.22:06:49.851>
user = 'https://github.com/phi-gamma'

bugs.python.org fields:

activity = <Date 2020-02-04.22:06:49.851>
actor = 'benjamin.peterson'
assignee = 'none'
closed = True
closed_date = <Date 2020-02-04.21:25:25.467>
closer = 'benjamin.peterson'
components = []
creation = <Date 2020-01-31.15:19:52.093>
creator = 'phg'
dependencies = []
files = []
hgrepos = []
issue_num = 39510
keywords = ['patch']
message_count = 5.0
messages = ['361119', '361369', '361372', '361373', '361375']
nosy_count = 3.0
nosy_names = ['benjamin.peterson', 'miss-islington', 'phg']
pr_nums = ['18295', '18348', '18349', '18350']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue39510'
versions = []

[phi-gamma]

reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) ### BANG!

Bisected to commit dc46945. PR on Github to follow.

[benjaminp]

New changeset cb1c074 by Philipp Gesang in branch 'master':
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295)
cb1c074

[miss-islington]

New changeset 30e7693 by Miss Islington (bot) in branch '3.8':
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295)
30e7693

[miss-islington]

New changeset 97d2a98 by Miss Islington (bot) in branch '3.7':
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295)
97d2a98

[benjaminp]

New changeset c352e6c by Miss Islington (bot) in branch '3.6':
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18350)
c352e6c