GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — `_lsprof.Profiler._creturn_callback()` segfaults · Issue #126220 · python/cpython

_lsprof.Profiler._creturn_callback() segfaults #126220

New issue
Copy link
New issue
Copy link
Closed
Closed
_lsprof.Profiler._creturn_callback() segfaults#126220
Copy link
Assignees
sobolevn
Labels
3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixesextension-modulesC modules in the Modules dirC modules in the Modules dirtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

Description

@devdanzin
devdanzin
opened on Oct 31, 2024
Issue body actions

Crash report

What happened?

It's possible to crash Python by simply calling the ._creturn_callback() or the ._ccall_callback() methods of the Profiler class in either _lsprof or cProfile.

from _lsprof import Profiler
Profiler()._creturn_callback()
Profiler()._ccall_callback()

Backtrace looks like:

Program received signal SIGSEGV, Segmentation fault.
get_cfunc_from_callable (callable=0x0, self_arg=0x7ffff7bff710, missing=0x555555c53b80 <_PyInstrumentation_MISSING>) at ./Modules/_lsprof.c:628
628         if (PyCFunction_Check(callable)) {
(gdb) bt
#0  get_cfunc_from_callable (callable=0x0, self_arg=0x7ffff7bff710,
    missing=0x555555c53b80 <_PyInstrumentation_MISSING>) at ./Modules/_lsprof.c:628
#1  0x00007ffff79dd610 in creturn_callback (self=0x7ffff7a91050, args=<optimized out>,
    size=<optimized out>) at ./Modules/_lsprof.c:676
#2  0x000055555568f4b9 in method_vectorcall_FASTCALL (func=0x7ffff7aba630, args=0x7ffff7fb0078,
    nargsf=<optimized out>, kwnames=<optimized out>) at Objects/descrobject.c:401
#3  0x000055555567ba55 in _PyObject_VectorcallTstate (tstate=0x555555cbbc70 <_PyRuntime+329232>,
    callable=0x7ffff7aba630, args=0x7ffff7fb0078, nargsf=9223372036854775809, kwnames=0x0)
    at ./Include/internal/pycore_call.h:167
#4  0x000055555567bb74 in PyObject_Vectorcall (callable=callable@entry=0x7ffff7aba630,
    args=args@entry=0x7ffff7fb0078, nargsf=<optimized out>, kwnames=kwnames@entry=0x0)
    at Objects/call.c:327
#5  0x0000555555827d24 in _PyEval_EvalFrameDefault (
    tstate=tstate@entry=0x555555cbbc70 <_PyRuntime+329232>, frame=0x7ffff7fb0020,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:955
#6  0x0000555555852fb7 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>,
    tstate=0x555555cbbc70 <_PyRuntime+329232>) at ./Include/internal/pycore_ceval.h:116
#7  _PyEval_Vector (tstate=tstate@entry=0x555555cbbc70 <_PyRuntime+329232>,
    func=func@entry=0x7ffff7a46450, locals=locals@entry=0x7ffff7a55df0, args=args@entry=0x0,
    argcount=argcount@entry=0, kwnames=kwnames@entry=0x0) at Python/ceval.c:1886
#8  0x0000555555853096 in PyEval_EvalCode (co=co@entry=0x7ffff7a58630,
    globals=globals@entry=0x7ffff7a55df0, locals=locals@entry=0x7ffff7a55df0) at Python/ceval.c:662
#9  0x00005555559251f4 in run_eval_code_obj (tstate=tstate@entry=0x555555cbbc70 <_PyRuntime+329232>,
    co=co@entry=0x7ffff7a58630, globals=globals@entry=0x7ffff7a55df0, locals=locals@entry=0x7ffff7a55df0)
    at Python/pythonrun.c:1338

Found using fusil by @vstinner.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux, Windows

Output from running 'python -VV' on the command line:

No response

Linked PRs

  • gh-126220: Adapt _lsprof to Argument Clinic #126233
  • gh-126220: Fix crash on calls to _lsprof.Profiler methods with 0 args (backportable) #126271
  • [3.13] gh-126220: Fix crash on calls to _lsprof.Profiler methods with 0 args (backportable) (GH-126271) #126310
  • [3.12] gh-126220: Fix crash on calls to _lsprof.Profiler methods with 0 args (backportable) (GH-126271) #126311
  • [3.13] gh-126220: Adapt _lsprof to Argument Clinic (GH-126233) #126402

Activity

  1. devdanzin
    added
    type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
    on Oct 31, 2024
  2. ZeroIntensity
    added
    extension-modulesC modules in the Modules dirC modules in the Modules dir
    on Oct 31, 2024
  3. sobolevn commented on Oct 31, 2024

    @sobolevn
    sobolevn
    on Oct 31, 2024
    Member
    More actions

    Not just these two, but also others (like _pystart_callback) all from #103534 CC @gaogaotiantian

    This happens because args is never checked to have a proper length. I think that TypeError should be raised when these function do not have enough arguments (like we always do).

    I am working on a fix :)

  4. sobolevn
    self-assigned this
    on Oct 31, 2024
  5. sobolevn
    added 2 commits that reference this issue on Oct 31, 2024

    pythongh-126220: Fix crash on calls to `_lsprof.Profiler` methods wit…

    299f63f

    pythongh-126220: Fix crash on calls to `_lsprof.Profiler` methods wit…

    a748d98
  6. picnixz
    added
    3.12only security fixesonly security fixes
    3.13only security fixesonly security fixes
    3.14bugs and security fixesbugs and security fixes
    on Nov 1, 2024
  7. sobolevn
    added a commit that references this issue on Nov 1, 2024

    gh-126220: Fix crash on calls to `_lsprof.Profiler` methods with 0 ar…

    28b148f
  8. miss-islington
    added 2 commits that reference this issue on Nov 1, 2024

    pythongh-126220: Fix crash on calls to `_lsprof.Profiler` methods wit…

    144447c

    pythongh-126220: Fix crash on calls to `_lsprof.Profiler` methods wit…

    4197d40
  9. sobolevn
    added 3 commits that reference this issue on Nov 1, 2024

    [3.12] gh-126220: Fix crash on calls to `_lsprof.Profiler` methods wi…

    b5c19bd

    [3.13] gh-126220: Fix crash on calls to `_lsprof.Profiler` methods wi…

    1b9710c

    gh-126220: Adapt `_lsprof` to Argument Clinic (#126233)

    c806cd5
  10. miss-islington
    added a commit that references this issue on Nov 4, 2024

    pythongh-126220: Adapt `_lsprof` to Argument Clinic (pythonGH-126233)

    9eaf3e6
  11. vstinner commented on Nov 6, 2024

    @vstinner
    vstinner
    on Nov 6, 2024
    Member
    More actions

    Can we close this isue?

  12. sobolevn
    closed this as completedon Nov 6, 2024
  13. picnixz
    added 2 commits that reference this issue on Dec 8, 2024

    pythongh-126220: Fix crash on calls to `_lsprof.Profiler` methods wit…

    590269e

    pythongh-126220: Adapt `_lsprof` to Argument Clinic (python#126233)

    c86f49b
  14. ebonnal
    added 2 commits that reference this issue on Jan 12, 2025

    pythongh-126220: Fix crash on calls to `_lsprof.Profiler` methods wit…

    8829f6d

    pythongh-126220: Adapt `_lsprof` to Argument Clinic (python#126233)

    2081eee
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

  • @sobolevn
    sobolevn

Labels

3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixesextension-modulesC modules in the Modules dirC modules in the Modules dirtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    You are visitor 01402503 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.