GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing github.com — Use-after-free in `_io.BytesIO.writelines` via re-entrant `__buffer__` close · Issue #143378 · python/cpython Closed Labels extension-modulesC modules in the Modules dirC modules in the Modules dirtopic-IOtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump DescriptionWhat happened?
Proof of Concept: from _io import BytesIO class Evil: def __init__(self, target): self.target = target def __buffer__(self, flags): self.target.close() return memoryview(b"A") bio = BytesIO() bio.writelines([Evil(bio)]) Vulnerable Code Snippet: Click to expandstatic PyObject * _io_BytesIO_writelines_impl(bytesio *self, PyObject *lines) /*[clinic end generated code: output=03a43a75773bc397 input=5d6a616ae39dc9ca]*/ { PyObject *it, *item; CHECK_CLOSED(self); it = PyObject_GetIter(lines); if (it == NULL) return NULL; while ((item = PyIter_Next(it)) != NULL) { Py_ssize_t ret = write_bytes_lock_held(self, item); Py_DECREF(item); if (ret < 0) { Py_DECREF(it); return NULL; } } Py_DECREF(it); /* See if PyIter_Next failed */ if (PyErr_Occurred()) return NULL; Py_RETURN_NONE; } /* Buggy Re-entrant Path */ Py_NO_INLINE static Py_ssize_t write_bytes_lock_held(bytesio *self, PyObject *b) { _Py_CRITICAL_SECTION_ASSERT_OBJECT_LOCKED(self); Py_buffer buf; if (PyObject_GetBuffer(b, &buf, PyBUF_CONTIG_RO) < 0) { /* Reentrant call site */ return -1; } Py_ssize_t len = buf.len; /* ... */ memcpy(PyBytes_AS_STRING(self->buf) + self->pos, /* crashing pointer derived */ /* Crash site */ buf.buf, len); /* ... */ return len; } /* Clobbering Path */ static PyObject * _io_BytesIO_close_impl(bytesio *self) { CHECK_EXPORTS(self); Py_CLEAR(self->buf); /* state mutate site */ Py_RETURN_NONE; } Sanitizer Output: Click to expandCPython versions tested on:3.12, 3.13, 3.14, 3.15 Output from running 'python -VV' on the command line:Python 3.15.0a1+ (heads/main:f5394c257ce, Oct 28 2025, 19:29:54) [GCC 13.3.0] Linked PRs
Activity
MetadataMetadataAssigneesLabelsextension-modulesC modules in the Modules dirC modules in the Modules dirtopic-IOtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump ProjectsMilestoneRelationshipsDevelopmentIssue actions |
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |