Description

pablogsal

opened on Apr 6, 2026

Issue body actions

_remote_debugging should perform stricter validation of externally read debug-offset metadata before using it to size memory reads or interpret remote process layouts. The current attach path verifies version compatibility, but it should also reject malformed or inconsistent offset and size tables up front, including optional asyncio metadata when it is loaded, so invalid data is handled cleanly rather than being consumed by the unwinder.

Linked PRs

• gh-148178: Validate async debug offsets read from remote process #148179
• gh-148178: Validate remote debug offset tables on load #148187
• [3.14] gh-148178: Validate remote debug offset tables on load (GH-148187) #148577

Activity

1. gpshead commented on Apr 6, 2026

   

   gpshead

   on Apr 6, 2026

   Member

   More actions

   My own claude also independently found this (very much a theme at the moment in time as all sorts of people are realizing what the tools they've got can do) so I had one variant of a PR waiting for this being a public issue. attached as a draft in case you find it useful.

   Reacted by Pablo Galindo Salgado, Seth Larson and Maurycy Pawłowski-Wieroński
2. pablogsal commented on Apr 6, 2026

   

   pablogsal

   on Apr 6, 2026

   MemberAuthor

   More actions

   My own claude also independently found this (very much a theme at the moment in time as all sorts of people are realizing what the tools they've got can do) so I had one variant of a PR waiting for this being a public issue. attached as a draft in case you find it useful.

   Thanks a lot @gpshead! I answer in the PR but I am afraid the fix requires much more than just checking for the async debug as we need to validate all the offsets somehow and also ensure there aren't other vectors for the same thing :(

   Reacted by Gregory P. Smith
3. gpshead

   added 2 commits that reference this issue on Apr 6, 2026

   Add NEWS entry for pythongh-148178

   2943185

   Add NEWS entry for pythongh-148178

   83bda8a
4. gpshead commented on Apr 6, 2026

   

   gpshead

   on Apr 6, 2026

   Member

   More actions

   yeah i figured this probably went beyond just that very targeted one...
5. pablogsal commented on Apr 6, 2026

   

   pablogsal

   on Apr 6, 2026

   MemberAuthor

   More actions

   Alright I will prepare a PR. At the very least we need to:

   • Validate all fields in the async debug and regular offsets fields.
   • Ensure that if someone adds a new field we fail at compile time if a validation is not added
   • Sanitize other vectors for the same problem.
   • Do this in a way that doesn't have runtime performance impact
6. pablogsal

   added 3 commits that reference this issue on Apr 6, 2026

   pythongh-148178: Validate remote debug offset tables on load

   f12f6c4

   pythongh-148178: Validate remote debug offset tables on load

   b8dcd8f

   pythongh-148178: Validate remote debug offset tables on load

   e1f980e
7. picnixz

   added

   type-featureA feature request or enhancementA feature request or enhancement

   interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)

   on Apr 6, 2026
8. pablogsal

   added 3 commits that reference this issue on Apr 8, 2026

   pythongh-148178: Validate remote debug offset tables on load

   f6f2faf

   Merge pull request #125 from maurycy/maurycy-memcpy-get-member

   6657166

   gh-148178: Validate remote debug offset tables on load (#148187)

   289fd2c
9. pablogsal

   closed this as completedon Apr 13, 2026
10. StanFromIreland commented on Apr 14, 2026

    

    StanFromIreland

    on Apr 14, 2026

    Member

    More actions

    This should be backported to 3.14, no?
11. StanFromIreland

    reopened this on Apr 14, 2026
12. pablogsal commented on Apr 14, 2026

    

    pablogsal

    on Apr 14, 2026

    MemberAuthor

    More actions

    Yes but the patch is non trivisl, it needs to be re-created
13. ljfp

    added a commit that references this issue on Apr 25, 2026

    pythongh-148178: Validate remote debug offset tables on load (python#…

    e030841
14. bmwiedemann

    added 2 commits that reference this issue on Apr 28, 2026

    Update python315 to version 3.15.0~a8 / rev 12 via SR 1349644

    62afcad

    Update python315 to version 3.15.0~a8 / rev 13 via SR 1349863

    e0f2724
15. pablogsal

    added a commit that references this issue on May 4, 2026

    [3.14] gh-148178: Validate remote debug offset tables on load (GH-148187

    316f626
16. pablogsal

    closed this as completedon May 5, 2026

Issue actions