GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing github.com — Marshal Stacksize Integer Overflow leading to Frame Crash · Issue #158648 · python/cpython Open Labels pendingThe issue will be closed if no feedback is providedThe issue will be closed if no feedback is providedtype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error DescriptionBug reportDescriptionIn
With
int slots = code->co_nlocalsplus + code->co_stacksize; PyFrameObject *f = PyObject_GC_NewVar(PyFrameObject, &PyFrame_Type, slots);
_PyInterpreterFrame *_PyThreadState_PushFrame(PyThreadState *tstate, size_t size) { assert(size < INT_MAX/sizeof(PyObject *)); // Compiled out with -DNDEBUG if (_PyThreadState_HasStackSpace(tstate, (int)size)) { _PyInterpreterFrame *res = (_PyInterpreterFrame *)tstate->datastack_top; tstate->datastack_top += size; return res; }
PoC# main.py import marshal, struct, types code = compile("def f(a, b, c): return a + b + c", "<t>", "exec") ns = {}; exec(code, ns) func_code = ns['f'].__code__ # Patch stacksize to INT_MAX in the marshal stream data = bytearray(marshal.dumps(func_code)) data[13:17] = struct.pack('<i', 0x7fffffff) # stacksize field # Load it: no error, valid code object evil = marshal.loads(bytes(data)) func = types.FunctionType(evil, globals()) print("Running func without tracing...") print(func(1, 2, 3)) import sys sys.settrace(lambda f, e, a: None) print("Running func with tracing...") func(1, 2, 3) OutputRunning func without tracing... 6 Running func with tracing... Traceback (most recent call last): File "main.py", line 22, in <module> func(1, 2, 3) ~~~~^^^^^^^^^ SystemError: Missing frame when calling trace function. CPython versions tested on:3.15 Operating systems tested on:Linux Linked PRsActivity
MetadataMetadataAssigneesLabelspendingThe issue will be closed if no feedback is providedThe issue will be closed if no feedback is providedtype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error ProjectsMilestoneRelationshipsDevelopmentIssue actions |
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |