GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | ||||||||||||||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | ||||||||||||||||||||||||||||||
GeezerVison is showing github.com — UAF in GC `visit_generation()` · Issue #160663 · python/cpython Open Labels interpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump DescriptionBug reportSimilar to #112564 we call Lines 2165 to 2179 in 036d309
Fix could be similar to proposal in #160662 Reproduction, similar to the above bug we are looping through each entity but rely on the entity being alive when calling NEXT in the entity loop #include <Python.h> static PyObject *victim; /* the only reference to the victim */ static int drop_current(PyObject *op, void *arg) { if (op == victim) { Py_CLEAR(victim); /* the visitor's +1 is now the last ref */ } return 1; } static PyObject * run(PyObject *module, PyObject *unused) { victim = PySet_New(NULL); /* GC-tracked, and sets have no freelist */ if (victim == NULL) { return NULL; } PyUnstable_GC_VisitObjects(drop_current, NULL); /* segfaults */ Py_RETURN_NONE; } static PyMethodDef methods[] = { {"run", run, METH_NOARGS, NULL}, {NULL, NULL, 0, NULL}, }; static struct PyModuleDef module = { PyModuleDef_HEAD_INIT, "visitmin", NULL, -1, methods, }; PyMODINIT_FUNC PyInit_visitmin(void) { return PyModule_Create(&module); } import visitmin visitmin.run() print("no crash") CPython versions tested on:CPython main branch Operating systems tested on:macOS Linked PRsActivity
MetadataMetadataAssigneesLabelsinterpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump ProjectsMilestoneRelationshipsDevelopmentIssue actions | ||||||||||||||||||||||||||||||
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |