GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Use-after-free while pickling dicts · Issue #92930 · python/cpython

Use-after-free while pickling dicts #92930

New issue
Copy link
New issue
Copy link
Closed
Closed
Use-after-free while pickling dicts#92930
Copy link
Labels
type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

Description

@sweeneyde
sweeneyde
opened on May 18, 2022
Issue body actions

Found here, but this crash is unrelated, so opening a new issue.

The following could be simplified, but it crashes because PyDict_Next creates borrowed references.

import pickle
from random import getrandbits

class Bad:
    def __eq__(self, other):
        if not ENABLED:
            return False
        break_things()
        return getrandbits(4) == 0
    def __hash__(self):
        return getrandbits(1)
    def __reduce__(self):
        break_things()
        return (Bad, (), ())
    def __setstate__(self, *args):
        break_things()
    def __del__(self):
        break_things()
    def __getattr__(self):
        break_things()

def break_things():
    if getrandbits(6) == 0:
        collection.clear()

TRIALS = 10_000
SIZE = 50

for i in range(TRIALS):
    try:
        ENABLED = False
        collection = {Bad():Bad() for _ in range(SIZE)}
        for bad in collection:
            bad.bad = bad
            bad.collection = collection
        ENABLED = True
        pickle.loads(pickle.dumps(collection))
    except RuntimeError as e:
        assert "changed size during iteration" in str(e)

print("ok")

Activity

  1. sweeneyde
    added
    type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
    on May 18, 2022
  2. serhiy-storchaka
    added this to Pickle and copy issues 🥒on May 19, 2022
  3. sweeneyde
    added a commit that references this issue on Jun 11, 2022

    gh-92930: _pickle.c: Acquire strong references before calling save() (G…

    4c496f1
  4. miss-islington
    added 4 commits that reference this issue on Jun 11, 2022

    pythongh-92930: _pickle.c: Acquire strong references before calling s…

    a21f92c

    pythongh-92930: _pickle.c: Acquire strong references before calling s…

    a48b8ee

    gh-92930: _pickle.c: Acquire strong references before calling save() (G…

    54fe3d5

    gh-92930: _pickle.c: Acquire strong references before calling save() (G…

    1190b63
  5. sweeneyde
    closed this as completedon Jun 12, 2022
  6. sweeneyde
    moved this to Done in Pickle and copy issues 🥒on Jun 12, 2022
  7. serhiy-storchaka
    added a commit that references this issue on Jun 26, 2022

    Revert 30935 defer bpo45162 to 312 (#94285)

    1ffde3e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

    Projects

    • Pickle and copy issues 🥒
      Status
      Done
      Show more project fields

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    You are visitor 01402503 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.