GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — `PyEval_GetFrame` crashes when it returns incomplete frames · Issue #96975 · python/cpython

PyEval_GetFrame crashes when it returns incomplete frames #96975

New issue
Copy link
New issue
Copy link
Closed
Closed
PyEval_GetFrame crashes when it returns incomplete frames#96975
Copy link
Assignees
markshannonbrandtbucher
Labels
3.11only security fixesonly security fixes3.12only security fixesonly security fixes

Description

@pablogsal
pablogsal
opened on Sep 20, 2022
Issue body actions

Is it possible that PyEval_GetFrame returns incomplete frames. When this happens, Python segfaults in release mode or crashes in debug mode because of the check for incomplete frames in _PyFrame_GetFrameObject. This is reproducible in many ways involving C extensions, the easier one may be by installing a custom memory allocator for all the domains and calling PyEval_GetFrame from there. As the allocator can be called at random points of the eval loop (for example here) is perfectly possible that a legitimate call to PyEval_GetFrame returns an incomplete frame.

Activity

Next
  1. pablogsal
    added
    3.11only security fixesonly security fixes
    3.12only security fixesonly security fixes
    on Sep 20, 2022
  2. pablogsal
    assigned
    markshannon
    and
    brandtbucher
    on Sep 20, 2022
  3. pablogsal commented on Sep 20, 2022

    @pablogsal
    pablogsal
    on Sep 20, 2022
    MemberAuthor
    More actions

    CC: @markshannon @brandtbucher @ericsnowcurrently @iritkatriel

  4. brandtbucher commented on Sep 20, 2022

    @brandtbucher
    brandtbucher
    on Sep 20, 2022
    Member
    More actions

    Typo? Are you asking us if it's possible, or telling us it is?

  5. pablogsal commented on Sep 20, 2022

    @pablogsal
    pablogsal
    on Sep 20, 2022
    MemberAuthor
    More actions

    I am telling you

    Reacted by Brandt Bucher
  6. pablogsal
    changed the title [-]`PyEval_GetFrame` crashes if it returns incomplete frames[/-] [+]`PyEval_GetFrame` crashes when it returns incomplete frames[/+] on Sep 20, 2022
  7. pablogsal
    added
    release-blocker
    on Sep 20, 2022
  8. ezio-melotti
    added this to Release and Deferred blockers 🚫on Sep 20, 2022
  9. ezio-melotti
    moved this to Todo in Release and Deferred blockers 🚫on Sep 20, 2022
  10. pablogsal commented on Sep 20, 2022

    @pablogsal
    pablogsal
    on Sep 20, 2022
    MemberAuthor
    More actions

    It may be easier to reproduce by using generators.

  11. brandtbucher commented on Sep 20, 2022

    @brandtbucher
    brandtbucher
    on Sep 20, 2022
    Member
    More actions

    It seems to me that the correct thing to do in this case is to walk back over the frames until we reach a "complete" one, like we do in other places. Not 100% sure yet.

  12. brandtbucher commented on Sep 20, 2022

    @brandtbucher
    brandtbucher
    on Sep 20, 2022
    Member
    More actions

    It may also be possible in sys._getframe(). The logic for skipping incomplete frames doesn't seem to happen anymore once you've walked back to the desired depth.

  13. brandtbucher commented on Sep 20, 2022

    @brandtbucher
    brandtbucher
    on Sep 20, 2022
    Member
    More actions

    Ah wait, I think sys._getframe() is okay actually. I don't think it can be called from an incomplete frame.

  14. 10 remaining items

  15. kumaraditya303 commented on Sep 21, 2022

    @kumaraditya303
    kumaraditya303
    on Sep 21, 2022
    Contributor
    More actions

    Looking at the code, shouldn't we just call PyThreadState_GetFrame() in PyEval_GetFrame()?

    That indeed fixes the issue and avoids code duplication.

  16. miss-islington
    added a commit that references this issue on Sep 22, 2022

    pythonGH-96975: Skip incomplete frames in PyEval_GetFrame (pythonGH-9…

    3f60d68
  17. brandtbucher
    added 2 commits that reference this issue on Sep 22, 2022

    GH-96975: Skip incomplete frames in PyEval_GetFrame (GH-97003)

    8fd2c3b

    GH-96975: Skip incomplete frames in PyEval_GetFrame (GH-97018)

    6a646dd
  18. brandtbucher
    closed this as completedon Sep 22, 2022
  19. Repository owner moved this from Todo to Done in Release and Deferred blockers 🚫on Sep 22, 2022
  20. brandtbucher commented on Sep 22, 2022

    @brandtbucher
    brandtbucher
    on Sep 22, 2022
    Member
    More actions

    Actually, I'll let Pablo close this once it's cherry picked to the stable release.

  21. brandtbucher
    reopened this on Sep 22, 2022
  22. Repository owner moved this from Done to In Progress in Release and Deferred blockers 🚫on Sep 22, 2022
  23. pablogsal commented on Sep 28, 2022

    @pablogsal
    pablogsal
    on Sep 28, 2022
    MemberAuthor
    More actions

    I wonder if we should expose the _PyFrame_IsIncomplete function so if there are more cases like this extension authors can protect their code against this meanwhile we release a fix. Thoughts?

  24. pablogsal
    added a commit that references this issue on Oct 22, 2022

    GH-96975: Skip incomplete frames in PyEval_GetFrame (GH-97018)

    154b3cd
  25. Fidget-Spinner commented on Oct 26, 2022

    @Fidget-Spinner
    Fidget-Spinner
    on Oct 26, 2022
    Member
    More actions

    I'm closing this and removing release blocker label as I've seen it cherry picked on the official announcement https://mail.python.org/archives/list/[email protected]/thread/SB5PWB32JQHE7QFIULXIZIGUFPKSYEKP/.

  26. Fidget-Spinner
    closed this as completedon Oct 26, 2022
  27. Repository owner moved this from In Progress to Done in Release and Deferred blockers 🚫on Oct 26, 2022
  28. Fidget-Spinner
    removed
    release-blocker
    on Oct 26, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

  • @brandtbucher
    brandtbucher
  • @markshannon
    markshannon

Labels

3.11only security fixesonly security fixes3.12only security fixesonly security fixes

Projects

  • Release and Deferred blockers 🚫
    Status
    Done
    Show more project fields

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.