GeezerVison is showing github.com — Double-free in Argument Clinic `str_converter` generated code · Issue #99240 · python/cpython
Double-free in Argument Clinic str_converter generated code #99240DescriptionArgument Clinic str_converter generate such code when encoding is set
(see function test_str_converter_encoding in file Lib/test/clinic.test):
/* -- snip -- */
if (!_PyArg_ParseStack(args, nargs, "esesetes#et#:test_str_converter_encoding",
"idna", &a, "idna", &b, "idna", &c, "idna", &d, &d_length, "idna", &e, &e_length)) {
goto exit;
}
return_value = test_str_converter_encoding_impl(module, a, b, c, d, d_length, e, e_length);
exit:
/* Cleanup for a */
if (a) {
PyMem_FREE(a);
}
/* Cleanup for b */
if (b) {
PyMem_FREE(b);
}
/* Cleanup for c */
if (c) {
PyMem_FREE(c);
}
/* -- snip -- */If parsing a successes, a will be assigned an address points to an allocated memory.
After that, if parsing b fails, the memory which a points to is freed by function _PyArg_ParseStack,
and _PyArg_ParseStack returns 0, then control flow goes to label "exit".
At this time, a is not NULL, so the memory it points to is freed again, which cause a double-free problem and a runtime crash.
This bug is found in #96178 "Argument Clinic functional test".
Activitychanged the title [-]Double-fre in Argument clinic `str_converter` generated code[/-] [+]Double-free in Argument clinic `str_converter` generated code[/+] on Nov 8, 2022changed the title [-]Double-free in Argument clinic `str_converter` generated code[/-] [+]Double-free in Argument Clinic `str_converter` generated code[/+] on Nov 8, 2022colorfulappl commented on Nov 8, 2022 ContributorAuthor More actions added a commit that references this issue on Nov 24, 2022gh-99240: Fix double-free bug in Argument Clinic str_converter genera… hauntsaninja commented on Nov 29, 2022 Thanks for reporting and fixing, looks like this has been completed erlend-aasland commented on Nov 29, 2022 We should consider backporting this, IMO. colorfulappl commented on Nov 30, 2022 ContributorAuthor More actions
We should consider backporting this, IMO.
Should we backport #96002 before backporting this?
And I made a new bug fix #99890 . erlend-aasland commented on Nov 30, 2022
Should we backport #96002 before backporting this?
Yes, I think we should. Although that PR introduced a new C file, it expands the Argument Clinic coverage considerably, so I think it is definitely worth it.
And I made a new bug fix #99890 .
Great :) added a commit that references this issue on Dec 17, 2022gh-99240: Reset pointer to NULL when the pointed memory is freed in a… kumaraditya303 commented on Dec 21, 2022 Thanks for working on this, all PRs have been merged. Reacted by Erlend E. Aasland erlend-aasland commented on Dec 23, 2022 Yes, thanks for all your good work on argument clinic, @colorfulappl! And thank you Kumar for landing these PRs; I've had a hard time keeping up with CPython dev lately. Reacted by Shantanu and Kumar Aditya
MetadataMetadataDevelopmentNo branches or pull requestsIssue actions
|