GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | ||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | ||||||||||||||||
GeezerVison is showing github.com — gh-144475: Fix a heap buffer overflow in partial_repr by brijkapadia · Pull Request #145362 · python/cpython Conversation
|
| for (i = 0; PyDict_Next(pto->kw, &i, &key, &value);) { | ||
| for (i = 0; PyDict_Next(kw, &i, &key, &value);) { | ||
| /* Prevent key.__str__ from deleting the value. */ | ||
| Py_INCREF(value); |
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
If we're covering all the bases:
Here, key can be an arbitrary object as well.
Also, the iteration should have a critical section around it -- see PyDict_Next docs.
But perhaps the best way to solve that would be switching to always use frozendict with string keys, so let's leave this to a future PR?
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
Also, the iteration should have a critical section around it -- see PyDict_Next docs.
I think that adding a critical section here is best for a future PR. This PR is more about fixing a mutation during repr. In contrast, adding a critical section is intended for the free-threaded build. Additionally, I realized that there are quite a few other times in this file where PyDict_Next is called without a critical section, so a new PR is needed anyway. I can create an issue for this change, although, should we wait on a PR until this one is merged to avoid any conflicts? I'm fine adding a critical section now, though, if you think that is better.
But perhaps the best way to solve that would be switching to always use frozendict with string keys, so let's leave this to a future PR?
I agree, enforcing that kw has only string keys seems like the best solution. Just to make sure I understand correctly, when you mean switch to using a frozendict, are you saying that the kw entry in the partialobject struct should be a frozendict instead of a dict, or are you referring to something only in this function (partial_repr)? If the former, I would like to work on making that change in a new PR. I’m fairly new to CPython, so I’d appreciate any suggestions you have for that change.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
The reason will be displayed to describe this comment to others. Learn more.
I think that adding a critical section here is best for a future PR.
OK!
are you saying that the kw entry in the partialobject struct should be a frozendict instead of a dict, or are you referring to something only in this function (partial_repr)?
The former seems worth looking into. As you said, there's a lot of PyDict_Next without critical sections (and other possibilities for possible mutation than threads); frozendict could solve these neatly.
I can create an issue for this change, although, should we wait on a PR until this one is merged to avoid any conflicts?
Yes.
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
|
Thanks @bkap123 for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
…45362) (cherry picked from commit 671a953) Co-authored-by: bkap123 <[email protected]>
|
Sorry, @bkap123 and @encukou, I could not cleanly backport this to |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
|
GH-145470 is a backport of this pull request to the 3.14 branch. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
GH-145470) (cherry picked from commit 671a953) Co-authored-by: bkap123 <[email protected]>
…honGH-145362) (cherry picked from commit 671a953) Co-authored-by: bkap123 <[email protected]>
|
GH-145882 is a backport of this pull request to the 3.13 branch. |
Sorry, something went wrong.
There was an error while loading. Please reload this page.
There was an error while loading. Please reload this page.
Successfully merging this pull request may close these issues.
There was an error while loading. Please reload this page.