GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-148178: Validate async debug offsets read from remote process by gpshead · Pull Request #148179 · python/cpython

Conversation

@gpshead

@gpshead gpshead commented Apr 6, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

The _remote_debugging module reads async_debug_offsets from the target process's memory but did not validate them, unlike debug_offsets which go through validate_debug_offsets(). The asyncio_task_object.size field is used as the read length into fixed-size 4096-byte stack buffers (SIZEOF_TASK_OBJ); a malicious or compromised target process could supply a larger size and overflow the debugger's stack.

Add validate_async_debug_offsets() and call it from read_async_debug() (the single chokepoint for loading these offsets) to bound the task object size and the member offsets that index into the local buffer.

--

Opening as a draft to start with as this isn't my area of the code and there are possibly more of these to be fixed. Claude authored the fix.

  • Issue: Harden validation of remote debugging offset tables #148178

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@bedevere-app bedevere-app Bot mentioned this pull request Apr 6, 2026
Harden validation of remote debugging offset tables #148178
Closed
@pablogsal

pablogsal commented Apr 6, 2026

Copy link
Copy Markdown
Member

I need to think a bit more about how to do this properly. We need to validate every field of every section, not just the async debug. I also need to think carefully how to do this without having to write all by hand and how to ensure we fail at build time if we forget.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@pablogsal

pablogsal commented Apr 6, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

@gpshead I was working on a fix while you opened this. If you want we can iterate over this draft but since there is a lot more to do here and is quite tricky because I suspect we are going to need a lot of macros I am not sure if that's going to be the best route.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
gpshead added 2 commits April 6, 2026 17:05
@gpshead
Validate async debug offsets read from remote process
58756ef 
The _remote_debugging module reads async_debug_offsets from the target
process's memory but did not validate them, unlike debug_offsets which
go through validate_debug_offsets(). The asyncio_task_object.size field
is used as the read length into fixed-size 4096-byte stack buffers
(SIZEOF_TASK_OBJ); a malicious or compromised target process could
supply a larger size and overflow the debugger's stack.

Add validate_async_debug_offsets() and call it from read_async_debug()
(the single chokepoint for loading these offsets) to bound the task
object size and the member offsets that index into the local buffer.
@gpshead
Add NEWS entry for pythongh-148178
83bda8a
@gpshead
gpshead force-pushed the fix-async-debug-offsets-validation branch from 2943185 to 83bda8a Compare April 6, 2026 17:06
@gpshead

gpshead commented Apr 6, 2026

Copy link
Copy Markdown
Member Author

Totally fine if this PR gets closed. I mostly i wanted to surface it as food for thought (I suppose I could've just linked to the branch for that without a draft PR).
pablogsal reacted with heart emoji
All reactions
  • ❤️ 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@pablogsal

pablogsal commented Apr 6, 2026

Copy link
Copy Markdown
Member

Totally fine if this PR gets closed. I mostly i wanted to surface it as food for thought (I suppose I could've just linked to the branch for that without a draft PR).

Thanks a lot! I really appreciate the help and I want to say this explicitly :) It's just that unfortunately this fix will be tricky to balance in all fronts :(
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@pablogsal

pablogsal commented Apr 6, 2026

Copy link
Copy Markdown
Member

Closing in favour of #148187 Thanks for the draft Greg!
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@pablogsal pablogsal closed this Apr 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pablogsal pablogsal Awaiting requested review from pablogsal pablogsal will be requested when the pull request is marked ready for review pablogsal is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@gpshead @pablogsal
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.