GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-156939: Fix memory corruption check in fcntl by vstinner · Pull Request #157103 · python/cpython

Conversation

@vstinner

@vstinner vstinner commented Sep 7, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

For "large" buffer using PyBytesWriter, copy guard bytes rather than just checking the last trailing byte.

  • Issue: C API: Detect buffer overflow in PyBytesWriter #156939

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@vstinner
pythongh-156939: Fix buffer overflow in fcntl
6627b40 
Allocate one extra "canary byte" to detect buffer overflow.

Previously, the canary byte (NUL byte) was written after the
allocated byte which would lead to buffer overflow if the bytes
writer uses the small buffer.
@bedevere-app bedevere-app Bot mentioned this pull request Sep 7, 2026
C API: Detect buffer overflow in PyBytesWriter #156939
Closed
@vstinner

This comment was marked as outdated.

Sign in to view
@vstinner

vstinner commented Sep 7, 2026

Copy link
Copy Markdown
Member Author

Python 3.13 and 3.14 are not affected. They fail with an error if the buffer size is larger than 1024 bytes.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@vstinner
Replace canary byte with guard bytes
d90a253
@vstinner vstinner changed the title gh-156939: Fix buffer overflow in fcntl gh-156939: Fix memory corruption check in fcntl Sep 7, 2026
@vstinner vstinner added skip news needs backport to 3.15 bugs and security fixes labels Sep 7, 2026
@vstinner
Update comment
db05828
vstinner
vstinner commented Sep 7, 2026
View reviewed changes

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With this change, I'm not sure that it's still needed to have a "fast path" (is it really faster?) for buffer smaller than or equal to 1024 bytes (the code path which doesn't use PyBytesWriter).

            // Truncate the trailing guard bytes
            return PyBytesWriter_FinishWithSize(writer, len);

The updated code now allocates extra 8 bytes and then resize the bytes object to truncate the last 8 bytes. It's less efficient than the previous code which relies on the fact that bytes objects always end with a trailing NUL byte. IMO it's better to have better check for memory overflow, than paying attention of the performance of such short operation.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@vstinner

vstinner commented Sep 7, 2026

Copy link
Copy Markdown
Member Author

Ubuntu (installed) / build, install and test

On a CI building Python in release mode, test_ioctl does crash :-(

0:04:01 load avg: 4.14 mem: 49.8 MiB [1/2/1] test_ioctl worker non-zero exit code (Exit code -6 (SIGABRT))
Re-running test_ioctl in verbose mode
test_bad_fd (test.test_ioctl.IoctlTestsPty.test_bad_fd) ... *** buffer overflow detected ***: terminated
Fatal Python error: Aborted
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@vstinner
Fix typo
c303c1e
@vstinner

vstinner commented Sep 7, 2026

Copy link
Copy Markdown
Member Author

On a CI building Python in release mode, test_ioctl does crash :-(

Ah, I just found and fixed a typo.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@vstinner

vstinner commented Sep 7, 2026

Copy link
Copy Markdown
Member Author

Currently, the code is correct. It relies on the fact that bytes objects always end with a NUL byte.

This change is mostly needed if we decide to implement the check to detect buffer overflow in PyBytesWriter: PR gh-156943.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@vstinner

vstinner commented Sep 9, 2026

Copy link
Copy Markdown
Member Author

I included this change in PR gh-156943, so I close this PR.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@vstinner vstinner closed this Sep 9, 2026
@vstinner
vstinner deleted the fcntl_canary branch September 9, 2026 19:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

needs backport to 3.15 bugs and security fixes skip news

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

@vstinner
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.