GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.15] gh-157364: Fix use-after-free in io.TextIOWrapper during reentrant detach by vstinner · Pull Request #159591 · python/cpython

Conversation

@vstinner

@vstinner vstinner commented Oct 16, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member
  • Issue: io.TextIOWrapper UAF triggered by readline() #157364

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
cmaloney and others added 3 commits October 17, 2026 00:30
@cmaloney @yihong0618 @vstinner
pythongh-143008: Fix Null pointer dereferences in TextIOWrapper under…
d978860
…lying stream access (python#145957)

TextIOWrapper keeps its underlying stream in a member called
`self->buffer`. That stream can be detached by user code, such as custom
`.flush` implementations resulting in `self->buffer` being set to NULL.
The implementation often checked at the start of functions if
`self->buffer` is in a good state, but did not always recheck after
other Python code was called which could modify `self->buffer`.

The cases which need to be re-checked are hard to spot so rather than
rely on reviewer effort create better safety by making all self->buffer
access go through helper functions.

Thank you yihong0618 for the test, NEWS and initial implementation in
pythongh-143041.

Co-authored-by: yihong0618 <[email protected]>
Co-authored-by: Victor Stinner <[email protected]>
(cherry picked from commit db4b194)
@brijkapadia @vstinner
pythongh-154523: Fix data-race in TextIOWrapper.detach() (python#15…
e1ff17b
…4565)

(cherry picked from commit 8440a6a)
@ashm-dev @vstinner
pythongh-157364: Fix use-after-free in io.TextIOWrapper during reentr…
5dd00da
…ant detach (python#157370)

Co-authored-by: Victor Stinner <[email protected]>
(cherry picked from commit e19dc47)
@bedevere-app bedevere-app Bot mentioned this pull request Oct 16, 2026
io.TextIOWrapper UAF triggered by readline() #157364
Closed
@bedevere-app bedevere-app Bot added the awaiting core review label Oct 16, 2026
@vstinner vstinner mentioned this pull request Oct 16, 2026
gh-157364: Fix use-after-free in TextIOWrapper during reentrant detach #157370
Merged
@vstinner vstinner added the needs backport to 3.14 bugs and security fixes label Oct 16, 2026
@vstinner
vstinner merged commit ea1312b into python:3.15 Oct 16, 2026
58 checks passed

Uh oh!

There was an error while loading. Please reload this page.

@vstinner
vstinner deleted the textio15 branch October 16, 2026 23:23
@miss-islington-app

miss-islington-app Bot commented Oct 16, 2026

Copy link
Copy Markdown

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app bedevere-app Bot removed the awaiting core review label Oct 16, 2026
@miss-islington-app

miss-islington-app Bot commented Oct 16, 2026

Copy link
Copy Markdown

Sorry, @vstinner, I could not cleanly backport this to 3.14 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker ea1312bdb446a536964ec7133625ae6aa6a592bf 3.14
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@miss-islington-app miss-islington-app Bot assigned vstinner Oct 16, 2026
@vstinner vstinner removed the needs backport to 3.14 bugs and security fixes label Oct 16, 2026
vstinner added a commit that referenced this pull request Oct 16, 2026
@vstinner @cmaloney
@yihong0618 @brijkapadia @ashm-dev
[3.14] gh-157364: Fix use-after-free in io.TextIOWrapper during reent…
13fc16c
…rant detach (#159600)

[3.15] gh-157364: Fix use-after-free in io.TextIOWrapper during reentrant detach (#159591)

* gh-143008: Fix Null pointer dereferences in TextIOWrapper underlying stream access (#145957)

TextIOWrapper keeps its underlying stream in a member called
`self->buffer`. That stream can be detached by user code, such as custom
`.flush` implementations resulting in `self->buffer` being set to NULL.
The implementation often checked at the start of functions if
`self->buffer` is in a good state, but did not always recheck after
other Python code was called which could modify `self->buffer`.

The cases which need to be re-checked are hard to spot so rather than
rely on reviewer effort create better safety by making all self->buffer
access go through helper functions.

Thank you yihong0618 for the test, NEWS and initial implementation in
gh-143041.



(cherry picked from commit db4b194)

* gh-154523: Fix data-race in `TextIOWrapper.detach()` (#154565)

(cherry picked from commit 8440a6a)

* gh-157364: Fix use-after-free in io.TextIOWrapper during reentrant detach (#157370)


(cherry picked from commit e19dc47)

---------





(cherry picked from commit ea1312b)

Co-authored-by: Cody Maloney <[email protected]>
Co-authored-by: yihong0618 <[email protected]>
Co-authored-by: Brij Kapadia <[email protected]>
Co-authored-by: Shamil <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@vstinner vstinner

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@vstinner @cmaloney @brijkapadia @ashm-dev
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.