GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.14] gh-157364: Fix use-after-free in io.TextIOWrapper during reentrant detach by vstinner · Pull Request #159600 · python/cpython

Conversation

@vstinner

@vstinner vstinner commented Oct 16, 2026

Copy link
Copy Markdown
Member
  • Null pointer dereference in TextIOWrapper.truncate via re-entrant flush #143008: Fix Null pointer dereferences in TextIOWrapper underlying stream access (gh-143008: Fix Null pointer dereferences in TextIOWrapper underlying stream access #145957)

TextIOWrapper keeps its underlying stream in a member called self->buffer. That stream can be detached by user code, such as custom .flush implementations resulting in self->buffer being set to NULL. The implementation often checked at the start of functions if self->buffer is in a good state, but did not always recheck after other Python code was called which could modify self->buffer.

The cases which need to be re-checked are hard to spot so rather than rely on reviewer effort create better safety by making all self->buffer access go through helper functions.

Thank you yihong0618 for the test, NEWS and initial implementation in gh-143041.

(cherry picked from commit db4b194)

  • Data race: TextIOWrapper.detach() stores self->buffer = NULL non-atomically #154523: Fix data-race in TextIOWrapper.detach() (gh-154523: Fix data-race in TextIOWrapper.detach() #154565)

(cherry picked from commit 8440a6a)

  • io.TextIOWrapper UAF triggered by readline() #157364: Fix use-after-free in io.TextIOWrapper during reentrant detach (gh-157364: Fix use-after-free in TextIOWrapper during reentrant detach #157370)

(cherry picked from commit e19dc47)


(cherry picked from commit ea1312b)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@vstinner @cmaloney
@yihong0618 @brijkapadia @ashm-dev
[3.15] pythongh-157364: Fix use-after-free in io.TextIOWrapper during…
5145a3e
… reentrant detach (python#159591)

* pythongh-143008: Fix Null pointer dereferences in TextIOWrapper underlying stream access (python#145957)

TextIOWrapper keeps its underlying stream in a member called
`self->buffer`. That stream can be detached by user code, such as custom
`.flush` implementations resulting in `self->buffer` being set to NULL.
The implementation often checked at the start of functions if
`self->buffer` is in a good state, but did not always recheck after
other Python code was called which could modify `self->buffer`.

The cases which need to be re-checked are hard to spot so rather than
rely on reviewer effort create better safety by making all self->buffer
access go through helper functions.

Thank you yihong0618 for the test, NEWS and initial implementation in
pythongh-143041.

Co-authored-by: yihong0618 <[email protected]>
Co-authored-by: Victor Stinner <[email protected]>
(cherry picked from commit db4b194)

* pythongh-154523: Fix data-race in `TextIOWrapper.detach()` (python#154565)

(cherry picked from commit 8440a6a)

* pythongh-157364: Fix use-after-free in io.TextIOWrapper during reentrant detach (python#157370)

Co-authored-by: Victor Stinner <[email protected]>
(cherry picked from commit e19dc47)

---------

Co-authored-by: Cody Maloney <[email protected]>
Co-authored-by: yihong0618 <[email protected]>
Co-authored-by: Brij Kapadia <[email protected]>
Co-authored-by: Shamil <[email protected]>
(cherry picked from commit ea1312b)
@bedevere-app bedevere-app Bot mentioned this pull request Oct 16, 2026
io.TextIOWrapper UAF triggered by readline() #157364
Closed
@bedevere-app bedevere-app Bot added the awaiting core review label Oct 16, 2026
@vstinner
vstinner enabled auto-merge (squash) October 16, 2026 23:26
@vstinner
vstinner merged commit 13fc16c into python:3.14 Oct 16, 2026
51 checks passed

Uh oh!

There was an error while loading. Please reload this page.

@vstinner
vstinner deleted the textio14 branch October 16, 2026 23:53
@bedevere-app bedevere-app Bot removed the awaiting core review label Oct 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

@vstinner
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.