GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-92888: memory_ass_sub() calls CHECK_RELEASED_INT() twice by vstinner · Pull Request #93127 · python/cpython

Conversation

@vstinner

@vstinner vstinner commented May 23, 2022

Copy link
Copy Markdown
Member

If a memoryview is released while setting an item, raise an
exception. For example, converting an object to an index in C can
execute arbitrary Python code which can indirectly release the
memoryview.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@vstinner
gh-92888: memory_ass_sub() calls CHECK_RELEASED_INT() twice
14f423a 
If a memoryview is released while setting an item, raise an
exception. For example, converting an object to an index in C can
execute arbitrary Python code which can indirectly release the
memoryview.
@bedevere-bot bedevere-bot added the awaiting core review label May 23, 2022
@vstinner

vstinner commented May 23, 2022

Copy link
Copy Markdown
Member Author

I chose to keep the CHECK_RELEASED_INT() call at memory_ass_sub() entry.

I guess that memory_subscript() suffers from the same issue: I would prefer to fix it in a separated PR, but maybe then we can combine the two changes when backporting to stable branches.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@vstinner vstinner mentioned this pull request May 23, 2022
Use After Free when assigning into a memoryview #92888
Closed
@vstinner

vstinner commented Jun 17, 2022

Copy link
Copy Markdown
Member Author

PR #92946 seems more complete, I close my issue.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@vstinner vstinner closed this Jun 17, 2022
@vstinner
vstinner deleted the release_view branch June 17, 2022 14:53
@vstinner vstinner mentioned this pull request Jun 17, 2022
gh-92888: Fix memoryview bad __index__ use after free #92946
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

awaiting core review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@vstinner @bedevere-bot
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.