Staging
v0.8.1
v0.8.1
https://github.com/python/cpython
Revision 30e769382dfb67a68fe8e6bfe8509addb4aa9514 authored by Miss Islington (bot) on 04 February 2020, 21:41:55 UTC, committed by GitHub on 04 February 2020, 21:41:55 UTC
When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:
==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==220553== Access not within mapped region at address 0x2A
==220553== at 0x48408A0: memmove (vg_replace_strmem.c:1272)
==220553== by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
==220553== by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
==220553== by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)
Reproducer:
reader = open ("/dev/zero", "rb")
_void = reader.read (42)
reader.close ()
reader.readinto (bytearray (42)) GH-GH-GH- BANG!
The problem exists since 2012 when commit dc469454ec added code
to free the read buffer on close().
Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c0746f277052e45a60d6c436a765e34722821)
Co-authored-by: Philipp Gesang <phg@phi-gamma.net> 1 parent 9a740b6
Tip revision: 30e769382dfb67a68fe8e6bfe8509addb4aa9514 authored by Miss Islington (bot) on 04 February 2020, 21:41:55 UTC
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295)
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295)
Tip revision: 30e7693
| File | Mode | Size |
|---|---|---|
| cpython | ||
| internal | ||
| Python-ast.h | -rw-r--r-- | 25.9 KB |
| Python.h | -rw-r--r-- | 3.5 KB |
| abstract.h | -rw-r--r-- | 29.6 KB |
| asdl.h | -rw-r--r-- | 1.2 KB |
| ast.h | -rw-r--r-- | 948 bytes |
| bitset.h | -rw-r--r-- | 468 bytes |
| bltinmodule.h | -rw-r--r-- | 264 bytes |
| boolobject.h | -rw-r--r-- | 886 bytes |
| bytearrayobject.h | -rw-r--r-- | 2.1 KB |
| bytes_methods.h | -rw-r--r-- | 3.2 KB |
| bytesobject.h | -rw-r--r-- | 8.3 KB |
| cellobject.h | -rw-r--r-- | 713 bytes |
| ceval.h | -rw-r--r-- | 8.2 KB |
| classobject.h | -rw-r--r-- | 1.7 KB |
| code.h | -rw-r--r-- | 6.8 KB |
| codecs.h | -rw-r--r-- | 6.6 KB |
| compile.h | -rw-r--r-- | 3.2 KB |
| complexobject.h | -rw-r--r-- | 1.8 KB |
| context.h | -rw-r--r-- | 2.0 KB |
| datetime.h | -rw-r--r-- | 9.0 KB |
| descrobject.h | -rw-r--r-- | 2.9 KB |
| dictobject.h | -rw-r--r-- | 3.6 KB |
| dtoa.h | -rw-r--r-- | 458 bytes |
| dynamic_annotations.h | -rw-r--r-- | 21.9 KB |
| enumobject.h | -rw-r--r-- | 253 bytes |
| errcode.h | -rw-r--r-- | 1.7 KB |
| eval.h | -rw-r--r-- | 1.2 KB |
| fileobject.h | -rw-r--r-- | 1.3 KB |
| fileutils.h | -rw-r--r-- | 4.2 KB |
| floatobject.h | -rw-r--r-- | 4.7 KB |
| frameobject.h | -rw-r--r-- | 3.2 KB |
| funcobject.h | -rw-r--r-- | 4.1 KB |
| genobject.h | -rw-r--r-- | 3.6 KB |
| graminit.h | -rw-r--r-- | 2.1 KB |
| grammar.h | -rw-r--r-- | 1.8 KB |
| import.h | -rw-r--r-- | 4.8 KB |
| interpreteridobject.h | -rw-r--r-- | 334 bytes |
| intrcheck.h | -rw-r--r-- | 861 bytes |
| iterobject.h | -rw-r--r-- | 567 bytes |
| listobject.h | -rw-r--r-- | 2.9 KB |
| longintrepr.h | -rw-r--r-- | 3.7 KB |
| longobject.h | -rw-r--r-- | 9.3 KB |
| marshal.h | -rw-r--r-- | 803 bytes |
| memoryobject.h | -rw-r--r-- | 2.7 KB |
| methodobject.h | -rw-r--r-- | 4.3 KB |
| modsupport.h | -rw-r--r-- | 9.4 KB |
| moduleobject.h | -rw-r--r-- | 2.3 KB |
| namespaceobject.h | -rw-r--r-- | 349 bytes |
| node.h | -rw-r--r-- | 1.3 KB |
| object.h | -rw-r--r-- | 28.9 KB |
| objimpl.h | -rw-r--r-- | 10.3 KB |
| odictobject.h | -rw-r--r-- | 1.3 KB |
| opcode.h | -rw-r--r-- | 5.0 KB |
| osdefs.h | -rw-r--r-- | 737 bytes |
| osmodule.h | -rw-r--r-- | 291 bytes |
| parsetok.h | -rw-r--r-- | 2.9 KB |
| patchlevel.h | -rw-r--r-- | 1.3 KB |
| picklebufobject.h | -rw-r--r-- | 847 bytes |
| py_curses.h | -rw-r--r-- | 2.4 KB |
| pyarena.h | -rw-r--r-- | 2.7 KB |
| pycapsule.h | -rw-r--r-- | 1.7 KB |
| pyctype.h | -rw-r--r-- | 1.3 KB |
| pydebug.h | -rw-r--r-- | 1.2 KB |
| pydtrace.d | -rw-r--r-- | 1008 bytes |
| pydtrace.h | -rw-r--r-- | 2.4 KB |
| pyerrors.h | -rw-r--r-- | 12.5 KB |
| pyexpat.h | -rw-r--r-- | 2.4 KB |
| pyfpe.h | -rw-r--r-- | 341 bytes |
| pyhash.h | -rw-r--r-- | 4.0 KB |
| pylifecycle.h | -rw-r--r-- | 2.0 KB |
| pymacconfig.h | -rw-r--r-- | 2.9 KB |
| pymacro.h | -rw-r--r-- | 3.7 KB |
| pymath.h | -rw-r--r-- | 8.1 KB |
| pymem.h | -rw-r--r-- | 5.3 KB |
| pyport.h | -rw-r--r-- | 29.5 KB |
| pystate.h | -rw-r--r-- | 4.6 KB |
| pystrcmp.h | -rw-r--r-- | 436 bytes |
| pystrhex.h | -rw-r--r-- | 849 bytes |
| pystrtod.h | -rw-r--r-- | 1.4 KB |
| pythonrun.h | -rw-r--r-- | 7.5 KB |
| pythread.h | -rw-r--r-- | 5.5 KB |
| pytime.h | -rw-r--r-- | 8.7 KB |
| rangeobject.h | -rw-r--r-- | 629 bytes |
| setobject.h | -rw-r--r-- | 3.3 KB |
| sliceobject.h | -rw-r--r-- | 2.5 KB |
| structmember.h | -rw-r--r-- | 2.0 KB |
| structseq.h | -rw-r--r-- | 1.3 KB |
| symtable.h | -rw-r--r-- | 5.2 KB |
| sysmodule.h | -rw-r--r-- | 1.2 KB |
| token.h | -rw-r--r-- | 2.4 KB |
| traceback.h | -rw-r--r-- | 601 bytes |
| tracemalloc.h | -rw-r--r-- | 1.1 KB |
| tupleobject.h | -rw-r--r-- | 1.6 KB |
| typeslots.h | -rw-r--r-- | 2.2 KB |
| ucnhash.h | -rw-r--r-- | 1.0 KB |
| unicodeobject.h | -rw-r--r-- | 34.9 KB |
| warnings.h | -rw-r--r-- | 1.7 KB |
| weakrefobject.h | -rw-r--r-- | 2.8 KB |
Computing file changes ...
