Staging
v0.5.1
https://github.com/python/cpython
Revision c352e6c7446c894b13643f538db312092b351789 authored by Miss Islington (bot) on 04 February 2020, 22:06:42 UTC, committed by GitHub on 04 February 2020, 22:06:42 UTC
When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc469454ec added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c0746f277052e45a60d6c436a765e34722821)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
1 parent 51332c4
Raw File
Tip revision: c352e6c7446c894b13643f538db312092b351789 authored by Miss Islington (bot) on 04 February 2020, 22:06:42 UTC
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18350)
Tip revision: c352e6c
.travis.yml
language: c
dist: xenial

# To cache doc-building dependencies and C compiler output.
cache:
  - pip
  - ccache

env:
  global:
    # Use -O3 because we don't use debugger on Travis-CI
    - CFLAGS="-O3"

branches:
  only:
    - master
    - /^\d\.\d$/
    - buildbot-custom

matrix:
  fast_finish: true
  allow_failures:
    - env: OPTIONAL=true
  include:
    - os: linux
      language: c
      compiler: clang
      # gcc also works, but to keep the # of concurrent builds down, we use one C
      # compiler here and the other to run the coverage build. Clang is preferred
      # in this instance for its better error messages.
      env: TESTING=cpython
      addons:
        apt:
          packages:
            - xvfb
    - os: linux
      language: python
      python: 3.6
      env: TESTING=docs
      before_script:
        - cd Doc
        # Sphinx is pinned so that new versions that introduce new warnings won't suddenly cause build failures.
        # (Updating the version is fine as long as no warnings are raised by doing so.)
        - python -m pip install sphinx==1.8.2 blurb
      script:
        - make check suspicious html SPHINXOPTS="-q -W -j4"
    - os: linux
      language: c
      compiler: gcc
      env: OPTIONAL=true
      addons:
        apt:
          packages:
            - xvfb
      before_script:
        - ./configure PYTHON_FOR_REGEN=python3
        - make -s -j4
        # Need a venv that can parse covered code.
        - ./python -m venv venv
        - ./venv/bin/python -m pip install -U coverage
        - ./venv/bin/python -m test.pythoninfo
      script:
        # Skip tests that re-run the entire test suite.
        - xvfb-run ./venv/bin/python -m coverage run --pylib -m test -uall,-cpu -x test_multiprocessing_fork -x test_multiprocessing_forkserver -x test_multiprocessing_spawn
      after_script:  # Probably should be after_success once test suite updated to run under coverage.py.
        # Make the `coverage` command available to Codecov w/ a version of Python that can parse all source files.
        - source ./venv/bin/activate
        - bash <(curl -s https://codecov.io/bash)


before_install:
  - set -e
  - |
      # Check short-circuit conditions
      if [ "${TESTING}" != "docs" ]
      then
        if [ "$TRAVIS_PULL_REQUEST" = "false" ]
        then
          echo "Not a PR, doing full build."
        else
          # Pull requests are slightly complicated because $TRAVIS_COMMIT_RANGE
          # may include more changes than desired if the history is convoluted.
          # Instead, explicitly fetch the base branch and compare against the
          # merge-base commit.
          git fetch -q origin +refs/heads/$TRAVIS_BRANCH
          changes=$(git diff --name-only HEAD $(git merge-base HEAD FETCH_HEAD))
          echo "Files changed:"
          echo "$changes"
          if ! echo "$changes" | grep -qvE '(\.rst$)|(^Doc)|(^Misc)'
          then
            echo "Only docs were updated, stopping build process."
            exit
          fi
        fi
      fi

# Travis provides only 2 cores, so don't overdo the parallelism and waste memory.
before_script:
  - ./configure --with-pydebug PYTHON_FOR_REGEN=python3
  - make -j4 regen-all
  - changes=`git status --porcelain`
  - |
      # Check for changes in regenerated files
      if ! test -z "$changes"
      then
        echo "Generated files not up to date"
        echo "$changes"
        exit 1
      fi
  - make -j4
  - make pythoninfo

script:
  # Using the built Python as patchcheck.py is built around the idea of using
  # a checkout-build of CPython to know things like what base branch the changes
  # should be compared against.
  # Only run on Linux as the check only needs to be run once.
  - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then ./python Tools/scripts/patchcheck.py --travis $TRAVIS_PULL_REQUEST; fi
  # Check that all symbols exported by libpython start with "Py" or "_Py"
  - make smelly
  # `-r -w` implicitly provided through `make buildbottest`.
  - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then XVFB_RUN=xvfb-run; fi; $XVFB_RUN make buildbottest TESTOPTS="-j4 -uall,-cpu"

notifications:
  email: false
  irc:
    channels:
      # This is set to a secure variable to prevent forks from notifying the
      # IRC channel whenever they fail a build. This can be removed when travis
      # implements https://github.com/travis-ci/travis-ci/issues/1094.
      # The actual value here is: irc.freenode.net#python-dev
      - secure: "s7kAkpcom2yUJ8XqyjFI0obJmhAGrn1xmoivdaPdgBIA++X47TBp1x4pgDsbEsoalef7bEwa4l07KdT4qa+DOd/c4QxaWom7fbN3BuLVsZuVfODnl79+gYq/TAbGfyH+yDs18DXrUfPgwD7C5aW32ugsqAOd4iWzfGJQ5OrOZzqzGjYdYQUEkJFXgxDEIb4aHvxNDWGO3Po9uKISrhb5saQ0l776yLo1Ur7M4oxl8RTbCdgX0vf5TzPg52BgvZpOgt3DHOUYPeiJLKNjAE6ibg0U95sEvMfHX77nz4aFY4/3UI6FFaRla34rZ+mYKrn0TdxOhera1QOgPmM6HzdO4K44FpfK1DS0Xxk9U9/uApq+cG0bU3W+cVUHDBe5+90lpRBAXHeHCgT7TI8gec614aiT8lEr3+yH8OBRYGzkjNK8E2LJZ/SxnVxDe7aLF6AWcoWLfS6/ziAIBFQ5Nc4U72CT8fGVSkl8ywPiRlvixKdvTODMSZo0jMqlfZSNaAPTsNRx4wu5Uis4qekwe32Fz4aB6KGpsuuVjBi+H6v0RKxNJNGY3JKDiEH2TK0UE2auJ5GvLW48aUVFcQMB7euCWYXlSWVRHh3WLU8QXF29Dw4JduRZqUpOdRgMHU79UHRq+mkE0jAS/nBcS6CvsmxCpTSrfVYuMOu32yt18QQoTyU="
    on_success: change
    on_failure: always
    skip_join: true
back to top