Staging
v0.8.1
v0.8.1
https://github.com/python/cpython
Revision c352e6c7446c894b13643f538db312092b351789 authored by Miss Islington (bot) on 04 February 2020, 22:06:42 UTC, committed by GitHub on 04 February 2020, 22:06:42 UTC
When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:
==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==220553== Access not within mapped region at address 0x2A
==220553== at 0x48408A0: memmove (vg_replace_strmem.c:1272)
==220553== by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
==220553== by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
==220553== by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)
Reproducer:
reader = open ("/dev/zero", "rb")
_void = reader.read (42)
reader.close ()
reader.readinto (bytearray (42)) GH-GH-GH- BANG!
The problem exists since 2012 when commit dc469454ec added code
to free the read buffer on close().
Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c0746f277052e45a60d6c436a765e34722821)
Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
1 parent 51332c4
Tip revision: c352e6c7446c894b13643f538db312092b351789 authored by Miss Islington (bot) on 04 February 2020, 22:06:42 UTC
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18350)
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18350)
Tip revision: c352e6c
| File | Mode | Size |
|---|---|---|
| clinic | ||
| Python-ast.c | -rw-r--r-- | 263.0 KB |
| README | -rw-r--r-- | 62 bytes |
| _warnings.c | -rw-r--r-- | 35.6 KB |
| asdl.c | -rw-r--r-- | 1.4 KB |
| ast.c | -rw-r--r-- | 160.5 KB |
| bltinmodule.c | -rw-r--r-- | 81.1 KB |
| ceval.c | -rw-r--r-- | 172.0 KB |
| ceval_gil.h | -rw-r--r-- | 8.9 KB |
| codecs.c | -rw-r--r-- | 45.0 KB |
| compile.c | -rw-r--r-- | 150.6 KB |
| condvar.h | -rw-r--r-- | 11.0 KB |
| dtoa.c | -rw-r--r-- | 78.5 KB |
| dup2.c | -rw-r--r-- | 705 bytes |
| dynamic_annotations.c | -rw-r--r-- | 6.6 KB |
| dynload_aix.c | -rw-r--r-- | 5.7 KB |
| dynload_dl.c | -rw-r--r-- | 581 bytes |
| dynload_hpux.c | -rw-r--r-- | 1.9 KB |
| dynload_next.c | -rw-r--r-- | 3.9 KB |
| dynload_shlib.c | -rw-r--r-- | 3.3 KB |
| dynload_stub.c | -rw-r--r-- | 186 bytes |
| dynload_win.c | -rw-r--r-- | 10.0 KB |
| errors.c | -rw-r--r-- | 32.2 KB |
| fileutils.c | -rw-r--r-- | 45.5 KB |
| formatter_unicode.c | -rw-r--r-- | 50.3 KB |
| frozen.c | -rw-r--r-- | 1.7 KB |
| frozenmain.c | -rw-r--r-- | 2.7 KB |
| future.c | -rw-r--r-- | 4.9 KB |
| getargs.c | -rw-r--r-- | 72.3 KB |
| getcompiler.c | -rw-r--r-- | 369 bytes |
| getcopyright.c | -rw-r--r-- | 511 bytes |
| getopt.c | -rw-r--r-- | 3.4 KB |
| getplatform.c | -rw-r--r-- | 130 bytes |
| getversion.c | -rw-r--r-- | 289 bytes |
| graminit.c | -rw-r--r-- | 43.3 KB |
| import.c | -rw-r--r-- | 57.8 KB |
| importdl.c | -rw-r--r-- | 7.1 KB |
| importdl.h | -rw-r--r-- | 487 bytes |
| importlib.h | -rw-r--r-- | 96.2 KB |
| importlib_external.h | -rw-r--r-- | 129.7 KB |
| makeopcodetargets.py | -rwxr-xr-x | 1.6 KB |
| marshal.c | -rw-r--r-- | 50.3 KB |
| modsupport.c | -rw-r--r-- | 14.8 KB |
| mysnprintf.c | -rw-r--r-- | 3.3 KB |
| mystrtoul.c | -rw-r--r-- | 8.1 KB |
| opcode_targets.h | -rw-r--r-- | 6.3 KB |
| peephole.c | -rw-r--r-- | 30.7 KB |
| pyarena.c | -rw-r--r-- | 5.5 KB |
| pyctype.c | -rw-r--r-- | 7.7 KB |
| pyfpe.c | -rw-r--r-- | 621 bytes |
| pyhash.c | -rw-r--r-- | 13.0 KB |
| pylifecycle.c | -rw-r--r-- | 46.8 KB |
| pymath.c | -rw-r--r-- | 1.6 KB |
| pystate.c | -rw-r--r-- | 27.5 KB |
| pystrcmp.c | -rw-r--r-- | 613 bytes |
| pystrhex.c | -rw-r--r-- | 1.6 KB |
| pystrtod.c | -rw-r--r-- | 40.1 KB |
| pythonrun.c | -rw-r--r-- | 43.3 KB |
| pytime.c | -rw-r--r-- | 19.8 KB |
| random.c | -rw-r--r-- | 17.8 KB |
| sigcheck.c | -rw-r--r-- | 529 bytes |
| strdup.c | -rw-r--r-- | 247 bytes |
| structmember.c | -rw-r--r-- | 8.6 KB |
| symtable.c | -rw-r--r-- | 56.9 KB |
| sysmodule.c | -rw-r--r-- | 70.0 KB |
| thread.c | -rw-r--r-- | 12.4 KB |
| thread_foobar.h | -rw-r--r-- | 2.2 KB |
| thread_nt.h | -rw-r--r-- | 9.6 KB |
| thread_pthread.h | -rw-r--r-- | 18.6 KB |
| traceback.c | -rw-r--r-- | 22.1 KB |
| wordcode_helpers.h | -rw-r--r-- | 1.2 KB |
Computing file changes ...
