https://github.com/python/cpython/commit/4e9005d32ff466925f40af410f2ea6bf2329bcf8
commit: 4e9005d32ff466925f40af410f2ea6bf2329bcf8
branch: main
author: Nico-Posada <[email protected]>
committer: kumaraditya303 <[email protected]>
date: 2025-05-18T12:41:38+05:30
summary:
gh-134100: Fix use-after-free in `PyImport_ImportModuleLevelObject` (#134117)
files:
A
Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst
M Lib/test/test_importlib/import_/test_relative_imports.py
M Python/import.c
diff --git a/Lib/test/test_importlib/import_/test_relative_imports.py
b/Lib/test/test_importlib/import_/test_relative_imports.py
index e535d119763148..1549cbe96ce2d1 100644
--- a/Lib/test/test_importlib/import_/test_relative_imports.py
+++ b/Lib/test/test_importlib/import_/test_relative_imports.py
@@ -223,6 +223,21 @@ def test_relative_import_no_package_exists_absolute(self):
self.__import__('sys', {'__package__': '', '__spec__': None},
level=1)
+ def test_malicious_relative_import(self):
+ # https://github.com/python/cpython/issues/134100
+ # Test to make sure UAF bug with error msg doesn't come back to life
+ import sys
+ loooong = "".ljust(0x23000, "b")
+ name = f"a.{loooong}.c"
+
+ with util.uncache(name):
+ sys.modules[name] = {}
+ with self.assertRaisesRegex(
+ KeyError,
+ r"'a\.b+' not in sys\.modules as expected"
+ ):
+ __import__(f"{loooong}.c", {"__package__": "a"}, level=1)
+
(Frozen_RelativeImports,
Source_RelativeImports
diff --git
a/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst
b/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst
new file mode 100644
index 00000000000000..d672347f9ad246
--- /dev/null
+++
b/Misc/NEWS.d/next/Core_and_Builtins/2025-05-16-17-25-52.gh-issue-134100.5-FbLK.rst
@@ -0,0 +1,2 @@
+Fix a use-after-free bug that occurs when an imported module isn't
+in :data:`sys.modules` after its initial import. Patch by Nico-Posada.
diff --git a/Python/import.c b/Python/import.c
index 9dec0f488a3b90..e7be1b90751a6c 100644
--- a/Python/import.c
+++ b/Python/import.c
@@ -3854,15 +3854,17 @@ PyImport_ImportModuleLevelObject(PyObject *name,
PyObject *globals,
}
final_mod = import_get_module(tstate, to_return);
- Py_DECREF(to_return);
if (final_mod == NULL) {
if (!_PyErr_Occurred(tstate)) {
_PyErr_Format(tstate, PyExc_KeyError,
"%R not in sys.modules as expected",
to_return);
}
+ Py_DECREF(to_return);
goto error;
}
+
+ Py_DECREF(to_return);
}
}
else {
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3/lists/python-checkins.python.org/
Member address: [email protected]
