[issue44396] pegen _PyParser_ASTFromFile(): Use-After-Free in syntaxerror()
alessandro mantovani added the comment: Fuzzing experimental techniques, but then I observed the same behavior was happening with vanilla afl++. As a starting queue I used the *.py files that I found in the repo under ‘test’ or so Best Alessandro Mantovani Inviato da iPhone > Il giorno 12.06.2021, alle ore 19:57, Pablo Galindo Salgado > ha scritto: > > > Pablo Galindo Salgado added the comment: > > alessandro mantovani, one question, how did you generate the crash scripts? > > -- > > ___ > Python tracker > <https://bugs.python.org/issue44396> > ___ -- ___ Python tracker <https://bugs.python.org/issue44396> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue44396] Use-After-Free
New submission from alessandro mantovani : Use After Free in python3.11 (commit 2ab27c4af4ddf752) Steps to reproduce: 1) ./configure --with-address-sanitizer 2) make 3) ./python I attach some of the input that lead to the undefined behavior For the complete description you can find the asan report here: ==1082579==ERROR: AddressSanitizer: heap-use-after-free on address 0x62645a40 at pc 0x00735155 bp 0x7fffbed0 sp 0x7fffbec8 READ of size 8 at 0x62645a40 thread T0 #0 0x735154 in ascii_decode /home/elmanto/ddg/other_targets/cpython/Objects/unicodeobject.c:5091:28 #1 0x735154 in unicode_decode_utf8 /home/elmanto/ddg/other_targets/cpython/Objects/unicodeobject.c:5158:10 #2 0xc98381 in syntaxerror /home/elmanto/ddg/other_targets/cpython/Parser/tokenizer.c:1087:15 #3 0xc8d616 in tok_get /home/elmanto/ddg/other_targets/cpython/Parser/tokenizer.c #4 0xc8696b in PyTokenizer_Get /home/elmanto/ddg/other_targets/cpython/Parser/tokenizer.c:1884:18 #5 0xead74c in _PyPegen_check_tokenizer_errors /home/elmanto/ddg/other_targets/cpython/Parser/pegen.c:1260:17 #6 0xead74c in _PyPegen_run_parser /home/elmanto/ddg/other_targets/cpython/Parser/pegen.c:1292:17 #7 0xeaebca in _PyPegen_run_parser_from_file_pointer /home/elmanto/ddg/other_targets/cpython/Parser/pegen.c:1377:14 #8 0xc83a91 in _PyParser_ASTFromFile /home/elmanto/ddg/other_targets/cpython/Parser/peg_api.c:26:12 #9 0xa0abf1 in pyrun_file /home/elmanto/ddg/other_targets/cpython/Python/pythonrun.c:1197:11 #10 0xa0abf1 in _PyRun_SimpleFileObject /home/elmanto/ddg/other_targets/cpython/Python/pythonrun.c:455:13 #11 0xa09b19 in _PyRun_AnyFileObject /home/elmanto/ddg/other_targets/cpython/Python/pythonrun.c:89:15 #12 0x4dfe94 in pymain_run_file_obj /home/elmanto/ddg/other_targets/cpython/Modules/main.c:353:15 #13 0x4dfe94 in pymain_run_file /home/elmanto/ddg/other_targets/cpython/Modules/main.c:372:15 #14 0x4dfe94 in pymain_run_python /home/elmanto/ddg/other_targets/cpython/Modules/main.c:587:21 #15 0x4dfe94 in Py_RunMain /home/elmanto/ddg/other_targets/cpython/Modules/main.c:666:5 #16 0x4e154c in pymain_main /home/elmanto/ddg/other_targets/cpython/Modules/main.c:696:12 #17 0x4e1874 in Py_BytesMain /home/elmanto/ddg/other_targets/cpython/Modules/main.c:720:12 #18 0x77a2e0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16 #19 0x43501d in _start (/home/elmanto/ddg/other_targets/cpython/python+0x43501d) 0x62645a40 is located 2368 bytes inside of 10560-byte region [0x62645100,0x62647a40) freed by thread T0 here: #0 0x4ada79 in realloc (/home/elmanto/ddg/other_targets/cpython/python+0x4ada79) #1 0x638e61 in PyMem_RawRealloc /home/elmanto/ddg/other_targets/cpython/Objects/obmalloc.c:602:12 #2 0x638e61 in _PyObject_Realloc /home/elmanto/ddg/other_targets/cpython/Objects/obmalloc.c:2339:12 previously allocated by thread T0 here: #0 0x4ada79 in realloc (/home/elmanto/ddg/other_targets/cpython/python+0x4ada79) #1 0x638e61 in PyMem_RawRealloc /home/elmanto/ddg/other_targets/cpython/Objects/obmalloc.c:602:12 #2 0x638e61 in _PyObject_Realloc /home/elmanto/ddg/other_targets/cpython/Objects/obmalloc.c:2339:12 SUMMARY: AddressSanitizer: heap-use-after-free /home/elmanto/ddg/other_targets/cpython/Objects/unicodeobject.c:5091:28 in ascii_decode Shadow bytes around the buggy address: 0x0c4c8af0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c8b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c8b10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c8b20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c8b30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c4c8b40: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd 0x0c4c8b50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c8b60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c8b70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c8b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c8b90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user:f7 Container overflow: fc Array cookie:ac Intra object redzone:bb ASan internal: fe Left alloca redzone: ca Right alloca redzone:cb Shadow gap: cc ==1082579==ABORTING -- components: C API files: crashes.tgz messages: 395637 nosy: elmanto priority: normal severity: normal sta
