[issue24097] Use after free in PyObject_GetState

[Roundup Robot]

Roundup Robot added the comment:

New changeset eed36e19f8b8 by Serhiy Storchaka in branch '3.4':
Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside
https://hg.python.org/cpython/rev/eed36e19f8b8

New changeset 99839a1c9c6d by Serhiy Storchaka in branch '3.5':
Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside
https://hg.python.org/cpython/rev/99839a1c9c6d

New changeset 502465d22522 by Serhiy Storchaka in branch 'default':
Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside
https://hg.python.org/cpython/rev/502465d22522

New changeset 4a201d0d4d1e by Serhiy Storchaka in branch '2.7':
Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside
https://hg.python.org/cpython/rev/4a201d0d4d1e

--
nosy: +python-dev

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Serhiy Storchaka]

Changes by Serhiy Storchaka :


--
resolution:  -> fixed
stage: patch review -> resolved
status: open -> closed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Serhiy Storchaka]

Changes by Serhiy Storchaka :


--
assignee: pitrou -> serhiy.storchaka

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Serhiy Storchaka]

Serhiy Storchaka added the comment:

In 2.7 the test doesn't crash, but __reduce__ produces invalid recursive 
structure.

--
versions: +Python 2.7

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Serhiy Storchaka]

Serhiy Storchaka added the comment:

Here is backported to 2.7 patch with test. Can you review the test and commit 
the patch Antoine?

--
assignee: serhiy.storchaka -> pitrou
Added file: 
http://bugs.python.org/file40936/getstate_borrowed_ref_with_test-2.7.patch

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Serhiy Storchaka]

Changes by Serhiy Storchaka :


Added file: 
http://bugs.python.org/file40937/getstate_borrowed_ref_with_test-3.4.patch

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Serhiy Storchaka]

Serhiy Storchaka added the comment:

Here is a test for this issue.

--
stage: test needed - patch review
Added file: http://bugs.python.org/file39953/test_issue24097.patch

___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24097
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[paul]

paul added the comment:

ping

--

___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24097
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Antoine Pitrou]

Changes by Antoine Pitrou pit...@free.fr:


--
keywords: +patch
Added file: http://bugs.python.org/file39842/getstate_borrowed_ref.patch

___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24097
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Antoine Pitrou]

Antoine Pitrou added the comment:

Thanks for the report. Here is a patch.

--

___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24097
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Antoine Pitrou]

Changes by Antoine Pitrou pit...@free.fr:


--
stage: needs patch - patch review
versions: +Python 3.6

___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24097
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Serhiy Storchaka]

Changes by Serhiy Storchaka storch...@gmail.com:


--
assignee:  - serhiy.storchaka

___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24097
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Serhiy Storchaka]

Serhiy Storchaka added the comment:

The fix LGTM.

It would be nice to add a test.

--
assignee: serhiy.storchaka - pitrou
stage: patch review - test needed

___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24097
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Benjamin Peterson]

Benjamin Peterson added the comment:

lgtm

--
nosy: +benjamin.peterson

___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24097
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Arfrever Frehtes Taifersar Arahesis]

Changes by Arfrever Frehtes Taifersar Arahesis arfrever@gmail.com:


--
nosy: +Arfrever

___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24097
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Serhiy Storchaka]

Changes by Serhiy Storchaka storch...@gmail.com:


--
nosy: +alexandre.vassalotti, pitrou, serhiy.storchaka

___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24097
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[Christian Heimes]

Changes by Christian Heimes li...@cheimes.de:


--
components: +Extension Modules
stage:  - needs patch
versions: +Python 3.5

___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24097
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue24097] Use after free in PyObject_GetState

[paul]

New submission from paul:

# Program received signal SIGSEGV, Segmentation fault.
# 0x080f27b2 in PyObject_Hash (v=unknown at remote 0x405720e4) at 
Objects/object.c:746
# 746 if (tp-tp_hash != NULL)
# (gdb) bt
# #0  0x080f27b2 in PyObject_Hash (v=unknown at remote 0x405720e4) at 
Objects/object.c:746
# #1  0x080e1717 in PyDict_SetItem (op={}, key=unknown at remote 0x405720e4, 
value=None) at Objects/dictobject.c:1201
# #2  0x0810e8a0 in _PyObject_GetState (obj=Y at remote 0x405731bc) at 
Objects/typeobject.c:3657
# #3  0x081100e9 in reduce_2 (obj=Y at remote 0x405731bc) at 
Objects/typeobject.c:3949
# #4  0x08110551 in _common_reduce (self=Y at remote 0x405731bc, proto=2) at 
Objects/typeobject.c:4012
# #5  0x08110641 in object_reduce (self=Y at remote 0x405731bc, args=(2,)) at 
Objects/typeobject.c:4032
# 
# (gdb) frame 2
# #2  0x0810e8a0 in _PyObject_GetState (obj=Y at remote 0x405731bc) at 
Objects/typeobject.c:3657
# 3657int err = PyDict_SetItem(slots, name, value);
# (gdb) print *name
# $1 = {_ob_next = 0xdbdbdbdb, _ob_prev = 0xdbdbdbdb, ob_refcnt = -606348325, 
ob_type = 0xdbdbdbdb}
# 
# name is freed inside __getattr__ and is later used by PyDict_SetItem.

--
files: poc_getstate.py
messages: 242313
nosy: pkt
priority: normal
severity: normal
status: open
title: Use after free in PyObject_GetState
type: crash
versions: Python 3.4
Added file: http://bugs.python.org/file39248/poc_getstate.py

___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24097
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com