[issue30058] Buffer overflow in kqueue.control()

[Serhiy Storchaka]

Change by Serhiy Storchaka :


--
resolution:  -> fixed
stage: patch review -> resolved
status: open -> closed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue30058] Buffer overflow in kqueue.control()

[Serhiy Storchaka]

Serhiy Storchaka  added the comment:


New changeset 9aa60245a0ff929e528b4521da7af20dacd4145b by Serhiy Storchaka in 
branch '2.7':
[2.7] bpo-30058: Fixed buffer overflow in select.kqueue.control(). (GH-1095). 
(#3976)
https://github.com/python/cpython/commit/9aa60245a0ff929e528b4521da7af20dacd4145b


--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue30058] Buffer overflow in kqueue.control()

[Serhiy Storchaka]

Change by Serhiy Storchaka :


--
pull_requests: +3952

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue30058] Buffer overflow in kqueue.control()

[Serhiy Storchaka]

Serhiy Storchaka  added the comment:


New changeset c923da188bc055e4f3001a6daf1caf54f2b10e40 by Serhiy Storchaka 
(Miss Islington (bot)) in branch '3.6':
[3.6] bpo-30058: Fixed buffer overflow in select.kqueue.control(). (GH-1095) 
(#3973)
https://github.com/python/cpython/commit/c923da188bc055e4f3001a6daf1caf54f2b10e40


--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue30058] Buffer overflow in kqueue.control()

[Roundup Robot]

Change by Roundup Robot :


--
keywords: +patch
pull_requests: +3951

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue30058] Buffer overflow in kqueue.control()

[Serhiy Storchaka]

Serhiy Storchaka  added the comment:


New changeset de072100775cc29e6cd93a75466cecbd1086f258 by Serhiy Storchaka in 
branch 'master':
bpo-30058: Fixed buffer overflow in select.kqueue.control(). (#1095)
https://github.com/python/cpython/commit/de072100775cc29e6cd93a75466cecbd1086f258


--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue30058] Buffer overflow in kqueue.control()

[Serhiy Storchaka]

Serhiy Storchaka  added the comment:

I have tested it on FreeBSD, found and fixed one bug.

--
assignee:  -> serhiy.storchaka
versions:  -Python 3.5

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue30058] Buffer overflow in kqueue.control()

[Serhiy Storchaka]

Serhiy Storchaka added the comment:

Proposed patch presumably fixes the issue. But since this is *BSD specific I 
can't even check that it is compiled.

--
stage:  -> patch review

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue30058] Buffer overflow in kqueue.control()

[Serhiy Storchaka]

Changes by Serhiy Storchaka :


--
pull_requests: +1237

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue30058] Buffer overflow in kqueue.control()

[Serhiy Storchaka]

New submission from Serhiy Storchaka:

The first parameter of kqueue.control() is documented as an iterable. But 
actually it should have a length. kqueue.control() uses PyObject_Size() for 
allocating an array and PyObject_GetIter()+PyIter_Next() for iterating kevent 
objects and filling the array. If the length and the iterator are not 
consistent this can lead to writing past the end of the array.

--
components: Extension Modules, FreeBSD
messages: 291563
nosy: koobs, serhiy.storchaka
priority: normal
severity: normal
status: open
title: Buffer overflow in kqueue.control()
type: crash
versions: Python 2.7, Python 3.5, Python 3.6, Python 3.7

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com