[issue36253] Use after free in ctypes test suite

[Ben Harper]

Ben Harper  added the comment:

Changes merged

--
stage: patch review -> resolved
status: open -> closed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue36253] Use after free in ctypes test suite

[Thomas Wouters]

Thomas Wouters  added the comment:


New changeset a9b6033179b64b985394ad351501089a6a94fc9d by T. Wouters (Ben 
Harper) in branch 'master':
bpo-36253: Remove use after free reference in ctypes test suite (GH-12257)
https://github.com/python/cpython/commit/a9b6033179b64b985394ad351501089a6a94fc9d


--
nosy: +twouters

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue36253] Use after free in ctypes test suite

[Brad Larsen]

Brad Larsen  added the comment:

I was just going to submit a patch for this, then I found this issue.

I can confirm; I see the same use-after-free without the fix.

--
nosy: +blarsen

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue36253] Use after free in ctypes test suite

[Karthikeyan Singaravelan]

Change by Karthikeyan Singaravelan :


--
nosy: +amaury.forgeotdarc, belopolsky, gregory.p.smith, meador.inge

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue36253] Use after free in ctypes test suite

[Ben Harper]

Change by Ben Harper :


--
keywords: +patch
pull_requests: +12243
stage:  -> patch review

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue36253] Use after free in ctypes test suite

[Ben Harper]

New submission from Ben Harper :

When running the builtin test suite with address sanitizer enabled, one of the 
ctypes tests causes a use after free demonstrating the danger of using a 
reference to the inside of a deallocated buffer. This use is detected as an 
error by the address sanitizer and can be replicated with the following; a 
stack trace from the resulting failure is attached.

export ASAN_OPTIONS="detect_leaks=0"
make clean
./configure --with-address-sanitizer --with-pydebug
make
./python Lib/ctypes/test/test_stringptr.py StringPtrTestCase -v

--
components: Tests, ctypes
files: asan StringPtrTestCase.txt
messages: 337583
nosy: btharper
priority: normal
severity: normal
status: open
title: Use after free in ctypes test suite
type: behavior
versions: Python 2.7, Python 3.4, Python 3.5, Python 3.6, Python 3.7, Python 3.8
Added file: https://bugs.python.org/file48202/asan StringPtrTestCase.txt

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com