[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Amaury Forgeot d'Arc <[EMAIL PROTECTED]> added the comment: Committed r66963. -- resolution: accepted -> fixed status: open -> closed ___ Python tracker <[EMAIL PROTECTED]> ___ ___

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Barry A. Warsaw <[EMAIL PROTECTED]> added the comment: Amaury, please apply the patch and close the issue. Thanks! -- priority: deferred blocker -> release blocker ___ Python tracker <[EMAIL PROTECTED]>

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Amaury Forgeot d'Arc <[EMAIL PROTECTED]> added the comment: The patch is fine. -- nosy: +amaury.forgeotdarc resolution: -> accepted ___ Python tracker <[EMAIL PROTECTED]> ___

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Alexandre Vassalotti <[EMAIL PROTECTED]> added the comment: Oops. I must have been quite tired when I submitted that. Here's the patch for the fix and the test case. -- keywords: +patch Added file: http://bugs.python.org/file11814/issue3664_fix.diff

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Barry A. Warsaw <[EMAIL PROTECTED]> added the comment: Rather than attach a full _pickle.c file, please generate a unified diff with just your changes. The patch should include a test for the crashing condition. If you can upload that I'll try to accept it for rc3. Deferring for now.

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Alexandre Vassalotti <[EMAIL PROTECTED]> added the comment: Here's the fix. The added check in Pickler_dump should prevent any segfaults due to __init__() errors. I also added the check proposed by Christian as a safe-guard in case a core developer adds a new method that doesn't check if the ob

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Changes by Jesús Cea Avión <[EMAIL PROTECTED]>: -- nosy: +jcea ___ Python tracker <[EMAIL PROTECTED]> ___ ___ Python-bugs-list mailing l

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Alexandre Vassalotti <[EMAIL PROTECTED]> added the comment: I will try to find time next weekend to fix this (and other pickle blockers). ___ Python tracker <[EMAIL PROTECTED]> ___ ___

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Changes by Alexandre Vassalotti <[EMAIL PROTECTED]>: ___ Python tracker <[EMAIL PROTECTED]> ___ ___ Python-bugs-list mailing list Unsubscribe: h

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Alexandre Vassalotti <[EMAIL PROTECTED]> added the comment: I will try to time next weekend to fix this (and other pickle blockers). ___ Python tracker <[EMAIL PROTECTED]> ___ _

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Changes by Barry A. Warsaw <[EMAIL PROTECTED]>: -- priority: deferred blocker -> release blocker ___ Python tracker <[EMAIL PROTECTED]> ___

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Changes by Barry A. Warsaw <[EMAIL PROTECTED]>: -- priority: release blocker -> deferred blocker ___ Python tracker <[EMAIL PROTECTED]> ___

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Changes by Barry A. Warsaw <[EMAIL PROTECTED]>: -- priority: deferred blocker -> release blocker ___ Python tracker <[EMAIL PROTECTED]> ___

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Changes by Benjamin Peterson <[EMAIL PROTECTED]>: -- priority: release blocker -> deferred blocker ___ Python tracker <[EMAIL PROTECTED]> ___ __

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Alexandre Vassalotti <[EMAIL PROTECTED]> added the comment: Unpickler looks safe as Unpickler_load() checks if Unpickler was properly initialized. And only Pickler_dump is vulnerable right now (new methods, if any, exposed for issue3385 will have to take into account this vulnerability). ___

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Alexandre Vassalotti <[EMAIL PROTECTED]> added the comment: Oh, that's nasty. Recalling __init__ with bad arguments breaks the internal invariants as it clears the Pickler's content before parsing the arguments. I suspect that Unpickler is vulnerable too. Adding a NULL check in pickler_write wil

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Christian Heimes <[EMAIL PROTECTED]> added the comment: pickler_write() has no check for self->write_buf == NULL Suggested patch: === --- Modules/_pickle.c (Revision 66010) +++ Modules/_pickle.c (Arbeitskopie) @@ -421,6 +421,10

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

Changes by Benjamin Peterson <[EMAIL PROTECTED]>: -- assignee: -> alexandre.vassalotti nosy: +alexandre.vassalotti priority: -> release blocker ___ Python tracker <[EMAIL PROTECTED]> ___

[issue3664] Pickler.dump from a badly initialized Pickler segfaults

New submission from Daniel Diniz <[EMAIL PROTECTED]>: This script segfaults: ## import _pickle obj = _pickle.Pickler(open("/bin/ls")) #can be open(__file__) for scripts try: obj.__init__('pouet', 87) except Exception as err: pass obj.dump(0) ### [Switching to Thread -1210775360 (LWP 19096)] 0x