New submission from alessandro mantovani <mantovanialessandro1...@gmail.com>:
Use After Free in python3.11 (commit 2ab27c4af4ddf752) Steps to reproduce: 1) ./configure --with-address-sanitizer 2) make 3) ./python <input> I attach some of the input that lead to the undefined behavior For the complete description you can find the asan report here: ==1082579==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000045a40 at pc 0x000000735155 bp 0x7fffffffbed0 sp 0x7fffffffbec8 READ of size 8 at 0x626000045a40 thread T0 #0 0x735154 in ascii_decode /home/elmanto/ddg/other_targets/cpython/Objects/unicodeobject.c:5091:28 #1 0x735154 in unicode_decode_utf8 /home/elmanto/ddg/other_targets/cpython/Objects/unicodeobject.c:5158:10 #2 0xc98381 in syntaxerror /home/elmanto/ddg/other_targets/cpython/Parser/tokenizer.c:1087:15 #3 0xc8d616 in tok_get /home/elmanto/ddg/other_targets/cpython/Parser/tokenizer.c #4 0xc8696b in PyTokenizer_Get /home/elmanto/ddg/other_targets/cpython/Parser/tokenizer.c:1884:18 #5 0xead74c in _PyPegen_check_tokenizer_errors /home/elmanto/ddg/other_targets/cpython/Parser/pegen.c:1260:17 #6 0xead74c in _PyPegen_run_parser /home/elmanto/ddg/other_targets/cpython/Parser/pegen.c:1292:17 #7 0xeaebca in _PyPegen_run_parser_from_file_pointer /home/elmanto/ddg/other_targets/cpython/Parser/pegen.c:1377:14 #8 0xc83a91 in _PyParser_ASTFromFile /home/elmanto/ddg/other_targets/cpython/Parser/peg_api.c:26:12 #9 0xa0abf1 in pyrun_file /home/elmanto/ddg/other_targets/cpython/Python/pythonrun.c:1197:11 #10 0xa0abf1 in _PyRun_SimpleFileObject /home/elmanto/ddg/other_targets/cpython/Python/pythonrun.c:455:13 #11 0xa09b19 in _PyRun_AnyFileObject /home/elmanto/ddg/other_targets/cpython/Python/pythonrun.c:89:15 #12 0x4dfe94 in pymain_run_file_obj /home/elmanto/ddg/other_targets/cpython/Modules/main.c:353:15 #13 0x4dfe94 in pymain_run_file /home/elmanto/ddg/other_targets/cpython/Modules/main.c:372:15 #14 0x4dfe94 in pymain_run_python /home/elmanto/ddg/other_targets/cpython/Modules/main.c:587:21 #15 0x4dfe94 in Py_RunMain /home/elmanto/ddg/other_targets/cpython/Modules/main.c:666:5 #16 0x4e154c in pymain_main /home/elmanto/ddg/other_targets/cpython/Modules/main.c:696:12 #17 0x4e1874 in Py_BytesMain /home/elmanto/ddg/other_targets/cpython/Modules/main.c:720:12 #18 0x7ffff7a2e0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16 #19 0x43501d in _start (/home/elmanto/ddg/other_targets/cpython/python+0x43501d) 0x626000045a40 is located 2368 bytes inside of 10560-byte region [0x626000045100,0x626000047a40) freed by thread T0 here: #0 0x4ada79 in realloc (/home/elmanto/ddg/other_targets/cpython/python+0x4ada79) #1 0x638e61 in PyMem_RawRealloc /home/elmanto/ddg/other_targets/cpython/Objects/obmalloc.c:602:12 #2 0x638e61 in _PyObject_Realloc /home/elmanto/ddg/other_targets/cpython/Objects/obmalloc.c:2339:12 previously allocated by thread T0 here: #0 0x4ada79 in realloc (/home/elmanto/ddg/other_targets/cpython/python+0x4ada79) #1 0x638e61 in PyMem_RawRealloc /home/elmanto/ddg/other_targets/cpython/Objects/obmalloc.c:602:12 #2 0x638e61 in _PyObject_Realloc /home/elmanto/ddg/other_targets/cpython/Objects/obmalloc.c:2339:12 SUMMARY: AddressSanitizer: heap-use-after-free /home/elmanto/ddg/other_targets/cpython/Objects/unicodeobject.c:5091:28 in ascii_decode Shadow bytes around the buggy address: 0x0c4c80000af0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c80000b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c80000b10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c80000b20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c80000b30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c4c80000b40: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd 0x0c4c80000b50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c80000b60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c80000b70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c80000b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4c80000b90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==1082579==ABORTING ---------- components: C API files: crashes.tgz messages: 395637 nosy: elmanto priority: normal severity: normal status: open title: Use-After-Free type: security versions: Python 3.11 Added file: https://bugs.python.org/file50105/crashes.tgz _______________________________________ Python tracker <rep...@bugs.python.org> <https://bugs.python.org/issue44396> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com