10000 bpo-9263: _PyObject_Dump() detects freed memory (GH-10061) · python/cpython@82af0b6 · GitHub
[go: up one dir, main page]
Skip to content

Commit 82af0b6

Browse files
vstinnervstinner
authored
bpo-9263: _PyObject_Dump() detects freed memory (GH-10061)
_PyObject_Dump() now uses an heuristic to check if the object memory has been freed: log "<freed object>" in that case. The heuristic rely on the debug hooks on Python memory allocators which fills the memory with DEADBYTE (0xDB) when memory is deallocated. Use PYTHONMALLOC=debug to always enable these debug hooks.
1 parent 96f2c73 commit 82af0b6

File tree

4 files changed

+75
-24
lines changed

4 files changed

+75
-24
lines changed

‎Include/object.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -521,6 +521,7 @@ struct _Py_Identifier;
521521
PyAPI_FUNC(int) PyObject_Print(PyObject *, FILE *, int);
522522
PyAPI_FUNC(void) _Py_BreakPoint(void);
523523
PyAPI_FUNC(void) _PyObject_Dump(PyObject *);
524+
PyAPI_FUNC(int) _PyObject_IsFreed(PyObject *);
524525
#endif
525526
PyAPI_FUNC(PyObject *) PyObject_Repr(PyObject *);
526527
PyAPI_FUNC(PyObject *) PyObject_Str(PyObject *);

‎Include/pymem.h

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,9 @@ PyAPI_FUNC(int) PyTraceMalloc_Untrack(
5555
PyAPI_FUNC(PyObject*) _PyTraceMalloc_GetTraceback(
5656
unsigned int domain,
5757
uintptr_t ptr);
58-
#endif /* !Py_LIMITED_API */
58+
59+
PyAPI_FUNC(int) _PyMem_IsFreed(void *ptr, size_t size);
60+
#endif /* !defined(Py_LIMITED_API) */
5961

6062

6163
/* BEWARE:

‎Objects/object.c

Lines changed: 55 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -410,34 +410,66 @@ _Py_BreakPoint(void)
410410
}
411411

412412

413+
/* Heuristic checking if the object memory has been deallocated.
414+
Rely on the debug hooks on Python memory allocators which fills the memory
415+
with DEADBYTE (0xDB) when memory is deallocated.
416+
417+
The function can be used to prevent segmentation fault on dereferencing
418+
pointers like 0xdbdbdbdbdbdbdbdb. Such pointer is very unlikely to be mapped
419+
in memory. */
420+
int
421+
_PyObject_IsFreed(PyObject *op)
422+
{
423+
int freed = _PyMem_IsFreed(&op->ob_type, sizeof(op->ob_type));
424+
/* ignore op->ob_ref: the value can have be modified
425+
by Py_INCREF() and Py_DECREF(). */
426+
#ifdef Py_TRACE_REFS
427+
freed &= _PyMem_IsFreed(&op->_ob_next, sizeof(op->_ob_next));
428+
freed &= _PyMem_IsFreed(&op->_ob_prev, sizeof(op->_ob_prev));
429+
#endif
430+
return freed;
431+
}
432+
433+
413434
/* For debugging convenience. See Misc/gdbinit for some useful gdb hooks */
414435
void
415436
_PyObject_Dump(PyObject* op)
416437
{
417-
if (op == NULL)
418-
fprintf(stderr, "NULL\n");
419-
else {
420-
PyGILState_STATE gil;
421-
PyObject *error_type, *error_value, *error_traceback;
422-
423-
fprintf(stderr, "object : ");
424-
gil = PyGILState_Ensure();
425-
426-
PyErr_Fetch(&error_type, &error_value, &error_traceback);
427-
(void)PyObject_Print(op, stderr, 0);
428-
PyErr_Restore(error_type, error_value, error_traceback);
429-
430-
PyGILState_Release(gil);
431-
/* XXX(twouters) cast refcount to long until %zd is
432-
universally available */
433-
fprintf(stderr, "\n"
434-
"type : %s\n"
435-
"refcount: %ld\n"
436-
"address : %p\n",
437-
Py_TYPE(op)==NULL ? "NULL" : Py_TYPE(op)->tp_name,
438-
(long)op->ob_refcnt,
439-
op);
438+
if (op == NULL) {
439+
fprintf(stderr, "<NULL object>\n");
440+
fflush(stderr);
441+
return;
442+
}
443+
444+
if (_PyObject_IsFreed(op)) {
445+
/* It seems like the object memory has been freed:
446+
don't access it to prevent a segmentation fault. */
447+
fprintf(stderr, "<freed object>\n");
440448
}
449+
450+
PyGILState_STATE gil;
451+
PyObject *error_type, *error_value, *error_traceback;
452+
453+
fprintf(stderr, "object : ");
454+
fflush(stderr);
455+
gil = PyGILState_Ensure();
456+
457+
PyErr_Fetch(&error_type, &error_value, &error_traceback);
458+
(void)PyObject_Print(op, stderr, 0);
459+
fflush(stderr);
460+
PyErr_Restore(error_type, error_value, error_traceback);
461+
462+
PyGILState_Release(gil);
463+
/* XXX(twouters) cast refcount to long until %zd is
464+
universally available */
465+
fprintf(stderr, "\n"
466+
"type : %s\n"
467+
"refcount: %ld\n"
468+
"address : %p\n",
469+
Py_TYPE(op)==NULL ? "NULL" : Py_TYPE(op)->tp_name,
470+
(long)op->ob_refcnt,
471+
op);
472+
fflush(stderr);
441473
}
442474

443475
PyObject *

‎Objects/obmalloc.c

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2033,6 +2033,22 @@ _PyMem_DebugRawCalloc(void *ctx, size_t nelem, size_t elsize)
20332033
}
20342034

20352035

2036+
/* Heuristic checking if the memory has been freed. Rely on the debug hooks on
2037+
Python memory allocators which fills the memory with DEADBYTE (0xDB) when
2038+
memory is deallocated. */
2039+
int
2040+
_PyMem_IsFreed(void *ptr, size_t size)
2041+
{
2042+
unsigned char *bytes = ptr;
2043+
for (size_t i=0; i < size; i++) {
2044+
if (bytes[i] != DEADBYTE) {
2045+
return 0;
2046+
}
2047+
}
2048+
return 1;
2049+
}
2050+
2051+
20362052
/* The debug free first checks the 2*SST bytes on each end for sanity (in
20372053
particular, that the FORBIDDENBYTEs with the api ID are still intact).
20382054
Then fills the original bytes with DEADBYTE.

0 commit comments

Comments
 (0)
0