8000 [3.6] bpo-9263: _PyObject_Dump() detects freed memory (GH-10061) (GH-10662) by vstinner · Pull Request #10663 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

[3.6] bpo-9263: _PyObject_Dump() detects freed memory (GH-10061) (GH-10662) #10663

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 22, 2018
Merged

[3.6] bpo-9263: _PyObject_Dump() detects freed memory (GH-10061) (GH-10662) #10663

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions Include/object.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -520,6 +520,7 @@ struct _Py_Identifier;
PyAPI_FUNC(int) PyObject_Print(PyObject *, FILE *, int);
PyAPI_FUNC(void) _Py_BreakPoint(void);
PyAPI_FUNC(void) _PyObject_Dump(PyObject *);
PyAPI_FUNC(int) _PyObject_IsFreed(PyObject *);
#endif
PyAPI_FUNC(PyObject *) PyObject_Repr(PyObject *);
PyAPI_FUNC(PyObject *) PyObject_Str(PyObject *);
Expand Down
4 changes: 3 additions & 1 deletion Include/pymem.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,9 @@ PyAPI_FUNC(int) _PyTraceMalloc_Untrack(
PyAPI_FUNC(PyObject*) _PyTraceMalloc_GetTraceback(
_PyTraceMalloc_domain_t domain,
uintptr_t ptr);
#endif /* !Py_LIMITED_API */

PyAPI_FUNC(int) _PyMem_IsFreed(void *ptr, size_t size);
#endif /* !defined(Py_LIMITED_API) */


/* BEWARE:
Expand Down
85 changes: 58 additions & 27 deletions Objects/object.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -422,40 +422,71 @@ _Py_BreakPoint(void)
}


/* Heuristic checking if the object memory has been deallocated.
Rely on the debug hooks on Python memory allocators which fills the memory
with DEADBYTE (0xDB) when memory is deallocated.

The function can be used to prevent segmentation fault on dereferencing
pointers like 0xdbdbdbdbdbdbdbdb. Such pointer is very unlikely to be mapped
in memory. */
int
_PyObject_IsFreed(PyObject *op)
{
uintptr_t ptr = (uintptr_t)op;
if (_PyMem_IsFreed(&ptr, sizeof(ptr))) {
return 1;
}
int freed = _PyMem_IsFreed(&op->ob_type, sizeof(op->ob_type));
/* ignore op->ob_ref: the value can have be modified
by Py_INCREF() and Py_DECREF(). */
#ifdef Py_TRACE_REFS
freed &= _PyMem_IsFreed(&op->_ob_next, sizeof(op->_ob_next));
freed &= _PyMem_IsFreed(&op->_ob_prev, sizeof(op->_ob_prev));
#endif
return freed;
}


/* For debugging convenience. See Misc/gdbinit for some useful gdb hooks */
void
_PyObject_Dump(PyObject* op)
{
if (op == NULL)
fprintf(stderr, "NULL\n");
else {
#ifdef WITH_THREAD
PyGILState_STATE gil;
#endif
PyObject *error_type, *error_value, *error_traceback;
if (op == NULL) {
fprintf(stderr, "<NULL object>\n");
fflush(stderr);
return;
}

fprintf(stderr, "object : ");
#ifdef WITH_THREAD
gil = PyGILState_Ensure();
#endif
if (_PyObject_IsFreed(op)) {
/* It seems like the object memory has been freed:
don't access it to prevent a segmentation fault. */
fprintf(stderr, "<freed object>\n");
return;
}

PyErr_Fetch(&error_type, &error_value, &error_traceback);
(void)PyObject_Print(op, stderr, 0);
PyErr_Restore(error_type, error_value, error_traceback);
PyGILState_STATE gil;
PyObject *error_type, *error_value, *error_traceback;

#ifdef WITH_THREAD
PyGILState_Release(gil);
#endif
/* XXX(twouters) cast refcount to long until %zd is
universally available */
fprintf(stderr, "\n"
"type : %s\n"
"refcount: %ld\n"
"address : %p\n",
Py_TYPE(op)==NULL ? "NULL" : Py_TYPE(op)->tp_name,
(long)op->ob_refcnt,
op);
}
fprintf(stderr, "object : ");
fflush(stderr);
gil = PyGILState_Ensure();

PyErr_Fetch(&error_type, &error_value, &error_traceback);
(void)PyObject_Print(op, stderr, 0);
fflush(stderr);
PyErr_Restore(error_type, error_value, error_traceback);

PyGILState_Release(gil);
/* XXX(twouters) cast refcount to long until %zd is
universally available */
fprintf(stderr, "\n"
"type : %s\n"
"refcount: %ld\n"
"address : %p\n",
Py_TYPE(op)==NULL ? "NULL" : Py_TYPE(op)->tp_name,
(long)op->ob_refcnt,
op);
fflush(stderr);
}

PyObject *
Expand Down
17 changes: 17 additions & 0 deletions Objects/obmalloc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1907,6 +1907,23 @@ _PyMem_DebugRawCalloc(void *ctx, size_t nelem, size_t elsize)
return _PyMem_DebugRawAlloc(1, ctx, nbytes);
}


/* Heuristic checking if the memory has been freed. Rely on the debug hooks on
Python memory allocators which fills the memory with DEADBYTE (0xDB) when
memory is deallocated. */
int
_PyMem_IsFreed(void *ptr, size_t size)
{
unsigned char *bytes = ptr;
for (size_t i=0; i < size; i++) {
if (bytes[i] != DEADBYTE) {
return 0;
}
}
return 1;
}


/* The debug free first checks the 2*SST bytes on each end for sanity (in
particular, that the FORBIDDENBYTEs with the api ID are still intact).
Then fills the original bytes with DEADBYTE.
Expand Down
0