8000 bpo-39510: Fix use-after-free in BufferedReader.readinto() by phi-gamma · Pull Request #18295 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

bpo-39510: Fix use-after-free in BufferedReader.readinto() #18295

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Feb 4, 2020
Merged

bpo-39510: Fix use-after-free in BufferedReader.readinto() #18295

merged 2 commits into from
Feb 4, 2020

Conversation

phi-gamma
Copy link
Contributor
@phi-gamma phi-gamma commented Jan 31, 2020 •
edited by bedevere-bot
Loading

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==220553==  Access not within mapped region at address 0x2A
==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

reader = open ("/dev/zero", "rb")
_void  = reader.read (42)
reader.close ()
reader.readinto (bytearray (42)) ### BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang philipp.gesang@intra2net.com

https://bugs.python.org/issue39510

@the-knights-who-say-ni
Copy link

Hello, and thanks for your contribution!

I'm a bot set up to make sure that the project can legally accept this contribution by verifying everyone involved has signed the PSF contributor agreement (CLA).

CLA Missing

Our records indicate the following people have not signed the CLA:

@phi-gamma

For legal reasons we need all the people listed to sign the CLA before we can look at your contribution. Please follow the steps outlined in the CPython devguide to rectify this issue.

If you have recently signed the CLA, please wait at least one business day
before our records are updated.

You can check yourself to see if the CLA has been received.

Thanks again for the contribution, we look forward to reviewing it!

@benjaminp
Copy link
Contributor

Thanks for the PR; please add a brief NEWS note.

@phi-gamma
Fix use-after-free in BufferedReader.readinto()
3328533 
When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) ### BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
@benjaminp benjaminp merged commit cb1c074 into python:master Feb 4, 2020
@miss-islington
Copy link
Contributor

Thanks @phi-gamma for the PR, and @benjaminp for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7, 3.8.
🐍🍒⛏🤖

@bedevere-bot
Copy link

GH-18348 is a backport of this pull request to the 3.8 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 4, 2020
@phi-gamma @miss-islington
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (py…
12d79db 
…thonGH-18295)

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c074)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
@bedevere-bot
Copy link

GH-18349 is a backport of this pull request to the 3.7 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 4, 2020
@phi-gamma @miss-islington
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (py…
47bce0a 
…thonGH-18295)

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c074)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
@bedevere-bot
Copy link

GH-18350 is a backport of this pull request to the 3.6 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 4, 2020
@phi-gamma @miss-islington
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (py…
697f519 
…thonGH-18295)

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c074)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
miss-islington added a commit that referenced this pull request Feb 4, 2020
@miss-islington @phi-gamma
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH…
30e7693 
…-18295)

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c074)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
miss-islington added a commit that referenced this pull request Feb 4, 2020
@miss-islington @phi-gamma
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH…
97d2a98 
…-18295)

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
68F8

    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c074)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@phi-gamma @the-knights-who-say-ni @benjaminp @miss-islington @bedevere-bot
0