8000 [3.8] closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295) by miss-islington · Pull Request #18348 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

[3.8] closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295) #18348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Feb 4, 2020
Merged

[3.8] closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295) #18348

merged 1 commit into from
Feb 4, 2020

Conversation

miss-islington
Copy link
Contributor
@miss-islington miss-islington commented Feb 4, 2020 •
edited by bedevere-bot
Loading

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==220553==  Access not within mapped region at address 0x2A
==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

reader = open ("/dev/zero", "rb")
_void  = reader.read (42)
reader.close ()
reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang philipp.gesang@intra2net.com
(cherry picked from commit cb1c074)

Co-authored-by: Philipp Gesang phg@phi-gamma.net

https://bugs.python.org/issue39510

@phi-gamma @miss-islington
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (py…
12d79db 
…thonGH-18295)

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c074)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
@bedevere-bot bedevere-bot mentioned this pull request Feb 4, 2020
Merged
@miss-islington
Copy link
Contributor Author

@phi-gamma and @benjaminp: Status check is done, and it's a success ✅ .

@miss-islington miss-islington merged commit 30e7693 into python:3.8 Feb 4, 2020
@miss-islington miss-islington deleted the backport-cb1c074-3.8 branch February 4, 2020 21:42
@miss-islington
Copy link
Contributor Author

@phi-gamma and @benjaminp: Status check is done, and it's a success ✅ .

1 similar comment
@miss-islington
Copy link
Contributor Author

@phi-gamma and @benjaminp: Status check is done, and it's a success ✅ .

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@benjaminp benjaminp benjaminp approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@miss-islington @benjaminp @the-knights-who-say-ni @bedevere-bot @phi-gamma
0