Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

gh-120298: Fix use-after-free in list_richcompare_impl #120303

Merged
merged 3 commits into from
Jun 11, 2024
Merged

gh-120298: Fix use-after-free in list_richcompare_impl #120303

merged 3 commits into from
Jun 11, 2024

Conversation

sobolevn
Copy link
Member

@sobolevn sobolevn commented Jun 10, 2024 •
edited by bedevere-app bot
Loading

This code does the same thing as the code above it:

cpython/Objects/listobject.c

Lines 3360 to 3364 in 0ae8579

Py_INCREF(vitem);
Py_INCREF(witem);
int k = PyObject_RichCompareBool(vitem, witem, Py_EQ);
Py_DECREF(vitem);
Py_DECREF(witem);

And looks like it gets the job done. I've added tests for these two corner cases.

@sobolevn sobolevn requested a review from rhettinger as a code owner June 10, 2024 07:44
@bedevere-app bedevere-app bot mentioned this pull request Jun 10, 2024
Closed
serhiy-storchaka
serhiy-storchaka reviewed Jun 10, 2024
View reviewed changes
Copy link
Member

@serhiy-storchaka serhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What bisect or deque do with this?

What tests were added for the similar case above?

@serhiy-storchaka
Copy link
Member

The corresponding test is test_equal_operator_modifying_operand in Lib/test/test_list.py (added in 2d5bf56, GH-17734). You can perhaps just add a case there.

@sobolevn
Copy link
Member Author

Yes, @serhiy-storchaka, you are correct. I simplified the reproduction to:

class evil(object):
    def __lt__(self, other):
        other.clear()
        return NotImplemented

a =   [ [ evil()]]

a[0] < a  # crash without this patch

I've updated tests to store this test near test_equal_operator_modifying_operand. Thanks a lot for the advice!

serhiy-storchaka
serhiy-storchaka approved these changes Jun 10, 2024
View reviewed changes
Copy link
Member

@serhiy-storchaka serhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Lib/test/test_list.py Outdated Show resolved Hide resolved
@sobolevn @serhiy-storchaka
Update Lib/test/test_list.py
6c56bc0 
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@sobolevn sobolevn merged commit 141baba into python:main Jun 11, 2024
36 checks passed
@sobolevn sobolevn added needs backport to 3.12 bug and security fixes needs backport to 3.13 bugs and security fixes labels Jun 11, 2024
@miss-islington-app
Copy link

Thanks @sobolevn for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

@miss-islington-app
Copy link

Thanks @sobolevn for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jun 11, 2024
@sobolevn @serhiy-storchaka @miss-islington
pythongh-120298: Fix use-after-free in list_richcompare_impl (pytho…
ade2838 
…nGH-120303)

(cherry picked from commit 141baba)

Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jun 11, 2024
@sobolevn @serhiy-storchaka @miss-islington
pythongh-120298: Fix use-after-free in list_richcompare_impl (pytho…
5a2001c 
…nGH-120303)

(cherry picked from commit 141baba)

Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@bedevere-app
Copy link

bedevere-app bot commented Jun 11, 2024

GH-120339 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 bug and security fixes label Jun 11, 2024
@bedevere-app
Copy link

bedevere-app bot commented Jun 11, 2024

GH-120340 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Jun 11, 2024
@sobolevn sobolevn mentioned this pull request Jun 11, 2024
Closed
sobolevn added a commit that referenced this pull request Jun 11, 2024
@miss-islington @sobolevn @serhiy-storchaka
[3.12] gh-120298: Fix use-after-free in list_richcompare_impl (GH-1…
b884536 
…20303) (#120339)

gh-120298: Fix use-after-free in `list_richcompare_impl` (GH-120303)
(cherry picked from commit 141baba)

Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
sobolevn added a commit that referenced this pull request Jun 11, 2024
@miss-islington @sobolevn @serhiy-storchaka
[3.13] gh-120298: Fix use-after-free in list_richcompare_impl (GH-1…
52225c6 
…20303) (#120340)

gh-120298: Fix use-after-free in `list_richcompare_impl` (GH-120303)
(cherry picked from commit 141baba)

Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
mrahtz pushed a commit to mrahtz/cpython that referenced this pull request Jun 30, 2024
@sobolevn @serhiy-storchaka @mrahtz
pythongh-120298: Fix use-after-free in list_richcompare_impl (pytho…
06a131d 
…n#120303)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
noahbkim pushed a commit to hudson-trading/cpython that referenced this pull request Jul 11, 2024
@sobolevn @serhiy-storchaka @noahbkim
pythongh-120298: Fix use-after-free in list_richcompare_impl (pytho…
2cdbc2f 
…n#120303)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
estyxx pushed a commit to estyxx/cpython that referenced this pull request Jul 17, 2024
@sobolevn @serhiy-storchaka @estyxx
pythongh-120298: Fix use-after-free in list_richcompare_impl (pytho…
baa7cdb 
…n#120303)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@serhiy-storchaka serhiy-storchaka serhiy-storchaka approved these changes

@rhettinger rhettinger Awaiting requested review from rhettinger

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@sobolevn @serhiy-storchaka