Skip to content

GH-125789: fix fut._callbacks to always return a copy of callbacks - #125922

Merged
kumaraditya303 merged 2 commits into
python:mainfrom
kumaraditya303:callbacks
Oct 25, 2024
Merged

GH-125789: fix fut._callbacks to always return a copy of callbacks#125922
kumaraditya303 merged 2 commits into
python:mainfrom
kumaraditya303:callbacks

Conversation

@kumaraditya303

@kumaraditya303kumaraditya303 commented Oct 24, 2024•
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Contributor

@bedevere-appbedevere-appBot mentioned this pull request Oct 24, 2024
Closed
@kumaraditya303kumaraditya303 mentioned this pull request Oct 24, 2024
Closed
kumaraditya303
kumaraditya303 commented Oct 24, 2024
View reviewed changes
Comment threadMisc/NEWS.d/next/Library/2024-10-24-14-08-10.gh-issue-125789.eaiAMw.rst Outdated
@kumaraditya303
kumaraditya303 marked this pull request as ready for review October 24, 2024 14:12
@kumaraditya303

kumaraditya303 commented Oct 24, 2024

Copy link
Copy Markdown
ContributorAuthor
== Tests result: SUCCESS ==1 test skipped: test_asyncio.test_unix_events30 tests OK.Total duration: 6 min 8 secTotal tests: run=2,242 skipped=74Total test files: run=31/31 skipped=1Result: SUCCESS

Refleak tested

@kumaraditya303kumaraditya303 added topic-asyncio 3.12 only security fixes 3.13 bugs and security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes and removed 3.12 only security fixes 3.13 bugs and security fixes labels Oct 24, 2024
picnixz
picnixz reviewed Oct 25, 2024
View reviewed changes

@picnixzpicnixz left a comment •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would add a test for that (e.g., one of the test that Nico wrote with the evil classes) to see that the interpreter does not crash anymore.

EDIT: My previous comment was wrong. We can still change the length by just adding new callbacks but we cannot change the type of the items.

Comment threadModules/_asynciomodule.c
Comment threadModules/_asynciomodule.c Outdated
Comment threadLib/test/test_asyncio/test_futures.py
@picnixzpicnixz mentioned this pull request Oct 25, 2024
Closed
@kumaraditya303

kumaraditya303 commented Oct 25, 2024

Copy link
Copy Markdown
ContributorAuthor

I would add a test for that (e.g., one of the test that Nico wrote with the evil classes) to see that the interpreter does not crash anymore.

I think it is more appropriate to add that to your PR which fixes the UAF issues.

@kumaraditya303
kumaraditya303 merged commit cae853e into python:mainOct 25, 2024
@miss-islington-app

miss-islington-appBot commented Oct 25, 2024

Copy link
Copy Markdown

Thanks @kumaraditya303 for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13.
🐍🍒⛏🤖

@kumaraditya303
kumaraditya303 deleted the callbacks branch October 25, 2024 12:49
@miss-islington-app

miss-islington-appBot commented Oct 25, 2024

Copy link
Copy Markdown

Sorry, @kumaraditya303, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker cae853e3b44cd5cb033b904e163c490dd28bc30a 3.13

@miss-islington-app

miss-islington-appBot commented Oct 25, 2024

Copy link
Copy Markdown

Sorry, @kumaraditya303, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker cae853e3b44cd5cb033b904e163c490dd28bc30a 3.12

@bedevere-app

bedevere-appBot commented Oct 25, 2024

Copy link
Copy Markdown

GH-125976 is a backport of this pull request to the 3.13 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.13 bugs and security fixes label Oct 25, 2024
kumaraditya303 added a commit to kumaraditya303/cpython that referenced this pull request Oct 25, 2024
@kumaraditya303
pythonGH-125789: fixfut._callbacksto always return a copy of call…
250ece9
…backs (python#125922)
Fix `asyncio.Future._callbacks` to always return a copy of the internal list of callbacks to avoid mutation from user code affecting the internal state.
(cherry picked from commit cae853e)
kumaraditya303 added a commit that referenced this pull request Oct 25, 2024
@kumaraditya303
[3.13]GH-125789: fixfut._callbacksto always return a copy of cal…
f54e1a2
…lbacks (#125922) (#125976)
GH-125789: fix `fut._callbacks` to always return a copy of callbacks (#125922)
Fix `asyncio.Future._callbacks` to always return a copy of the internal list of callbacks to avoid mutation from user code affecting the internal state.
(cherry picked from commit cae853e)
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 25, 2024
@kumaraditya303@miss-islington
[3.13]pythonGH-125789: fixfut._callbacksto always return a copy …
374dc09
…of callbacks (pythonGH-125922) (pythonGH-125976)
pythonGH-125789: fix `fut._callbacks` to always return a copy of callbacks (pythonGH-125922)
Fix `asyncio.Future._callbacks` to always return a copy of the internal list of callbacks to avoid mutation from user code affecting the internal state.
(cherry picked from commit f54e1a2)
Co-authored-by: Kumar Aditya <kumaraditya@python.org>
(cherry picked from commit cae853e)
@miss-islingtonmiss-islington mentioned this pull request Oct 25, 2024
Merged
kumaraditya303 added a commit that referenced this pull request Oct 25, 2024
@miss-islington@kumaraditya303
[3.12]GH-125789: fixfut._callbacksto always return a copy of cal…
42927f7
…lbacks (GH-125922) (#125977)
GH-125789: fix `fut._callbacks` to always return a copy of callbacks (GH-125922)
Fix `asyncio.Future._callbacks` to always return a copy of the internal list of callbacks to avoid mutation from user code affecting the internal state.
Co-authored-by: Kumar Aditya <kumaraditya@python.org>
(cherry picked from commit cae853e)
ebonnal pushed a commit to ebonnal/cpython that referenced this pull request Jan 12, 2025
@kumaraditya303@ebonnal
pythonGH-125789: fixfut._callbacksto always return a copy of call…
a30843f
…backs (python#125922)
Fix `asyncio.Future._callbacks` to always return a copy of the internal list of callbacks to avoid mutation from user code affecting the internal state.
@hugovkhugovk removed the needs backport to 3.12 only security fixes label Feb 26, 2025
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@picnixzpicnixzpicnixz left review comments
@1st11st1Awaiting requested review from 1st11st1 is a code owner
@asvetlovasvetlovAwaiting requested review from asvetlovasvetlov is a code owner
@gvanrossumgvanrossumAwaiting requested review from gvanrossum
@willingcwillingcAwaiting requested review from willingcwillingc is a code owner

Assignees

@kumaraditya303kumaraditya303

Labels

topic-asyncio

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@kumaraditya303@picnixz@hugovk