gh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing by colorfulappl · Pull Request #99890 · python/cpython

colorfulappl · 2022-11-30T09:07:29Z

In the family of _PyArg_Parse functions, pointers can be passed in as arguments to store the parsed PyArgs.
If a pointer is assigned to newly allocated memory and the memory is freed as a result of an error while parsing the subsequent PyArgs, the pointer should be set to NULL; otherwise, it leaks the freed memory.

Issue: Double-free in Argument Clinic str_converter generated code #99240

colorfulappl · 2022-11-30T09:11:32Z

This fix corresponds to my comment in #99240

If function _PyArg_ParseStack parses failed, assign all the parsed arguments to "NULL" after they are freed, this should be done in _PyArg_ParseStack.

kumaraditya303 · 2022-12-14T10:35:29Z

Can you add a test for this?

kumaraditya303

LGTM

miss-islington · 2022-12-17T06:40:54Z

Thanks @colorfulappl for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11.
🐍🍒⛏🤖

miss-islington · 2022-12-17T06:42:15Z

Sorry, @colorfulappl and @kumaraditya303, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker a6f82f1fc68cb24e2d88d35fde4cfb663213a744 3.11

miss-islington · 2022-12-17T06:42:20Z

Sorry, @colorfulappl and @kumaraditya303, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker a6f82f1fc68cb24e2d88d35fde4cfb663213a744 3.10

kumaraditya303 · 2022-12-17T06:43:19Z

@colorfulappl Can you create the backport PRs? Thanks

…d in argument parsing (python#99890) Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com> Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>

* origin/main: (1306 commits) Correct CVE-2020-10735 documentation (python#100306) pythongh-100272: Fix JSON serialization of OrderedDict (pythonGH-100273) pythongh-93649: Split tracemalloc tests from _testcapimodule.c (python#99551) Docs: Use `PY_VERSION_HEX` for version comparison (python#100179) pythongh-97909: Fix markup for `PyMethodDef` members (python#100089) pythongh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing (python#99890) pythongh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing (python#99890) pythonGH-98831: Add DECREF_INPUTS(), expanding to DECREF() each stack input (python#100205) pythongh-78707: deprecate passing >1 argument to `PurePath.[is_]relative_to()` (pythonGH-94469) pythongh-99540: Constant hash for _PyNone_Type to aid reproducibility (pythonGH-99541) pythongh-100039: enhance __signature__ to work with str and callables (pythonGH-100168) pythongh-99830: asyncio: Document returns of remove_{reader,writer} (python#100302) "Compound statement" docs: Fix with-statement step indexing (python#100286) pythonGH-90043: Handle NaNs in COMPARE_OP_FLOAT_JUMP (pythonGH-100278) Improve stats presentation for calls. (pythonGH-100274) Better stats for `LOAD_ATTR` and `STORE_ATTR` (pythonGH-100295) pythongh-81057: Move the Cached Parser Dummy Name to _PyRuntimeState (python#100277) Document that zipfile's pwd parameter is a `bytes` object (python#100209) pythongh-99767: mark `PyTypeObject.tp_watched` as internal use only in table (python#100271) Fix typo in introduction.rst (python#100266) ...

colorfulappl · 2022-12-19T02:07:24Z

@colorfulappl Can you create the backport PRs?

Sure. I will do this later.

* main: pythongh-89727: Fix os.walk RecursionError on deep trees (python#99803) Docs: Don't upload CI artifacts (python#100330) pythongh-94912: Added marker for non-standard coroutine function detection (python#99247) Correct CVE-2020-10735 documentation (python#100306) pythongh-100272: Fix JSON serialization of OrderedDict (pythonGH-100273) pythongh-93649: Split tracemalloc tests from _testcapimodule.c (python#99551) Docs: Use `PY_VERSION_HEX` for version comparison (python#100179) pythongh-97909: Fix markup for `PyMethodDef` members (python#100089) pythongh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing (python#99890) pythongh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing (python#99890) pythonGH-98831: Add DECREF_INPUTS(), expanding to DECREF() each stack input (python#100205) pythongh-78707: deprecate passing >1 argument to `PurePath.[is_]relative_to()` (pythonGH-94469)

…is freed in argument parsing (pythonGH-99890) (cherry picked from commit efbb1eb) Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com> Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>

bedevere-bot · 2022-12-21T02:38:16Z

GH-100385 is a backport of this pull request to the 3.11 branch.

…is freed in argument parsing (pythonGH-99890) (cherry picked from commit efbb1eb) Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com> Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>

bedevere-bot · 2022-12-21T02:39:30Z

GH-100386 is a backport of this pull request to the 3.10 branch.

…ed in argument parsing (GH-99890) (#100385) (cherry picked from commit efbb1eb) Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com> Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>

…ed in argument parsing (GH-99890) (#100386) (cherry picked from commit efbb1eb) Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com> Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>

…d in argument parsing (python#99890) Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com> Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>

colorfulappl added 2 commits November 30, 2022 16:42

Reset pointer to NULL when memory is freed
9271e85

Add news
eba62a3

bedevere-bot mentioned this pull request Nov 30, 2022
Double-free in Argument Clinic str_converter generated code #99240
Closed

bedevere-bot added the awaiting review label Nov 30, 2022

kumaraditya303 reviewed Dec 13, 2022
View reviewed changes

Comment threadPython/getargs.c Outdated

Remove unnecessary null-check
39895ee

python deleted a comment from netlifyBotDec 14, 2022

Add test
ef866b2

kumaraditya303 reviewed Dec 15, 2022
View reviewed changes

Comment threadModules/_testcapi/getargs.c Outdated

carljm changed the title ~~gh-99240: Reset pointer to NULL then the pointed memory is freed in argument parsing~~gh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsingDec 15, 2022

Fix an error
357576b

kumaraditya303 reviewed Dec 16, 2022
View reviewed changes

Comment threadModules/_testcapi/getargs.c Outdated

PyMem_FREE -> PyMem_Free
0424701

kumaraditya303 reviewed Dec 16, 2022
View reviewed changes

Comment threadModules/_testcapi/getargs.c Outdated

kumaraditya303 added 2 commits December 16, 2022 16:26

Update Modules/_testcapi/getargs.c
4a7d386

Merge branch 'main' into clear_freed_pointer
1d3b069

kumaraditya303 self-assigned this Dec 16, 2022

kumaraditya303 approved these changes Dec 16, 2022
View reviewed changes

bedevere-bot added awaiting merge and removed awaiting review labels Dec 16, 2022

kumaraditya303 added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Dec 16, 2022

kumaraditya303 requested a review from erlend-aasland December 16, 2022 11:03

erlend-aasland approved these changes Dec 16, 2022
View reviewed changes

Comment threadModules/_testcapi/getargs.c Outdated

Update Modules/_testcapi/getargs.c
6e9744c

kumaraditya303 approved these changes Dec 17, 2022
View reviewed changes

kumaraditya303 merged commit a6f82f1 into python:mainDec 17, 2022

bedevere-bot removed the awaiting merge label Dec 17, 2022

bedevere-bot removed the needs backport to 3.11 only security fixes label Dec 21, 2022

bedevere-bot removed the needs backport to 3.10 only security fixes label Dec 21, 2022

Navigation Menu

Uh oh!

Uh oh!

gh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing - #99890

gh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing#99890
kumaraditya303 merged 9 commits into
python:mainfrom
colorfulappl:clear_freed_pointer

colorfulappl commented Nov 30, 2022•
edited by bedevere-bot
Loading

Uh oh!

colorfulappl commented Nov 30, 2022•
edited
Loading

Uh oh!

Uh oh!

kumaraditya303 commented Dec 14, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kumaraditya303 left a comment

Uh oh!

Uh oh!

miss-islington commented Dec 17, 2022

Uh oh!

miss-islington commented Dec 17, 2022

Uh oh!

miss-islington commented Dec 17, 2022

Uh oh!

kumaraditya303 commented Dec 17, 2022

Uh oh!

colorfulappl commented Dec 19, 2022

Uh oh!

bedevere-bot commented Dec 21, 2022

Uh oh!

bedevere-bot commented Dec 21, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Uh oh!

Conversation

colorfulappl commented Nov 30, 2022• edited by bedevere-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

colorfulappl commented Nov 30, 2022• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

kumaraditya303 commented Dec 14, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kumaraditya303 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

miss-islington commented Dec 17, 2022

Uh oh!

miss-islington commented Dec 17, 2022

Uh oh!

miss-islington commented Dec 17, 2022

Uh oh!

kumaraditya303 commented Dec 17, 2022

Uh oh!

colorfulappl commented Dec 19, 2022

Uh oh!

bedevere-bot commented Dec 21, 2022

Uh oh!

bedevere-bot commented Dec 21, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

colorfulappl commented Nov 30, 2022•
edited by bedevere-bot
Loading

colorfulappl commented Nov 30, 2022•
edited
Loading