Repository navigation
uaf of it_sentinel in callable_iterator.__next__ #158031
Description
Bug report
Bug description:
class Sentinel:
def __eq__(self, other):
it.__setstate__(((), StopIteration))
return NotImplemented
class Result:
def __eq__(self, other):
print("reflected __eq__ got", type(other))
return NotImplemented
it = iter(lambda: Result(), Sentinel())
next(it)asan output:
=================================================================
==20==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000014b20 at pc 0xaaaad8ba8154 bp 0xffffcf50d9b0 sp 0xffffcf50d9a0
READ of size 4 at 0x513000014b20 thread T0
#0 0xaaaad8ba8150 in _Py_IsImmortal Include/refcount.h:132
#1 0xaaaad8ba8150 in _PyStackRef_FromPyObjectNew Include/internal/pycore_stackref.h:602
#2 0xaaaad8ba8150 in _PyEval_Vector Python/ceval.c:2158
#3 0xaaaad88f8c24 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
#4 0xaaaad88f8c24 in vectorcall_unbound Objects/typeobject.c:3032
#5 0xaaaad88f8c24 in maybe_call_special_one_arg Objects/typeobject.c:3174
#6 0xaaaad88f8c24 in _PyObject_MaybeCallSpecialOneArg Objects/typeobject.c:3189
#7 0xaaaad88f8c24 in slot_tp_richcompare Objects/typeobject.c:11012
#8 0xaaaad879ae40 in do_richcompare Objects/object.c:1071
#9 0xaaaad879ae40 in PyObject_RichCompare Objects/object.c:1114
#10 0xaaaad87a0b54 in PyObject_RichCompareBool Objects/object.c:1136
#11 0xaaaad8687380 in calliter_iternext Objects/iterobject.c:285
#12 0xaaaad8b6ab78 in builtin_next Python/bltinmodule.c:1777
#13 0xaaaad85a72d0 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
#14 0xaaaad85a72d0 in PyObject_Vectorcall Objects/call.c:327
#15 0xaaaad8b88248 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:770
#16 0xaaaad830d368 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
#17 0xaaaad8ba719c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
#18 0xaaaad8ba719c in _PyEval_Vector Python/ceval.c:2176
#19 0xaaaad8ba719c in PyEval_EvalCode Python/ceval.c:681
#20 0xaaaad8da7ac4 in run_mod Python/pythonrun.c:1509
#21 0xaaaad8da8948 in _PyRun_File Python/pythonrun.c:1332
#22 0xaaaad8dacc0c in _PyRun_SimpleFile Python/pythonrun.c:544
#23 0xaaaad8db09e0 in _PyRun_AnyFile Python/pythonrun.c:92
#24 0xaaaad8e7bd8c in pymain_run_file_obj Modules/main.c:478
#25 0xaaaad8e7bd8c in pymain_run_file Modules/main.c:494
#26 0xaaaad8e7bd8c in pymain_run_python Modules/main.c:804
#27 0xaaaad8e7bd8c in Py_RunMain Modules/main.c:891
#28 0xaaaad8e7e0b8 in pymain_main Modules/main.c:921
#29 0xaaaad8e7e0b8 in Py_BytesMain Modules/main.c:945
#30 0xffffa5a184c0 (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
#31 0xffffa5a18594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
#32 0xaaaad837746c in _start (/src/cpython/python+0x17a746c) (BuildId: fa8e9c5023d067471f9646ceca1b9bc57d6cd116)
0x513000014b20 is located 32 bytes inside of 328-byte region [0x513000014b00,0x513000014c48)
freed by thread T0 here:
#0 0xffffa63b61b4 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0xaaaad88728ec in subtype_dealloc Objects/typeobject.c:2846
#2 0xaaaad8799a20 in _Py_Dealloc Objects/object.c:3346
#3 0xaaaad8c8bd8c in Py_DECREF_MORTAL Include/internal/pycore_object.h:449
#4 0xaaaad8c8bd8c in PyStackRef_XCLOSE Include/internal/pycore_stackref.h:726
#5 0xaaaad8c8bd8c in _PyFrame_ClearLocals Python/frame.c:108
#6 0xaaaad8c8c8e0 in _PyFrame_ClearExceptCode Python/frame.c:133
#7 0xaaaad8b8a4e4 in clear_thread_frame Python/ceval.c:1987
#8 0xaaaad8b8a4e4 in _PyEval_FrameClearAndPop Python/ceval.c:2019
#9 0xaaaad8311914 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:11557
#10 0xaaaad8ba8080 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
#11 0xaaaad8ba8080 in _PyEval_Vector Python/ceval.c:2176
#12 0xaaaad88f8c24 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
#13 0xaaaad88f8c24 in vectorcall_unbound Objects/typeobject.c:3032
#14 0xaaaad88f8c24 in maybe_call_special_one_arg Objects/typeobject.c:3174
#15 0xaaaad88f8c24 in _PyObject_MaybeCallSpecialOneArg Objects/typeobject.c:3189
#16 0xaaaad88f8c24 in slot_tp_richcompare Objects/typeobject.c:11012
#17 0xaaaad879ab14 in do_richcompare Objects/object.c:1065
#18 0xaaaad879ab14 in PyObject_RichCompare Objects/object.c:1114
#19 0xaaaad87a0b54 in PyObject_RichCompareBool Objects/object.c:1136
#20 0xaaaad8687380 in calliter_iternext Objects/iterobject.c:285
#21 0xaaaad8b6ab78 in builtin_next Python/bltinmodule.c:1777
#22 0xaaaad85a72d0 in _PyObject_VectorcallTstate Include/internal/pycore_call.h:144
#23 0xaaaad85a72d0 in PyObject_Vectorcall Objects/call.c:327
#24 0xaaaad8b88248 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:770
#25 0xaaaad830d368 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
#26 0xaaaad8ba719c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
#27 0xaaaad8ba719c in _PyEval_Vector Python/ceval.c:2176
#28 0xaaaad8ba719c in PyEval_EvalCode Python/ceval.c:681
#29 0xaaaad8da7ac4 in run_mod Python/pythonrun.c:1509
#30 0xaaaad8da8948 in _PyRun_File Python/pythonrun.c:1332
#31 0xaaaad8dacc0c in _PyRun_SimpleFile Python/pythonrun.c:544
#32 0xaaaad8db09e0 in _PyRun_AnyFile Python/pythonrun.c:92
#33 0xaaaad8e7bd8c in pymain_run_file_obj Modules/main.c:478
#34 0xaaaad8e7bd8c in pymain_run_file Modules/main.c:494
#35 0xaaaad8e7bd8c in pymain_run_python Modules/main.c:804
#36 0xaaaad8e7bd8c in Py_RunMain Modules/main.c:891
#37 0xaaaad8e7e0b8 in pymain_main Modules/main.c:921
#38 0xaaaad8e7e0b8 in Py_BytesMain Modules/main.c:945
#39 0xffffa5a184c0 (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
#40 0xffffa5a18594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
#41 0xaaaad837746c in _start (/src/cpython/python+0x17a746c) (BuildId: fa8e9c5023d067471f9646ceca1b9bc57d6cd116)
previously allocated by thread T0 here:
#0 0xffffa63b76d0 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0xaaaad88b2a1c in _PyObject_MallocWithType Include/internal/pycore_object_alloc.h:46
#2 0xaaaad88b2a1c in _PyType_AllocNoTrack Objects/typeobject.c:2498
#3 0xaaaad88b30a0 in PyType_GenericAlloc Objects/typeobject.c:2529
#4 0xaaaad88b8aa8 in type_call Objects/typeobject.c:2442
#5 0xaaaad85a5200 in _PyObject_MakeTpCall Objects/call.c:242
#6 0xaaaad8b88248 in _Py_VectorCallInstrumentation_StackRefSteal Python/ceval.c:770
#7 0xaaaad830d368 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:1906
#8 0xaaaad8ba719c in _PyEval_EvalFrame Include/internal/pycore_ceval.h:122
#9 0xaaaad8ba719c in _PyEval_Vector Python/ceval.c:2176
#10 0xaaaad8ba719c in PyEval_EvalCode Python/ceval.c:681
#11 0xaaaad8da7ac4 in run_mod Python/pythonrun.c:1509
#12 0xaaaad8da8948 in _PyRun_File Python/pythonrun.c:1332
#13 0xaaaad8dacc0c in _PyRun_SimpleFile Python/pythonrun.c:544
#14 0xaaaad8db09e0 in _PyRun_AnyFile Python/pythonrun.c:92
#15 0xaaaad8e7bd8c in pymain_run_file_obj Modules/main.c:478
#16 0xaaaad8e7bd8c in pymain_run_file Modules/main.c:494
#17 0xaaaad8e7bd8c in pymain_run_python Modules/main.c:804
#18 0xaaaad8e7bd8c in Py_RunMain Modules/main.c:891
#19 0xaaaad8e7e0b8 in pymain_main Modules/main.c:921
#20 0xaaaad8e7e0b8 in Py_BytesMain Modules/main.c:945
#21 0xffffa5a184c0 (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
#22 0xffffa5a18594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) (BuildId: 27027b96e5b8c475fc327aa445bea1c71d37b4e2)
#23 0xaaaad837746c in _start (/src/cpython/python+0x17a746c) (BuildId: fa8e9c5023d067471f9646ceca1b9bc57d6cd116)
SUMMARY: AddressSanitizer: heap-use-after-free Include/refcount.h:132 in _Py_IsImmortal
Shadow bytes around the buggy address:
0x513000014880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa
0x513000014900: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x513000014980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x513000014a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x513000014a80: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa
=>0x513000014b00: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
0x513000014b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x513000014c00: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x513000014c80: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x513000014d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x513000014d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==20==ABORTING
Aborted
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Activity
pythongh-158031: Add the NEWS entry for the iter sentinel fix
pythongh-158031, pythongh-158033: Fix UAF in iter/aiter sentinel comp…