New submission from Sam Gross <[email protected]>:
The implementation of weakref.proxy's methods call back into the Python API
using a "borrowed reference" of the weakly referenced object (acquired via
PyWeakref_GET_OBJECT). This API call may delete the last reference to the
object (either directly or via GC), leaving a dangling pointer, which can be
subsequently dereferenced.
Tested with Python 3.8.0b4 (debug build)
The following code crashes with a debug build of Python 3.8.0b4 on Linux.
import weakref
obj = None
class MyObj:
def __iter__(self):
global obj
del obj
return NotImplemented
obj = MyObj()
p = weakref.proxy(obj)
print(5 in p)
This particular test case does not crash with a release build (on Linux).
The implementation of `in` on a proxy object calls proxy_contains:
return PySequence_Contains(PyWeakref_GET_OBJECT(proxy), value);
https://github.com/python/cpython/blob/v3.8.0b4/Objects/weakrefobject.c#L556
This eventually calls _PySequence_IterSearch. The call to PyObject_GetIter can
call arbitrary code, which can lead to seq (the proxy's referent) being
deleted. The subsequent call to type_error dereferences a dead object.
it = PyObject_GetIter(seq);
if (it == NULL) {
type_error("argument of type '%.200s' is not iterable", seq);
return -1;
}
https://github.com/python/cpython/blob/v3.8.0b4/Objects/abstract.c#L2003-L2007
I believe some functions, like proxy_length, may be immune to this problem
because they do not access the borrowed referent after calling into user code.
However, this is hard to verify from reading the code and may be fragile --
small changes to PyObject_Length/Size, for example, might .
See also https://bugs.python.org/issue16602
----------
components: Interpreter Core
messages: 354102
nosy: colesbury
priority: normal
severity: normal
status: open
title: proxy_contains (weakref.proxy) can access an object with 0 refcount
type: crash
versions: Python 3.8
_______________________________________
Python tracker <[email protected]>
<https://bugs.python.org/issue38395>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
