[issue42422] types.CodeType() has no bytecode verifier
Sofian Brabez added the comment: It's been a while and I still have no clear guidance from there of what developers want to do. Follow-up on this again to see if requires updates or just close it. -- ___ Python tracker <https://bugs.python.org/issue42422> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue42422] types.CodeType() has no bytecode verifier
Sofian Brabez added the comment: Thanks Victor, it's clear now. About the updates of the crashers, I sent the updated patches to update them in PR [3] before the following issue [1] and PR [2] but the other seems to have been merged already. It seems my submission was totally forgot and now obsolete. So I'm gonna close this ticket. [1] https://bugs.python.org/issue42734 [2] https://github.com/python/cpython/pull/23939 [3] https://github.com/python/cpython/pull/23448 -- ___ Python tracker <https://bugs.python.org/issue42422> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104
Sofian Brabez added the comment: Any ETA? I would appreciate to see my contribution being merged. Batuhan, the current code is not doing what it's supposed to do in bogus_code_obj.py (i.e. no crash after 3.8 and above in master and branches). This still make the issue valid I guess. ``` $ ./python -V Python 3.8.6+ $ ./python -V Python 3.10.0a2+ $ ./python Lib/test/crashers/bogus_code_obj.py Traceback (most recent call last): File "/usr/home/sbz/github/cpython/Lib/test/crashers/bogus_code_obj.py", line 17, in co = types.CodeType(0, 0, 0, 0, 0, b'\x04\x71\x00\x00', TypeError: code expected at least 14 arguments, got 13 ``` I would be happy to update and fix it instead if you think it's better that way. Please let me know, it will be great to see my first submission being treated. -- ___ Python tracker <https://bugs.python.org/issue42422> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104
New submission from Sofian Brabez : This PoC is causing a local crash of python interpreters version 2.7,3.6,3.7,3.8 and 3.9. By creating a code object of size 0 with a POP_TOP opcode, in Python/ceval.c the call to Py_DECREF(value) on a NULL pointer lead to a segmentation fault of the python interpreter. It was tested on all python3.x versions against a fresh compilation of a git clone github.com/python/cpython.git on branches and master. You need to adapt the code() constructor because the parameters are different across versions but crash remains. I'm just covering the version 3.7 in following text $ git clone --depth 1 https://github.com/python/cpython.git $ git checkout -b 3.7 origin/3.7 $ export CFLAGS+="-g -O0" $ ./configure $ make $ ./python -V Python 3.7.9+ $ ./python -c 'import sys; print(sys.version)' 3.7.9+ (heads/3.7-dirty:08ba61dade, Nov 21 2020, 04:57:20) [Clang 10.0.1 (g...@github.com:llvm/llvm-project.git llvmorg-10.0.1-0-gef32c611a $ ./python crash.py Running the python3.7 execution into gdb, helped me to locate the crash for python3.7 https://github.com/python/cpython/blob/3.7/Python/ceval.c#L1104 $ gdb --batch --silent ./python -ex 'r crash.py' Program received signal SIGSEGV, Segmentation fault. 0x0033873a in _PyEval_EvalFrameDefault (f=0x800bdda00, throwflag=0) at Python/ceval.c:1104 1104Py_DECREF(value); Also I have executed the PoC on different platforms Linux, FreeBSD and MacOSX. The behaviour is the same and SIGSEGV the interpreter. I have located the issue in the source code but I'm wondering what will be the best solution to fix it? Python developers should know better, I am open to your advices and suggestions. I have noticed that one assertion handle this case (in master) https://github.com/python/cpython/blob/master/Python/ceval.c#L1430 but most of the interpreters are built without --with-assertions enabled, so the crash will still persist. More details on this gist https://gist.github.com/sbz/267d35de5766c53835c5c4ef45b18705 I think the python interpreter shouldn't crash and handle properly this edge case. -- components: Interpreter Core files: crash.py messages: 381527 nosy: sbz priority: normal severity: normal status: open title: Py_Decref on value crash the interpreter in Python/ceval.c:1104 type: crash versions: Python 3.6, Python 3.7, Python 3.8, Python 3.9 Added file: https://bugs.python.org/file49610/crash.py ___ Python tracker <https://bugs.python.org/issue42422> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104
Sofian Brabez added the comment: Linux, FreeBSD and MacOSX crash reports and backtraces joined in the zip. Contributor Agreement 2020-09-23 signed. -- Added file: https://bugs.python.org/file49611/crash-report-txt.zip ___ Python tracker <https://bugs.python.org/issue42422> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104
Sofian Brabez added the comment: Thanks Dennis for pointing me the crashers, I was not aware of them. I have added a new crash test to cover multiple crashes in different interpreter versions. Current bogus does not crash where it could be possible to crash in older and newer interpreter versions. Do you think it's worth to add it? I joined the patch against master and if yes I could submit a new PR. -- keywords: +patch Added file: https://bugs.python.org/file49612/add-new-crasher-to-cover-multiple-versions.diff ___ Python tracker <https://bugs.python.org/issue42422> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue42422] Py_Decref on value crash the interpreter in Python/ceval.c:1104
Change by Sofian Brabez : -- pull_requests: +22340 stage: -> patch review pull_request: https://github.com/python/cpython/pull/23448 ___ Python tracker <https://bugs.python.org/issue42422> ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
