bpo-46561: Ensure operands to __get__ survive the call#30979
bpo-46561: Ensure operands to __get__ survive the call#30979tekknolagi wants to merge 3 commits into
Conversation
Callees can assume their parameters survive for the entire call. This violates that assumption and can cause a use-after-free. This is not an issue in CPython right now because later on in the interpreter __get__ fastcall path, the whole vector of arguments get INCREFed. However, if a program provides a different entrypoint for a vectorcall, it may crash.
8729722 to
a47eaac
Compare
January 28, 2022 07:09
|
The changes look good, could you add some test cases? |
Sorry, something went wrong.
|
I am working on making a C-API equivalent for your sample Python test code. Unfortunately, it is not so easy as making a C extension class with |
Sorry, something went wrong.
|
Lol, did this finally bite someone else? |
Sorry, something went wrong.
|
I am on a mission to review old PRs that were not reviewed by anybody. LGTM, but please fix the NEWS entry (and its text is not very clear, it could be improved). It would be nice to add tests, but if it is too complicated, it is not necessary. |
Sorry, something went wrong.
Sorry, something went wrong.
|
This PR is stale because it has been open for 30 days with no activity. |
Sorry, something went wrong.
|
@tekknolagi, please sign the CLA. This is needed to merge this PR. |
Sorry, something went wrong.
|
I feel like I've signed the CLA like 3 times. I'll sign it again if needed. But also, I'm not sure if Dino's patch does address it? It looks like a SETREF after the call. |
Sorry, something went wrong.
|
Oh. I had signed the old CLA. I signed the new one. |
Sorry, something went wrong.
|
Thank you. That bug has been fixed in other PR after I approved this PR and before I have opportunity to return to it (and I didn't because you didn't update the entry in the NEWS section). But this will help with your other PRs. |
Sorry, something went wrong.
Before your patch, |
Sorry, something went wrong.
Callees can assume their parameters survive for the entire call. This
violates that assumption and can cause a use-after-free.
https://bugs.python.org/issue46561