Skip to content

/ cpython

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bpo-39510: Fix use-after-free in BufferedReader.readinto() #18295

Merged
merged 2 commits into from Feb 4, 2020
Merged

bpo-39510: Fix use-after-free in BufferedReader.readinto() #18295

merged 2 commits into from Feb 4, 2020
+7 −0

Conversation

@phi-gamma
Copy link
Contributor

phi-gamma commented Jan 31, 2020 •
edited by bedevere-bot

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==220553==  Access not within mapped region at address 0x2A
==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

reader = open ("/dev/zero", "rb")
_void  = reader.read (42)
reader.close ()
reader.readinto (bytearray (42)) ### BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang philipp.gesang@intra2net.com

https://bugs.python.org/issue39510
@the-knights-who-say-ni

This comment has been minimized.

Sign in to view
Copy link

the-knights-who-say-ni commented Jan 31, 2020

Hello, and thanks for your contribution!

I'm a bot set up to make sure that the project can legally accept this contribution by verifying everyone involved has signed the PSF contributor agreement (CLA).

CLA Missing

Our records indicate the following people have not signed the CLA:

@phi-gamma

For legal reasons we need all the people listed to sign the CLA before we can look at your contribution. Please follow the steps outlined in the CPython devguide to rectify this issue.

If you have recently signed the CLA, please wait at least one business day
before our records are updated.

You can check yourself to see if the CLA has been received.

Thanks again for the contribution, we look forward to reviewing it!
@phi-gamma phi-gamma force-pushed the phi-gamma:segv branch from 0e6676d to 319b826 Feb 1, 2020
@phi-gamma phi-gamma force-pushed the phi-gamma:segv branch from 319b826 to 0a90d4a Feb 1, 2020
@benjaminp

This comment has been minimized.

Sign in to view
Copy link
Contributor

benjaminp commented Feb 4, 2020

Thanks for the PR; please add a brief NEWS note.
@phi-gamma
Fix use-after-free in BufferedReader.readinto()
Unverified
This user has not uploaded their public key yet.
GPG key ID: F12D9BAC178A094C Learn about signing commits
Loading status checks…
3328533 
When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) ### BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
@phi-gamma phi-gamma force-pushed the phi-gamma:segv branch from 0a90d4a to 3328533 Feb 4, 2020
@benjaminp
formatting
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
ab1894c
@benjaminp benjaminp merged commit cb1c074 into python:master Feb 4, 2020
9 checks passed
9 checks passed
Docs
Details
Windows (x86)
Details
Windows (x64)
Details
macOS
Details
Ubuntu
Details
Azure Pipelines PR #20200204.35 succeeded
Details
bedevere/issue-number Issue number 39510 found
Details
bedevere/news News entry found in Misc/NEWS.d
continuous-integration/travis-ci/pr The Travis CI build passed
Details
@miss-islington

This comment has been minimized.

Sign in to view
Copy link

miss-islington commented Feb 4, 2020

Thanks @phi-gamma for the PR, and @benjaminp for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7, 3.8.
🐍🍒⛏🤖
@bedevere-bot

This comment has been minimized.

Sign in to view
Copy link

bedevere-bot commented Feb 4, 2020

GH-18348 is a backport of this pull request to the 3.8 branch.
miss-islington added a commit to miss-islington/cpython that referenced this pull request Feb 4, 2020
@phi-gamma @miss-islington
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (py…
12d79db 
…thonGH-18295)

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c074)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
@bedevere-bot

This comment has been minimized.

Sign in to view
Copy link

bedevere-bot commented Feb 4, 2020

GH-18349 is a backport of this pull request to the 3.7 branch.
miss-islington added a commit to miss-islington/cpython that referenced this pull request Feb 4, 2020
@phi-gamma @miss-islington
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (py…
47bce0a 
…thonGH-18295)

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c074)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
@bedevere-bot

This comment has been minimized.

Sign in to view
Copy link

bedevere-bot commented Feb 4, 2020

GH-18350 is a backport of this pull request to the 3.6 branch.
miss-islington added a commit to miss-islington/cpython that referenced this pull request Feb 4, 2020
@phi-gamma @miss-islington
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (py…
697f519 
…thonGH-18295)

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c074)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
miss-islington added a commit that referenced this pull request Feb 4, 2020
@miss-islington @phi-gamma
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH…
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
30e7693 
…-18295)

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c074)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
miss-islington added a commit that referenced this pull request Feb 4, 2020
@miss-islington @phi-gamma
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH…
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
97d2a98 
…-18295)

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c074)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
opavlyuk pushed a commit to opavlyuk/cpython that referenced this pull request Feb 12, 2020
@phi-gamma opavliuk
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (py…
5370f13 
…thonGH-18295)

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) ### BANG!

The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
CLA signed
Projects
None yet
Milestone
No milestone
Linked issues

Successfully merging this pull request may close these issues.

None yet

5 participants
@phi-gamma @the-knights-who-say-ni @benjaminp @miss-islington @bedevere-bot
You can’t perform that action at this time.