Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.
Sign up[3.6] closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295) #18350
Conversation
…-18295) When called on a closed object, readinto() segfaults on account of a write to a freed buffer: ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core ==220553== Access not within mapped region at address 0x2A ==220553== at 0x48408A0: memmove (vg_replace_strmem.c:1272) ==220553== by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972) ==220553== by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053) ==220553== by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253) Reproducer: reader = open ("/dev/zero", "rb") _void = reader.read (42) reader.close () reader.readinto (bytearray (42)) GH-GH-GH- BANG! The problem exists since 2012 when commit dc46945 added code to free the read buffer on close(). Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com> (cherry picked from commit cb1c074) Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
This comment has been minimized.
This comment has been minimized.
|
@phi-gamma and @benjaminp: Status check is done, and it's a success |
This comment has been minimized.
This comment has been minimized.
|
Sorry, I can't merge this PR. Reason: |
c352e6c
into
python:3.6
6 checks passed
6 checks passed
bedevere/maintenance-branch-pr
Valid maintenance branch PR title.
bedevere/news
News entry found in Misc/NEWS.d
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
miss-islington commentedFeb 4, 2020
•
edited by bedevere-bot
When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:
Reproducer:
The problem exists since 2012 when commit dc46945 added code
to free the read buffer on close().
Signed-off-by: Philipp Gesang philipp.gesang@intra2net.com
(cherry picked from commit cb1c074)
Co-authored-by: Philipp Gesang phg@phi-gamma.net
https://bugs.python.org/issue39510