Skip to content

gh-120298: Fix use-after-free in list_richcompare_impl#120303

Merged
sobolevn merged 3 commits into
python:mainfrom
sobolevn:issue-120298
Jun 11, 2024
Merged

gh-120298: Fix use-after-free in list_richcompare_impl#120303
sobolevn merged 3 commits into
python:mainfrom
sobolevn:issue-120298

Conversation

@sobolevn

@sobolevn sobolevn commented Jun 10, 2024 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

This code does the same thing as the code above it:

cpython/Objects/listobject.c

Lines 3360 to 3364 in 0ae8579

Py_INCREF(vitem);
Py_INCREF(witem);
int k = PyObject_RichCompareBool(vitem, witem, Py_EQ);
Py_DECREF(vitem);
Py_DECREF(witem);

And looks like it gets the job done. I've added tests for these two corner cases.

@sobolevn sobolevn requested a review from rhettinger as a code owner June 10, 2024 07:44
@bedevere-app bedevere-app Bot mentioned this pull request Jun 10, 2024
Closed
serhiy-storchaka
serhiy-storchaka reviewed Jun 10, 2024
View reviewed changes

@serhiy-storchaka serhiy-storchaka left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What bisect or deque do with this?

What tests were added for the similar case above?

@serhiy-storchaka

serhiy-storchaka commented Jun 10, 2024

Copy link
Copy Markdown
Member

The corresponding test is test_equal_operator_modifying_operand in Lib/test/test_list.py (added in 2d5bf56, GH-17734). You can perhaps just add a case there.

@sobolevn

sobolevn commented Jun 10, 2024

Copy link
Copy Markdown
Member Author

Yes, @serhiy-storchaka, you are correct. I simplified the reproduction to:

class evil(object):
    def __lt__(self, other):
        other.clear()
        return NotImplemented

a =   [ [ evil()]]

a[0] < a  # crash without this patch

I've updated tests to store this test near test_equal_operator_modifying_operand. Thanks a lot for the advice!

serhiy-storchaka
serhiy-storchaka approved these changes Jun 10, 2024
View reviewed changes

@serhiy-storchaka serhiy-storchaka left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Comment thread Lib/test/test_list.py Outdated
@sobolevn @serhiy-storchaka
Update Lib/test/test_list.py
6c56bc0 
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@sobolevn sobolevn merged commit 141baba into python:main Jun 11, 2024
@sobolevn sobolevn added needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes labels Jun 11, 2024
@miss-islington-app

miss-islington-app Bot commented Jun 11, 2024

Copy link
Copy Markdown

Thanks @sobolevn for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-app Bot commented Jun 11, 2024

Copy link
Copy Markdown

Thanks @sobolevn for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jun 11, 2024
@sobolevn @serhiy-storchaka @miss-islington
pythongh-120298: Fix use-after-free in list_richcompare_impl (pytho…
ade2838 
…nGH-120303)

(cherry picked from commit 141baba)

Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jun 11, 2024
@sobolevn @serhiy-storchaka @miss-islington
pythongh-120298: Fix use-after-free in list_richcompare_impl (pytho…
5a2001c 
…nGH-120303)

(cherry picked from commit 141baba)

Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@bedevere-app

bedevere-app Bot commented Jun 11, 2024

Copy link
Copy Markdown

GH-120339 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Jun 11, 2024
@bedevere-app

bedevere-app Bot commented Jun 11, 2024

Copy link
Copy Markdown

GH-120340 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Jun 11, 2024
@sobolevn sobolevn mentioned this pull request Jun 11, 2024
Closed
sobolevn added a commit that referenced this pull request Jun 11, 2024
@miss-islington @sobolevn @serhiy-storchaka
[3.12] gh-120298: Fix use-after-free in list_richcompare_impl (GH-1…
b884536 
…20303) (#120339)

gh-120298: Fix use-after-free in `list_richcompare_impl` (GH-120303)
(cherry picked from commit 141baba)

Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
sobolevn added a commit that referenced this pull request Jun 11, 2024
@miss-islington @sobolevn @serhiy-storchaka
[3.13] gh-120298: Fix use-after-free in list_richcompare_impl (GH-1…
52225c6 
…20303) (#120340)

gh-120298: Fix use-after-free in `list_richcompare_impl` (GH-120303)
(cherry picked from commit 141baba)

Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
mrahtz pushed a commit to mrahtz/cpython that referenced this pull request Jun 30, 2024
@sobolevn @serhiy-storchaka @mrahtz
pythongh-120298: Fix use-after-free in list_richcompare_impl (pytho…
06a131d 
…n#120303)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
noahbkim pushed a commit to hudson-trading/cpython that referenced this pull request Jul 11, 2024
@sobolevn @serhiy-storchaka @noahbkim
pythongh-120298: Fix use-after-free in list_richcompare_impl (pytho…
2cdbc2f 
…n#120303)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
estyxx pushed a commit to estyxx/cpython that referenced this pull request Jul 17, 2024
@sobolevn @serhiy-storchaka @estyxx
pythongh-120298: Fix use-after-free in list_richcompare_impl (pytho…
baa7cdb 
…n#120303)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@serhiy-storchaka serhiy-storchaka serhiy-storchaka approved these changes

@rhettinger rhettinger Awaiting requested review from rhettinger

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sobolevn @serhiy-storchaka