cpython

mirror of https://github.com/AdaCore/cpython.git synced 2026-02-12 12:57:15 -08:00

Files

Miss Islington (bot) 30e769382d closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295)

When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc469454ec added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c0746f2)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>

2020-02-04 13:41:55 -08:00

clinic

[3.8] bpo-37206: Unrepresentable default values no longer represented as None. (GH-13933) (GH-16141)

2019-09-14 13:31:50 +03:00

_iomodule.c

[3.8] bpo-37206: Unrepresentable default values no longer represented as None. (GH-13933) (GH-16141)

2019-09-14 13:31:50 +03:00

_iomodule.h

bpo-31572: Get rid of PyObject_HasAttr() and _PyObject_HasAttrId() in the _io module. (#3726 )

2018-01-16 18:34:21 +02:00

bufferedio.c

closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295)