Skip to content

Commit 6cd67e4

Browse files
authored
[3.13] gh-123083: Fix a potential use-after-free in ``STORE_ATTR_WITH… (#123235)
[3.13] gh-123083: Fix a potential use-after-free in ``STORE_ATTR_WITH_HINT`` (gh-123092) (cherry picked from commit 297f2e0)
1 parent e4b91b7 commit 6cd67e4

File tree

5 files changed

+31
-8
lines changed

5 files changed

+31
-8
lines changed

Lib/test/test_dict.py

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1476,6 +1476,24 @@ def test_dict_items_result_gc_reversed(self):
14761476
gc.collect()
14771477
self.assertTrue(gc.is_tracked(next(it)))
14781478

1479+
def test_store_evilattr(self):
1480+
class EvilAttr:
1481+
def __init__(self, d):
1482+
self.d = d
1483+
1484+
def __del__(self):
1485+
if 'attr' in self.d:
1486+
del self.d['attr']
1487+
gc.collect()
1488+
1489+
class Obj:
1490+
pass
1491+
1492+
obj = Obj()
1493+
obj.__dict__ = {}
1494+
for _ in range(10):
1495+
obj.attr = EvilAttr(obj.__dict__)
1496+
14791497
def test_str_nonstr(self):
14801498
# cpython uses a different lookup function if the dict only contains
14811499
# `str` keys. Make sure the unoptimized path is used when a non-`str`
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Fix a potential use-after-free in ``STORE_ATTR_WITH_HINT``.

Objects/dictobject.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1762,6 +1762,8 @@ insert_split_value(PyInterpreterState *interp, PyDictObject *mp, PyObject *key,
17621762
uint64_t new_version = _PyDict_NotifyEvent(interp, PyDict_EVENT_MODIFIED, mp, key, value);
17631763
STORE_SPLIT_VALUE(mp, ix, Py_NewRef(value));
17641764
mp->ma_version_tag = new_version;
1765+
// old_value should be DECREFed after GC track checking is done, if not, it could raise a segmentation fault,
1766+
// when dict only holds the strong reference to value in ep->me_value.
17651767
Py_DECREF(old_value);
17661768
}
17671769
ASSERT_CONSISTENT(mp);

Python/bytecodes.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2170,14 +2170,15 @@ dummy_func(
21702170
new_version = _PyDict_NotifyEvent(tstate->interp, PyDict_EVENT_MODIFIED, dict, name, value);
21712171
ep->me_value = value;
21722172
}
2173-
Py_DECREF(old_value);
2174-
STAT_INC(STORE_ATTR, hit);
21752173
/* Ensure dict is GC tracked if it needs to be */
21762174
if (!_PyObject_GC_IS_TRACKED(dict) && _PyObject_GC_MAY_BE_TRACKED(value)) {
21772175
_PyObject_GC_TRACK(dict);
21782176
}
2179-
/* PEP 509 */
2180-
dict->ma_version_tag = new_version;
2177+
dict->ma_version_tag = new_version; // PEP 509
2178+
// old_value should be DECREFed after GC track checking is done, if not, it could raise a segmentation fault,
2179+
// when dict only holds the strong reference to value in ep->me_value.
2180+
Py_DECREF(old_value);
2181+
STAT_INC(STORE_ATTR, hit);
21812182
Py_DECREF(owner);
21822183
}
21832184

Python/generated_cases.c.h

Lines changed: 5 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)