traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
cpython/Modules/_io
History
Miss Islington (bot) 30e769382d
closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295) 
When called on a closed object, readinto() segfaults on account
of a write to a freed buffer:

    ==220553== Process terminating with default action of signal 11 (SIGSEGV): dumping core
    ==220553==  Access not within mapped region at address 0x2A
    ==220553==    at 0x48408A0: memmove (vg_replace_strmem.c:1272)
    ==220553==    by 0x58DB0C: _buffered_readinto_generic (bufferedio.c:972)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto_impl (bufferedio.c:1053)
    ==220553==    by 0x58DCBA: _io__Buffered_readinto (bufferedio.c.h:253)

Reproducer:

    reader = open ("/dev/zero", "rb")
    _void  = reader.read (42)
    reader.close ()
    reader.readinto (bytearray (42)) GH-GH-GH- BANG!

The problem exists since 2012 when commit dc469454ec added code
to free the read buffer on close().

Signed-off-by: Philipp Gesang <philipp.gesang@intra2net.com>
(cherry picked from commit cb1c0746f2)

Co-authored-by: Philipp Gesang <phg@phi-gamma.net>
 		2020-02-04 13:41:55 -08:00
..
clinic [3.8] bpo-37206: Unrepresentable default values no longer represented as None. (GH-13933) (GH-16141) 2019-09-14 13:31:50 +03:00
_iomodule.c [3.8] bpo-37206: Unrepresentable default values no longer represented as None. (GH-13933) (GH-16141) 2019-09-14 13:31:50 +03:00
_iomodule.h bpo-31572: Get rid of PyObject_HasAttr() and _PyObject_HasAttrId() in the _io module. (#3726) 2018-01-16 18:34:21 +02:00
bufferedio.c closes bpo-39510: Fix use-after-free in BufferedReader.readinto() (GH-18295) 2020-02-04 13:41:55 -08:00
bytesio.c Fix typos mostly in comments, docs and test names (GH-15209) 2019-08-30 13:42:54 -07:00
fileio.c [3.8] closes bpo-27805: Ignore ESPIPE in initializing seek of append-mode files. (GH-17136) 2019-11-12 15:54:19 -08:00
iobase.c bpo-36974: tp_print -> tp_vectorcall_offset and tp_reserved -> tp_as_async (GH-13464) 2019-05-30 19:13:39 -07:00
stringio.c Fix typos mostly in comments, docs and test names (GH-15209) 2019-08-30 13:42:54 -07:00
textio.c [3.8] bpo-37206: Unrepresentable default values no longer represented as None. (GH-13933) (GH-16141) 2019-09-14 13:31:50 +03:00
winconsoleio.c bpo-36974: tp_print -> tp_vectorcall_offset and tp_reserved -> tp_as_async (GH-13464) 2019-05-30 19:13:39 -07:00