https://github.com/python/cpython/commit/ed5059eeb1aa50b481957307db5a34b937497382
commit: ed5059eeb1aa50b481957307db5a34b937497382
branch: main
author: Bénédikt Tran <[email protected]>
committer: kumaraditya303 <[email protected]>
date: 2024-10-27T22:40:10+05:30
summary:
gh-125966: fix use-after-free on `fut->fut_callback0` due to an evil callback's
`__eq__` in asyncio (#125967)
files:
A Misc/NEWS.d/next/Library/2024-10-25-10-53-56.gh-issue-125966.eOCYU_.rst
M Lib/test/test_asyncio/test_futures.py
M Modules/_asynciomodule.c
diff --git a/Lib/test/test_asyncio/test_futures.py
b/Lib/test/test_asyncio/test_futures.py
index bac76b074981df..3a4291e3a68ca6 100644
--- a/Lib/test/test_asyncio/test_futures.py
+++ b/Lib/test/test_asyncio/test_futures.py
@@ -999,6 +999,24 @@ def evil_call_soon(*args, **kwargs):
# returns an empty list but the C implementation returns None.
self.assertIn(fut._callbacks, (None, []))
+ def test_use_after_free_on_fut_callback_0_with_evil__eq__(self):
+ # Special thanks to Nico-Posada for the original PoC.
+ # See https://github.com/python/cpython/issues/125966.
+
+ fut = self._new_future()
+
+ class cb_pad:
+ def __eq__(self, other):
+ return True
+
+ class evil(cb_pad):
+ def __eq__(self, other):
+ fut.remove_done_callback(None)
+ return NotImplemented
+
+ fut.add_done_callback(cb_pad())
+ fut.remove_done_callback(evil())
+
def test_use_after_free_on_fut_callback_0_with_evil__getattribute__(self):
# see: https://github.com/python/cpython/issues/125984
diff --git
a/Misc/NEWS.d/next/Library/2024-10-25-10-53-56.gh-issue-125966.eOCYU_.rst
b/Misc/NEWS.d/next/Library/2024-10-25-10-53-56.gh-issue-125966.eOCYU_.rst
new file mode 100644
index 00000000000000..9fe8795de18003
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2024-10-25-10-53-56.gh-issue-125966.eOCYU_.rst
@@ -0,0 +1,2 @@
+Fix a use-after-free crash in :meth:`asyncio.Future.remove_done_callback`.
+Patch by Bénédikt Tran.
diff --git a/Modules/_asynciomodule.c b/Modules/_asynciomodule.c
index a4dab29ee9428d..d4135f04e56575 100644
--- a/Modules/_asynciomodule.c
+++ b/Modules/_asynciomodule.c
@@ -1019,7 +1019,12 @@ _asyncio_Future_remove_done_callback_impl(FutureObj
*self, PyTypeObject *cls,
ENSURE_FUTURE_ALIVE(state, self)
if (self->fut_callback0 != NULL) {
- int cmp = PyObject_RichCompareBool(self->fut_callback0, fn, Py_EQ);
+ // Beware: An evil PyObject_RichCompareBool could free fut_callback0
+ // before a recursive call is made with that same arg. For details, see
+ //
https://github.com/python/cpython/pull/125967#discussion_r1816593340.
+ PyObject *fut_callback0 = Py_NewRef(self->fut_callback0);
+ int cmp = PyObject_RichCompareBool(fut_callback0, fn, Py_EQ);
+ Py_DECREF(fut_callback0);
if (cmp == -1) {
return NULL;
}
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3/lists/python-checkins.python.org/
Member address: [email protected]
