[issue36218] .sort() segfaults consistently on crafted input

Raymond Hettinger added the comment: New changeset 9dbb09fc27b99d2c08b8f56db71018eb828cc7cd by Raymond Hettinger (Miss Islington (bot)) in branch '3.7': bpo-36218: Fix handling of heterogeneous values in list.sort (GH-12209) GH-12532)

[issue36218] .sort() segfaults consistently on crafted input

Change by Raymond Hettinger : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___

[issue36218] .sort() segfaults consistently on crafted input

Change by miss-islington : -- pull_requests: +12482 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue36218] .sort() segfaults consistently on crafted input

Raymond Hettinger added the comment: New changeset dd5417afcf8924bcdd7077351941ad21727ef644 by Raymond Hettinger (Rémi Lapeyre) in branch 'master': bpo-36218: Fix handling of heterogeneous values in list.sort (GH-12209)

[issue36218] .sort() segfaults consistently on crafted input

Ned Deily added the comment: Thanks for the analysis and the suggested PR which is now awaiting review. While segfaults are nasty, I don't see how this problem would be likely exploitable as a DoS without direct access to the interpreter. So I'm downgrading it to "deferred blocker" for

[issue36218] .sort() segfaults consistently on crafted input

Rémi Lapeyre added the comment: > Rémi, are you saying there are failing tests currently in the master related > to this bug? No, you are right there is no tests for this code path and there is no tests on master related to this bug as far as I can tell. I think the issue comes from

[issue36218] .sort() segfaults consistently on crafted input

Change by Rémi Lapeyre : -- keywords: +patch pull_requests: +12201 stage: needs patch -> patch review ___ Python tracker ___ ___

[issue36218] .sort() segfaults consistently on crafted input

SilentGhost added the comment: > The following patch fixed the issue and made the whole test suite pass: Rémi, are you saying there are failing tests currently in the master related to this bug? It seems there are actually very few tests that test for TypeError and all those introduced in

[issue36218] .sort() segfaults consistently on crafted input

Rémi Lapeyre added the comment: Hi @xtreak, sorry for that. I think the issue may come from https://github.com/python/cpython/blob/master/Objects/listobject.c#L2273-L2357 where ms.key_compare is set, the conditions on the first ifs looks weird to me and I suspect ms.key_compare is set to

[issue36218] .sort() segfaults consistently on crafted input

Karthikeyan Singaravelan added the comment: @remi.lapeyre please make sure you are not unsubscribing others by mistake while adding comment. -- nosy: +elliot.gorokhovsky, zach.ware ___ Python tracker

[issue36218] .sort() segfaults consistently on crafted input

Rémi Lapeyre added the comment: The code segfaults at https://github.com/python/cpython/blob/master/Objects/listobject.c#L2164 coming from https://github.com/python/cpython/blob/master/Objects/listobject.c#L1324. -- nosy: -elliot.gorokhovsky, zach.ware

[issue36218] .sort() segfaults consistently on crafted input

Change by Karthikeyan Singaravelan : -- nosy: +elliot.gorokhovsky, zach.ware ___ Python tracker ___ ___ Python-bugs-list mailing

[issue36218] .sort() segfaults consistently on crafted input

Rémi Lapeyre added the comment: On mac I confirm that 1e34da49ef2 segfaults and 6c6ddf97c4 gives the expected result: ➜ cpython git:(6c6ddf97c4) ✗ ./python.exe tests.py Traceback (most recent call last): File "tests.py", line 1, in [(1.0, 1.0), (False, "A"), 6].sort() TypeError: '<'

[issue36218] .sort() segfaults consistently on crafted input

Change by Zachary Ware : -- nosy: +elliot.gorokhovsky ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue36218] .sort() segfaults consistently on crafted input

Zachary Ware added the comment: Confirmed on Linux: $ python3.6 Python 3.6.8 (default, Mar 5 2019, 22:01:36) [GCC 8.2.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> [(1.0, 1.0), (False, "A"), 6].sort() Traceback (most recent call last): File "",

[issue36218] .sort() segfaults consistently on crafted input

Change by SilentGhost : -- nosy: +elliot.gorokhovsky ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue36218] .sort() segfaults consistently on crafted input

Karthikeyan Singaravelan added the comment: Adding ned and Łukasz since this seems to happen on release builds. -- nosy: +lukasz.langa, ned.deily, xtreak ___ Python tracker

[issue36218] .sort() segfaults consistently on crafted input

Change by SilentGhost : -- versions: +Python 3.8 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue36218] .sort() segfaults consistently on crafted input

Lysandros Nikolaou added the comment: Can confirm for 3.7.2 on my macOS 10.14 system. Although this is the case in 3.7 on my current build of the master branch I get the following AssertionError instead: Assertion failed: (v->ob_type == w->ob_type), function unsafe_tuple_compare, file

[issue36218] .sort() segfaults consistently on crafted input

SilentGhost added the comment: Can confirm on 3.7.1 on Linux. The same is happening for sorted. I wonder if the optimisation done in 1e34da49ef2 is responsible -- components: +Interpreter Core nosy: +SilentGhost, rhettinger stage: -> needs patch

[issue36218] .sort() segfaults consistently on crafted input

New submission from Lyn Levenick : Running Python 3.7.2, it is possible to segfault the process when sorting some arrays. Executed commands are $ python3 Python 3.7.2 (default, Feb 12 2019, 08:15:36) [Clang 10.0.0 (clang-1000.11.45.5)] on darwin Type "help", "copyright",