[issue41288] Pickle crashes using a crafted datetime object

Change by Serhiy Storchaka : -- keywords: +patch pull_requests: +20605 stage: -> patch review pull_request: https://github.com/python/cpython/pull/21458 ___ Python tracker

[issue41288] Pickle crashes using a crafted datetime object

Change by Karthikeyan Singaravelan : -- nosy: +belopolsky, p-ganssle ___ Python tracker ___ ___ Python-bugs-list mailing list

[issue41288] Pickle crashes using a crafted datetime object

Change by Serhiy Storchaka : -- assignee: -> serhiy.storchaka components: +Extension Modules -Interpreter Core nosy: +serhiy.storchaka ___ Python tracker ___

[issue41288] Pickle crashes using a crafted datetime object

Christian Heimes added the comment: datetime_new assumes that args is a tuple. load_newobj_ex() doesn't check that args is a tuple and kwargs is a dictionary. The demo exploit passes ``True`` as args, which triggers a segfault in PyTuple_GET_SIZE in datetime_new. #0 datetime_new

[issue41288] Pickle crashes using a crafted datetime object

New submission from Iman Sharafodin : The following code generates a segfault on the Pickle module [it's a crafted datetime object] (Python 3.10.0a0 (heads/master:b40e434, Jul 4 2020), Python 3.6.11 and Python 3.7.2): import io import pickle hex_string =