[issue24105] Use after free during json encoding a dict (3)
Changes by Arfrever Frehtes Taifersar Arahesis arfrever@gmail.com: -- nosy: +Arfrever ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24105 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24105] Use after free during json encoding a dict (3)
Serhiy Storchaka added the comment: Here is a disadvantage of opening several issues for similar bugs. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24105 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24105] Use after free during json encoding a dict (3)
Benjamin Peterson added the comment: I applied a very similar patch for #24094. -- nosy: +benjamin.peterson resolution: - duplicate status: open - closed superseder: - Use after free during json encoding (PyType_IsSubtype) ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24105 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24105] Use after free during json encoding a dict (3)
Serhiy Storchaka added the comment: Proposed patch fixes three related issues: issue24094, issue24095 and issue24105. -- assignee: - serhiy.storchaka keywords: +patch stage: - patch review versions: +Python 3.5 Added file: http://bugs.python.org/file39264/json_encode_mutated_dict.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24105 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24105] Use after free during json encoding a dict (3)
paul added the comment: @Serhiy: Not all of my bugs are in the same module. Sure, I will group them by module in the future. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24105 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24105] Use after free during json encoding a dict (3)
Changes by Serhiy Storchaka storch...@gmail.com: -- components: +Extension Modules nosy: +ezio.melotti, pitrou, rhettinger, serhiy.storchaka ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24105 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24105] Use after free during json encoding a dict (3)
Raymond Hettinger added the comment: Please don't file a multiple tracker items for the same module. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24105 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24105] Use after free during json encoding a dict (3)
New submission from paul:
# Program received signal SIGSEGV, Segmentation fault.
# 0x40036740 in encoder_listencode_dict (s=0x405b43fc, acc=0xbf86438c, dct=D
at remote 0x405b2fb4, indent_level=0)
# at /home/p/Python-3.4.1/Modules/_json.c:1557
# 1557PyList_SET_ITEM(items, i, item);
# (gdb) print *(PyListObject*)items
# $1 = {ob_base = {ob_base = {_ob_next = 0x405bcab4, _ob_prev = 0x40591184,
ob_refcnt = 2, ob_type = 0x830e1c0 PyList_Type},
# ob_size = 0}, ob_item = 0x0, allocated = 0}
# (gdb) print i
# $2 = 112233
#
# items was cleared in __hash__, so we get a wild write at a controlled
address.
--
files: poc_enc_dict3.py
messages: 242322
nosy: pkt
priority: normal
severity: normal
status: open
title: Use after free during json encoding a dict (3)
type: crash
versions: Python 3.4
Added file: http://bugs.python.org/file39256/poc_enc_dict3.py
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24105
___
___
Python-bugs-list mailing list
Unsubscribe:
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24105] Use after free during json encoding a dict (3)
paul added the comment: You want multiple bugs in the same module grouped in one issue? -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24105 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24105] Use after free during json encoding a dict (3)
Serhiy Storchaka added the comment: Yes, if they are related. I didn't look at the code close, but at first glance all your recently opened issues look related (may be I wrong). -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24105 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
