Activity

1. jackfromeast commented on Dec 20, 2025

   

   jackfromeast

   on Dec 20, 2025

   Author

   More actions

   This is similar to the issue #142594.
2. yihong0618 commented on Dec 20, 2025

   

   yihong0618

   on Dec 20, 2025

   Contributor

   More actions

   This is similar to the issue #142594.

   CHECK_ATTACHED need check it again

   maybe this is a simple fix

   diff --git a/Modules/_io/textio.c b/Modules/_io/textio.c
   index f988195256..07575dede5 100644
   --- a/Modules/_io/textio.c
   +++ b/Modules/_io/textio.c
   @@ -2965,12 +2965,11 @@ static PyObject *
    _io_TextIOWrapper_truncate_impl(textio *self, PyObject *pos)
    /*[clinic end generated code: output=90ec2afb9bb7745f input=8bddb320834c93ee]*/
    {
   -    CHECK_ATTACHED(self)
    
        if (_PyFile_Flush((PyObject *)self) < 0) {
            return NULL;
        }
   -
   +    CHECK_ATTACHED(self)
        return PyObject_CallMethodOneArg(self->buffer, &_Py_ID(truncate), pos);
    }
    
   

   not sure can cover all the case...and maybe some guys can also chagne he self->detect
   we should carefully to make sure CHECK_ATTACHED after that?
3. yihong0618 commented on Dec 20, 2025

   

   yihong0618

   on Dec 20, 2025

   Contributor

   More actions

   I will leave other this kind of issues here that found the same behavior

   1

   import io
   
   class EvilRaw(io.BytesIO):
       def __init__(self):
           super().__init__()
           self._done = False
           
       def write(self, data):
           if not self._done:
               self._done = True
               wrap.detach()
           return super().write(data)
   
   wrap = io.TextIOWrapper(EvilRaw())
   wrap.write("hello")
   wrap.flush()

   2

   import io
   
   class EvilRaw(io.BytesIO):
       def __init__(self):
           super().__init__(b"hello world")
           self._done = False
       def flush(self):
           if not self._done:
               self._done = True
               wrap.detach()
           return None
   
   wrap = io.TextIOWrapper(EvilRaw())
   wrap.read() 
   pos = wrap.tell()
   wrap.seek(0)
   wrap.seek(pos)

   3

   import io
   
   class EvilRaw(io.BytesIO):
       def __init__(self):
           super().__init__(b"hello world")
           self._done = False
           
       def flush(self):
           if not self._done:
               self._done = True
               wrap.detach()
           return None
   
   wrap = io.TextIOWrapper(EvilRaw())
   wrap.close()

   4

   import io
   
   class EvilRaw(io.BytesIO):
       def __init__(self):
           super().__init__(b"hello world")
           self._done = False
           
       def write(self, data):
           if not self._done:
               self._done = True
               wrap.detach()
           return super().write(data)
   
   wrap = io.TextIOWrapper(EvilRaw())
   wrap.write("test")
   wrap.read() 

   cc @cmaloney @picnixz

   Reacted by jackfromeast
4. StanFromIreland

   added

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   topic-IO

   type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

   on Dec 20, 2025
5. picnixz

   linked a pull request that will close this issuegh-143008: fix TextIOWrapper.truncate via re-entrant flush #143041on Jan 1, 2026
6. picnixz

   removed a link to a pull requestgh-143008: fix TextIOWrapper.truncate via re-entrant flush #143041on Jan 1, 2026
7. cmaloney commented on Jan 5, 2026

   

   cmaloney

   on Jan 5, 2026

   Contributor

   More actions

   Going through the TextIO code, there's quite a few related cases it currently looks like. Making sure no new code is added between a call which could invalidate self->buffer and uses of self->buffer feels like it'll be hard to maintain.

   Could we do a small refactor here to make it so the code doesn't use self->buffer directly as often but rather a simple helper? My thought is a internal helper C function which uses the standard PyObject return pattern but always does the self->attached + self->ok check before returning. That seems like it will be easier to maintain to me.

   Some cases it might mean we check more than needed, but I'd rather close out the type of bug first, then can make more efficient for cases which are important (A collection of I/O performance critical workloads that can validate with would be nice! don't have currently; but am working on).
8. cmaloney

   added a commit that references this issue on Mar 15, 2026

   pythongh-143008: Safer TextIOWrapper underlying stream access

   42caa08
9. vstinner

   added a commit that references this issue on Jun 9, 2026

   gh-143008: Fix Null pointer dereferences in TextIOWrapper underlying …

   db4b194
10. vstinner commented on Jun 9, 2026

    

    vstinner

    on Jun 9, 2026

    Member

    More actions

    Thnaks @jackfromeast for your bug report. It's now fixed.
11. vstinner

    closed this as completedon Jun 9, 2026
12. vstinner

    added 3 commits that reference this issue on Jun 10, 2026

    [3.15] gh-143008: Fix race re-initializing TextIOWrapper (#151203)

    0318867

    [3.13][3.15] gh-143008: Fix race re-initializing TextIOWrapper (#151203…

    c40e6d6

    [3.14] gh-143008: Fix race re-initializing TextIOWrapper (GH-151203) (#…

    a4bdc21
13. philthompson10

    added a commit that references this issue on Jun 17, 2026

    pythongh-143008: Fix Null pointer dereferences in TextIOWrapper under…

    c24e0bb
14. vstinner

    added 2 commits that reference this issue on Oct 16, 2026

    [3.15] gh-157364: Fix use-after-free in io.TextIOWrapper during reent…

    ea1312b

    [3.14] gh-157364: Fix use-after-free in io.TextIOWrapper during reent…

    13fc16c