FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-142831: Fix UAF in `_json` module by ashm-dev · Pull Request #142851 · python/cpython · GitHub

  1. python
  2. cpython

Repository navigation

gh-142831: Fix UAF in _json module - #142851

Merged
gpshead merged 25 commits into
python:mainfrom
ashm-dev:json
Apr 12, 2026
ConversationCommits (25)ChecksFiles changed
Merged

gh-142831: Fix UAF in _json module#142851
gpshead merged 25 commits into
python:mainfrom
ashm-dev:json

Conversation

ashm-dev commented Dec 17, 2025 •
edited by gpshead
Loading

Copy link
Copy Markdown
Contributor

bedevere-app Bot mentioned this pull request Dec 17, 2025
Closed
serhiy-storchaka reviewed Dec 17, 2025
View reviewed changes

serhiy-storchaka left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Could you add tests?

kumaraditya303 reviewed Dec 17, 2025
View reviewed changes
Comment thread Modules/_json.c Outdated
kumaraditya303 added needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes labels Dec 17, 2025

ashm-dev commented Dec 18, 2025

Copy link
Copy Markdown
Contributor Author

Added tests

kumaraditya303 reviewed Dec 18, 2025
View reviewed changes
Comment thread Lib/test/test_json/test_dump.py Outdated

kumaraditya303 commented Dec 19, 2025

Copy link
Copy Markdown
Contributor

I pushed a minor test change to make the test run on both pure python and C encoder.

ashm-dev commented Dec 19, 2025

Copy link
Copy Markdown
Contributor Author

@kumaraditya303 But the new tests don't reproduce the issue!
P.S. Here is how I verify the tests: I build Python from main with ASan, and if the tests trigger the leak (the one reported in the issue), then they are good; otherwise, they are not.

kumaraditya303 commented Dec 19, 2025

Copy link
Copy Markdown
Contributor

But the new tests don't reproduce the issue!

I was able to reproduce it but now I can't, not sure if it was a build cache issue or something. Sorry reverted it back.

serhiy-storchaka reviewed Dec 19, 2025
View reviewed changes
Comment thread Lib/test/test_json/test_dump.py Outdated
Comment thread Lib/test/test_json/test_dump.py Outdated
Add comments explaining why Py_INCREF is needed in iteration functions
a412165 
Match the style of the comment added by pythongh-145244 for the dict
iteration case.  These explain why borrowed references from items
lists and sequences must be held as strong references during encoding.
gpshead self-assigned this Apr 11, 2026

gpshead commented Apr 11, 2026

Copy link
Copy Markdown
Member

nothing the irony of my commit re-adding explanatory comments that earlier reviewer wanted removed. the other PR I merged intersecting with this region and bug had such a comment so put them in here as well. i'll re-look at the whole and pick a direction in a bit.

gpshead added 2 commits April 11, 2026 23:33
Improve test assertions and robustness for UAF tests
7e3c835 
- Replace bare try/except with direct calls; both tests should
  succeed without raising since encode_str and default return valid
  serializable values.
- Assert that the mutation path was actually exercised (cleared flag,
  call_count).
- Trigger list mutation on 3rd element instead of 1st, so the loop
  processes multiple items before the list is cleared mid-iteration.
- Add comments explaining what each test verifies.
Simplify borrowed-ref comments to focus on the why
727696d
gpshead enabled auto-merge (squash) April 11, 2026 23:54
gpshead merged commit 235fa72 into python:main Apr 12, 2026
62 of 63 checks passed

miss-islington-app Bot commented Apr 12, 2026

Copy link
Copy Markdown

Thanks @ashm-dev for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

miss-islington-app Bot commented Apr 12, 2026

Copy link
Copy Markdown

Sorry, @ashm-dev and @gpshead, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 235fa7244a0474c492ae98ee444529c7ba2a9047 3.14

miss-islington-app Bot commented Apr 12, 2026

Copy link
Copy Markdown

Sorry, @ashm-dev and @gpshead, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 235fa7244a0474c492ae98ee444529c7ba2a9047 3.13

ashm-dev deleted the json branch April 12, 2026 00:18
ljfp pushed a commit to ljfp/cpython that referenced this pull request Apr 25, 2026
pythongh-142831: Fix use-after-free in json encoder during re-entrant…
1f896f8 
… mutation (pythongh-142851)

Hold strong references to borrowed items unconditionally (not only in                                                                        
free-threading builds) in _encoder_iterate_mapping_lock_held and                                                                             
_encoder_iterate_fast_seq_lock_held.  User callbacks invoked during                                                                          
encoding can mutate or clear the underlying container, invalidating                                                                          
borrowed references.                                                                                                                         
                                                                                                                                               
The dict iteration path was already fixed by pythongh-145244.

Co-authored-by: Kumar Aditya <kumaraditya@python.org>
Co-authored-by: Gregory P. Smith <greg@krypto.org>

StanFromIreland commented May 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

@ashm-dev are you able to do the backports (see the bot's comments above for instructions)?

ashm-dev commented May 2, 2026

Copy link
Copy Markdown
Contributor Author

@StanFromIreland Yes, of course I will

ashm-dev mentioned this pull request May 19, 2026
Merged

bedevere-app Bot commented May 19, 2026

Copy link
Copy Markdown

GH-150078 is a backport of this pull request to the 3.14 branch.

ashm-dev mentioned this pull request May 19, 2026
Merged
bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label May 19, 2026

bedevere-app Bot commented May 19, 2026

Copy link
Copy Markdown

GH-150079 is a backport of this pull request to the 3.13 branch.

ashm-dev commented May 19, 2026

Copy link
Copy Markdown
Contributor Author

@StanFromIreland backports done — manually because the bot couldn't cherry-pick cleanly (the iteration loops in 3.13/3.14 had not yet been extracted into the _encoder_iterate_*_lock_held helpers that exist in main):

Both built locally with --with-pydebug and test_json passes (both new UAF regression tests included).

bedevere-app Bot removed the needs backport to 3.13 only security fixes label May 19, 2026
gpshead added a commit that referenced this pull request May 20, 2026
[3.14] gh-142831: Fix use-after-free in json encoder during re-entran…
bba6c1d 
…t mutation (gh-142851) (#150078)

gh-142831: Fix use-after-free in json encoder during re-entrant mutation (gh-142851)

User callbacks invoked during JSON encoding (e.g. the `default` callback or
a custom string encoder) can mutate or clear the dict or sequence being
encoded, invalidating borrowed references to items, keys, and values. Hold
strong references unconditionally while iterating.



(cherry picked from commit 235fa72)

Co-authored-by: Kumar Aditya <kumaraditya@python.org>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
gpshead added a commit that referenced this pull request May 20, 2026
[3.13] gh-142831: Fix use-after-free in json encoder during re-entran…
e87baa8 
…t mutation (gh-142851) (#150079)

gh-142831: Fix use-after-free in json encoder during re-entrant mutation (gh-142851)

User callbacks invoked during JSON encoding (e.g. the `default` callback or
a custom string encoder) can mutate or clear the dict or sequence being
encoded, invalidating borrowed references to items, keys, and values. Hold
strong references unconditionally while iterating.



(cherry picked from commit 235fa72)

Co-authored-by: Kumar Aditya <kumaraditya@python.org>
Co-authored-by: Gregory P. Smith <greg@krypto.org>

gpshead commented May 20, 2026

Copy link
Copy Markdown
Member

thanks!

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

gpshead gpshead approved these changes
kumaraditya303 Awaiting requested review from kumaraditya303
serhiy-storchaka Awaiting requested review from serhiy-storchaka
+1 more reviewer
nineteendo nineteendo left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

gpshead

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Use-after-free in json.encoder mapping iteration via re-entrant key encoder

8 participants

Back | FazBrowse Home | New Git URL