FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-143008: fix TextIOWrapper.truncate via re-entrant flush by yihong0618 · Pull Request #143041 · python/cpython · GitHub

  1. python
  2. cpython

Repository navigation

gh-143008: fix TextIOWrapper.truncate via re-entrant flush #143041

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
yihong0618 wants to merge 3 commits into from
+90 −5
Conversation 24 Commits 3 Checks 42 Files changed 3
Closed

gh-143008: fix TextIOWrapper.truncate via re-entrant flush #143041

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f7eca0d
fix: TextIOWrapper.truncate via re-entrant flush
yihong0618 Dec 21, 2025
a96757b
Update Misc/NEWS.d/next/Library/2025-12-21-17-56-37.gh-issue-143008.a…
yihong0618 Dec 22, 2025
65d7dbb
fix: apply some suggestion
yihong0618 Dec 29, 2025
File filter

Filter by extension

Filter by extension .c  (1) .py  (1) .rst  (1) All 3 file types selected
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
46 changes: 46 additions & 0 deletions Lib/test/test_io/test_textio.py
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -1560,6 +1560,52 @@ def closed(self):
wrapper = self.TextIOWrapper(raw)
wrapper.close() # should not crash

def test_reentrant_detach_during_flush(self):
# gh-143008: Reentrant detach() during flush should raise RuntimeError
# instead of crashing.
wrapper = None
wrapper_ref = None

class EvilBuffer(self.BufferedRandom):
detach_on_write = False

def flush(self):
wrapper = wrapper_ref() if wrapper_ref is not None else None
if wrapper is not None and not self.detach_on_write:
wrapper.detach()
return super().flush()

def write(self, b):
wrapper = wrapper_ref() if wrapper_ref is not None else None
if wrapper is not None and self.detach_on_write:
wrapper.detach()
return len(b)

tests = [
('truncate', lambda: wrapper.truncate(0)),
('close', lambda: wrapper.close()),
('detach', lambda: wrapper.detach()),
('seek', lambda: wrapper.seek(0)),
('tell', lambda: wrapper.tell()),
('reconfigure', lambda: wrapper.reconfigure(line_buffering=True)),
]
for name, method in tests:
with self.subTest(name):
wrapper = self.TextIOWrapper(EvilBuffer(self.MockRawIO()), encoding='utf-8')
wrapper_ref = weakref.ref(wrapper)
self.assertRaisesRegex(RuntimeError, "reentrant", method)
wrapper_ref = None
del wrapper

with self.subTest('read via writeflush'):
EvilBuffer.detach_on_write = True
wrapper = self.TextIOWrapper(EvilBuffer(self.MockRawIO()), encoding='utf-8')
wrapper_ref = weakref.ref(wrapper)
wrapper.write('x')
self.assertRaisesRegex(RuntimeError, "reentrant", wrapper.read)
wrapper_ref = None
del wrapper


class PyTextIOWrapperTest(TextIOWrapperTest, PyTestCase):
shutdown_error = "LookupError: unknown encoding: ascii"
Expand Down
1 change: 1 addition & 0 deletions Misc/NEWS.d/next/Library/2025-12-21-17-56-37.gh-issue-143008.aakErJ.rst
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Fix crash in :class:`io.TextIOWrapper` when reentrant :meth:`io.TextIOBase.detach` called.
48 changes: 43 additions & 5 deletions Modules/_io/textio.c
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -894,6 +894,11 @@ _textiowrapper_set_decoder(textio *self, PyObject *codec_info,
PyObject *res;
int r;

if (self->detached > 0) {
PyErr_SetString(PyExc_ValueError,
"underlying buffer has been detached");
return -1;
}
res = PyObject_CallMethodNoArgs(self->buffer, &_Py_ID(readable));
if (res == NULL)
return -1;
Expand Down Expand Up @@ -950,6 +955,11 @@ _textiowrapper_set_encoder(textio *self, PyObject *codec_info,
PyObject *res;
int r;

if (self->detached > 0) {
PyErr_SetString(PyExc_ValueError,
"underlying buffer has been detached");
return -1;
}
res = PyObject_CallMethodNoArgs(self->buffer, &_Py_ID(writable));
if (res == NULL)
return -1;
Expand Down Expand Up @@ -996,6 +1006,11 @@ _textiowrapper_fix_encoder_state(textio *self)

self->encoding_start_of_stream = 1;

if (self->detached > 0) {
PyErr_SetString(PyExc_ValueError,
"underlying buffer has been detached");
return -1;
}
PyObject *cookieObj = PyObject_CallMethodNoArgs(
self->buffer, &_Py_ID(tell));
if (cookieObj == NULL) {
Expand Down Expand Up @@ -1536,7 +1551,7 @@ _io_TextIOWrapper_closed_get_impl(textio *self);

#define CHECK_ATTACHED(self) \
CHECK_INITIALIZED(self); \
if (self->detached) { \
if (self->detached > 0) { \
PyErr_SetString(PyExc_ValueError, \
"underlying buffer has been detached"); \
return NULL; \
Expand All @@ -1547,13 +1562,12 @@ _io_TextIOWrapper_closed_get_impl(textio *self);
PyErr_SetString(PyExc_ValueError, \
"I/O operation on uninitialized object"); \
return -1; \
} else if (self->detached) { \
} else if (self->detached > 0) { \
PyErr_SetString(PyExc_ValueError, \
"underlying buffer has been detached"); \
return -1; \
}


/*[clinic input]
@critical_section
_io.TextIOWrapper.detach
Expand All @@ -1565,7 +1579,18 @@ _io_TextIOWrapper_detach_impl(textio *self)
{
PyObject *buffer;
CHECK_ATTACHED(self);
if (self->detached < 0) {
PyErr_SetString(PyExc_RuntimeError,
"reentrant call to detach() is not allowed");
return NULL;
}
int entered = (self->detached == 0);
if (entered)
self->detached = -1;
if (_PyFile_Flush((PyObject *)self) < 0) {
if (entered && self->detached < 0) {
self->detached = 0;
}
return NULL;
}
buffer = self->buffer;
Expand Down Expand Up @@ -1636,9 +1661,15 @@ _textiowrapper_writeflush(textio *self)
Py_DECREF(pending);

PyObject *ret;
CHECK_ATTACHED_INT(self);
int entered = (self->detached == 0);
if (entered)
self->detached = -1;
do {
ret = PyObject_CallMethodOneArg(self->buffer, &_Py_ID(write), b);

cmaloney Dec 21, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

every loop iteration / write call could execute arbitrary interpreter code that could invalidate self->buffer so likely need to check on each loop iteration.

yihong0618 Dec 22, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

will check, but I think maybe not need

yihong0618 Dec 29, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

dropped
} while (ret == NULL && _PyIO_trap_eintr());
if (entered && self->detached < 0)
self->detached = 0;
Py_DECREF(b);
// NOTE: We cleared buffer but we don't know how many bytes are actually written
// when an error occurred.
Expand Down Expand Up @@ -3123,7 +3154,14 @@ _io_TextIOWrapper_flush_impl(textio *self)
self->telling = self->seekable;
if (_textiowrapper_writeflush(self) < 0)
return NULL;
return PyObject_CallMethodNoArgs(self->buffer, &_Py_ID(flush));
int entered = (self->detached == 0);
if (entered) {
self->detached = -1;
}
PyObject *ret = PyObject_CallMethodNoArgs(self->buffer, &_Py_ID(flush));
if (entered && self->detached < 0)
self->detached = 0;
return ret;
}

/*[clinic input]
Expand All @@ -3150,7 +3188,7 @@ _io_TextIOWrapper_close_impl(textio *self)
if (r > 0) {
Py_RETURN_NONE; /* stream already closed */
}
if (self->detached) {
if (self->detached > 0) {
Py_RETURN_NONE; /* gh-142594 null pointer issue */
}
else {
Expand Down
Loading
Back | FazBrowse Home | New Git URL