FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-143195: fix UAF in `{bytearray,memoryview}.hex(sep)` via re-entrant `sep.__len__` by picnixz · Pull Request #143209 · python/cpython · GitHub

/ cpython Public

gh-143195: fix UAF in {bytearray,memoryview}.hex(sep) via re-entrant sep.__len__ - #143209

Merged
picnixz merged 3 commits into
python:mainfrom
picnixz:fix/bytearray/uaf-in-hex-143195
Dec 27, 2025
ConversationCommits (3)ChecksFiles changed
Merged

gh-143195: fix UAF in {bytearray,memoryview}.hex(sep) via re-entrant sep.__len__#143209
picnixz merged 3 commits into
python:mainfrom
picnixz:fix/bytearray/uaf-in-hex-143195

Conversation

picnixz commented Dec 27, 2025 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

bedevere-app Bot mentioned this pull request Dec 27, 2025
Closed
picnixz force-pushed the fix/bytearray/uaf-in-hex-143195 branch from 64e6922 to 0488d21 Compare December 27, 2025 09:25
picnixz requested a review from vstinner December 27, 2025 09:25
vstinner approved these changes Dec 27, 2025
View reviewed changes

vstinner left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

LGTM

picnixz commented Dec 27, 2025 •
edited
Loading

Copy link
Copy Markdown
Member Author

Mmh. The memoryview is not entirely fixed. Looks like there is still a UAF but this one doesn't crash with the default build (bytearray crashed without ASAN build but memoryview requires ASAN). I'll fix this as well (I'll need to configure my build with ASAN, which I previously didn't)

picnixz force-pushed the fix/bytearray/uaf-in-hex-143195 branch from a7f98fb to 0b1553f Compare December 27, 2025 10:31
picnixz requested a review from vstinner December 27, 2025 10:32
picnixz added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Dec 27, 2025
picnixz merged commit 9976c2b into python:main Dec 27, 2025
50 checks passed

miss-islington-app Bot commented Dec 27, 2025

Copy link
Copy Markdown

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

picnixz deleted the fix/bytearray/uaf-in-hex-143195 branch December 27, 2025 12:32
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Dec 27, 2025
pythongh-143195: fix UAF in {bytearray,memoryview}.hex(sep) via re-…
af58a56 
…entrant `sep.__len__` (pythonGH-143209)

(cherry picked from commit 9976c2b)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

miss-islington-app Bot commented Dec 27, 2025

Copy link
Copy Markdown

Sorry, @picnixz, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 9976c2b6349a079ae39931d960b8c147e21c6c3f 3.13

bedevere-app Bot commented Dec 27, 2025

Copy link
Copy Markdown

GH-143219 is a backport of this pull request to the 3.14 branch.

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Dec 27, 2025
picnixz added a commit to picnixz/cpython that referenced this pull request Dec 27, 2025
[3.13] pythongh-143195: fix UAF in {bytearray,memoryview}.hex(sep) …
b38a7be 
…via re-entrant `sep.__len__` (pythonGH-143209)

(cherry picked from commit 9976c2b)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-app Bot commented Dec 27, 2025

Copy link
Copy Markdown

GH-143220 is a backport of this pull request to the 3.13 branch.

bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Dec 27, 2025
picnixz added a commit that referenced this pull request Dec 27, 2025
[3.13] gh-143195: fix UAF in {bytearray,memoryview}.hex(sep) via re…
8aca2fd 
…-entrant `sep.__len__` (GH-143209) (#143220)

(cherry picked from commit 9976c2b)
picnixz added a commit that referenced this pull request Dec 27, 2025
[3.14] gh-143195: fix UAF in {bytearray,memoryview}.hex(sep) via re…
93029e4 
…-entrant `sep.__len__` (GH-143209) (#143219)

gh-143195: fix UAF in `{bytearray,memoryview}.hex(sep)` via re-entrant `sep.__len__` (GH-143209)
(cherry picked from commit 9976c2b)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
thunder-coding pushed a commit to thunder-coding/cpython that referenced this pull request Feb 15, 2026
pythongh-143195: fix UAF in {bytearray,memoryview}.hex(sep) via re-…
483fde4 
…entrant `sep.__len__` (python#143209)
sobolevn mentioned this pull request May 15, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

vstinner Awaiting requested review from vstinner

Assignees

picnixz

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

Back | FazBrowse Home | New Git URL