gh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing by colorfulappl · Pull Request #99890 · python/cpython · GitHub

In the family of _PyArg_Parse functions, pointers can be passed in as arguments to store the parsed PyArgs.
If a pointer is assigned to newly allocated memory and the memory is freed as a result of an error while parsing the subsequent PyArgs, the pointer should be set to NULL; otherwise, it leaks the freed memory.

Issue: Double-free in Argument Clinic str_converter generated code #99240

This fix corresponds to my comment in #99240

If function _PyArg_ParseStack parses failed, assign all the parsed arguments to "NULL" after they are freed, this should be done in _PyArg_ParseStack.

Can you add a test for this?

LGTM

Thanks @colorfulappl for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11.
🐍🍒⛏🤖

Sorry, @colorfulappl and @kumaraditya303, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker a6f82f1fc68cb24e2d88d35fde4cfb663213a744 3.11

Sorry, @colorfulappl and @kumaraditya303, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker a6f82f1fc68cb24e2d88d35fde4cfb663213a744 3.10

@colorfulappl Can you create the backport PRs? Thanks

…d in argument parsing (python#99890) Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com> Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>

* origin/main: (1306 commits) Correct CVE-2020-10735 documentation (python#100306) pythongh-100272: Fix JSON serialization of OrderedDict (pythonGH-100273) pythongh-93649: Split tracemalloc tests from _testcapimodule.c (python#99551) Docs: Use `PY_VERSION_HEX` for version comparison (python#100179) pythongh-97909: Fix markup for `PyMethodDef` members (python#100089) pythongh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing (python#99890) pythongh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing (python#99890) pythonGH-98831: Add DECREF_INPUTS(), expanding to DECREF() each stack input (python#100205) pythongh-78707: deprecate passing >1 argument to `PurePath.[is_]relative_to()` (pythonGH-94469) pythongh-99540: Constant hash for _PyNone_Type to aid reproducibility (pythonGH-99541) pythongh-100039: enhance __signature__ to work with str and callables (pythonGH-100168) pythongh-99830: asyncio: Document returns of remove_{reader,writer} (python#100302) "Compound statement" docs: Fix with-statement step indexing (python#100286) pythonGH-90043: Handle NaNs in COMPARE_OP_FLOAT_JUMP (pythonGH-100278) Improve stats presentation for calls. (pythonGH-100274) Better stats for `LOAD_ATTR` and `STORE_ATTR` (pythonGH-100295) pythongh-81057: Move the Cached Parser Dummy Name to _PyRuntimeState (python#100277) Document that zipfile's pwd parameter is a `bytes` object (python#100209) pythongh-99767: mark `PyTypeObject.tp_watched` as internal use only in table (python#100271) Fix typo in introduction.rst (python#100266) ...

@colorfulappl Can you create the backport PRs?

Sure. I will do this later.

* main: pythongh-89727: Fix os.walk RecursionError on deep trees (python#99803) Docs: Don't upload CI artifacts (python#100330) pythongh-94912: Added marker for non-standard coroutine function detection (python#99247) Correct CVE-2020-10735 documentation (python#100306) pythongh-100272: Fix JSON serialization of OrderedDict (pythonGH-100273) pythongh-93649: Split tracemalloc tests from _testcapimodule.c (python#99551) Docs: Use `PY_VERSION_HEX` for version comparison (python#100179) pythongh-97909: Fix markup for `PyMethodDef` members (python#100089) pythongh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing (python#99890) pythongh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing (python#99890) pythonGH-98831: Add DECREF_INPUTS(), expanding to DECREF() each stack input (python#100205) pythongh-78707: deprecate passing >1 argument to `PurePath.[is_]relative_to()` (pythonGH-94469)

…is freed in argument parsing (pythonGH-99890) (cherry picked from commit efbb1eb) Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com> Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>

GH-100385 is a backport of this pull request to the 3.11 branch.

…is freed in argument parsing (pythonGH-99890) (cherry picked from commit efbb1eb) Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com> Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>

GH-100386 is a backport of this pull request to the 3.10 branch.

…ed in argument parsing (GH-99890) (#100385) (cherry picked from commit efbb1eb) Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com> Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>

…ed in argument parsing (GH-99890) (#100386) (cherry picked from commit efbb1eb) Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com> Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>

…d in argument parsing (python#99890) Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com> Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>

colorfulappl added 2 commits November 30, 2022 16:42

Reset pointer to NULL when memory is freed

9271e85

Add news

eba62a3

bedevere-bot mentioned this pull request Nov 30, 2022

Double-free in Argument Clinic str_converter generated code #99240

Closed

bedevere-bot added the awaiting review label Nov 30, 2022

kumaraditya303 reviewed Dec 13, 2022

View reviewed changes

Comment thread Python/getargs.c Outdated

Remove unnecessary null-check

39895ee

python deleted a comment from netlify Bot Dec 14, 2022

Add test

ef866b2

kumaraditya303 reviewed Dec 15, 2022

View reviewed changes

Comment thread Modules/_testcapi/getargs.c Outdated

carljm changed the title gh-99240: Reset pointer to NULL then the pointed memory is freed in argument parsing gh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing Dec 15, 2022

Fix an error

357576b

kumaraditya303 reviewed Dec 16, 2022

View reviewed changes

Comment thread Modules/_testcapi/getargs.c Outdated

PyMem_FREE -> PyMem_Free

0424701

kumaraditya303 reviewed Dec 16, 2022

View reviewed changes

Comment thread Modules/_testcapi/getargs.c Outdated

kumaraditya303 added 2 commits December 16, 2022 16:26

Update Modules/_testcapi/getargs.c

4a7d386

Merge branch 'main' into clear_freed_pointer

1d3b069

kumaraditya303 self-assigned this Dec 16, 2022

kumaraditya303 approved these changes Dec 16, 2022

View reviewed changes

bedevere-bot added awaiting merge and removed awaiting review labels Dec 16, 2022

kumaraditya303 added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Dec 16, 2022

kumaraditya303 requested a review from erlend-aasland December 16, 2022 11:03

erlend-aasland approved these changes Dec 16, 2022

View reviewed changes

Comment thread Modules/_testcapi/getargs.c Outdated

Update Modules/_testcapi/getargs.c

6e9744c

kumaraditya303 approved these changes Dec 17, 2022

View reviewed changes

kumaraditya303 merged commit a6f82f1 into python:main Dec 17, 2022

bedevere-bot removed the awaiting merge label Dec 17, 2022

bedevere-bot removed the needs backport to 3.11 only security fixes label Dec 21, 2022

bedevere-bot removed the needs backport to 3.10 only security fixes label Dec 21, 2022

gh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing by colorfulappl · Pull Request #99890 · python/cpython · GitHub

Uh oh!

Uh oh!

gh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing - #99890

gh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing#99890kumaraditya303 merged 9 commits intopython:mainpython/cpython:mainfrom colorfulappl:clear_freed_pointercolorfulappl/cpython:clear_freed_pointerCopy head branch name to clipboard

Conversation

colorfulappl commented Nov 30, 2022 • edited by bedevere-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

colorfulappl commented Nov 30, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

kumaraditya303 commented Dec 14, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kumaraditya303 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

miss-islington commented Dec 17, 2022

Uh oh!

miss-islington commented Dec 17, 2022

Uh oh!

miss-islington commented Dec 17, 2022

Uh oh!

kumaraditya303 commented Dec 17, 2022

Uh oh!

colorfulappl commented Dec 19, 2022

Uh oh!

bedevere-bot commented Dec 21, 2022

Uh oh!

bedevere-bot commented Dec 21, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

gh-99240: Reset pointer to NULL when the pointed memory is freed in argument parsing#99890
kumaraditya303 merged 9 commits into
python:mainfrom
colorfulappl:clear_freed_pointer

colorfulappl commented Nov 30, 2022 •
edited by bedevere-bot
Loading

colorfulappl commented Nov 30, 2022 •
edited
Loading