this work on python 2.7.10 and 2.7.11 crash,

C:\Users\RaminFP>cdb -g python C:\Users\RaminFP\Desktop\1.py

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: python C:\Users\RaminFP\Desktop\1.py
Symbol search path is: srv*c:\pubsymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
ModLoad: 1d000000 1d00a000   python.exe
ModLoad: 76fe0000 77159000   ntdll.dll
ModLoad: 76ac0000 76bb0000   C:\Windows\SysWOW64\KERNEL32.DLL
ModLoad: 74e30000 74fa6000   C:\Windows\SysWOW64\KERNELBASE.dll
ModLoad: 1e000000 1e264000   C:\Windows\SysWOW64\python27.dll
ModLoad: 71a10000 71ab3000   C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9158_none_5091b51ebcb97cdc\MSVCR90.dll
ModLoad: 748f0000 74a30000   C:\Windows\SysWOW64\USER32.dll
ModLoad: 747a0000 748ed000   C:\Windows\SysWOW64\GDI32.dll
ModLoad: 763e0000 7645b000   C:\Windows\SysWOW64\ADVAPI32.dll
ModLoad: 74bd0000 74c8e000   C:\Windows\SysWOW64\msvcrt.dll
ModLoad: 76bd0000 76c13000   C:\Windows\SysWOW64\sechost.dll
ModLoad: 76c30000 76cdc000   C:\Windows\SysWOW64\RPCRT4.dll
ModLoad: 740f0000 7410e000   C:\Windows\SysWOW64\SspiCli.dll
ModLoad: 740e0000 740ea000   C:\Windows\SysWOW64\CRYPTBASE.dll
ModLoad: 74080000 740d9000   C:\Windows\SysWOW64\bcryptPrimitives.dll
ModLoad: 74fb0000 7636f000   C:\Windows\SysWOW64\SHELL32.dll
ModLoad: 742c0000 7479d000   C:\Windows\SysWOW64\windows.storage.dll
ModLoad: 76900000 76aba000   C:\Windows\SysWOW64\combase.dll
ModLoad: 74de0000 74e24000   C:\Windows\SysWOW64\shlwapi.dll
ModLoad: 767c0000 767cc000   C:\Windows\SysWOW64\kernel.appcore.dll
ModLoad: 76d40000 76dcd000   C:\Windows\SysWOW64\shcore.dll
ModLoad: 767d0000 76814000   C:\Windows\SysWOW64\powrprof.dll
ModLoad: 76bc0000 76bcf000   C:\Windows\SysWOW64\profapi.dll
ModLoad: 76670000 7669b000   C:\Windows\SysWOW64\IMM32.DLL
ModLoad: 766a0000 767c0000   C:\Windows\SysWOW64\MSCTF.dll
(13a4.1030): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=02555630 ebx=5708ac94 ecx=00003c7a edx=00000000 esi=02546448 edi=57091000
eip=71a4ae7a esp=0028fc98 ebp=0028fca0 iopl=0         nv up ei pl nz ac pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010216
MSVCR90!memcpy+0x5a:
71a4ae7a f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
0:000> r
eax=02555630 ebx=5708ac94 ecx=00003c7a edx=00000000 esi=02546448 edi=57091000
eip=71a4ae7a esp=0028fc98 ebp=0028fca0 iopl=0         nv up ei pl nz ac pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010216
MSVCR90!memcpy+0x5a:
71a4ae7a f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
0:000> db esi
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\SysWOW64\python27.dll -
02546448  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
02546458  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
02546468  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
02546478  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
02546488  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
02546498  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
025464a8  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
025464b8  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
0:000> db edi
57091000  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
57091010  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
57091020  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
57091030  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
57091040  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
57091050  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
57091060  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
57091070  ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??  ????????????????
0:000>

Thanks for the report. This module has been deprecated for a long time, but we should still fix this. Do you have any idea how to fix it?

I cannot reproduce this on Mac (the code form 1.py just gives a very long answer). I don't have a Windows machine to try it on.

Do you have a patch or fix?

static char *
mymemreplace(const char *str, Py_ssize_t len,           
         const char *pat, Py_ssize_t pat_len,            pattern string to find */
         const char *sub, Py_ssize_t sub_len,            substitution string */
         Py_ssize_t count,                               number of replacements */
         Py_ssize_t *out_len)
{
    [...]

    new_len = len + nfound*(sub_len - pat_len); <<<< Unchecked arithmetic can overflow here.
    if (new_len == 0) {
        /* Have to allocate something for the caller to free(). */
        out_s = (char *)PyMem_MALLOC(1);
        if (out_s == NULL)
            return NULL;
        out_s[0] = '\0';
    }
    else {
        assert(new_len > 0);
        new_s = (char *)PyMem_MALLOC(new_len); <<<< An allocation is performed using overflowed value.
        if (new_s == NULL)
            return NULL;
        out_s = new_s;

        for (; count > 0 && len > 0; --count) { <<<< Memory is copied to new_s using len, which can be greater than the overflowed new_len value.
            /* find index of next instance of pattern */
            offset = mymemfind(str, len, pat, pat_len);
            if (offset == -1)
                break;

            /* copy non matching part of input string */
            memcpy(new_s, str, offset);
            str += offset + pat_len;
            len -= offset + pat_len;

            /* copy substitute into the output string */
            new_s += offset;
            memcpy(new_s, sub, sub_len);
            new_s += sub_len;
        }
        /* copy any remaining values into output string */
        if (len > 0)
            memcpy(new_s, str, len);
    }

The issue can be triggered by performing a large substitution that overflows the arithmetic used in mymemreplace() to calculate the size of the new string:

I thought this was fixed in issue24708. At least I get MemoryError on 32-bit Linux as expected, and the code around looks correct.

May be PyMem_MALLOC on 64-bit Windows works only with 32-bit size?

The code in msg257977 doesn't match current sources.

python 2.7.10 32bit and python 2.7.11 64bit crash on windows 10

Do you have any idea how to fix it?

please look image : 


Thanks,

I don't have a Windows machine too.

also linux Ubuntu version Python 2.7.6

2.7.6 and 2.7.10 are outdated.

I say work this problem on version 2.7.11

> Do you have any idea how to fix it?

strop is a deprecated module, you can write ("\x100"  *0xEAAA).replace("\x100", "AA"*0xAAAA). Does this instruction also crash?

Not work ,i think should check sizeof of memory avoid overflow 
assert(new_len > 0 && new_len <= PY_SSIZE_T_MAX);

Win 10, 2.7.11, from IDLE editor: 1.py take several seconds, nothing printed.  Add 'print' in front of call and 
Traceback (most recent call last):
  File "F:\Python\mypy\tem.py", line 3, in <module>
    print strop.replace("\x100"*0xEAAA,"\x100","AA"*0xAAAA)
  File "C:\Programs\Python27\lib\idlelib\PyShell.py", line 1356, in write
    return self.shell.write(s, self.tags)
MemoryError

strop gone in 3.5.

Are you sure that you use 2.7.11 Ramin?

Can anyone else confirm the issue?

Yes!I use python version 2.7.11 and my Windows machine stop and crashed, on cmd Windows,

i trust me ,i don't undrestand :( , work for me this print strop.replace("\x100"*0xEAAA,"\x100","AA"*0xAAAA) .

now test again my system machine crash and i restart windows,


my info system :


Host Name:                 DESKTOP-84QSQQ8
OS Name:                   Microsoft Windows 10 Enterprise
OS Version:                10.0.10240 N/A Build 10240
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          RaminFP
Registered Organization:
Product ID:                00329-00000-00003-AA066
Original Install Date:     11/6/2015, 6:12:53 AM
System Boot Time:          1/16/2016, 6:57:16 PM
System Manufacturer:       ASUSTeK Computer Inc.
System Model:              K52DY
System Type:               x64-based PC
Processor(s):              1 Processor(s) Installed.
                           [01]: AMD64 Family 16 Model 5 Stepping 3 AuthenticAMD ~1800 Mhz
BIOS Version:              American Megatrends Inc. K52DY.207, 1/27/2011
Windows Directory:         C:\Windows
System Directory:          C:\Windows\system32
Boot Device:               \Device\HarddiskVolume2
System Locale:             en-us;English (United States)
Input Locale:              en-us;English (United States)
Time Zone:                 (UTC+03:30) Tehran
Total Physical Memory:     4,094 MB
Available Physical Memory: 1,967 MB
Virtual Memory: Max Size:  6,270 MB
Virtual Memory: Available: 4,152 MB
Virtual Memory: In Use:    2,118 MB
Page File Location(s):     C:\pagefile.sys
Domain:                    WORKGROUP
Logon Server:              \\DESKTOP-84QSQQ8
Hotfix(s):                 5 Hotfix(s) Installed.
                           [01]: KB3087040
                           [02]: KB3106932
                           [03]: KB3116869
                           [04]: KB3124266
                           [05]: KB3133431
Network Card(s):           6 NIC(s) Installed.
                           [01]: Qualcomm Atheros AR9002WB-1NG Wireless Network Adapter
                                 Connection Name: Wi-Fi
                                 DHCP Enabled:    Yes
                                 DHCP Server:     192.168.1.1
                                 IP address(es)
                                 [01]: 192.168.1.101
                                 [02]: fe80::1d3d:b7fa:e576:7111
                           [02]: JMicron PCI Express Gigabit Ethernet Adapter
                                 Connection Name: Ethernet
                                 Status:          Hardware not present
                           [03]: Kerio Virtual Network Adapter
                                 Connection Name: Ethernet 5
                                 Status:          Media disconnected
                           [04]: VMware Virtual Ethernet Adapter for VMnet1
                                 Connection Name: Ethernet 2
                                 Status:          Hardware not present
                           [05]: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
                                 Connection Name: Ethernet 6
                                 Status:          Hardware not present
                           [06]: VMware Virtual Ethernet Adapter for VMnet8
                                 Connection Name: Ethernet 3
                                 Status:          Hardware not present
Hyper-V Requirements:      VM Monitor Mode Extensions: Yes
                           Virtualization Enabled In Firmware: Yes
                           Second Level Address Translation: Yes
                           Data Execution Prevention Available: Yes

i test python version 2.7.11 32 bit i get your error , but 64 bit no crashed,


CommandLine: python.exe
Symbol search path is: srv*c:\pubsymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
ModLoad: 1c3c0000 1c3cb000   python.exe
ModLoad: 77020000 77199000   ntdll.dll
ModLoad: 76d00000 76df0000   C:\Windows\SysWOW64\KERNEL32.DLL
ModLoad: 76ea0000 77016000   C:\Windows\SysWOW64\KERNELBASE.dll
ModLoad: 5fd70000 5fffe000   C:\Windows\SysWOW64\python27.dll
ModLoad: 71de0000 71e83000   C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9158_none_5091b51ebcb97cdc\MSVCR90.dll
ModLoad: 76970000 76ab0000   C:\Windows\SysWOW64\USER32.dll
ModLoad: 76140000 7628d000   C:\Windows\SysWOW64\GDI32.dll
ModLoad: 76b10000 76b8b000   C:\Windows\SysWOW64\ADVAPI32.dll
ModLoad: 76c40000 76cfe000   C:\Windows\SysWOW64\msvcrt.dll
ModLoad: 75c20000 75c63000   C:\Windows\SysWOW64\sechost.dll
ModLoad: 76df0000 76e9c000   C:\Windows\SysWOW64\RPCRT4.dll
ModLoad: 74130000 7414e000   C:\Windows\SysWOW64\SspiCli.dll
ModLoad: 74120000 7412a000   C:\Windows\SysWOW64\CRYPTBASE.dll
ModLoad: 740c0000 74119000   C:\Windows\SysWOW64\bcryptPrimitives.dll
ModLoad: 74150000 7550e000   C:\Windows\SysWOW64\SHELL32.dll
ModLoad: 75510000 759ec000   C:\Windows\SysWOW64\windows.storage.dll
ModLoad: 75c80000 75e3a000   C:\Windows\SysWOW64\combase.dll
ModLoad: 76bf0000 76c34000   C:\Windows\SysWOW64\shlwapi.dll
ModLoad: 76290000 7629c000   C:\Windows\SysWOW64\kernel.appcore.dll
ModLoad: 768e0000 7696d000   C:\Windows\SysWOW64\shcore.dll
ModLoad: 76ac0000 76b04000   C:\Windows\SysWOW64\powrprof.dll
ModLoad: 76ab0000 76abf000   C:\Windows\SysWOW64\profapi.dll
ModLoad: 768b0000 768db000   C:\Windows\SysWOW64\IMM32.DLL
ModLoad: 75fb0000 760d0000   C:\Windows\SysWOW64\MSCTF.dll
Python 2.7.11 (v2.7.11:6d1b6a68f775, Dec  5 2015, 20:32:19) [MSC v.1500 32 bit (Intel)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import strop
>>> strop.replace("\x100"*0xEAAA,"\x100","AA"*0xAAAA)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
MemoryError

here version :

C:\python2711>python.exe
Python 2.7.11 (v2.7.11:6d1b6a68f775, Dec  5 2015, 20:40:30) [MSC v.1500 64 bit (AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import strop
>>> strop.replace("\x100"*0xEAAA,"\x100","AA"*0xAAAA)

i try install windows on VMWare and get video for you, in primary OS i my system crash i can't save video or image for you ,

also work it , windows 7 OS 64bit with python 2.7.11 64bit,

this is a vulnerability in python 2.7.11 64bit version,

please look video,

https://drive.google.com/file/d/0B0zktfkIvV-LajlIQ0p0eWZjd0U/view

Looking at the 2.7.11 code, I think it should fail properly at this line <https://hg.python.org/cpython/file/v2.7.11/Modules/stropmodule.c#l1113>, which checks if the change in size of all the replacements overflows. Is there a way to get a stack trace or similar on Windows?

Your video only shows the operation taking a long time or hanging as far as I can tell, not the Python program crashing. I would expect the call to raise MemoryError fairly quickly, after it has counted all 0xEAAA bytes to replace (but not actually replaced them).

"Your video only shows the operation taking a long time or hanging as far as I can tell," what your means?

i say my OS crash with run function strop i should restart manually for work again,

do you have idea for fix it ?

My previous comment was assuming 32-bit Python on Windows; now I see it is 64-bit.

At the end of the video, I see that the cursor stops blinking, and you can’t do anything (closing the window seems to do nothing). So maybe the OS has crashed or frozen, or maybe it is just being really slow.

In the video I also see you have about 8 GB of RAM. The Python strop code should try to allocate a temporary buffer of 0xEAAA * 2 * 0xAAAA bytes = 5.2 GB, and then a second 5.2 GB object which is the final string result. It copies the temporary buffer into the string object, so it will temporarily require 10.4 GB allocated. Does Windows use swap memory? I suspect what you see is normal Windows behaviour when it runs low on memory, and it is not Python’s fault.

Yes,

i have any idea,

Thanks,