classification
Title: Core dump when use uninitialized _json objects
Type: crash Stage: resolved
Components: Extension Modules Versions: Python 3.7, Python 3.6, Python 3.5, Python 2.7
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: serhiy.storchaka Nosy List: bob.ippolito, ezio.melotti, rhettinger, serhiy.storchaka
Priority: normal Keywords:

Created on 2017-05-03 06:41 by serhiy.storchaka, last changed 2017-05-05 08:22 by serhiy.storchaka. This issue is now closed.

Pull Requests
URL Status Linked Edit
PR 1420 merged serhiy.storchaka, 2017-05-03 07:37
PR 1469 merged serhiy.storchaka, 2017-05-05 07:12
PR 1470 merged serhiy.storchaka, 2017-05-05 07:14
PR 1471 merged serhiy.storchaka, 2017-05-05 07:38
Messages (6)
msg292846 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2017-05-03 06:41
It is possible to get a core dump by using uninitialized _json objects.

$ ./python -c "import _json; _json.make_scanner.__new__(_json.make_scanner)('', 0)"
Segmentation fault (core dumped)
$ ./python -c "import _json; _json.make_encoder.__new__(_json.make_encoder)([0], 0)"
Segmentation fault (core dumped)

The cause is that make_scanner and make_encoder classes implement __new__ and __init__. The __new__ methods create uninitialized object, with NULLs pointers, the __init__ methods initialize them. Possible solutions are: 1) set fields to Py_None rather than NULL in __new__; 2) check every pointer for NULL before using; 3) just remove __init__ methods and make initialization in __new__ methods. Since the scanner and the encoder are not inheritable classes, the latter solution look the most preferable to me.
msg293043 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2017-05-05 05:27
Repeated calling of the __init__ method caused memory leaks.
msg293050 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2017-05-05 07:08
New changeset 76a3e51a403bc84ed536921866c86dd7d07aaa7e by Serhiy Storchaka in branch 'master':
bpo-30243: Fixed the possibility of a crash in _json. (#1420)
https://github.com/python/cpython/commit/76a3e51a403bc84ed536921866c86dd7d07aaa7e
msg293058 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2017-05-05 07:40
New changeset 39b73dd5131ce205dcee3b9e24ba0fc28934d79c by Serhiy Storchaka in branch '3.6':
[3.6] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) (#1469)
https://github.com/python/cpython/commit/39b73dd5131ce205dcee3b9e24ba0fc28934d79c
msg293059 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2017-05-05 07:40
New changeset ee2294860e224c2b08cc6847d3c9a0ec3875c3d8 by Serhiy Storchaka in branch '3.5':
[3.5] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) (#1470)
https://github.com/python/cpython/commit/ee2294860e224c2b08cc6847d3c9a0ec3875c3d8
msg293074 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2017-05-05 08:21
New changeset 5d7a18f3b65bd958d876391cca3c381396021639 by Serhiy Storchaka in branch '2.7':
[2.7] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) (#1471)
https://github.com/python/cpython/commit/5d7a18f3b65bd958d876391cca3c381396021639
History
Date User Action Args
2017-05-05 08:22:42serhiy.storchakasetstatus: open -> closed
resolution: fixed
stage: resolved
2017-05-05 08:21:47serhiy.storchakasetmessages: + msg293074
2017-05-05 07:40:49serhiy.storchakasetmessages: + msg293059
2017-05-05 07:40:32serhiy.storchakasetmessages: + msg293058
2017-05-05 07:38:37serhiy.storchakasetpull_requests: + pull_request1570
2017-05-05 07:14:08serhiy.storchakasetpull_requests: + pull_request1569
2017-05-05 07:12:41serhiy.storchakasetpull_requests: + pull_request1568
2017-05-05 07:08:51serhiy.storchakasetmessages: + msg293050
2017-05-05 05:27:24serhiy.storchakasetmessages: + msg293043
2017-05-05 05:10:00serhiy.storchakasetassignee: serhiy.storchaka
2017-05-03 08:43:52serhiy.storchakalinkissue30248 dependencies
2017-05-03 07:37:07serhiy.storchakasetpull_requests: + pull_request1526
2017-05-03 06:41:50serhiy.storchakacreate