Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use after free in Element.remove #68281

Closed
pkt mannequin opened this issue May 1, 2015 · 2 comments
Closed

Use after free in Element.remove #68281

pkt mannequin opened this issue May 1, 2015 · 2 comments
Labels
extension-modules C modules in the Modules dir type-crash A hard crash of the interpreter, possibly with a core dump

Comments

@pkt
Copy link
Mannequin

pkt mannequin commented May 1, 2015

BPO 24093
Nosy @scoder, @tiran, @serhiy-storchaka
Superseder
  • bpo-24091: Use after free in Element.extend (1)
    		•
    Files
  • poc_elt_remove.py
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2015-05-02.20:36:29.014>
created_at = <Date 2015-05-01.13:58:08.887>
labels = ['extension-modules', 'type-crash']
title = 'Use after free in Element.remove'
updated_at = <Date 2015-05-03.06:44:43.480>
user = 'https://bugs.python.org/pkt'

    bugs.python.org fields:

    activity = <Date 2015-05-03.06:44:43.480>
actor = 'Arfrever'
assignee = 'none'
closed = True
closed_date = <Date 2015-05-02.20:36:29.014>
closer = 'serhiy.storchaka'
components = ['Extension Modules']
creation = <Date 2015-05-01.13:58:08.887>
creator = 'pkt'
dependencies = []
files = ['39242']
hgrepos = []
issue_num = 24093
keywords = []
message_count = 2.0
messages = ['242307', '242432']
nosy_count = 6.0
nosy_names = ['scoder', 'christian.heimes', 'Arfrever', 'eli.bendersky', 'serhiy.storchaka', 'pkt']
pr_nums = []
priority = 'normal'
resolution = 'duplicate'
stage = 'resolved'
status = 'closed'
superseder = '24091'
type = 'crash'
url = 'https://bugs.python.org/issue24093'
versions = ['Python 3.4', 'Python 3.5']
    @pkt
    Copy link
    Mannequin Author

    pkt mannequin commented May 1, 2015

    # Program received signal SIGABRT, Aborted.
    # 0x40022424 in __kernel_vsyscall ()
    # (gdb) bt
    # #0 0x40022424 in __kernel_vsyscall ()
    # #1 0x400bb1df in raise () from /lib/i386-linux-gnu/libc.so.6
    # #2 0x400be825 in abort () from /lib/i386-linux-gnu/libc.so.6
    # #3 0x08067030 in Py_FatalError (
    # msg=0xbfed7a20 "/home/p/Python-3.4.1/Modules/_elementtree.c:1436 object at 0x405743ec has negative ref count -606348326")
    # at Python/pythonrun.c:2633
    # #4 0x080f1374 in _Py_NegativeRefcount (fname=0x40646100 "/home/p/Python-3.4.1/Modules/_elementtree.c", lineno=1436,
    # op=<unknown at remote 0x405743ec>) at Objects/object.c:203
    # #5 0x4063dfa6 in element_remove (self=0x40583c34, args=(<xml.etree.ElementTree.Element at remote 0x40583bb4>,))
    # at /home/p/Python-3.4.1/Modules/_elementtree.c:1436
    # (gdb) frame 5
    # #5 0x4063dfa6 in element_remove (self=0x40583c34, args=(<xml.etree.ElementTree.Element at remote 0x40583bb4>,))
    # at /home/p/Python-3.4.1/Modules/_elementtree.c:1436
    \bpo-1436 Py_DECREF(self->extra->children[i]);
    # (gdb) print i
    # $1 = 1
    # (gdb) print *(PyObject*)self->extra->children
    # $3 = {ob_next = 0x4057437c, _ob_prev = 0x405743ec, ob_refcnt = 1079461180, ob_type = 0x4057461c}
    #
    # Fatal Python error: /home/p/Python-3.4.1/Modules/elementtree.c:1436 object at 0x405743ec has negative ref count -606348326
    #
    # "self->extra->children" is cleared in custom __eq     method. Py_DECREF handles
    # stale pointer. Use after free.

    @pkt pkt mannequin added the type-crash A hard crash of the interpreter, possibly with a core dump label May 1, 2015
    @tiran tiran added the extension-modules C modules in the Modules dir label May 1, 2015
    @serhiy-storchaka
    Copy link
    Member

    The patch for bpo-24091 fixes this issue.

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees
    No one assigned
    Labels
    extension-modules C modules in the Modules dir type-crash A hard crash of the interpreter, possibly with a core dump
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    2 participants
    @tiran @serhiy-storchaka