Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use after free in xmlparser_setevents (1) #68291

Closed
pkt mannequin opened this issue May 1, 2015 · 5 comments
Closed

Use after free in xmlparser_setevents (1) #68291

pkt mannequin opened this issue May 1, 2015 · 5 comments
Assignees
@serhiy-storchaka
Labels
extension-modules C modules in the Modules dir topic-XML type-crash A hard crash of the interpreter, possibly with a core dump

Comments

@pkt
Copy link
Mannequin

pkt mannequin commented May 1, 2015

BPO 24103
Nosy @tiran, @serhiy-storchaka
Files
  • poc_xml_setevents1.py
  • xmlparser_setevents_refcnt_bugs.patch
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = 'https://github.com/serhiy-storchaka'
closed_at = <Date 2015-12-24.09:54:27.706>
created_at = <Date 2015-05-01.14:15:15.567>
labels = ['extension-modules', 'expert-XML', 'type-crash']
title = 'Use after free in xmlparser_setevents (1)'
updated_at = <Date 2015-12-24.09:54:27.704>
user = 'https://bugs.python.org/pkt'

    bugs.python.org fields:

    activity = <Date 2015-12-24.09:54:27.704>
actor = 'serhiy.storchaka'
assignee = 'serhiy.storchaka'
closed = True
closed_date = <Date 2015-12-24.09:54:27.706>
closer = 'serhiy.storchaka'
components = ['Extension Modules', 'XML']
creation = <Date 2015-05-01.14:15:15.567>
creator = 'pkt'
dependencies = []
files = ['39254', '41347']
hgrepos = []
issue_num = 24103
keywords = ['patch']
message_count = 5.0
messages = ['242320', '246068', '246145', '256658', '256959']
nosy_count = 5.0
nosy_names = ['christian.heimes', 'Arfrever', 'python-dev', 'serhiy.storchaka', 'pkt']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue24103'
versions = ['Python 3.5', 'Python 3.6']
    @pkt
    Copy link
    Mannequin Author

    pkt mannequin commented May 1, 2015

    # xmlparser_setevents(XMLParserObject *self, PyObject* args)
    # {
    # ...
    # /* clear out existing events */
    # Py_CLEAR(target->start_event_obj);
    # 1 Py_CLEAR(target->end_event_obj);
    # Py_CLEAR(target->start_ns_event_obj);
    # Py_CLEAR(target->end_ns_event_obj);
    #
    # ...
    #
    # seqlen = PySequence_Size(events_seq);
    # for (i = 0; i < seqlen; ++i) {
    # 3 PyObject *event_name_obj = PySequence_Fast_GET_ITEM(events_seq, i);
    # ...
    #
    # if (event_name == NULL) {
    # ...
    # return NULL;
    # } else if (strcmp(event_name, "start") == 0) {
    # ...
    # } else if (strcmp(event_name, "end") == 0) {
    # Py_INCREF(event_name_obj);
    # 2 Py_XDECREF(target->end_event_obj);
    # target->end_event_obj = event_name_obj;
    # }
    # ...
    # }
    # ...
    # }
    #
    # This one leverages nested _setevents invocations. First invocation sets
    # target->end_event_obj to S1 instance. On seconds invocation,
    # target->end_event_obj has refcnt==1, so DECREF at line 1 triggers S1.__del__().
    # Destructor invokes _setevents again and sets target->end_event_obj to a S3
    # instance (with refcnt==1). After we return from nested call at line 1,
    # execution continues until it hits an "end" element. At line 2 S3.__del__() is
    # called and it deallocates "events_seq". This triggers a controlled OOB (we can
    # call it a use after free too) read at line 3. We can control a PyObject pointer.
    #
    # Program received signal SIGSEGV, Segmentation fault.
    # 0x4068563b in xmlparser_setevents (self=0x40669e4c, args=([], [])) at /home/p/Python-3.4.1/Modules/_elementtree.c:3560
    \bpo-3560 PyObject *event_name_obj = PySequence_Fast_GET_ITEM(events_seq, i);
    # (gdb) print i
    # $1 = 1337
    # (gdb) print *(PyListObject*)events_seq
    # $2 = {ob_base = {ob_base = {_ob_next = 0x40669df4, _ob_prev = 0x4055f814, ob_refcnt = 3, ob_type = 0x830e1c0 <PyList_Type>},
    # ob_size = 0}, ob_item = 0x0, allocated = 0}

    @pkt pkt mannequin added the type-crash A hard crash of the interpreter, possibly with a core dump label May 1, 2015
    @tiran tiran added the extension-modules C modules in the Modules dir label May 1, 2015
    @pkt
    Copy link
    Mannequin Author

    pkt mannequin commented Jul 2, 2015

    ping

    1 similar comment
    @pkt
    Copy link
    Mannequin Author

    pkt mannequin commented Jul 3, 2015

    ping

    @serhiy-storchaka
    Copy link
    Member

    Proposed patch fixes both this issue and bpo-24104. With the special macro proposed in bpo-20440 it can be better.

    @serhiy-storchaka serhiy-storchaka self-assigned this Dec 18, 2015
    @python-dev
    Copy link
    Mannequin

    python-dev mannequin commented Dec 24, 2015

    New changeset deda5b5160d2 by Serhiy Storchaka in branch '2.7':
    Issue bpo-24103: Fixed possible use after free in ElementTree.iterparse().
    https://hg.python.org/cpython/rev/deda5b5160d2

    New changeset ed62cf0cf256 by Serhiy Storchaka in branch '3.5':
    Issue bpo-24103: Fixed possible use after free in ElementTree.XMLPullParser.
    https://hg.python.org/cpython/rev/ed62cf0cf256

    New changeset 8a14af800f96 by Serhiy Storchaka in branch 'default':
    Issue bpo-24103: Fixed possible use after free in ElementTree.XMLPullParser.
    https://hg.python.org/cpython/rev/8a14af800f96

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees

    @serhiy-storchaka serhiy-storchaka

    Labels
    extension-modules C modules in the Modules dir topic-XML type-crash A hard crash of the interpreter, possibly with a core dump
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    2 participants
    @tiran @serhiy-storchaka