Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Core dump when use uninitialized _json objects #74429

Closed
serhiy-storchaka opened this issue May 3, 2017 · 6 comments
Closed

Core dump when use uninitialized _json objects #74429

serhiy-storchaka opened this issue May 3, 2017 · 6 comments
Assignees
@serhiy-storchaka
Labels
3.7 (EOL) end of life extension-modules C modules in the Modules dir type-crash A hard crash of the interpreter, possibly with a core dump

Comments

@serhiy-storchaka
Copy link
Member

BPO 30243
Nosy @rhettinger, @etrepum, @ezio-melotti, @serhiy-storchaka
PRs
  • bpo-30243: Fixed the possibility of a crash in _json. #1420
  • [3.6] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) #1469
  • [3.5] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) #1470
  • [2.7] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) #1471
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = 'https://github.com/serhiy-storchaka'
closed_at = <Date 2017-05-05.08:22:42.344>
created_at = <Date 2017-05-03.06:41:50.176>
labels = ['extension-modules', '3.7', 'type-crash']
title = 'Core dump when use uninitialized _json objects'
updated_at = <Date 2017-05-05.08:22:42.343>
user = 'https://github.com/serhiy-storchaka'

    bugs.python.org fields:

    activity = <Date 2017-05-05.08:22:42.343>
actor = 'serhiy.storchaka'
assignee = 'serhiy.storchaka'
closed = True
closed_date = <Date 2017-05-05.08:22:42.344>
closer = 'serhiy.storchaka'
components = ['Extension Modules']
creation = <Date 2017-05-03.06:41:50.176>
creator = 'serhiy.storchaka'
dependencies = []
files = []
hgrepos = []
issue_num = 30243
keywords = []
message_count = 6.0
messages = ['292846', '293043', '293050', '293058', '293059', '293074']
nosy_count = 4.0
nosy_names = ['rhettinger', 'bob.ippolito', 'ezio.melotti', 'serhiy.storchaka']
pr_nums = ['1420', '1469', '1470', '1471']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue30243'
versions = ['Python 2.7', 'Python 3.5', 'Python 3.6', 'Python 3.7']
    @serhiy-storchaka
    Copy link
    Member Author

    It is possible to get a core dump by using uninitialized _json objects.

    $ ./python -c "import _json; _json.make_scanner.__new__(_json.make_scanner)('', 0)"
Segmentation fault (core dumped)
$ ./python -c "import _json; _json.make_encoder.__new__(_json.make_encoder)([0], 0)"
Segmentation fault (core dumped)

    The cause is that make_scanner and make_encoder classes implement __new__ and __init__. The __new__ methods create uninitialized object, with NULLs pointers, the __init__ methods initialize them. Possible solutions are: 1) set fields to Py_None rather than NULL in __new__; 2) check every pointer for NULL before using; 3) just remove __init__ methods and make initialization in __new__ methods. Since the scanner and the encoder are not inheritable classes, the latter solution look the most preferable to me.

    @serhiy-storchaka serhiy-storchaka added 3.7 (EOL) end of life extension-modules C modules in the Modules dir type-crash A hard crash of the interpreter, possibly with a core dump labels May 3, 2017
    @serhiy-storchaka serhiy-storchaka self-assigned this May 5, 2017
    @serhiy-storchaka
    Copy link
    Member Author

    Repeated calling of the __init__ method caused memory leaks.

    @serhiy-storchaka
    Copy link
    Member Author

    New changeset 76a3e51 by Serhiy Storchaka in branch 'master':
    bpo-30243: Fixed the possibility of a crash in _json. (bpo-1420)
    76a3e51

    @serhiy-storchaka
    Copy link
    Member Author

    New changeset 39b73dd by Serhiy Storchaka in branch '3.6':
    [3.6] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) (bpo-1469)
    39b73dd

    @serhiy-storchaka
    Copy link
    Member Author

    New changeset ee22948 by Serhiy Storchaka in branch '3.5':
    [3.5] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) (bpo-1470)
    ee22948

    @serhiy-storchaka
    Copy link
    Member Author

    New changeset 5d7a18f by Serhiy Storchaka in branch '2.7':
    [2.7] bpo-30243: Fixed the possibility of a crash in _json. (GH-1420) (bpo-1471)
    5d7a18f

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees

    @serhiy-storchaka serhiy-storchaka

    Labels
    3.7 (EOL) end of life extension-modules C modules in the Modules dir type-crash A hard crash of the interpreter, possibly with a core dump
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    1 participant
    @serhiy-storchaka